Privacy Notice

This privacy notice covers the processing of personal data of people who deposit works in the repository and of the authors and contributors of those works.

The controller of personal data is the Institute of Slavic Studies, Polish Academy of Sciences, with its registered office at Jaracza 1, 00-378 Warsaw, Poland, referred to below as the “Controller”.

Contact details for the Controller: sekretariat@ispan.edu.pl, +48 504071786.

The Controller has appointed a Data Protection Officer, who can be contacted on matters concerning the processing of personal data by email at iod@ispan.edu.pl, or by post at the Controller’s address given above, marked “ochrona danych osobowych” (personal data protection).

Personal data is processed for the following purposes:

1. Operating the repository and making deposited material publicly available – on the basis of the performance of a task carried out in the public interest (Article 6(1)(e) GDPR), arising from the Controller’s statutory activity in the field of scientific research and the dissemination of its results;
2. Registering users and administering their accounts – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR) in enabling users to register themselves and to deposit material in the repository;
3. Establishing, pursuing, or defending against claims – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR) in defending its legal position.

In connection with the deposit of material in the repository, the first and last names of the authors and contributors of that material are processed, together with their affiliation, ORCID identifier, and email address where these have been provided. This data is made publicly available as part of the published record.

The personal data of authors and contributors comes from the metadata supplied by the person depositing the work, who may be a publisher, a co-author, or another depositing party, and from the content of the deposited material.

Personal data may be disclosed to:

1. Providers of services to the Controller, in particular hosting, IT, and analytics services;
2. Public authorities in the cases provided for by law;
3. Crossref – where a DOI is registered, the metadata associated with the record, which may include the names of authors and contributors, is transferred to Crossref as the DOI registration agency;
4. The Internet Archive – for selected works additionally deposited with that service, files are transferred together with their metadata; these may contain the personal data of authors and contributors, as well as of other people named in the content of the material.

Personal data is not transferred outside the European Economic Area, with two exceptions:

1. The registration of a DOI, where one has been assigned to material deposited in the repository – the associated metadata, which may contain the names of authors and contributors, is transferred to Crossref, an organization based in the United States;
2. The deposit of a selected work with the Internet Archive – files and their metadata are transferred to an organization based in the United States.

Neither Crossref nor the Internet Archive is covered by a European Commission decision finding an adequate level of protection for personal data, and the Controller has not entered into an agreement with either organization providing for the safeguards referred to in Article 46 GDPR. This means that the transfer takes place without the safeguards that the GDPR ordinarily requires for transfers of data outside the European Economic Area, and that U.S. law may not afford the same level of protection for personal data as the law applying in the EEA. For this reason, the basis for the transfer of data outside the EEA is the author’s explicit consent (Article 49(1)(a) GDPR).

Personal data is retained as follows:

1. Deposited works and their metadata: indefinitely, as part of the repository’s long-term preservation (archiving) function for deposited material;
2. Account data: for as long as the user account exists; it is deleted when the account is closed.

In connection with the processing of personal data, data subjects have the following rights:

1. The right to access the data and to obtain a copy of it;
2. The right to have inaccurate data corrected or incomplete data completed;
3. The right to erasure (the “right to be forgotten”) in the cases provided for in the GDPR;
4. The right to restriction of processing in the cases provided for in the GDPR;
5. The right to data portability, to the extent that data is processed by automated means on the basis of consent or a contract;
6. The right to object to processing based on the Controller’s legitimate interest or on the performance of a task carried out in the public interest;
7. The right to withdraw consent to the transfer of data outside the European Economic Area at any time, without affecting the lawfulness of any transfer made before the withdrawal.

In relation to works and metadata that have been deposited and are held in the repository, the right to erasure may be restricted in the cases provided for in the GDPR, where processing is necessary for archiving purposes in the public interest or for scientific research purposes (Article 17(3)(d) GDPR), or for exercising the right to freedom of expression and information. Requests concerning the removal of deposited material are considered under the withdrawal procedure in force in the repository.

Data subjects have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office, Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.

The provision of personal data is voluntary. However, creating a user account in order to deposit material in the repository requires data to be entered in the account form, and publishing material requires the first and last names of the work’s authors and contributors to be given in the metadata. Where this data is not provided, an account cannot be created or a work cannot be published in the repository, as the case may be.

In the operation of the repository, no decisions are made based solely on automated processing, including profiling, that would produce legal effects concerning a data subject or similarly significantly affect them.

The Controller reserves the right to make changes to this privacy notice. The Controller informs users of any significant changes by a notice posted on the repository site.

This privacy notice is effective from 1 September 2026.