---

1. Personal data administrator

Public Library in the Włochy District of the Capital City of Warsaw
ks. J. Chrościckiego 2 Street, 02-421 Warsaw
bpwlochy@bpwlochy.waw.pl
Phone: 22 863-23-97, 22 863-61-73

2. Contact details of the Data Protection Officer

iod@bpwlochy.waw.pl
Phone: 22 863-23-97, 22 863-61-73

3. Purpose of data processing and legal basis

1. Identifying data of the Reader, including their image, as well as data related to the Reader’s use of Library services, are processed in connection with the performance of tasks in the public interest¹ and serve the following purposes:
   1. providing access to and lending library materials,
   2. documenting and informing about the Library’s activities, which also includes processing for archival purposes in the public interest.
2. Identifying data of the Reader and their socio-professional status, data regarding their obligations towards the Library, and data on their use of the Internet or the Library’s Wi-Fi network (if the Reader uses these services), including data identifying the Reader’s computer, are processed in connection with the legal obligations imposed on the Library² and serve the following purposes:
   1. pursuing potential legal claims and notifying relevant authorities in case of suspected offenses or crimes,
   2. compiling statistics on the Library’s activities,
   3. ensuring the security of the Library’s network and IT systems.
3. The Reader’s email address and phone number may be processed based on consent for the following purposes:
   1. notifying about return deadlines for library materials, informing about the availability of reserved materials, and handling similar correspondence,
   2. providing information about the Library’s activities.
4. Information about the Reader’s use of certain services (e.g., home delivery of library materials), which may be interpreted as data concerning the Reader’s health status, is processed in connection with the Library’s obligation to ensure accessibility in order to provide services to individuals with special needs³.

4. Categories of data recipients

1. Entities to which data processing is entrusted (e.g., debt collection companies, SMS dispatch system operators), with the condition that such entities do not acquire the right to independently decide on the processing of this data but only act under the instructions of the Library.
2. Entities authorized to process personal data under applicable laws and regulations.

5. Transfer of data to third countries (outside the European economic area)

The data is not transferred to third countries or international organizations.

6. The data retention period

The data retention period is as follows:

1. For processing to provide and lend library materials, communicating with the reader, and compiling statistics – no more than 5 years from the end of the year in which the reader last used the Library’s services, provided that the reader is not in debt to the Library.
2. For data processed to pursue potential legal claims – until the claim becomes time-barred or until the conclusion of the proceedings related to the claim.
3. For data processed to document the Library’s activities and inform about them – no more than 5 years from the date of the documented event, unless the data is processed for archival purposes in the public interest.
4. For data processed to ensure the security of the Library’s networks and IT systems – no more than 5 years from the date of registration.
5. For data processed based on the reader’s consent – until the consent is withdrawn.

7. You have the right to access your data, and correct it

The data subject has the right to request access to their data, rectification, erasure, or restriction of processing, the right to object to processing, and the right to data portability.
The admissibility of exercising each right depends on the legal basis for the specific processing.
The consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.
The data subject has the right to file a complaint with the President of the Personal Data Protection Office.

8. Information about the requirement of voluntary provision of data and the consequences of not providing it

Providing personal data is voluntary. Refusal to provide data will result in the refusal of registration with the Library or the inability to use its services.