Data Protection Regulation (pol. “RODO”)
Information about the principles of personal data processing in accordance with art. 13 para. 3 and 4 RODO

Museum of Urban Engineering In connection with the entry into force of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) hereinafter referred to as the RODO, implementing the principles of fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data

1) The Controller, which is the entity determining how personal data will be used, is the Museum of Urban Engineering (MIM), 31-060 Kraków, ul. św. Wawrzyńca 15

2) Contact details of the Data Protection Officer:
  • to the e-mail address: iod[at]
  • by mail to the following address: 31-060 Kraków, ul. św. Wawrzyńca 15


3) We will process the data for the purposes of:
The project was co-financed from the European Union funds as part of the Operational Program Infrastructure and Environment.

a) conclusion of a contract (in accordance with Article 6 paragraph 1 point b of the RODO on the basis of acceptance of service regulations in order to conduct:
  • MIM Newsletter service;
  • ticket reservation;
  • online sales;
b) conducting cultural activities (in accordance with Article 6 paragraph 1 point f of the RODO) on the basis of legal provisions resulting from  the Act of 25 October 1991 on Organizing and Conducting Cultural Activity (ie, Journal of Laws of 2017, item 862, as amended) and the Act of 21 November  1996 on museums (ie Journal of Laws of 2018, item 720), for the purposes of:

d) contact with clients (in accordance with Article 6 paragraph 1 point a of the RODO to conduct:
  • recruitment;
  • correspondence;
based on the consent for processing personal data, expressed by the data subject.

4) Recipients of personal data will be:
  • entities authorized to receive data on the basis of legal regulations,
  • persons authorized by the Controller,
  • entities to which the Controller commissions the performance of activities that involve the need to process data.
5) Personal data will not be transferred to a third country / international organisation.

6) Personal data will be processed for the period of:
  • in connection with the MIM Newsletter service - for the duration of the service,
  • in connection with video monitoring - for a period of 30 days,
  •  in connection with the booking process - for a period of 6 years;
  • in connection with recruitment - for a period of 2 years;
  • in connection with the conclusion and performance of the contract - for the duration of the contract, and then in accordance with the law resulting from the obligation of storage and archiving,
  • and in connection with other purposes resulting from the statutory tasks of MIM - for a period necessary to achieve the above mentioned purposes of processing, including the archiving obligation resulting from the provisions of law.
7) Everyone has the right to:
  • access to their data, rectification, erasure, processing restrictions as well as data transfer and objection (articles 15, 16, 17 and 18, 20 and 21 of RODO). In such situations, please contact directly the Data Protection Officer (IOD), according to the contact details indicated in point 2 above,
  • submitting a complaint to the supervisory body dealing with the protection of personal data, i.e. the President of the Office for the Protection of Personal Data, when he or she considers that the data processing violates the provisions of the general RODO Regulation.


8) If the processing of personal data
  • takes place on the basis of the consent of the data subject, providing the data is voluntary, the consent may be withdrawn at any time, without affecting the legality of the previously performed processing activities.
Providing personal data is obligatory in a situation where the condition for the processing of personal data is a legal provision or an agreement is concluded between the parties.

10) Your data will not be processed in an automated way, including in the form of profiling.