Privacy & Data Protection Policy

CRAFT – Collaboratory for Responsible and Future Technologies
Faculty of Management, Wrocław University of Science and Technology

Effective Date: December 9, 2025
Last Updated: December 9, 2025

1. Introduction

CRAFT – Collaboratory for Responsible and Future Technologies (“CRAFT,” “we,” “us,” or “our”) is committed to protecting your privacy and ensuring transparency in how we collect, use, and safeguard your personal data. This Privacy & Data Protection Policy explains our practices in accordance with the General Data Protection Regulation (GDPR) and applicable Polish data protection laws.

Data Controller:
CRAFT – Collaboratory for Responsible and Future Technologies
Faculty of Management
Wrocław University of Science and Technology
ul. Łukasiewicza 5
50-371 Wrocław, Poland
Email: craft@pwr.edu.pl
Phone: +48 71 320 34 32

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information that you voluntarily provide when you:

  • Contact us through our contact form or email
    • Name
    • Email address
    • Phone number (optional)
    • Organization/affiliation
    • Message content
    • Type of inquiry (business consulting, market research, societal impact analysis, technology/innovation consulting, other)
  • Subscribe to our newsletter
    • Email address
    • Subscription preferences
  • Register for events
    • Name
    • Email address
    • Organization/affiliation
    • Professional background
    • Dietary requirements or accessibility needs (where applicable)
  • Participate in research or surveys
    • Responses to research questions
    • Professional information
    • Demographic data (anonymized where possible)
  • Apply for volunteer positions or partnerships
    • CV/resume
    • Professional qualifications
    • Contact information
    • References

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical information:

  • Technical data:
    • IP address
    • Browser type and version
    • Operating system
    • Device information
    • Time zone settings
    • Page response times
    • Download errors
    • Length of visits to certain pages
    • Page interaction information (scrolling, clicks, mouse-overs)
    • Methods used to browse away from the page
  • Usage data:
    • Pages visited
    • Referral sources
    • Date and time of visits
    • Navigation patterns

2.3 Cookies and Similar Technologies

We use cookies and similar tracking technologies to enhance your experience. For detailed information, please see Section 8 (Cookies Policy).

3. How We Use Your Information

We process your personal data for the following purposes:

3.1 Communication and Service Delivery

  • Responding to your inquiries and contact form submissions
  • Providing information about our research, programs, and services
  • Facilitating business consultations and partnerships
  • Managing event registrations and participation

Legal Basis: Legitimate interests (responding to inquiries), contractual necessity (service delivery), consent (where applicable)

3.2 Newsletter and Updates

  • Sending you updates on CRAFT briefings, programs, and events
  • Sharing research highlights and news
  • Providing information about opportunities to engage with CRAFT

Legal Basis: Consent (which you may withdraw at any time)

3.3 Research and Analysis

  • Conducting academic and applied research
  • Analyzing trends in technology, innovation, and policy
  • Producing reports and publications (data anonymized or aggregated)

Legal Basis: Legitimate interests (academic research), consent (where research involves identifiable data)

3.4 Event Management

  • Organizing and managing conferences, roundtables, and meetings
  • Facilitating networking and collaboration
  • Recording attendance and participation (where consented)
  • Collecting feedback for improvement

Legal Basis: Contractual necessity, legitimate interests, consent (for photography/recording)

3.5 Website Improvement

  • Analyzing website usage to improve functionality and user experience
  • Understanding visitor behavior and preferences
  • Technical administration and security

Legal Basis: Legitimate interests (website optimization and security)

3.6 Legal Compliance

  • Fulfilling legal obligations under Polish and EU law
  • Protecting our rights and interests
  • Preventing fraud and security threats

Legal Basis: Legal obligation, legitimate interests

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We may share your information only in the following circumstances:

4.1 Within Wrocław University of Science and Technology

  • With relevant departments of the Faculty of Management and university administration for operational purposes
  • Data sharing is governed by university policies and data protection agreements

4.2 Service Providers and Partners

We work with trusted third-party service providers who process data on our behalf:

  • Website hosting and technical services: Hosting providers, IT support
  • Email communication: Email service providers (e.g., for newsletters)
  • Event management: Event platforms, registration systems
  • Analytics: Website analytics tools (Google Analytics or similar)
  • Social media: LinkedIn, Facebook, Instagram (for public engagement)

All service providers are contractually bound to protect your data and use it only for specified purposes.

4.3 Research Collaborators

  • Academic and research partners involved in collaborative projects
  • Data shared for research is anonymized or pseudonymized wherever possible
  • Governed by data sharing agreements and ethical review protocols

4.4 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, or to:

  • Comply with legal obligations
  • Protect the rights, property, or safety of CRAFT, our users, or others
  • Prevent fraud or security threats

4.5 Event Co-organizers and Sponsors

  • When you register for co-organized events, your information may be shared with event partners
  • We will inform you of data sharing at the point of registration

5. International Data Transfers

CRAFT primarily operates within the European Economic Area (EEA). However, some of our service providers may be located outside the EEA. When we transfer data internationally, we ensure appropriate safeguards are in place:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequacy decisions recognizing equivalent data protection in recipient countries
  • Your explicit consent where required

We ensure that all international transfers comply with GDPR requirements.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law:

  • Contact form submissions: 2 years from last contact
  • Newsletter subscriptions: Until you unsubscribe, plus 1 year for compliance records
  • Event registrations: 3 years after the event for reporting and follow-up purposes
  • Research data: As required by academic standards and ethical approvals (typically 5-10 years)
  • Volunteer applications: 2 years from application or end of engagement
  • Website analytics: Anonymized after 26 months (Google Analytics default)
  • Legal compliance records: As required by applicable laws

After the retention period, we securely delete or anonymize your data.

7. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

7.1 Right of Access

You can request a copy of the personal data we hold about you.

7.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

7.3 Right to Erasure (“Right to be Forgotten”)

You can request deletion of your personal data in certain circumstances, such as:

  • Data no longer necessary for the purposes collected
  • You withdraw consent (where processing is based on consent)
  • You object to processing based on legitimate interests
  • Data processed unlawfully

7.4 Right to Restriction of Processing

You can request that we limit how we use your data in certain situations.

7.5 Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format and transfer it to another controller.

7.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

7.7 Right Not to Be Subject to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

7.8 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

7.9 Right to Lodge a Complaint

You have the right to lodge a complaint with the Polish supervisory authority:

Urząd Ochrony Danych Osobowych (UODO)
ul. Stawki 2
00-193 Warsaw, Poland
Phone: +48 22 531 03 00
Email: kancelaria@uodo.gov.pl
Website: www.uodo.gov.pl

To exercise your rights, contact us at:
Email: craft@pwr.edu.pl
Subject: “Data Protection Request”

We will respond to your request within one month, which may be extended by two additional months for complex requests.

8. Cookies Policy

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide you with a better experience and understand how our website is used.

8.2 Types of Cookies We Use

Strictly Necessary Cookies
Essential for website functionality. These cannot be disabled.

  • Session management
  • Security features
  • Load balancing

Performance and Analytics Cookies
Help us understand how visitors use our website.

  • Google Analytics (anonymized IP)
  • Page view tracking
  • User behavior analysis

Functional Cookies
Enhance website functionality and personalization.

  • Language preferences
  • Cookie consent preferences
  • Accessibility settings

Social Media Cookies
Enable sharing and social media integration.

  • LinkedIn, Facebook, Instagram share buttons
  • Social media feed embeds

8.3 Third-Party Cookies

We use the following third-party services that may set cookies:

  • Google Analytics: Website traffic analysis (anonymized)
  • Social media platforms: LinkedIn, Facebook, Instagram integration
  • YouTube: Video embedding (if applicable)

8.4 Managing Cookies

You can control cookies through your browser settings:

  • Accept all cookies
  • Reject all cookies (may affect website functionality)
  • Manage preferences by cookie type

Most browsers allow you to:

  • View and delete cookies
  • Block third-party cookies
  • Block cookies from specific websites
  • Clear all cookies when closing the browser

Browser-specific instructions:

  • Chrome: Settings > Privacy and security > Cookies
  • Firefox: Settings > Privacy & Security > Cookies
  • Safari: Preferences > Privacy > Cookies
  • Edge: Settings > Cookies and site permissions

For more information, visit: www.aboutcookies.org or www.allaboutcookies.org

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

9.1 Technical Measures

  • Encryption: SSL/TLS encryption for data transmission
  • Secure hosting: Data stored on secure servers with access controls
  • Firewalls and intrusion detection: Protection against unauthorized access
  • Regular security updates: Software and system patches
  • Backup and recovery: Regular data backups with secure storage

9.2 Organizational Measures

  • Access controls: Limited access to personal data on a need-to-know basis
  • Staff training: Regular training on data protection and security
  • Data processing agreements: Contracts with third-party processors
  • Incident response plan: Procedures for data breach notification
  • Regular audits: Periodic security and compliance reviews

9.3 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

  • Notify the supervisory authority within 72 hours
  • Inform affected individuals without undue delay
  • Take immediate action to mitigate harm

10. Children’s Privacy

Our website and services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at craft@pwr.edu.pl, and we will delete such information promptly.

11. Links to Third-Party Websites

Our website may contain links to external websites, including:

  • Research partners and collaborators
  • Academic institutions
  • Social media platforms
  • Event co-organizers
  • Reference materials and publications

We are not responsible for the privacy practices of third-party websites. We encourage you to review their privacy policies before providing any personal information.

12. Social Media

We maintain official profiles on LinkedIn, Facebook, and Instagram. When you interact with our social media pages:

  • Your interactions are governed by the social media platform’s privacy policy
  • We may access publicly available information you share or post
  • We do not collect additional personal data through social media beyond what is publicly visible
  • Messages sent via social media may be processed according to this policy

13. Newsletter and Marketing Communications

13.1 Consent

When you subscribe to our newsletter, you provide explicit consent to receive updates on CRAFT briefings, programs, and events.

13.2 Content

Our newsletters contain:

  • Research highlights and publications
  • Event announcements
  • News and insights from CRAFT
  • Opportunities for collaboration and engagement

We do not send spam or share your email address with third parties for marketing purposes.

13.3 Unsubscribe

You can unsubscribe at any time by:

  • Clicking the “Unsubscribe” link in any newsletter
  • Emailing craft@pwr.edu.pl with “Unsubscribe” in the subject line
  • Contacting us via phone at +48 71 320 34 32

We will process your unsubscribe request within 5 business days.

14. Research and Academic Activities

14.1 Research Data Processing

When you participate in CRAFT research projects:

  • We obtain informed consent before collecting personal data
  • Research protocols are reviewed by ethical review boards where required
  • Data is anonymized or pseudonymized wherever possible
  • Results are published in aggregate form without identifying individuals

14.2 Publication and Dissemination

  • Research outputs may be published in academic journals, reports, and conferences
  • Personal data is not disclosed in publications unless explicitly consented
  • You may be acknowledged as a research participant if you provide consent

14.3 Data Sharing for Research

  • Anonymized research data may be shared with academic collaborators
  • Data sharing agreements ensure appropriate safeguards
  • You can request information about data sharing arrangements

15. Event Recording and Photography

15.1 Photography and Video Recording

At CRAFT events, we may take photographs or video recordings for:

  • Documentation and reporting
  • Promotional materials (website, social media, publications)
  • Internal use and archival purposes

15.2 Consent

  • We will inform you if photography/recording will take place
  • You can object to being photographed or recorded
  • If you appear in photos/videos and wish them removed, contact us at craft@pwr.edu.pl

15.3 Third-Party Recording

  • Participants are prohibited from recording events without explicit permission
  • Professional recordings (e.g., by media partners) will be communicated in advance

16. Volunteer and Collaboration Opportunities

When you apply for volunteer positions or express interest in collaboration:

  • We collect CV/resume, professional information, and references
  • Data is used solely for evaluation and coordination purposes
  • Unsuccessful applications are retained for 2 years (unless you request deletion)
  • You can request updates on your application status

17. Changes to This Privacy Policy

We may update this Privacy & Data Protection Policy periodically to reflect changes in:

  • Legal requirements
  • Our practices and services
  • Technology and security measures

Notification of Changes:

  • Significant changes will be communicated via email (to newsletter subscribers) or website notice
  • The “Last Updated” date at the top of this policy will be revised
  • Continued use of our website after changes constitutes acceptance of the updated policy

We encourage you to review this policy periodically.

18. Contact Information

For questions, concerns, or requests related to data protection and privacy:

CRAFT – Collaboratory for Responsible and Future Technologies
Faculty of Management
Wrocław University of Science and Technology
ul. Łukasiewicza 5
50-371 Wrocław, Poland

Email: craft@pwr.edu.pl
Phone: +48 71 320 34 32

Data Protection Officer (if applicable):
For matters specifically related to data protection, you may contact the university’s Data Protection Officer: craft@pwr.edu.pl

19. Legal Framework

This Privacy & Data Protection Policy is governed by:

  • General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679
  • Polish Data Protection Act – Ustawa o ochronie danych osobowych
  • Polish Telecommunications Law – Ustawa Prawo telekomunikacyjne
  • Relevant regulations of Wrocław University of Science and Technology

20. Accessibility

We are committed to making this Privacy Policy accessible to all users. If you require this policy in an alternative format (e.g., large print, audio, Braille), please contact us at craft@pwr.edu.pl.

Thank you for trusting CRAFT with your personal information. We are committed to protecting your privacy and using your data responsibly to advance research, education, and societal impact.

Document Version: 1.0
Effective Date: December 9, 2025
Next Review Date: December 9, 2026