Skip to main content

Privacy and Cookie Policy

Last updated: 28 September 2026

This Policy explains how personal data are processed and how cookies and similar technologies are used on the internet domain of the Faculty of Political Science and International Studies, University of Warsaw, available at wnpism.uw.edu.pl (the “Website”).

1. Data controller

The controller of your personal data is:

University of Warsaw
26/28 Krakowskie Przedmiescie
00-927 Warsaw
Telephone: +48 22 55 20 000

Correspondence concerning the Website should identify the following organisational unit:

Faculty of Political Science and International Studies, University of Warsaw
Auditorium Building (Collegium Politicum)
26/28 Krakowskie Przedmiescie
00-927 Warsaw
Email: wnpism@uw.edu.pl
Telephone: +48 22 55 20 218

2. University of Warsaw Data Protection Officer

The University of Warsaw has appointed a Data Protection Officer (DPO). You may contact the DPO about any matter concerning the processing of personal data by the University of Warsaw or the exercise of your rights in connection with that processing.

Email: iod@adm.uw.edu.pl

3. Local data protection contact

For matters concerning data processing within the Faculty, you may also contact:

Dean’s Representative for Personal Data Protection (LODO)
Monika Tecław
Email: zamowienia.wnpism@uw.edu.pl
Telephone: +48 22 55 22 938

Visitor hours:

  • Monday: 08:00–15:00.
  • Tuesday: 08:00–15:00.
  • Wednesday: 08:00–15:00.
  • Thursday: 08:00–15:00.
  • Friday: internal work.

Contacting the Dean’s Representative at the Faculty does not affect your right to contact the University’s Data Protection Officer directly.

4. Categories of data processed

When you use the Website, the following data may be processed:

  • Your IP address and the approximate location derived from it.
  • The date and time of your connection.
  • The address of the page you visit.
  • The address of the page that referred you to the Website.
  • Information about your browser, operating system, and device.
  • Identifiers stored in cookies or similar technologies.
  • Information about pages visited, visit duration, clicks, and scrolling.
  • Information about errors and Website performance.
  • Data submitted through forms, particularly your first name, surname, email address, telephone number, and message.
  • Your email address and information associated with newsletter administration.
  • Information about newsletter opens and clicks on links within newsletters.
  • Information needed to detect spam, bots, attacks, and other misuse.
  • Information about your choices concerning cookies and other technologies.

5. Purposes and legal bases for processing

5.1. Website operation and security

Technical data and server logs are processed to make the Website available, administer it, diagnose errors, create backups, and prevent attacks and misuse.

The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR): the controller’s legitimate interest in ensuring the security and proper functioning of the Website.

5.2. Correspondence and forms

Data provided through a form, by email, or during a telephone conversation are processed to respond to your enquiry and handle the matter you raise.

Depending on the subject of your enquiry, the legal basis is:

  • Article 6(1)(b) GDPR, where the matter concerns entering into or performing a contract.
  • Article 6(1)(c) GDPR, where processing is required to comply with a legal obligation.
  • Article 6(1)(e) GDPR, where processing is necessary to perform a task carried out in the public interest.
  • Article 6(1)(f) GDPR in other cases, on the basis of the legitimate interest in handling correspondence and responding to enquiries.

5.3. Website analytics

Google Analytics 4 and Microsoft Clarity are used to compile statistics, analyse how the Website is used, and improve its content, structure, and usability.

These tools are completely blocked until you consent to analytics cookies. Before consent is given, their scripts do not run and do not transmit data about your visit to Google or Microsoft.

The legal basis is consent under Article 6(1)(a) GDPR.

5.4. Consent management

Consentlane is used to record your preferences, control the activation of optional tools, allow you to change your choices, and retain evidence of consent or refusal.

The legal bases are:

  • Article 6(1)(c) GDPR, in connection with the obligation to demonstrate consent under Article 7(1) GDPR.
  • Article 6(1)(f) GDPR, in relation to the legitimate interest in managing and documenting users’ preferences.

5.5. Form protection

Google reCAPTCHA is used to distinguish human activity from automated submissions and to protect forms against spam, bots, and other misuse.

The controller’s legal basis for processing is Article 6(1)(f) GDPR: the legitimate interest in ensuring the security of forms, infrastructure, and Website users.

5.6. Newsletter and performance measurement

Subscribers’ data are processed to:

  • Register subscribers on the mailing list.
  • Send the WNPiSM newsletter.
  • Determine whether a message has been delivered and opened.
  • Measure clicks on links.
  • Compile statistics on newsletter performance.
  • Adapt the topics and format of future messages.

The legal basis is freely given consent under Article 6(1)(a) GDPR and the applicable provisions governing electronic communications.

You may withdraw your consent at any time using the link in the footer of each message. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

5.7. Legal claims and archiving

Data may be retained to establish, exercise, or defend legal claims under Article 6(1)(f) GDPR.

Data subject to mandatory archiving requirements are processed under Article 6(1)(c) GDPR.

6. Hosting and server logs

The Website uses hosting services provided by cyber_Folks S.A.

When you connect to the Website, the server may record:

  • Your IP address.
  • The date and time of the connection.
  • The requested URL.
  • The server response code.
  • Information about your browser and operating system.
  • The referring page’s address.
  • Information about errors.

Logs are used to administer the Website, maintain security, diagnose technical problems, and compile aggregate technical statistics.

7. Consentlane

The Website uses the Consentlane consent management platform, provided by:

NEXVERA sp. z o.o.
124/12 Wolczanska
90-527 Lodz

Consentlane displays the consent panel, records your preferences, and controls the activation of optional tools.

The consent log records:

  • A randomly generated consent identifier.
  • The categories accepted and rejected.
  • The version of the Policy in effect when the choice was made.
  • A cryptographic hash of your IP address.
  • Abbreviated browser information.
  • The date and time of your choice.

Consentlane does not store IP addresses in plain text. Consent logs are stored on Hetzner Online GmbH servers in data centres located in Germany.

NEXVERA sp. z o.o. acts as a data processor on behalf of the University of Warsaw.

Further information is available in the Consentlane Privacy Policy.

8. Google Tag Manager

The Website uses Google Tag Manager to manage scripts and tags.

Google Tag Manager communicates consent settings and controls other tools. Google Analytics 4 and Microsoft Clarity tags remain blocked until consent to analytics has been confirmed.

Google may process standard technical logs associated with loading the tool. Information about Google’s processing of personal data is available in the Google Privacy Policy.

9. Google Analytics 4

Once you give consent, the Website activates Google Analytics 4 to compile statistics and analyse how the Website is used.

The service may process:

  • Cookie and device identifiers.
  • Your IP address.
  • Your approximate location.
  • Information about your device, browser, and operating system.
  • Information about the pages you visit.
  • The source of your visit.
  • Data about your interactions with the Website.

Data that could directly identify you, such as your first name, surname, email address, or telephone number, are not intentionally sent to Google Analytics.

User and event data are retained for the period configured in Google Analytics, for no longer than 14 months. This setting does not affect standard aggregate reports.

Further information is available in Google Analytics’ data protection information and the Google Privacy Policy.

10. Microsoft Clarity

Once you give consent, the Website activates Microsoft Clarity to generate click and scroll heatmaps and analyse browsing sessions.

Clarity may record:

  • How the page is displayed.
  • Clicks and pointer movements.
  • Scrolling.
  • Window resizing.
  • Device characteristics.
  • Technical errors.
  • Changes to page elements.

Form fields and elements containing personal data are masked so that information entered by users is not visible in session recordings.

According to Microsoft’s documentation, session recordings are generally retained for 30 days. Click data, heatmaps, and tagged sessions may be retained for nine months.

Further information is available in the Microsoft Privacy Statement.

11. Google reCAPTCHA

Forms are protected by Google reCAPTCHA.

reCAPTCHA runs on pages containing protected forms regardless of your choice concerning analytics cookies. In the Consentlane panel, it is listed as a technology necessary for form protection.

Google may analyse:

  • Your IP address.
  • Information about your device and browser.
  • Language settings.
  • How you interact with the page.
  • The time taken to complete actions.
  • Information about mouse movements or touch interactions.
  • Google cookies and identifiers.
  • Information needed to assess the risk of an automated submission.

Data are transmitted to Google to assess risk and determine whether a human is using the form.

Blocking reCAPTCHA in your browser settings may prevent you from submitting a form. If this happens, you can contact WNPiSM using the email address or telephone number provided in this Policy.

The use of reCAPTCHA is subject to the Google Privacy Policy and Google Terms of Service.

12. Newsletter and MailerLite

The newsletter is managed through MailerLite.

The following data are processed:

  • Your email address.
  • Your first name and surname, if provided.
  • The date and source of your subscription.
  • Information about your consent.
  • Your IP address and technical data associated with subscribing.
  • Your subscription status.
  • Information about message delivery or delivery failure.
  • Information about newsletter opens.
  • The date and time of opening.
  • Information about links clicked.
  • The date and time of clicks.
  • Basic information about your device and email client.

Email opens may be measured using a small, invisible image loaded when the message is displayed. Clicks are measured using specially configured redirect links.

These data are used to compile statistics, assess interest in the content, and improve WNPiSM communications.

You may unsubscribe at any time using the link in the message footer.

Further information is available in the MailerLite Privacy Policy.

13. Categories of cookies and similar technologies

The Website uses the following categories.

Necessary

These are required for the Website to function, protect forms, maintain security, and remember your choices. They include Consentlane and Google reCAPTCHA on pages containing forms.

Preferences

These remember selected settings and enable additional Website features.

Analytics

These measure traffic and analyse how the Website is used. They include Google Analytics 4 and Microsoft Clarity and are completely blocked until consent is given.

An up-to-date list of cookies, their providers, purposes, and lifetimes is available in the Privacy settings or Cookie settings panel. The list displayed by Consentlane forms an integral part of this Policy.

14. Managing consent

On your first visit, you may:

  • Accept all optional technologies.
  • Reject all optional technologies.
  • Select individual categories.

Declining analytics does not restrict access to the Website’s basic content and functions.

You may change or withdraw your consent at any time using the Privacy settings or Cookie settings button in the footer.

Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before withdrawal.

15. Recipients of data

Data may be made available to:

  • Authorised employees and associates of the University of Warsaw.
  • cyber_Folks S.A.
  • NEXVERA sp. z o.o., the provider of Consentlane.
  • Hetzner Online GmbH.
  • Cloudflare, Inc.
  • Google Ireland Limited and relevant Google group entities.
  • Microsoft Ireland Operations Limited and relevant Microsoft group entities.
  • MailerLite Limited and its subcontractors.
  • Email and IT service providers.
  • Providers of maintenance, audit, or legal services.
  • Public authorities authorised to receive the data.

Processors acting on behalf of the controller operate under appropriate agreements and documented instructions.

16. Transfers outside the European Economic Area

The use of services provided by Google, Microsoft, MailerLite, Consentlane, or their subcontractors may involve processing data outside the European Economic Area (EEA).

Data transfers take place using the mechanisms provided for in Chapter V GDPR, particularly a European Commission adequacy decision or standard contractual clauses supplemented, where necessary, by additional safeguards.

In the ordinary course of providing the service, Consentlane consent logs are stored on servers located in the European Union. Some subcontractors, particularly Cloudflare, may process data outside the EEA.

Information about the safeguards used can be obtained from the controller or the University of Warsaw’s Data Protection Officer.

17. Data retention periods

Data are retained for the following periods:

  • Server logs: for the period determined by the hosting configuration and security needs, after which they are deleted or anonymised.
  • Correspondence and forms: until the matter has been concluded, and subsequently for the period required by records management and archiving rules or the applicable limitation periods for legal claims.
  • Google Analytics 4 user and event data: no longer than 14 months.
  • Microsoft Clarity session recordings: generally 30 days.
  • Clarity heatmaps, click data, and tagged sessions: up to nine months.
  • Consentlane consent logs: five years from the date of the choice.
  • Newsletter data and open and click statistics: until consent is withdrawn or the newsletter is discontinued.
  • Information needed to demonstrate consent or unsubscription: until the applicable limitation period for legal claims expires.
  • Records subject to archiving requirements: for the period required by law and University of Warsaw regulations.

18. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

  • Access your personal data and obtain a copy.
  • Have your data rectified.
  • Have your data erased.
  • Restrict processing.
  • Data portability, where provided for in the GDPR.
  • Object to processing based on Article 6(1)(e) or (f) GDPR.
  • Withdraw consent at any time.
  • Lodge a complaint with the President of the Personal Data Protection Office.

The supervisory authority’s contact details are available on the Personal Data Protection Office’s website.

The exercise of individual rights may be subject to restrictions under the GDPR or other applicable legislation.

19. Voluntary provision of data

Providing data through a form or when subscribing to the newsletter is voluntary. Failure to provide information marked as required may prevent form submission, a response to your enquiry, or delivery of the newsletter.

Technical data needed to establish a connection, display the Website, and maintain security are processed automatically.

20. Automated decision-making

WNPiSM does not use Website users’ data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect users.

Analytics tools may associate events with technical identifiers, but this is not used to make such decisions.

21. External links and content

The Website may contain links to or embedded content from other websites, particularly social media services, maps, and multimedia platforms.

When you visit an external website, its operator’s privacy policy applies. Embedded content involving optional user tracking is activated only after the relevant consent has been given.

22. Changes to this Policy

This Policy may be updated following changes to the law, the Website’s configuration, the tools used, or the ways in which data are processed.

The current version is published on the Website together with its last updated date.
Archived website