Respecting your privacy and ensuring that you know how your personal data is processed, we present a set of key information related to the provisions of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU L 2016.119.1) (hereinafter referred to as “GDPR”).

PERSONAL DATA CONTROLLERS

The joint Personal Data Controllers are:

1. The association named Nowa Polska Organizacja (nowapl.org) entered in the Register of Associations, other social and professional organisations, foundations and independent public healthcare institutions of the National Court Register under KRS number: 0001125861 with its registered office in Warsaw, ul. Techników 28, 02-468 Warsaw, NIP: 5223310390, REGON: 52961717100000 (also referred to in the clause concerning the essential content of the provisions of the data co-administration agreement as Joint Controller No. 1).
2. European Parliament – European Conservative & Reformists Group – Group of European Conservatives and Reformists with its registered office in Brussels, Rue Wiertz, 60 ZWEIG 02L036, Belgium (also referred to in the clause concerning the essential content of the agreement on joint data administration as Joint Controller No. 2)

The PDCs can be contacted by email at stowarzyszenie@nowapl.org or by post at the following address: Nowa Polska Organizacja, ul. Techników 28, 02-468 Warsaw.

PURPOSES AND LEGAL BASIS FOR DATA PROCESSING

Please be advised that your personal data will be processed for the following purposes:

1. registration for the “ECR Youth Congress 2025”, hereinafter referred to as the “Congress”, which will take place in Lublin from 27 November 2025 to 29 November 2025 and automatic creation of a participant registration account – the legal basis for data processing is the performance of the contract of participation in the Congress (Article 6(1)(b) of the GDPR) and the necessity of processing for the purposes of the legitimate interests pursued by the Controller. In this case, the legitimate interest of the PDC is to contact participants in order to enable them to participate in the Congress (Article 6(1)(f) of the GDPR),
2. maintaining security measures related to the list of participants during the Congress – the legal basis for data processing is the necessity of processing for the purposes of the legitimate interests pursued by the Controller. In this case, the legitimate interest of the Controller is to ensure security during the Congress (Article 6(1)(f) of the GDPR),
3. establishing contact with Congress participants as part of organisational activities preceding the Congress – the legal basis for data processing is the performance of the contract for participation in the Congress (Article 6(1)(b) of the GDPR) and the necessity of processing for the purposes of the legitimate interests pursued by the Controller. In this case, the legitimate interest of the Controller is to contact Congress participants (Article 6(1)(f) of the GDPR),
4. keeping statistics and reports, and archiving for the Controller’s internal needs related to the number of event participants – the legal basis for data processing is the necessity of processing for purposes arising from the legitimate interests pursued by the Controller. The legitimate interest of the Controller is to keep statistics and reports (Article 6(1)(f) of the GDPR),
5. pursuing or defending against claims related to the organisation of the Congress – the legal basis for data processing is the necessity of processing for the purposes of the legitimate interests pursued by the Controller. In this case, the legitimate interest of the Controller is the ability to establish, pursue or defend against claims (Article 6(1)(f) of the GDPR),
6. informing about other initiatives undertaken or co-organised by the PDC on the basis of separately expressed consent (Article 6(1)(a) of the GDPR).

The course of the Congress will be recorded using image and/or sound recording devices, in the form of photographs and/or audiovisual films, for the purpose of reporting on the Congress for the purposes of promoting the Congress.

Your image recorded in this way may be disseminated through publication in materials promoting the Congress in the form of photographs and audiovisual recordings on the Organisers’ websites, the Organisers’ channels on websites enabling sharing, editing and live broadcasting (Facebook, YouTube, X) and on social media (Facebook, X).

In this case, the basis for data processing is the consent referred to in Article 6(1)(a) of the GDPR, while complying with the obligations under Article 81(1) of the Act of 4 February 1994 on copyright and related rights, i.e. by expressing consent/permission in the form of an unambiguous confirmatory action, which is understood as personal participation in the Congress.

Pursuant to Article 81(2) of the Act on Copyright and Related Rights, no authorisation is required for the dissemination of the image of:

1)   a person who is widely known, if the image was taken in connection with the performance of their public functions, in particular political, social or professional functions;

2)   a person who is only a detail of a whole, such as a gathering, landscape or public event.

If you do not consent to the dissemination of your image, please inform the Organisers of this fact before entering the area where photographs/video recordings are being made.

HOW LONG WE WILL PROCESS YOUR PERSONAL DATA

Your personal data will be processed for a period of 3 years from the end of the Congress.

The data may also be stored for the period necessary for the expiry of any claims.

The Congress fan page/channel on the social networking site (Facebook), the YouTube website and the X social networking platform are subject to retention in accordance with the rules set out in the regulations of the owners of the above-mentioned channels. The period of data storage by entities independent of the Joint Controllers is determined by those entities.

CATEGORIES OF DATA RECIPIENTS

The recipients of the data may be entities from the following categories:

1. entities providing IT and hosting services on behalf of the PDC,
2. entities providing postal and courier services acting on behalf of the PDC,
3. entities providing services to the PDC, in particular hotel and transport services related to the booking of accommodation and the organisation of transport for Congress participants,
4. entities providing accounting services,
5. META PLATFORMS INC.,
6. Google LLC.,
7. Twitter INC.

Personal data will not be transferred to international organisations.

Information on data transfer in connection with publication on the Facebook social network, YouTube website, and X social platform

If you consent to the publication of your personal data on social media, please be advised that your data will be transferred outside the European Economic Area to the United States. In accordance with applicable data protection regulations, we are required to take appropriate precautions when processing data. Data transfer is based on contractual clauses approved by the European Commission and European Commission decisions confirming an adequate level of data protection. More details are available at the addresses indicated in the section “PERSONAL DATA CONTROLLERS”.

Information on data processing by YouTube is available at:

https://www.youtube.com/intl/ALL_pl/howyoutubeworks/user-settings/privacy/

Information on the processing of personal data by the X portal is available at: https://x.com/pl/privacy

Information on the processing of personal data by the Facebook portal is available at:

 https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0

YOUR RIGHTS

Please be advised that you have the right to: request access to your personal data, rectify it, delete it, restrict its processing, object to its processing, and lodge a complaint with the President of the Personal Data Protection Office.

Every person has the right to withdraw their consent if the basis for the processing of personal data was consent granted under Article 6(1)(a) of the GDPR. In such a case, consent may be withdrawn at any time without affecting the lawfulness of the processing that was carried out on the basis of consent before its withdrawal. Consent may be withdrawn in person at the PDC’s registered office, by post or electronically to the following e-mail address: stowarzyszenie@nowapl.org.

INFORMATION ON THE REQUIREMENT OR VOLUNTARY NATURE OF PROVIDING DATA AND THE CONSEQUENCES OF NOT PROVIDING IT

Providing data during registration is a prerequisite for concluding a contract for participation in the Congress; without this data, it is not possible to participate in the Congress or to receive organisational information. Participants may withdraw their consent to participate in the Congress at any time by sending a message to: stowarzyszenie@nowapl.org, which is tantamount to removal from the list of Congress participants and the inability to participate in it. Consent to receive information about other initiatives undertaken or co-organised by PDC is voluntary and may be withdrawn at any time. Consent may be withdrawn in person at the PDC headquarters, by post or electronically to the following e-mail address: stowarzyszenie@nowapl.org.

PROFILING
Personal data will not be processed for the purpose of automated decision-making, including profiling.

ESSENTIAL CONTENT OF THE AGREEMENT ON JOINT ADMINISTRATION OF PERSONAL DATA

As we operate on a joint controller basis, in accordance with Article 26 of the GDPR, we have entered into an appropriate joint controller agreement.  Each of the Joint Controllers shall exercise due diligence to ensure the security of your data processing, and you may contact any of them with any questions you may have. We divide our tasks between us in a clear manner:

• the Joint Controller who received the request is responsible for exercising your rights under the GDPR;
• Joint Controller No. 1 is responsible for fulfilling the information obligation towards data subjects.

Details of the arrangements between the Joint Controllers are available at the offices of Joint Controller No. 1 and Joint Controller No. 2 at the addresses indicated in the section entitled “PERSONAL DATA CONTROLLERS”.

CONTACT POINT

The parties establish the following contact point for natural persons whose personal data are processed by the Joint Controllers: please contact Joint Controller No. 1 via e-mail: stowarzyszenie@nowapl.org or by post: ul. Techników 28, 02-468 Warsaw.