PRIVACY POLICY AND PRIVACY NOTICE

PRIVACY POLICY AND PRIVACY NOTICE

Fundacja Porta Vitae survey on how parents and guardians search for and choose an educational setting for a child

1. Who is the data controller?

The controller of personal data processed in connection with the survey is Fundacja Porta Vitae, with its registered office at ul. Romana Dmowskiego 38, 97-300 Piotrków Trybunalski, entered in the Polish National Court Register (KRS) under number 0000688966, NIP 7712892949, REGON 367932417 (“Fundacja”, the “Controller”).

Fundacja Porta Vitae is the governing authority of Przedszkole Specjalne “Kolorowe Kredki” and acts as the sole data controller in relation to this survey. The preschool is neither a separate data controller nor a research partner.

Contact details for matters concerning the survey and personal data:

  1. e-mail: portavitaefundacja@gmail.com;
  2. by post: Fundacja Porta Vitae, ul. Romana Dmowskiego 38, 97-300 Piotrków Trybunalski.

2. What is the survey about and why do we process data?

The purpose of the survey is to understand how parents and guardians search for information, compare options, and make decisions concerning the choice of an educational setting for a child who requires special educational or developmental support.

Responses will be used solely to:

  1. analyse families’ decision-making journeys, information needs, selection criteria, and barriers;
  2. prepare aggregated research findings;
  3. improve how the activities of Fundacja Porta Vitae and Przedszkole Specjalne “Kolorowe Kredki” are communicated.

Personal data contained in responses will be used solely for this specific study. Further communications or research activities may be designed on the basis of irreversibly anonymised aggregate findings. The use of individual responses in a new study requires a separate assessment, the provision of a new privacy notice and—where necessary—the obtaining of new consent.

The survey is not an enquiry about an available place, a child registration form, an admissions stage, a diagnosis, or an assessment of a child’s suitability for the educational setting. Participation or non-participation does not affect contact with Fundacja Porta Vitae, access to information, the ability to submit an enquiry, or any decisions concerning a child’s admission.

3. What data may be processed?

The form does not require the respondent to provide their full name, e-mail address, telephone number, exact address, the name of the child’s current educational setting, documents, or any other data directly identifying the respondent or the child.

Depending on the answers provided, we may process:

  1. information about the respondent’s role and involvement in decisions concerning the child;
  2. a general description of the most recent situation involving the search for or selection of an educational setting;
  3. information about the sources used, selection criteria, barriers, information needs, and the outcome of that situation;
  4. the general search area, acceptable travel distance or time, and language needs;
  5. voluntarily entered free-text responses;
  6. the submission timestamp, a technical identifier or response code, and a distribution source code—if these are actually recorded in the approved configuration;
  7. technical service data processed by Google, the precise scope of which depends on the account and service configuration, such as the IP address, device and browser data, cookies, and security and abuse-prevention signals. Before publication, Fundacja Porta Vitae must verify the actual scope, Google’s roles, and the relevant provider information; the public version must not remain a hypothetical description.

The context of the survey and the combination of responses may indirectly reveal information concerning a child’s health or disability. Information about development or educational needs constitutes a special category of personal data insofar as it reveals a health condition or disability. To that extent, it is subject to special protection under Article 9 GDPR.

The survey is not described as anonymous. Although it does not require directly identifying data, a free-text response or a unique combination of several pieces of information may enable a person or family to be identified indirectly. Please do not enter names, contact details, names of educational settings, contents of documents, a detailed diagnosis, treatment or therapy history, or any other information that could identify a child, family, specialist, or educational setting.

4. What is the legal basis for processing the data?

Article 6(1)(a) GDPR — voluntary consent to participate in the study and to the processing of responses;

Article 9(2)(a) GDPR — explicit consent to the processing of information that may reveal data concerning a child’s health, disability, or development.

Consent covers the respondent’s data and the child’s data contained in the responses, including health data, where the respondent is authorised to represent that child. If the responses relate to a child, consent must be given by a parent, legal guardian, or another person duly authorised to provide that information and to represent the child in this respect.

Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

5. Is providing data mandatory?

Participation is entirely voluntary. There is no obligation to begin or complete the survey. Refusing consent or subsequently withdrawing it has no adverse consequences and does not affect the ability to contact Fundacja Porta Vitae or the educational setting, or any admissions process.

6. Who may be given access to the data?

Access to the responses may be granted solely to:

  1. persons authorised by Fundacja Porta Vitae for whom access is necessary to conduct and supervise the study;
  2. the provider of the survey tool and IT services—solely to the extent necessary to provide the services and under an appropriate agreement;
  3. entities supporting Fundacja Porta Vitae in the technical preparation or analysis of the study, provided that their roles have been formally determined, access is restricted to what is necessary, and any required data processing agreement has been concluded;
  4. authorised public authorities where disclosure is required by law.

Raw responses will not be published, sent by e-mail, disclosed to any external generative artificial intelligence tools—whether public or enterprise tools—or used by Fundacja Porta Vitae to train AI models. Any necessary working exports must be encrypted, accessible only to specifically authorised individuals, and deleted after a predetermined short period.

Reports will contain aggregate findings. Results for groups of fewer than five people will be suppressed or combined. Fundacja Porta Vitae will also apply complementary suppression and verify that small cell counts cannot be reconstructed by subtracting values, combining tables, or comparing successive versions of a report.

7. Google Forms and transfers outside the European Economic Area

The intended configuration is for the form to be operated in Google Forms through an organisational Google Workspace account controlled by Fundacja Porta Vitae and covered by an appropriate agreement and data processing addendum.

Google or its approved subprocessors may also process data outside the European Economic Area. If such a transfer occurs, Fundacja Porta Vitae will ensure that a mechanism provided for under the GDPR is used, in particular an adequacy decision, the recipient’s certification under the EU–US Data Privacy Framework, or Standard Contractual Clauses—depending on the specific recipient and place of processing. Information about the mechanism used and how to obtain a copy of the safeguards is available by contacting Fundacja Porta Vitae.

8. How long do we retain the data?

The recommended retention period for individual responses is up to 12 months after the survey closes. Following the effective withdrawal of consent, personal data covered by that consent will be erased without undue delay, unless the Controller identifies another independent and documented legal basis applying to a strictly defined scope of data and informs the data subject of that basis.

After this period, individual responses will be erased or irreversibly anonymised. Following actual, irreversible anonymisation, it is no longer possible to locate or erase a specific response, and the GDPR does not apply to the resulting anonymous aggregate. Anonymised aggregate findings from which no individual or family can be identified may be retained for longer because they no longer constitute personal data.

9. How do we protect responses?

Fundacja Porta Vitae will implement measures appropriate to the risk, in particular:

  1. limiting the number of people with access to responses and granting permissions to named individuals;
  2. using organisational accounts, strong passwords, and multi-factor authentication;
  3. prohibiting public access to the form displaying results and the response spreadsheet;
  4. separating raw responses from aggregate reports;
  5. manually reviewing free-text fields and deleting or redacting excessive data before analysis or quotation;
  6. suppressing small cell counts in reports;
  7. not using raw responses in any external AI tools;
  8. prohibiting raw responses from being sent by e-mail, and encrypting and deleting necessary exports within the prescribed time;
  9. periodically reviewing permissions, exports, copies, and data erasure deadlines.

10. What rights do participants have?

Within the limits provided by the GDPR, the data subject may request:

  1. access to their data and a copy of it;
  2. rectification of their data;
  3. erasure of their data;
  4. restriction of processing;
  5. data portability, where the conditions set out in Article 20 GDPR are met;
  6. withdrawal of consent at any time.

If a request concerns information relating to a child, Fundacja Porta Vitae may, to the extent necessary, verify the authority of the person making the request. Such verification must not result in the collection of excessive data.

11. How can consent be withdrawn or a response identified?

A request may be sent to portavitaefundacja@gmail.com or by post to Fundacja Porta Vitae’s address. The subject line may read “Survey — personal data”.

12. Do we make automated decisions or profile families?

The data will not be used to make decisions concerning respondents or children based solely on automated processing, including profiling, where such decisions would produce legal effects or similarly significantly affect them.

Technical labels for research paths or N1–N5 segments may be used solely for aggregate analysis. They must not affect contact priority, assessment of the child, place availability, the admissions process, or the decision to admit the child to the educational setting.

13. Right to lodge a complaint

If a participant believes that their data is being processed unlawfully, they may lodge a complaint with the President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warszawa. Further information is available at uodo.gov.pl.

Contacting Fundacja Porta Vitae is optional and is not a prerequisite for lodging a complaint with the President of the Personal Data Protection Office. We encourage such contact only so that we can clarify the matter and, where necessary, promptly correct the process.

14. Changes to this information

If the purpose, scope of data, tool, recipients, method of analysis, or retention period changes, Fundacja Porta Vitae will update this information before the changed processing begins. The new version will be marked with a date and version number. Data must not be used for a new, incompatible purpose unless the relevant GDPR requirements have been met.