Information about the processing
of personal data.

This notice applies to personal data submitted in connection with an application to the NGO Cyfrowo pilot, its assessment and contact with the organisation. It has been prepared under Articles 13 and — where data comes from another source — 14 of the GDPR.

1. Purposes and legal bases

We use data to receive and assess pilot applications, assess needs, contact the person nominated by the NGO, document the application process and outcome, prevent abuse, and establish or pursue claims. For contact persons, the legal basis is Article 6(1)(f) GDPR: the controller's legitimate interest in running a fair application process, communicating and protecting its rights. Where legal obligations arise from a contract or its accounting, necessary data is also processed under Article 6(1)(c) GDPR.

2. Data categories and source

We may process organisation data and information about its contact or representative: name, role, work email, optional phone number, town or city, registration details, information about the NGO's needs and activities, selected package and funding option, confirmation of authority, and correspondence. The form also records necessary technical data to prevent abuse. We receive data directly from the applicant or the organisation they represent; where verification is necessary, we may consult relevant public registers.

We do not ask for member databases, passwords, copies of identity documents, beneficiary data or special-category data. If you provide another person's data, share this notice with them and limit the information to what is necessary. If data is obtained indirectly, we meet our information obligations within the period and on the terms set out in Article 14 GDPR.

3. Is providing data mandatory?

Providing fields marked as required is voluntary but necessary to process and assess an application. Without them, the organisation cannot take part in the selection process. The registration number and phone number are optional. Confirming authority means the person may contact the organiser on the NGO's behalf; it is not marketing consent or consent to data processing.

4. Recipients and data transfers

Access is limited to authorised staff conducting the selection process. Data may be entrusted to IT infrastructure and security providers needed to operate the website, database and form, including OpenAI Sites and Cloudflare. Assessors bound by confidentiality may access data where necessary. We do not share data with sponsors for marketing.

Providers' infrastructure may involve processing data outside the European Economic Area, including in the United States. Any transfer is made using a mechanism under Chapter V GDPR, such as an adequacy decision or standard contractual clauses. Details and a copy of the relevant safeguards are available from the controller on request.

5. Retention period

Applications that do not result in an agreement are retained for up to 12 months after the final decision. Data needed for a specific dispute may be kept until it is resolved. Data relating to selected organisations is then retained for the periods required by the agreement and law; we provide details when the agreement is signed. To prevent abuse, we create an hourly-bucketed hash of the IP address. Records older than 24 hours are deleted when the next application is processed.

6. Your rights

You may request access to, rectification or erasure of your data, or restriction of processing. You may object to processing based on legitimate interests. Data portability applies in the cases set out in Article 20 GDPR. You may lodge a complaint with the President of the Polish Personal Data Protection Office at uodo.gov.pl. Because application data is not processed on the basis of consent, the right to withdraw consent does not apply to this process.

7. Automated decisions and further use

We do not make decisions about individuals solely by automated means and do not use profiling that produces legal or similarly significant effects. A person approves each application assessment and funding recommendation. Applications are not used for marketing and are not published.

Version 1.0 · 22 October 2026 · Privacy notice for applications to NGO Cyfrowo