The National Maritime Museum in Gdańsk (hereinafter: NMM) places great importance on protecting the personal data and privacy of users visiting NMM’s online services, social media accounts, or using its offerings and resources. The processing of personal data is carried out in accordance with applicable laws, including the General Data Protection Regulation (GDPR).
Our priority is to ensure transparency in data processing and to guarantee an appropriate level of information security. Below, we provide detailed information about the principles of personal data processing.
1. Data Controller
The data controller is the National Maritime Museum in Gdańsk, with its registered office at Ołowianka 9-13, 80-751 Gdańsk, registered in the National Register of Cultural Institutions under number RNIK 14/92, REGON 000 635 075.
2. Data Protection Officer
The museum has appointed a Data Protection Officer, who can be contacted at: ochrona.danych@nmm.pl
3. Purposes and Legal Basis for Data Processing
The National Maritime Museum processes personal data for the following purposes:
| Purpose of Processing | Legal Basis |
| Handling correspondence | Art. 6(1)(e) GDPR – processing is necessary for the performance of a task carried out in the public interest in connection with the Act of November 21, 1996, on museums (Journal of Laws of 2022, item 385) and the Statute of the National Maritime Museum in Gdańsk – regarding inquiries about cultural events, exhibitions, collections, and museum activities. Art. 6(1)(f) GDPR – legitimate interest of the Controller when the content of the correspondence does not relate to the public tasks performed by NMM. Art. 6(1)(b) GDPR – processing is necessary for the performance of a contract or to take steps prior to entering into a contract. |
| Booking and purchasing tickets online | Art. 6(1)(b) GDPR – processing is necessary for the performance of a contract or to take steps prior to entering into a contract. |
| Processing orders for goods in the online store | Art. 6(1)(b) GDPR – processing is necessary for the performance of a contract or to take steps prior to entering into a contract. |
| Submission of application documents by job applicants | Art. 6(1)(c) GDPR – legal obligation imposed on the Controller regarding data required under labor law. Art. 6(1)(a) GDPR – when the applicant provides additional personal data beyond what is required by labor law or expresses willingness to participate in future recruitment processes. |
| Receiving the NMM Bulletin | Art. 6(1)(e) GDPR – performance of a public task in promoting and conducting artistic activities, disseminating culture, and providing educational activities in accordance with the Act on Museums and the Statute of the National Maritime Museum in Gdańsk. |
| Space rental | Art. 6(1)(b) GDPR – processing is necessary for the performance of a contract or to take steps prior to entering into a contract. |
| Accommodation reservations | Art. 6(1)(b) GDPR – processing is necessary for the performance of a contract or to take steps prior to entering into a contract. |
| Managing NMM’s social media accounts | Art. 6(1)(e) GDPR – performance of a public task in promoting and conducting artistic activities and disseminating culture in accordance with the Act on Museums and the Statute of the National Maritime Museum in Gdańsk. |
| Organizing events (competitions, conferences, seminars, lectures, workshops, invitations, event registration) | Art. 6(1)(e) GDPR – performance of a public task in disseminating culture and education in accordance with the Act on Museums and the Statute of the National Maritime Museum in Gdańsk. Art. 6(1)(b) GDPR – processing is necessary for the performance of a contract or to take steps prior to entering into a contract. |
| Responding to public information requests | Art. 6(1)(c) GDPR – legal obligation in accordance with the Act of September 6, 2001, on Access to Public Information. |
| Use of individuals’ images (e.g., event coverage in social media) | Art. 6(1)(f) GDPR – legitimate interest of the Controller, particularly in using image distribution permissions under Art. 81(1) of the Act of February 4, 1994, on Copyright and Related Rights. |
4. NMM Bulletin Subscription
Subscribing to the National Maritime Museum Bulletin is voluntary. To subscribe, users must complete the registration form available at nmm.pl/bulletin/ and provide an email address. After registration, an activation link will be sent to the provided email address, which must be confirmed to start receiving the Bulletin.
Providing personal data is voluntary but necessary for receiving the Bulletin. Users can unsubscribe at any time by clicking the link in the footer of each email. Data will be stored until users opt out of the subscription or the Bulletin is discontinued.
5. Data Processing of Children
The National Maritime Museum does not knowingly collect personal data of children without the consent of their legal guardians. If minors participate in museum events, workshops or competitions, their personal data is processed only with the consent of a parent or legal guardian and to the minimal extent necessary for organizing the event or competition, in compliance with applicable laws.
6. Data Recipients
Personal data may be shared with entities supporting NMM’s operations, such as IT service providers and cultural event partners. Event coverage, including photographs and videos, may be published on NMM’s official social media accounts and channels. NMM does not cooperate with companies outside the European Union, and therefore, data will not be transferred to non-EU countries.
7. Data Retention Period
Personal data is stored for the time necessary to achieve the processing purposes, in accordance with applicable laws, including the Act of July 14, 1983, on the National Archival Resource and Archives and the NMM Unified Subject File Index. Data processed based on consent is stored until consent is withdrawn.
8. Data Subject Rights
Individuals whose data is processed have the right to:
- Access their data,
- Rectify their data,
- Erasure of data (“right to be forgotten”) – except where processing is based on a legal obligation (Art. 6(1)(c) GDPR),
- Restrict processing,
- Object to processing (when based on Art. 6(1)(e) or (f) GDPR),
- Data portability (if processing is based on consent (Art. 6(1)(a)) or a contract (Art. 6(1)(b)),
- • Withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.
Requests to exercise these rights can be submitted:
- By mail to: National Maritime Museum in Gdańsk, Ołowianka 9-13, 80-751 Gdańsk
- By email to: ochrona.danych@nmm.pl
9. Cookies
The NMM website https://nmm.pl/uses cookies to ensure proper website functionality, personalize content, and conduct statistical analysis. Users can adjust cookie settings in their browser at any time.
Types of cookies used:
- Essential cookies – necessary for proper website operation. Users cannot disable them
- Functional cookies – store user preferences (only with user consent).
- Analytical cookies – used for statistical analysis (only with user consent).
- Marketing cookies – track user activity and display personalized content (only with user consent).
| Cookie Name | Description | Storage Duration | Cookie Type |
| cookielawinfo-checkbox-necessary | The cookies is used to store the user consent for the cookies in the category “Necessary”. | 11 months | Essential |
| cookielawinfo-checkbox-functional | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category “Functional” | 11 months | Essential |
| cookielawinfo-checkbox-performance | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category “Performance”. | 11 months | Essential |
| cookielawinfo-checkbox-analytics | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category “Analytics” | 11 months | Essential |
| cookielawinfo-checkbox-others | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category “Other” | 11 months | Essential |
| cookieyes-consent | CookieYes sets this cookie to remember users’ consent preferences so that their preferences are respected on subsequent visits to this site. | 1 year | Essential |
| sbjs_* | Stores data related to the operation of the online store | session / 1 day | Essential |
| wpEmojiSettingsSupports | WordPress sets this cookie when a user interacts with emojis on a WordPress site. It helps determine if the user’s browser can display emojis properly | session | Essential |
| yt-remote-device-id | YouTube sets this cookie to store the user’s video preferences using embedded YouTube videos | never expires | Funkctional |
| ytidb::LAST_RESULT_ENTRY_KEY | The cookie is used by YouTube to store the last search result entry that was clicked by the user. This information is used to improve the user experience by providing more relevant search results in the future | never expires | Funkctional |
| yt-remote-connected-devices | YouTube sets this cookie to store the user’s video preferences using embedded YouTube videos | never expires | Funkctional |
| yt-remote-session-app | Cookie is used by YouTube to store user preferences and information about the interface of the embedded YouTube video player | session | Funkctional |
| yt-remote-cast-installed | Cookie is used to store the user’s video player preferences using embedded YouTube video | session | Funkctional |
| yt-remote-session-name | Cookie is used by YouTube to store the user’s video player preferences using embedded YouTube video | session | Funkctional |
| yt-remote-fast-check-period | Cookie is used by YouTube to store the user’s video player preferences for embedded YouTube videose | session | Funkctional |
| _fbp | Facebook sets this cookie to display advertisements when either on Facebook or on a digital platform powered by Facebook advertising after visiting the website | 3 months | Analytical |
| _ga_* | Google Analytics sets this cookie to store and count page views | 1 year 1 month 4 days | Analytical |
| _gid | Google Analytics sets this cookie to store information on how visitors use a website while also creating an analytics report of the website’s performance. Some of the collected data includes the number of visitors, their source, and the pages they visit anonymously. | 1 day | Analytical |
| _ga* | Related to website traffic analytics | 400 days | Analytical |
| _gat_gtag_UA_* | Google Analytics sets this cookie to store a unique user ID | 1 minute | Analytical |
| sbjs_migrations | Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioural cookie is used to enhance the visitor experience on the website | session | Analytical |
| sbjs_current_add | Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioural cookie is used to enhance the visitor experience on the website | session | Analytical |
| sbjs_first_add | Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioural cookie is used to enhance the visitor experience on the website | session | Analytical |
| sbjs_current | Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioural cookie is used to enhance the visitor experience on the website | session | Analytical |
| sbjs_first | Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioural cookie is used to enhance the visitor experience on the website | session | Analytical |
| sbjs_udata | Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioural cookie is used to enhance the visitor experience on the website | session | Analytical |
| sbjs_session | Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioural cookie is used to enhance the visitor experience on the website | 1 hour | Analytical |
| _ga | Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site’s analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors | 1 year 1 month 4 days | Analytical |
| YSC | YouTube sets this cookie to track the views of embedded videos on YouTube pages | session | Marketing |
| VISITOR_INFO1_LIVE | YouTube sets this cookie to measure bandwidth, determining whether the user gets the new or old player interface | 6 months | Marketing |
| VISITOR_PRIVACY_METADATA | YouTube sets this cookie to store the user’s cookie consent state for the current domain | 6 months | Marketing |
| __Secure-ROLLOUT_TOKEN | Registers a unique ID to keep statistics of what videos from YouTube the user has seen | 6 months | Marketing |
10. Changes to the Privacy and Cookie Policy
The Administrator may update this Privacy Policy. The latest version is always available at nmm.pl/en/privacy-policy.