Skip to Main content
Site logo

Training materials for employees of Next Film sp. z o.o. – personal data protection policy

KEY DEFINITIONS

The GDPR – a regulation governing the protection of personal data throughout the European Union and the countries of the European Economic Area (EU + Iceland, Liechtenstein and Norway).

Personal data – any information relating to an identified or identifiable natural person (e.g. first name and surname, business address, IP address, email, telephone number, social media profile, national identity number, racial origin, health data, online identifier, image, views), including publicly available data and work-related data.

A natural person (data subject) – any individual (including an entrepreneur running a sole trader business or working within a civil partnership). Deceased persons and legal entities (e.g. foundations, associations, companies) are not considered natural persons.

Processing – any use of personal data (e.g. collection, viewing, downloading, sharing, storage, deletion, modification).

Data controller – the entity responsible for complying with the law in relation to the processing of personal data, which determines the purposes and means of such processing (e.g. the company you work with, the bank where you hold an account, the online shop where you make purchases).

ORGANISATION OF THE PERSONAL DATA PROTECTION AREA WITHIN THE AGORA GROUP

Within the companies of the Agora Group, including Next Film, individuals have been appointed to be responsible for handling tasks relating to the protection of personal data:

  • Data Protection Team – handles personal data breaches and other processes relating to the protection of personal data, e.g. handling GDPR requests;
  • Data Protection Officer (DPO) – carries out audits and is responsible for training.

If, in connection with the services you are providing or the work you are carrying out, you need to contact the Data Protection Team or the Data Protection Officer, please ask the person designated as your contact in the contract who, by name, holds that role at Next Film and how to contact them.

PERSONAL DATA BREACHES

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration or disclosure of personal data.

Examples of infringements

  • The theft or loss of a device or storage medium containing personal data (e.g. a mobile phone).
  • Accidentally overwriting the only copies of the original files and their irreversible loss.
  • Leaving paper documents containing personal data (e.g. attendance registers, contracts with actors, invoices) unattended in a place accessible to the general public (e.g. the canteen).
  • Access by a former employee or contractor to company resources.
  • Disclosure of sensitive information about another person, e.g. revealing that a team member is ill.
  • The accidental inclusion in a film, television programme or photograph of genuine personal data without the knowledge or consent of the data subject.
  • A data leak from the system onto the internet.

What should you do in the event of a breach?

If a data breach has occurred, or if you suspect that one may have occurred, please notify the data protection team immediately (contact: iod@next-film.pl). Please note that, in accordance with the regulations, Next Film, as the data controller, has only 72 hours to notify the President of the Office for Personal Data Protection (UODO) of certain data breaches, so please act as quickly as possible, even if you do not yet have all the details of the incident.

SAFETY

One of the requirements of the GDPR is to ensure that security measures are proportionate to the level of risk associated with the processing of specific data.

Examples of safety measures that apply to you

  • Do not leave your computer unlocked and unattended; lock it every time you step away from it, and use strong passwords (the so-called ‘clean desk, clean screen’ rule).
  • Process only the information that is necessary for you to carry out your duties, and only to the extent authorised by the company.
  • The data to which you have access (e.g. data relating to customers, actors, business partners and other employees) is confidential. You must not disclose it to anyone, and once your employment has ended, you should secure and return all documents.
  • Documents containing personal data (e.g. contracts, invoices, CVs) should be shredded or placed in specially marked bins at the company’s premises, rather than being thrown away in their entirety in the bin.

CHANGES TO DATA PROCESSING PROCEDURES

The GDPR requires that, prior to implementing new processes (e.g. the introduction of a new standard orcode of conduct, or commencing business activities in a new area) or when making changes to existing processes based on the processing of personal data, compliance with its key requirements must be verified and documented.

This assessment should be updated if there is a significant change in the circumstances of data processing within the project currently being carried out (e.g. if the scope of the personal data you wish to collect as part of your tasks changes).

If, in accordance with the contract, Next Film has entrusted you with implementing new or amended processes within the company, do not act on your own initiative – please raise any requests for support regarding personal data protection with the relevant contact persons. Do this in advance, before you put the changes into practice.

REQUESTS FROM DATA SUBJECTS

Data subjects have certain rights under the GDPR. For example, a person may request a copy of all their personal data, withdraw their consent to the processing of their data, or request that their data be erased. Such a request may be made in writing, but also verbally or by email.

Please remember – never process such a request yourself. Forward requests immediately to the data protection team at iod@next-film.pl. A response to the request must be provided within the prescribed time limit, so please do not delay in passing on this information.

FURTHER INFORMATION

Further information on data protection principles can be found in Next Film’s Personal Data Protection Policy and in Next Film’s applicable procedures. These will be provided to you by the person coordinating the performance of the contract or designated to liaise with you in connection with your contract with Next Film sp. z o.o. You may also request that the Data Protection Officer (DPO) or the data protection team send them to you.