If you use the My Portfolio tool, you thereby agree to the provisions of this policy. This is why it is so important to read it. To simplify matters, ‘My Portfolio’ is referred to in this document as the tool for collecting, organising and sharing evidence of knowledge, skills and social competences, as well as for preparing Development Plans. The term ‘Portal’ in this document is referred to as the way in which the services offered by My Portfolio can be accessed.

I. Who is the Controller of personal data?

The Educational Research Institute – National Research Institute (Instytut Badań Edukacyjnych – Państwowy Instytut Badawczy, IBE-PIB) with its registered office in Warsaw, at ul. Górczewska 8, 01-180 Warszawa, tel. (22) 24 17 101, e-mail: ibe@ibe.edu.pl (hereinafter: ‘IBE PIB’ or ‘Controller’) is the Controller of the personal data processed for the purposes and to the extent referred to in Part III.

IBE PIB is a National Research Institute, which, in accordance with the Act of 22 December 2015 on the Integrated Qualifications System, is responsible for the maintenance and development of the Integrated Qualifications Register, which, alongside the Polish Qualifications Framework, is a key element of the Integrated Qualifications System being implemented in Poland.

For matters relating to the operation of the My Portfolio tool, contact IBE PIB in writing at the above-mentioned postal address or by email at: info.walidacja@ibe.edu.pl.

For all matters relating to the processing of personal data, as well as questions regarding this Policy, please contact our Data Protection Officer at the email address: iod@ibe.edu.pl or at the above address of the Controller.

II. Definitions

Personal data (data) – any information about an identified or identifiable natural person. An identifiable person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, surname, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person;

Counsellor – a person providing vocational or educational counselling who has a ‘counsellor account’ in the My Portfolio tool, with whom an Individual User can share their My Portfolio account or its selected elements;

Evidence – the Individual User’s documents and work that confirm possession of the competences in listed in My Portfolio; these may include: certificates of completed courses, other certificates, diplomas, drawings, photographs, references (from employers, colleagues, social organisations) in .pdf, .jpg, .png format and as links to online resources;

Awarding body – an entity that has obtained the authorisation to award qualifications in accordance with the Act of 22 December 2015 on the Integrated Qualifications System (Journal Laws of 2024, item 1606);

Standard account – an account intended for an Individual User; in the case of Individual Users who are under 16 years of age, permission to set up an account must be given by a parent / legal guardian;

Professional account – an account for counsellors (‘counsellor account’), employers (‘employer account’) and awarding body representatives (‘awarding body account’); an account intended only for adults performing the roles cited above.

Competences – the ability to undertake specific actions and perform tasks using one’s own experiences, knowledge and skills;

My Portfolio [PL: Moje Portfolio] – a tool for collecting, organising and sharing evidence of knowledge, skills and social competences as well as for preparing Development Plans;

Development Plans – objectives and the actions and competences necessary to achieve them; a development plan helps the Individual User to identify and define their knowledge, skills and social competences and to plan the next steps in their professional or educational career;

Portal – the way a person accesses the services offered by My Portfolio;

Employer – a person representing a company/institution who has an ‘employer account’ in My Portfolio, with whom an Individual User can share their My Portfolio account or its selected elements;

Awarding body representative – a person representing an awarding body who has an ‘awarding body account’ in My Portfolio, with whom an Individual User can share their My Portfolio account or its selected elements;

Data processing – an operation or set of operations performed on personal data or sets of personal data, by automated or non-automated means, such as collecting, saving, organising, streamlining, storing, adapting or modifying, downloading, reviewing, using, disclosing by transmission, disseminating or other type of sharing, adjusting or combining, restricting, deleting or destroying;

Folder – a functionality of My Portfolio that allows an Individual User’s achievements (including competences and evidence thereof) to be collected and organised in one place in the form of a ‘Main Folder – Entire Portfolio’ and ‘Thematic Folders’;

Individual User – a natural person who has set up a standard account in My Portfolio in order to use the functionalities and services of the Portal, in particular to collect, organise and share evidence of their knowledge, skills and social competences, as well as to prepare their Development Plans;

Portal User (‘User’) – a person with a registered My Portfolio account.

Some of the terms appearing in this Policy are defined in the Regulations for the provision of electronic services for My Portfolio tool.

III. What kind of personal data is processed, for what purpose and on what legal basis?

My Portfolio is a digital tool that allows users to gather their educational and professional achievements in one place. It brings together the evidence of their competences, recognises and names even those skills that they may no longer remember or realise they have.

In providing My Portfolio services, the personal data is processed of natural persons who are Portal Users with a standard account or professional account. Personal data is processed to different extents and purposes and on different legal bases as set forth in the GDPR. Therefore, in order to provide the most transparent information possible, information has been grouped by the purpose of processing.

1. Registration and account maintenance 

When setting up an account on the Portal, the Individual User will be asked to provide the following personal data:

• e-mail address, password,
• age,
• first name and surname.

When setting up a professional account on the Portal, the User will be asked to provide the following personal data:

• e-mail address, password,
• age,
• first name and surname,
• name of the institution,
• type of institution (in the case of a counsellor account).

Data will be processed for:

a) registering and maintaining a standard account and a professional account,

b) authenticating the User when they log in to the Portal.

These data are processed on the basis of Article 6(1)(b) of the GDPR – the necessity of processing for the performance of a contract for the use of the services of the My Portfolio Portal. The provision of data is necessary to set up and maintain an account.

The data will be processed for this purpose until the User deletes the account or IBE PIB closes the account.

2. Registration via social networks

Logging in via Facebook

A user can register and then log in to the Portal via their Facebook account. If this option is used, the user will be redirected to the Facebook page to log in using their account details. This gives IBE PIB personal data in the form of an email address that has been entered into Facebook.

For more information on Facebook authorisation and privacy settings, please visit: http://facebook.com/privacy/center.

Logging in via Google

A user can register and then log in to the Portal using their Google account. If this option is used, the user will be redirected to their Google account to log in using their account details. This gives IBE PIB personal data in the form of an email address that has been entered into the Google account.

For more information on Google and privacy settings, please see the data protection guidelines at https://policies.google.com/privacy.

Data will be processed for:

a) registering and maintaining a user account,

b) authenticating the User when they log in to the Portal.

These data are processed on the basis of Article 6(1)(b) of the GDPR – the necessity of processing for the performance of a contract for the use of the services of the My Portfolio Portal. The provision of data is necessary to set up and maintain the account.

The data will be processed for this purpose until the User deletes the account or IBE PIB closes the account.

3. Standard account (Individual User)

An Individual User can gather personal data, information and documents in their account, the scope of which depends on the selected functionality.

Under the ‘Account settings’ tab, the Individual User has the option to modify their e-mail address, first name and surname. From this level, the Individual User can also share their account with a counsellor, employer or awarding body representative of their choice. The Individual User also has the option to add a profile picture visible in their account.

About me and contact details – under the tab ‘About me and contact details’, the Individual User voluntarily provides their personal data such as telephone number(s), e-mail address(es), image, data in the ‘about me’ fields.

Creating a Portfolio – within this functionality, the User may, either on their own or with the assistance of a counsellor, once they have shared their account with the counsellor, gather information on different areas of their life (education, work experience, courses and training workshops, life experiences and social activities, special achievements), on their competences (including social competences and knowledge of foreign languages), and add evidence of their competences (documents, such as certificates, diplomas or other works, e.g., links to multimedia materials, photos, drawings). Information relating to different areas of life, with assigned competences and evidence, is saved in the Individual User account in the form of a ‘Main Folder – Entire Portfolio’.

Creating ‘Thematic Folders’ – within this functionality, the User can group their competences and evidence (e.g., certificates, diplomas or other works, such as links to multimedia materials, photos, drawings) into separate collections (‘Thematic Folders’) for different purposes (e.g., to validate learning outcomes, to present to an employer) and then share these grouped competences and evidence (‘Thematic Folders’) with selected persons (e.g., counsellors, employers) and entities (e.g., awarding bodies) who have a My Portfolio account. The User may also share the ‘Main Folder – Entire Portfolio’ with the above-mentioned persons/entities.

Preparing Development Plans – in this functionality, the User can write down their plans, the actions to be performed to achieve them and the competences needed, and then make the Development Plan available to selected persons (e.g., counsellors, employers) and entities (e.g., awarding bodies) who have an account in My Portfolio.

CV generation – under this functionality, the Individual User can generate and store CVs. The CV document is generated by the Individual User on the basis of the data stored in the ‘Main Folder – Entire Portfolio’ or in ‘Thematic Folders’. CVs may be made available by the Individual User to selected persons (e.g., counsellors, employers) and entities (e.g., awarding bodies) who have an account in My Portfolio.

The e-mail address of the Individual User will also be processed in order to deliver system notifications, such as information on account activation.

IBE PIB stores the personal data collected through the described functionalities in order to provide its services in accordance with the Regulations, on the basis of Article 6(1)(b) of the GDPR. Provision of data is voluntary, although failure to do so may make it difficult or impossible to use selected functionalities. Personal data will be processed until they are deleted by the Individual User, but not longer than the deletion of the account.

4. Counsellor account

Under the ‘Account Settings’ tab, the counsellor can modify their e-mail address, name, name and type of institution. They also have the option to change the type of their account to either ‘employer account’ or ‘awarding body account’.

The personal data of the counsellor, in the form of the e-mail address used to register the account, first name and surname, and name of institution, will be visible in the Individual User account once that person has contacted the counsellor (by sharing their account or its selected element, i.e., ‘Main Folder – Entire Portfolio’, ‘Thematic Folder’ or ‘Development Plan’, available to the counsellor, or by sending an e-mail).

The counsellor’s e-mail address will be processed in order to deliver system notifications, e.g., information about an Individual User who has shared their account or its elements (or has stopped this sharing).

These data are processed in order to provide My Portfolio services in accordance with the Regulations, on the basis of Article 6(1)(b) of the GDPR. Personal data will be processed until they are deleted by the counsellor, but not longer than the deletion of the account.

5. Employer account

Under the ‘Account settings’ tab, an employer can modify their e-mail address, name and institution name. They also have the option to change the type of the account to either ‘counsellor account’ or ‘awarding body account’.

The personal data of the employer, in the form of the e-mail address used to register the account, first name and surname and name of the institution, will be visible in the Individual User account once that person has contacted the employer (by sharing their account or its selected element, i.e., ‘Main Folder – Entire Portfolio’, ‘Thematic Folder’ or ‘Development Plan’, with the employer, or by sending an e-mail).

The employer’s e-mail address will be processed in order to deliver system notifications, e.g., information about an Individual User who has shared their account or its elements (or has stopped this sharing).

These data are processed in order to provide our services in accordance with the Regulations, on the basis of Article 6(1)(b) of the GDPR. Personal data will be processed until they are deleted by the employer, but not longer than the deletion of the account.

6. Awarding body account

Under the ‘Account settings’ tab, the awarding body representative can modify their e-mail address, name and institution name. They also have the option to change the type of their account to either ‘counsellor account’ or ‘employer account’.

The personal data of the awarding body representative, in the form of the e-mail address used to register the account, first name and surname, and name of institution, will be visible in the Individual User account once that person has contacted the awarding body representative (by sharing their account or its selected elements, i.e., ‘Main Folder – Entire Portfolio’, ‘Thematic Folder’ or ‘Development Plan’, with the awarding body representative, or by sending an e-mail).

The awarding body representative’s e-mail address will be processed in order to deliver system notifications, e.g., information about an Individual User who has shared their account or its elements (or has stopped this sharing).

These data are processed in order to provide My Portfolio services in accordance with the Regulations, on the basis of Article 6(1)(b) of the GDPR. Personal data will be processed until they are deleted by the awarding body representative, but not longer than the deletion of the account.

7. Making an account available

As part of the services offered by My Portfolio, the Individual User can independently share their account with the personal data stored therein. In order to do so, the Individual User must enter the email address of the counsellor / employer / awarding body representative who has a professional account in My Portfolio.

Please read the information described in point 9 carefully before sharing your account.

With a view to protecting the privacy of Individual Users, the Portal ensures the voluntary nature of data provision, such as telephone number(s), e-mail address(es), image, data in the ‘about me’ fields, as well as the possibility of selecting the elements to be shared, which allows only as much personal data to be communicated to recipients as the Individual User believes is necessary to fulfil the purpose of the communication.

Sharing the account with a selected counsellor, employer or awarding body representative – under this functionality the Individual User can decide to share their account with a counsellor, employer or awarding body representative of their choice.

The Individual User can change these settings at any time and stop sharing their account with the counsellor, employer or awarding body representative. Personal data will be visible to the counsellor / employer / awarding body representative until the account settings are changed or the account is closed, whichever is sooner.

8. Sharing selected elements from My Portfolio

As part of the services offered by My Portfolio, the Individual User may independently make available selected elements of the tool in the form of the ‘Main folder – Entire Portfolio’, ‘Thematic Folders’, CVs or Development Plans. In order to share the selected My Portfolio elements, the Individual User must enter the e-mail address of the counsellor / employer / awarding body representative who has a professional account in My Portfolio.

Before making your folder available, please read the information in point 9 carefully.

With a view to protecting the privacy of Individual Users, the Portal enables selected elements of the My Portfolio tool to be shared, allowing only as much personal data to be made available to recipients as the Individual User believes is necessary to fulfil the purpose of the communication.

Sharing selected My Portfolio elements – with this functionality, the Individual User can share the ‘Main Folder – Entire Portfolio’, ‘Thematic Folders’, CV or Development Plan with a person who has a counsellor account, employer account or awarding body account.

The Individual User can change their account settings at any time and stop sharing selected My Portfolio elements with a counsellor, employer or awarding body representative. Personal data will be visible to the counsellor / employer / awarding body representative until the account settings are changed or the account is closed, whichever is sooner.

9. What happens to a User’s data when they share their My Portfolio account or its selected elements?

The Individual User shares their My Portfolio account or its selected elements within the Portal with persons having a counsellor account, employer account or awarding body account, based on their own considered and informed decision.

Please be advised that IBE PIB does not verify the identity of persons creating an account in My Portfolio, and therefore, before any personal data is transferred, the Individual User should carefully consider the risks that may be associated with such a transfer, in particular of residential address, contact details and image. Such risks could be, for example, the possibility of the User being identified by others, loss of some privacy and, in extreme cases, even identity theft.

IBE PIB has no control over the data or documents that an Individual User shares with other persons or entities through the My Portfolio tool and in particular, we have no influence on how long, where and for what purpose the data or documents will be processed. Since the role of IBE PIB is limited solely to providing the functionalities of the Portal specified in the Regulations, from the moment the User provides their personal data to the selected entity, that entity becomes the controller of these data, separate from IBE PIB, in accordance with the regulations of personal data protection. IBE PIB is responsible as a personal data controller only for the processing of Individual Users’ data within the Portal, i.e., its own activities as described in the Regulations.

10. Communication with the counsellor on the Portal

The Individual User has the opportunity to correspond with the counsellor / employer / representative of the awarding body, with the proviso that this action can only be initiated by the Individual User. In order to start the conversation, the Individual User must enter the email address of the counsellor / employer / representative of the awarding body who has a professional account in My Portfolio.

The exchange of messages within the Portal takes place after the Individual User has written the first message or after the first element has been shared.

The communication history (including personal data and information contained therein) is visible in the Individual User account for the duration of the account. The counsellor / employer / awarding body representative loses access to the communication history if the Individual User stops sharing their My Portfolio account or its selected elements with the counsellor / employer / awarding body representative or deletes the account from the Portal.

When the Individual User once again shares their My Portfolio account or its selected elements with the counsellor / employer / awarding body representative, the entire saved correspondence history is again visible to the counsellor / employer / awarding body representative.

The content of messages and information provided through this functionality is collected in order to provide the My Portfolio tool services in accordance with the Regulations, on the basis of Article 6(1)(b) of the GDPR. The personal data collected in the communication history will be processed until the message is deleted or the account is closed, whichever is sooner.

11. Communication with IBE PIB

If you address correspondence to IBE PIB via e-mail or the contact form available on the website, the personal data contained in this correspondence is processed, such as first name, surname, e-mail address and other data provided in the message sent.

Depending on the content of the sent message, the data will be processed for the following purposes:

• communication and reply, in accordance with the content of the message sent, on the basis of Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in responding to messages sent,
• establishing a relationship with persons who have expressed a wish to use the services offered on the Portal – legal basis: Article 6(1)(b) of the GDPR – necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract.

The data will be processed for the time needed to respond and then stored for the purpose of pursuing IBE PIB’s legitimate interest (e.g., for the purposes of defence in the event of complaints or enquiries).

12. Establishing, pursuing or defending legal claims

Users’ personal data will also be processed after deleting their My Portfolio account for the purpose of establishing, pursuing or defending legal claims – legal basis: Article 6(1)(f) of the GDPR – the legitimate interest pursued by the controller to protect its rights.

Please be informed that we will only keep data that are relevant for such purposes, and we will delete or anonymise the remaining data.

The data will be processed for this purpose until the expiry of the limitation period for claims specified in the provisions of the Act of 23 April 1964 – the Civil Code (6 years) or until an effective objection to the processing of data for this purpose is lodged.

13. System performance analysis

We may collect and process data collected within the Portal in order to analyse the performance of the system, implement or develop solutions/functionalities – legal basis: Article 6(1)(f) of the GDPR – legitimate interest of the controller to facilitate the use of the services provided and to improve the functionality of these services.

The data will be processed for this purpose for the duration of the account or until an effective objection to such processing is lodged.

The My Portfolio tool uses Sentry software to monitor errors and application performance. It allows these elements to be tracked in real time and all errors to be reported to the developers.

IV. To whom and in what cases does IBE PIB transfer personal data?

Under the conditions described in section III, point 9, the personal data of an Individual User will be communicated to a counsellor, employer or awarding body representative at the request of the Individual User expressed by his/her action.

Personal data collected in My Portfolio may be processed by the Portal’s main contractor, Bprog Sp. z o.o., in the event of a reported error in the operation of the Portal, to the extent necessary to eliminate this error. These data will not be passed on for any other purpose.

In other respects, personal data may only be made available to entities or authorities to which IBE PIB is authorised or obliged to disclose them in accordance with applicable law.

V. What are the rights of natural persons in relation to the processing of their personal data?

In relation to the Controller’s processing of your personal data, you have the following rights:

1. The right of access to data (Article 15 of the GDPR),

This is the right to obtain from the Controller confirmation as to whether or not personal data concerning you are being processed, and the right to obtain access to these data (including a copy thereof), and in particular to the following information:

• the purposes of the processing of your personal data,
• the categories of personal data processed,
• the recipients or categories of recipients to whom the Controller has disclosed or intends to disclose your personal data,
• the possibility of exercising your data protection rights and how to do so,
• the right to lodge a complaint with a supervisory authority,
• profiling, as well as the consequences of such processing for you.

2. The right to the rectification of your data (Article 16 of the GDPR)

This is the right to obtain from the Controller without undue delay the rectification of inaccurate personal data, and to have incomplete personal data completed.

3. The right to erasure (Article 17 of the GDPR)

This is the right to obtain from the Controller the erasure of all or some personal data concerning you without undue delay (also known as the ‘right to be forgotten’). The Controller is then obliged to erase personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected,
• the consent on which the processing is based has been withdrawn and the Controller has no other legal grounds for the processing,
• the personal data have been unlawfully processed,
• the personal data have to be erased for compliance with a legal obligation.

It is not possible to exercise the right to erasure of personal data where the Controller is obliged by law to continue to process personal data to the extent specified by the relevant law or for the purposes necessary to establish, pursue or defend legal claims.

4. The right to restrict data processing (Article 18 of the GDPR)

This is the right to obtain from the Controller the restriction of personal data processing in the following cases:

• the accuracy of the personal data processed by the Controller is contested,
• the processing of personal data is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the Controller no longer needs the personal data, but they are needed by the data subject to establish, pursue or defend legal claims;
• an objection has been lodged under Article 21(1) of the GDPR against the processing – pending the verification of whether the legitimate grounds of the Controller override those of the data subject.

Where the right to restrict the processing of personal data is exercised, the Controller may only process personal data, with the exception of storage, with the data subject’s consent or for establishing, pursuing or defending legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.

In the case of exercising the right to restrict the processing of personal data, the Controller may process personal data, except for their storage, only with the consent of the data subject or for establishing, pursuing or defending legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

5. The right to data portability (Article 20 of the GDPR)

This is the right to receive the personal data provided to the Controller in a structured, commonly used format and to request that these personal data be sent to another controller, if technically possible. This right applies if the data are processed on the basis of consent or in connection with a contract.

6. The right to object to the processing of data (Article 21 of the GDPR)

The data subject has the right to object at any time to the processing of data based on the legitimate interest of the Controller (i.e., on the basis of Article 6(1)(f) of the GDPR). In such a situation, the Controller will not be able to further process the data for these purposes unless there are compelling legitimate grounds for doing so or the data are needed by the Controller to exercise a claim.

The right to object to the processing of data does not apply if:

• the processing of personal data occurs on the basis of consent – in this situation, however, consent can be withdrawn,
• the processing is necessary for the performance of a contract to which the objector is party,
• processing is necessary for the fulfilment of a legal obligation by the Controller.

7. The right to withdraw consent (Article 7(3) of the GDPR)

In cases where the processing is based on Article 6(1)(a) of the GDPR, i.e., on the consent to the processing of personal data, the person who has given the consent has the right to withdraw that consent at any time without affecting the lawfulness of the processing conducted on the basis of consent before its withdrawal.

8. Complaint to the supervisory authority

In cases where you consider that the processing of personal data by the Controller violates the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority, i.e., the President of the Office for Personal Data Protection (www.uodo.gov.pl).

VI. How can you exercise your rights?

You can exercise your rights:

1. By contacting us via the e-mail address info.walidacja@ibe.edu.pl dedicated to the My Portfolio Portal,
2. By contacting us by telephone or in writing using the details set out in Section I,
3. By yourself using the functionalities of the Portal (change or erasure of data, deleting an account),
4. By contacting the Data Protection Officer of IBE PIB, e-mail address: iod@ibe.edu.pl.

VII. Deletion of account

A User’s account may be deleted:

1. By the User themselves through the functionalities of the Portal (‘delete account’ function);
2. At the request of the Individual User made in writing or electronically;
3. By IBE PIB in the event that the User fails to comply with the rules set forth in the Regulations.

VIII. Automated data processing

The Controller will not make decisions about you in a purely automated manner, in particular on the basis of profiling.

IX. Data transfer outside the EEA

The Controller will not transfer personal data to international organisations or outside the EEA.

X. How we use cookies

Detailed information on the extent and manner of our use of cookies is in our Cookie Policy.

XI. Changes to the Privacy Policy

In order to ensure that the Privacy Policy complies at all times with the current requirements imposed by law, the Educational Research Institute – National Research Institute reserves the right to amend it at any time.

We will inform you of any changes or additions by posting relevant information on the System’s website and, in the event of significant changes, we may additionally send separate notifications to the email address you have provided.