Rules for using computer workstations and electronic resources in the Wroclaw University Library

I. Types of computer workstations

1. Library's users may use the following types of computer workstations available in the Library:

1. terminals providing access to WUL's catalogs, located in the halls on all levels of the building;

2. computers with Internet access and basic software, enabling work on personal files, as well as access to electronic resources — available in reading rooms, Free Access areas, individual work cabins, group work rooms, and in the Informatory;

3. computer workstations equipped with accessibility-enhancing solutions – located in reading rooms, Free Access areas, and in the Informatory.

II. Logging in the WUL's computer workstations

1. Individual login is required for computer workstations that provide access to the Internet, allow work on user files, or enable the use of licensed databases or other services requiring user identification.

2. Terminals intended exclusively for browsing publicly accessible library catalogs are available without individual login, provided that such login is not required for technical or security reasons.

3. The user is required to log out after finishing work at a workstation that requires logging in.

4. Students, PhD students, and employees of the University of Wrocław log in using the university domain (uwr.edu.pl) – the same way as to the to electronic mail.

5. Other Library users are required to create an account that allows them to log in to the computer workstations. Accounts can be created in the user servicing departments.

6. To create an individual access account for a user from outside of the University of Wrocław, the following data are processed:

1. first name and surname – if necessary to connect the account to the user;

2. library card number or other unique user identifier;

3. email address – for account activation, account-related communication, and access recovery;

4. mobile phone number required to ensure account security.

7. The account is valid for the duration of the library card's validity. Upon the first login, the system requires the user to change their password.

8. Upon the expiration of the library card, the user is required to create a new account.

III. Rules for using computer workstations

1. The computer workstations are intended for individual usage for purposes related to research, teaching, or the user's own work.

2. Access to computer workstations is provided for:

1. employees, PhD students, and students of the University of Wrocław with an active library account;

2. users from outside of the University of Wrocław – after obtaining consent from librarian and on basis of an active library account;

3. Users from outside of the University of Wrocław may use computer workstations to access the Internet and open-access resources. Access to licensed resources is subjected to restrictions arising from the license terms applicable at the University of Wrocław.

4. Computer workstations may be used during the Library's opening hours. Sessions must be ended 10 minutes before the Library closes.

5. The User is obliged to:

1. maintain the confidentiality of access credentials;

2. log out after finishing work;

3. do not leave an active session unattended;

4. do not leave files, documents, or personal data at the workstation after finishing work;

5. immediately report to the librarian on duty any suspicion of account takeover, password disclosure, unauthorized access, or workstation malfunction;

6. refrain from using the workstation if data or an active session belonging to a previous user is detected, and immediately inform a Library staff member about the fact.

6. The user is responsible for actions performed using their account.

7. Computer workstations are not intended for the permanent storage of user's files. Users may save files to their own suitably secured storage media or to an electronic data storage service of their choice, while adhering to security practices appropriate for the type of information. The Library deletes files saved on the computers.

8. It is prohibited to:

1. taking actions that cause damage to computer hardware or software;

2. interfering with the system configuration or security measures;

3. using resources in a manner that is unlawful or infringes upon the rights of third parties;

4. sending unwanted information (spam);

5. taking actions that could disrupt the functioning of the network;

6. using computers for commercial purposes or in a manner that infringes copyright laws.

9. The librarian may interrupt a user's session if it is necessary for:

1. cessation of an ongoing violation of these Rules;

2. protection of personal data or protected information;

3. ensuring the security of the system or network;

4. preventing damage to hardware or software;

5. mitigation of the effects of an incident.

10. In the event of a serious or repeated violation of the Rules, the user's access to computer workstations or electronic services may be temporarily restricted.

11. The decision to restrict access for a period longer than the current session is made by the WUL's Director or a person authorized by them.

12. The user is informed of the reason, scope, and duration of the restriction, as well as the possibility of raising objections with the Director of BUWr.

13. The incident may be documented solely to the extent necessary to establish the course of events, ensure safety, apply an order-maintenance measures, and pursue or defend against claims.

14. The library does not guarantee continuous access to computer workstations due to possible technical or maintenance interruptions.

IV. Usage of personal electronic devices

1. Users may use their own devices in a manner that does not interfere with the Library's technical infrastructure.

2. It is prohibited to use the Library's network for activities that violate the law or the principles of social coexistence.

3. The library is not liable for damage to users' equipment.

V. Electronic resources

1. Access to subscribed electronic resources is intended for employees, PhD students, and students of the University of Wrocław.

2. Use of e-resources is subject to license terms and the regulations at the University of Wrocław.

3. It is permitted to:

1. search resources;

2. make single copies for scientific and educational purposes;

3. create custom material collections.

4. It is prohibited to:

1. mass data downloading;

2. use data for commercial purposes;

3. violate license terms;

4. share materials with unauthorized persons.

VI. Personal Data Protection (GDPR)

1. Administrator
   The administrator of personal data processed in connection with the use of computer workstations, terminals, and electronic databases is the University of Wrocław, with its registered office at Uniwersytecki 1 Sqr., 50-137 Wroclaw.

2. Personal Data Protection Supervisor
   The Administrator has appointed a Data Protection Supervisor, who can be contacted at the following e-mail address: IOD[w]uwr.edu.pl.

3. Processed data categories
   Depending on the type of user, the workstation used, and the scope of the service, the following data may be processed:

1. identification data, in particular first name and surname;

2. library card number or other unique user identifier;

3. UoW account identifier or technical account identifier;

4. information regarding active library access privileges;

5. email address;

6. phone number – only if necessary to ensure account security;

7. computer workstation identifier;

8. IP address;

9. session start and end date and time;

10. information about successful and unsuccessful login attempts;

11. information on the type of service or resource made available;

12. system security-related incidents;

13. information regarding the restriction of access, if such a measure has been applied in accordance with these Rules.

4. Purposes of processing
   The data is processed for the purpose of:

1. User identification and authentication;

2. Verification of his qualifications;

3. Creating, activation, management, and security of the access account;

4. Providing access to computer workstations and electronic resources;

5. Ensuring access to resources in accordance with license terms;

6. Ensuring the security of users, data, systems, networks, and infrastructure;

7. Counter violations of these Rules;

8. Compiling statistics in aggregated or anonymized forms;

9. Establishing, pursuing, or defending claims, should the need arise.

5. Legal basis
   The legal basis for data processing in order to provide access to computer stations and electronic library resources is Article 6(1)(e) of the GDPR, i.e. the necessity of processing for the performance of a task carried out in the public interest, in particular in connection with:

1. Article 11(1)(9) and Article 49(2) of the Act – Law on Higher Education and Science;

2. Article 4 of the Act on Libraries;

3. § 148 of the Statute of the University of Wrocław;

4. Rules of library's materials circulation in the library and information system of the University of Wrocław;

5. To the extent that the logging of events is necessary for the administrator to fulfill obligations related to ensuring the security of processing, the legal basis may also be Article 6(1)(c) of the GDPR in conjunction with Articles 24 and 32 of the GDPR.

6. Data source
   Data can be:

1. Provided directly by the user.

2. Obtained from the UoW's library system.

3. Obtained from the university's identity and access management system.

4. Automatically generated during login and use of the infrastructure or electronic resources.

7. Data recipients
   Access to the data may be obtained by:

1. authorized employees of the University of Wrocław;

2. University units responsible for the maintenance and security of IT infrastructure;

3. entities providing system maintenance, servicing, hosting, technical support, or cybersecurity services to the University – pursuant to an appropriate agreement;

4. providers of library systems and authentication services;

5. providers of licensed electronic resources – to the extent necessary to ensure access and compliance with license terms;

6. entities authorized to obtain data under the provisions of law.

8. Retention period

1. Data necessary for account management is stored for the duration of the account's activity and, following its deactivation, until all obligations have been settled and matters related to the use of the services have been concluded.

2. Standard authentication and session logs are stored for a period of 12 months from the date the incident was recorded, provided that logs extracted in connection with an incident, a violation of usage rules, an explanatory proceeding, proceedings conducted by a competent authority, or the pursuit or defense of claims may be retained for a longer period necessary to fulfill those purposes. Information regarding the temporary restriction of access is retained for the duration of the restriction and for 12 months after its termination if necessary to address user objections, demonstrate the propriety of the measure applied, or protect the University’s legitimate interests. Upon the expiry of the applicable period, the data are deleted or anonymized, unless continued retention is required by records management or archival regulations or by an obligation to preserve evidence concerning a specific incident.

9. Person's rights
   The data subject has the right—under the terms set out in the GDPR—to:

1. right of access to data and to obtain a copy of it;

2. right to rectification of data;

3. the right to request the deletion of data if the grounds specified in Article 17 of the GDPR apply;

4. right to restriction of processing;

5. the right to object to processing based on Article 6(1)(e) of the GDPR, on grounds relating to the person's particular situation.

10. Complaint to the supervisory authority
    A person has the right to lodge a complaint with the President of the Personal Data Protection Office if they believe that their data is being processed in violation of the regulations.

11. Obligation to provide data

1. Providing the data marked as mandatory is a condition for creating an individual account and using workstations or services that require authentication. Failure to provide this data will make it impossible to create an account or use a service requiring identification.

2. Data that is not necessary for authentication or ensuring security is provided voluntarily.

12. Automated decision-making and profiling

1. The data are not used to make decisions concerning the user based solely on automated processing that would produce legal effects or similarly significantly affect the user. Users are not subject to profiling.

2. Automatic lockout following a specified number of failed login attempts — used solely as a technical safeguard and subject to verification — should be described separately if implemented.

13. Access to full information
    Full information regarding the processing of personal data is available on the WUL's website and in the the user servicing departments. This information is provided to the user prior to account creation and the commencement of data processing.

VII. Final provisions

1. The rules enter into force on 1.10.2026.

2. In matters not covered herein, the Library's rules and the regulations of the University of Wrocław apply.

3. The library reserves the right to make changes resulting from technical, legal, or licensing conditions.