Pursuant to Article 13(1) and (2) and Article 14 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: "GDPR"), the company under the name "NZOZ Dentystka" Company with its registered office in Bielany Wrocławskie, 12 Konwaliowa Street (hereinafter also: "Company") informs that:

1. Who is the administrator of my personal data? The administrator of your personal data is NZOZ Dentystka" Company with its registered office in Bielany Wrocławskie, 12 Konwaliowa Street, contact phone: +48 692778011.
2. What are the purposes (prerequisites) of processing my personal data by the Company? Your personal data shall be processed for the following purposes: advertising, statistics, direct marketing, promotion, information on the Company's activities, as well as for the performance of a contract on the provision of services in the field of dentistry, implantology and prosthetics or aesthetic medicine, to which you are a party, or to take steps at your request, which may be necessary to conclude any contract with us, and finally for the purposes resulting from the legally justified interests pursued by the Company as a data controller - indicated further in this information. In each case of personal data processing by our Company, at least one of the above prerequisites applies. The Company does not process personal data if it cannot demonstrate the necessity of the processing for any of the above purposes.
3. Where does the Company get my personal information? We probably obtained the personal data directly from you - this is the main source of data that the Company has. Most often through your direct contact with the Company regardless of who initiated the contact.
However, it may happen that you did not provide us with your personal data - in such a case your personal data usually comes from your relatives or direct co-workers who, contacting us, for some reason decided that we should also have your personal data. Most often it is a situation when the Company has to address its actions not only directly to the person who turned to the Company, but at the request of these persons - also to or with the participation of interested third parties who do not directly contact the Company or do not initiate any contact with the Company in this regard (this refers for example to persons indicated "for information" in the address list in e-mail queries addressed to the Company, persons who are representatives or employees of our contractors). 
Often, we need the data of individuals who have not provided it to us directly in order to properly provide medical services (e.g., for dental services for children or patients requiring third-party care, at some point we will have the children's or patients’ data when their guardians contact us).
Once we have come into possession of your data in the manner described above, we may take lawful action against you for the purposes described in paragraph 2 above.
4. If the Company did not obtain my data from me, what categories of my data does the Company process? The Company most frequently processes the data of persons from whom it has not obtained them directly, with regard to: identification data (first name(s), surname(s), gender, age, PESEL number, NIP number, type and number of identity document) and contact data (contact address, e-mail address, contact telephone number). 
In the case of persons - representatives of a legal entity/authority holders of a legal entity or its employees - we also have information on the position held within the structure of such legal entity.
The extent of personal data that the Company processes depends on individual circumstances and needs and may vary; we try to take steps to minimize the need for certain categories of data.
5. What is the legal basis for Company's processing my personal data? The processing of personal data requires a legal basis. The GDPR provides for several types of such legal bases, and in the case of the Company we are dealing, in principle, with three legal bases for the processing of personal data:
   
   1. Article 6(1)(a) of the GDPR - the data subject’s consent to the processing of data - this prerequisite for the lawfulness of the processing of personal data occurs, in principle, only when we want to provide you with marketing, commercial information from the Company or trusted partners; however, we try to ensure that marketing, commercial or promotional content that we would like to provide is not addressed to people who do not wish it - hence, before our Company undertakes marketing, advertising or promotional activities, we will seek your consent to the processing of personal data for the above permitted purposes;
   2. Article 6(1)(b) of the GDPR - necessity to perform a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract - this prerequisite for the lawfulness of the processing of personal data by the Company will occur relatively frequently - in a situation where we conclude a contract with you concerning the provision of medical services by our Clinics or we will undertake, at your request, preparatory steps for the conclusion of such a contract;
   3. Article 6(1)(f) GDPR - legitimate interest pursued by the data controller - this rationale will occur just as often. It applies where the processing of personal data is justified by our legitimate needs.
6. What is the legitimate interest pursued by the controller? The legitimate interest of the controller is the marketing of the Company's own products and the need to realize the core business of the Company, which is the operation of dental and aesthetic medicine clinics. For this purpose, we process your data in order to:
   1. contact you, including in connection with permitted marketing activities, in particular, and with your consent, by e-mail and telephone;
   2. handle your requests, speeches, inquiries, etc. communicated in particular to the staff at the reception desk of our clinics or via the contact form in situations where they are not directly related to the performance of any contract concluded with the Company;
   3. be able to organize loyalty programs, competitions and promotional activities in which you may take part;
   4. be able to improve our services and products to meet the needs and convenience of current and future patients;
   5. pursue claims, including debt collection; litigation, arbitration and mediation; or to defend against claims;
   6. be able to conduct statistical analysis;
   7. store data for archiving purposes, and ensure accountability (i.e., demonstrate that the Company is meeting its obligations under the law);
   8. in addition, we may be required by law to process your information for tax, accounting, reporting and billing purposes to public funders of medical services.
7. To whom may the Company lawfully share my personal data? Your personal data, depending on the specific need justified by the legal or factual relationship between us, may be shared with: (1) direct marketing, legal and accounting advisors of the Company - for the purposes related to the preparation of the terms and conditions of the offer to use the services or purchase the product or products of the Company and for their legal and formal assessment; (2) audit companies - for the purposes related to the audit of the annual reports on the activities of the Company; (3) IT company, operating (servicing) the Company's ICT system; (4) to the operator of the CRM system used by our clinic; (5) to selected state institutions and professional organizations in accordance with the applicable Polish legislation; (6) to banks or institutions that finance medical services provided at our clinic, including the locally competent branches of the National Health Fund (NFZ), insurance companies, other payers; (7) our subcontractors in the provision of medical services on the basis of signed contracts for entrusting the processing of personal data; (8) our other medical facilities or cooperating facilities, including the staff of these facilities in order to ensure adequate quality, continuity and comprehensiveness of health care; (9) companies servicing the medical equipment used by the Company in accordance with signed contracts for entrusting the processing of personal data and to the extent necessary for these companies to perform their services; (10) your direct advisors (legal, accounting, medical, etc.) or other persons - at your express request; (11) other, not mentioned above, persons and entities - in cases provided by law.
The above catalog and list is an example and in a particular situation your data will be transferred only to selected recipients and according to a justified need.
8. Will the Company transfer my personal data to a third country (i.e., outside the EEA) or to an international organization? Your personal data will not be transferred to a third country/international organization without your consent, however, it is possible that your data will be transferred to a third country in a situation where the administrator of the e-mail you use to contact the Company (our clinic) uses servers physically located outside the EEA.
9. For how long will the Company keep my personal data? Your personal data will be stored until there is a basis for its processing - that is, in the case of granting your consent - until its withdrawal, restriction or other actions on your part limiting your consent; in the case of the indispensability of the data for the performance of a contract - for the duration of its performance and the time necessary for the parties to realize claims arising therefrom; and in the case where the basis for data processing is a legitimate interest of the controller - until the existence of that legitimate interest (i.e., until the date on which further processing of your personal data proves unjustified in view of the purpose it was supposed to serve).
10. What rights do I have in relation to the processing of my personal data by the Company? In relation to the processing of your personal data by the Company, you have the following rights:
    the right to withdraw at any time your consent to the processing of personal data, if the processing of your data by the Company is carried out on that basis - without affecting the legality of the existing processing performed on the basis of consent before its withdrawal, pursuant to Article 13(2)(c) of the GDPR,
    1. the right of access to the content of your data, pursuant to Article 15 GDPR,
    2. the right to rectify your data, pursuant to Article 16 GDPR,
    3. the right to erasure of your data, pursuant to Article 17 GDPR (this right may not be in conflict with any legal acts in force in Poland),
    4. the right to restrict the processing of your data, pursuant to Article 18 GDPR,
    5. the right to object to the processing of data, pursuant to Article 21 GDPR; the right to object - at any time, free of charge - to the processing of personal data - applies in particular to the situation in which your data are processed for the purposes of direct marketing,
    6. the right to data portability, pursuant to Article 20 GDPR,
    7. if you believe that the processing of your personal data violates the provisions of GDPR, you also have the right to lodge a complaint to the President of the Office for Personal Data Protection.
11. Do I have to provide the Company with my personal data? Providing the necessary personal data by you is voluntary, however, it is a condition for the Company to realize the purpose referred to in point. 2 above. Providing the data is voluntary, however, the consequence of failing to provide the data is the Company's inability to perform the activities referred to in section 2 above.
The voluntary nature of the provision of personal data applies in particular to so-called sensitive data (medical data), which are necessary for us to properly provide medical services. If you do not agree to provide us with this kind of data, it will make it difficult or even impossible for us to tailor and perform our services in accordance with your individual expectations.
12. Will the Company make automated decisions about me or conduct automated profiling (e.g. using algorithms)? The Company does not conduct automated decision-making or automatic profiling of personal data. The processing of your data will be carried out both manually and using a teleinformatic system.
13. Does the Company have specific procedures in place to protect my personal information? At the Company, we attach exceptional importance to the protection of the personal data we have acquired. To this end, we have implemented a Personal Data Protection Policy in our business in accordance with the requirements of GDPR, compliance with which ensures the protection of personal data entrusted to us from unauthorized processing. Conducting in accordance with the introduced Personal Data Protection Policy is one of our top priorities.