Information Clause of Danucer Spa
As part of the Privacy Policy conducted by DANUCERA sp. z o.o. and in connection with the implementation of the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("GDPR"), we inform you about the principles of processing your personal data and your rights.
Contact details
1. The administrator of your personal data is DANUCERA sp. z o.o. with its registered office in Warsaw at ul. Górnośląska 16 lok. 33, 00-432 Warsaw, entered into the National Court Register under KRS number 0001097617 (hereinafter: "Administrator").
2. The Administrator has appointed a Data Protection Officer (DPO): Anika Karpińska. The Inspector can be contacted in all matters concerning the processing of personal data and the exercise of rights related to the processing of personal data at the e-mail address: kontakt@danucera.pl or by sending correspondence to the address of our company's registered office:
DANUCERA sp. z o.o., Data Protection Officer (DPO)
Górnośląska 16 lok. 33, 00-432 Warszawa
Purposes of personal data processing
3. Your personal data is processed for the purposes indicated below:
a) for purposes related to the conclusion and proper performance of the contract, which constitutes the basis for booking a visit and performing DANUCERA SPA services, including booking (e.g., via Booksy, by phone, or in person) and organizational contact regarding the visit;
b) for the purpose of fulfilling the obligations incumbent on the Personal Data Administrator arising from legal provisions, including, among others, tax settlements, submitting to inspections conducted by public entities (e.g., inspections conducted by tax authorities, inspections by the National Labor Inspectorate);
c) in connection with the pursuit of the legally justified objectives of the Personal Data Administrator, which include, among others: pursuing civil law claims and defending against such claims;
d) for the purpose of performing and maintaining "before/after" treatment photographic documentation (recording treatment effects, evaluating results, ensuring the quality of the service provided, and possible handling of complaints);
e) for the purpose of ensuring the safety of people in the premises and protecting property (video monitoring), with the monitoring covering only publicly accessible areas and not including rooms such as toilets, changing rooms, or treatment rooms, and not recording sound.
4. If, in connection with DANUCERA SPA services, you provide us with information about contraindications to the treatment or other health data (e.g., in a questionnaire), these data will be processed solely for the purpose of qualifying for the treatment and ensuring its safe performance. We process these data based on your explicit consent, granted separately (e.g., in a questionnaire).
5. If you give your consent, the Administrator may process your image (photos/recordings) for marketing purposes, in particular by publishing it on the Administrator's website and on social media. We process these data based on your consent, granted separately. You can withdraw your consent at any time, without affecting the legality of processing performed before its withdrawal.
Personal data retention period
6. Your data will be stored in accordance with applicable law for no longer than necessary for the purposes for which these data are processed, namely:
a) for data collected for purposes related to the conclusion and proper performance of the contract regarding booking and performing DANUCERA SPA services – for the period necessary to perform the service, and then no longer than required by law from the date of completion of the service, and for the period necessary to establish, pursue, or defend claims;
b) for data collected for the purpose of fulfilling the obligations incumbent on the Personal Data Administrator arising from legal provisions, in particular: making tax settlements and maintaining accounting documentation;
c) for data collected in connection with the pursuit of the legally justified objectives of the Personal Data Administrator, in particular: potential pursuit of civil law claims and defense against such claims, handling complaints;
d) for data processed for the purpose of performing and maintaining "before/after" treatment photographic documentation – for the period necessary for the purposes indicated in point 3 lit. d, and then for the period necessary to establish, pursue, or defend claims;
e) for data processed as part of video monitoring – as a rule, for a period of up to 30 days, unless the recording constitutes evidence in proceedings or the Administrator has learned that it may constitute evidence (then until the final conclusion of the proceedings);
f) for health data processed based on explicit consent – until consent is withdrawn, but no longer than necessary for the purpose indicated in point 4, and then no longer than required by law from the date of completion of the service, and for the period necessary to establish, pursue, or defend claims;
g) for data processed based on consent for marketing purposes (image) – until consent is withdrawn or the material is removed, but no longer than necessary for the purpose for which consent was given.
Legal basis for processing personal data
7. The legal basis for processing your personal data is:
a) Art. 6 sec. 1 lit. a GDPR – to the extent of your expressed consent to the processing of personal data for one or more specified purposes (if such consent is obtained);
b) Art. 6 sec. 1 lit. b GDPR – to the extent of point 3 lit. a of the clause, among others, in the case of the necessity to perform a contract to which the data subject is a party, or to take action at the request of the data subject before concluding a contract (e.g., booking a visit and performing a service at DANUCERA SPA);
c) Art. 6 sec. 1 lit. c GDPR – to the extent of point 3 lit. b of the clause, among others, in the case of the necessity to fulfill legal obligations incumbent on the Personal Data Administrator, arising from Union law or Polish law (e.g., tax and accounting obligations);
d) Art. 6 sec. 1 lit. f GDPR – to the extent of point 3 lit. c of the clause, among others, in the case of the necessity to process your personal data for purposes resulting from the legitimate interests pursued by the Personal Data Administrator, i.e., pursuing, establishing, and defending against claims, handling complaints;
e) Art. 6 sec. 1 lit. b GDPR or Art. 6 sec. 1 lit. f GDPR – to the extent of point 3 lit. d of the clause, i.e., performing and maintaining "before/after" treatment photographic documentation (depending on the scope and purpose of the documentation – performance of the contract and the Administrator's legitimate interest in ensuring the quality of services and the ability to prove the correct performance of the service);
f) Art. 6 sec. 1 lit. f GDPR – to the extent of point 3 lit. e, i.e., video monitoring – the Administrator's legitimate interest in ensuring the safety of persons and protecting property;
g) Art. 9 sec. 2 lit. a GDPR – to the extent of point 4, i.e., health data – based on your explicit consent.
h) Art. 6 sec. 1 lit. a GDPR – to the extent of point 5, i.e., processing of image for marketing purposes – based on your consent.
8. Providing data is:
a) voluntary, but necessary to make a reservation and conclude and perform a contract, which constitutes the basis for the performance of DANUCERA SPA services;
b) voluntary in the case of health data, however, failure to provide them may make it impossible or limit the performance of the treatment for safety reasons.
c) in the case of video monitoring – data is obtained automatically in connection with being in the monitored area.
Transfer of personal data
9. The Personal Data Administrator does not intend to transfer your personal data to another recipient with the following exceptions:
a) entities providing services to the Personal Data Administrator, such as: IT, accounting, hosting, electronic payment processing, and settlements;
b) Booksy – provider of the visit reservation system, to the extent necessary for handling reservations and communication related to the visit;
c) legal advisors, attorneys, trainee legal advisors, and trainee attorneys cooperating with the Personal Data Administrator.
Rights
10. Based on and subject to the limitations resulting from Art. 15-22 GDPR, you have the right to:
a) access your data and receive a copy thereof;
b) rectification (correction) of your personal data;
c) restriction of personal data processing;
d) erasure of personal data;
e) data portability;
f) object to processing.
You can exercise these rights at the registered office of the Personal Data Administrator, by correspondence, via electronic communication, or by phone.
11. If you learn that your personal data is being processed unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office. The complaint is free of charge.
12. DANUCERA sp. z o.o. maintains a privacy policy described at the link: https://danucera.pl/pages/polityka-prywatnosci