Basic information on the processing of personal data (PALM STUDIO x Invimed)

Basic information on the processing of personal data

Data controllerMedi Partner Sp. z o.o., 36 Rakowiecka Street, 02-532 Warsaw

Data Protection Officer: The Controller has appointed a Data Protection Officer, who can be contacted via email at iod@medipartner.pl or by post at the company’s address.

The purposes of processing your personal data and the legal basis for such processing

If you register to take part in the promotional campaign, your personal data will be processed for the following purposes:

• receipt and processing of the application,
• verification of compliance with the conditions of participation set out in the terms and conditions of the promotional campaign,
• to contact you regarding matters relating to your participation in the promotional campaign,
• the exercise of the rights and fulfilment of the obligations arising from the terms and conditions of the promotional campaign
• investigating or defending against claims, handling complaints or feedback

The legal basis for the processing of your personal data is Article 6(1)(b) of the GDPR, i.e. the necessity of processing for the performance of a contract to which you become a party by entering a promotional campaign in accordance with its terms and conditions, or to take steps at your request prior to entering into such a contract. In the case of asserting or defending claims, or handling complaints or feedback, the legal basis is Article 6(1)(f) of the GDPR.

The retention period for your personal data

Personal data will be retained for the period necessary to carry out and settle the promotional campaign, and subsequently for the period necessary to pursue or defend against any potential claims relating to participation in the promotional campaign (up to 6 years), as well as for the period required by law, should such laws impose an obligation to retain the data further.

Your rights regarding the processing of personal data

You have the following rights in relation to the processing of your personal data:

• The right of access to your personal data,
• The right to request the rectification of your personal data,
• The right to request the deletion of your personal data,
• The right to request the restriction of the processing of your personal data,
• the right to data portability.

As the legal basis for the processing is Article 6(1)(b) of the GDPR, there is no right to withdraw consent, as the data is not processed on the basis of consent. However, you may terminate the contract at any time by opting out of the promotion.

Transfer of data to third countries

As we use the services of suppliers who support our business processes (in particular IT tools, including cloud-based solutions), personal data may be transferred to third countries (outside the European Economic Area). Data transfers take place only where necessary to fulfil the specified processing purposes and with an adequate level of data protection ensured, in accordance with the provisions of the GDPR. In the case of transfers to:

– the United States of America – data may be transferred to entities covered by the European Commission’s decision under the Data Privacy Framework,

– other third countries – the transfer takes place on the basis of standard contractual clauses (SCCs) or other mechanisms provided for in the GDPR, taking into account additional safeguards appropriate to the results of the risk assessment.

At the same time, we are checking whether the use of certain solutions (e.g. cloud-based tools or co-managed platforms, including social media sites) involves the transfer of data outside the EEA and whether appropriate safeguards are in place.

The data subject has the right to obtain a copy of the safeguards applied in connection with the transfer of data to a third country, and to be informed of where these safeguards are made available.

Providing your personal data is voluntary

The provision of personal data is voluntary, but is necessary to register and take part in the promotional campaign. Failure to provide such data will prevent your registration from being accepted and will prevent you from exercising the rights and fulfilling the obligations set out in the terms and conditions of the promotional campaign.