INFORMATION NOTICE – processing of personal data in connection with contact and business dealings

1. Personal data controller

The controller of your personal data is Medi Partner sp. z o. o., with its registered office at 36 Rakowiecka Street, 02-532 Warsaw

2. Data Protection Officer You can contact the Data Protection Officer via email at: iod@medipartner.pl

or in writing to the address of the controller’s registered office.

3. Purposes and legal basis for the processing of personal data

Your personal data is processed in connection with:

• to contact the Data Controller, in particular to lodge a complaint, provide feedback, make a report or ask a question,
• or as a contact person representing the Controller’s business partner or prospective business partner.

Accordingly, the Controller processes your personal data for the following purposes:

• Receiving, processing and handling complaints, feedback, reports and enquiries, including providing responses, clarifications and conducting correspondence relating to the submitted report. The legal basis for data processing is the Controller’s legitimate interest in handling reports, improving the quality of services provided and ensuring proper communication with patients and other persons contacting the Controller (Article 6(1)(f) of the GDPR).
• Ongoing contact and business cooperation, including the performance and administration of contracts entered into with the entity you represent, submitting quotations, responding to enquiries and conducting correspondence. The legal basis for the processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR).
• To defend against any potential claims or to pursue claims should a dispute arise in connection with a submission, complaint, opinion or collaboration. The legal basis for the processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR).
• Direct marketing of the Controller’s products and services in the context of a business relationship (e.g. invitations to meetings, information about offers), where the contact takes place in connection with representing a partner organisation. The legal basis is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR). You may object to the processing of your data for this purpose at any time.

4. Retention period for personal data

Your personal data will be processed:

• for the time necessary to deal with complaints, feedback, reports or enquiries and to conduct the related correspondence,
• during the term of the contract concluded between the Controller and the entity you represent,
• for the duration of the limitation period for any claims,
• until such time as an objection is lodged – in the case of data processing for direct marketing purposes.

5. Recipients of personal data

Personal data may be disclosed to service providers acting on behalf of the Controller, in particular:

• IT service providers,
• organisations that support customer service and administrative processes,
• marketing and research agencies.

These entities process data on the basis of contracts concluded with the Controller and solely in accordance with the Controller’s instructions.

6. Data source

Your personal details:

• were provided directly by you during your contact with the Controller,
• may originate from the organisation you represent,
• or from publicly available sources, including websites and social media platforms.

7 Transfers of data outside the European Economic Area

As the Controller uses the services of providers who support the implementation of processes (in particular IT tools, including cloud-based solutions), personal data may be transferred to third countries (outside the European Economic Area).

Data is transferred only where this is necessary to fulfil the specified purposes of processing and provided that an adequate level of data protection is ensured, in accordance with the provisions of the GDPR.

In the case of transfers to:

United States of America – data may be transferred to entities covered by the European Commission’s decision under the Data Privacy Framework,

other third countries – the transfer takes place on the basis of standard contractual clauses (SCCs) or other mechanisms provided for in the GDPR,

taking into account additional safeguards appropriate to the results of the risk assessment.

At the same time, the Controller verifies whether the use of specific solutions (e.g. cloud-based tools or co-managed platforms, including social media sites) involves the transfer of data outside the EEA and implements appropriate safeguards.

The data subject has the right to:

to obtain a copy of the safeguards applied in connection with the transfer of data to a third country, and to be informed of where these are made available.

8 Rights of data subjects

You have the following rights:

• the right of access to personal data,
• the right to have them rectified,
• the right to request the erasure of data,
• the right to request restriction of processing,
• the right to object to the processing of your data on grounds relating to your particular circumstances,
• the right to data portability – to the extent that the data is processed on the basis of consent or a contract and by automated means.

To exercise the above rights, please contact the Data Controller or the Data Protection Officer.

9. The right to lodge a complaint

You have the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your personal data infringes the provisions of the GDPR.