Privacy policy

1. The controller of the personal data collected via the normanrehabilitation.com website is Norman Łoziński, conducting a business under the name ZOZ NORMAN, registered office address: 75-393 Koszalin, ul. Pomorska 28, correspondence address: , NIP (tax identification number): 5841880692, REGON: , entered in the Central Registration and Information on Business (CEIDG), email address: kontakt@normanrehabilitacja.pl, hereinafter the “Controller”, being at the same time the Service Provider. , place of business: 75-393 Koszalin, ul. Pomorska 28, correspondence address: 75-393 Koszalin, ul. Pomorska 28, NIP: 5841880692, REGON: , email address: kontakt@normanrehabilitacja.pl, hereinafter the “Controller”.
2. The personal data collected by the Controller via the website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter the GDPR, and with the Personal Data Protection Act of 10 May 2018.

PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes personal data via the normanrehabilitation.com website for the purpose of:

1. the user making use of the contact form. The personal data is processed on the basis of Article 6(1)(f) GDPR as a legitimate interest of the Controller.
2. the user subscribing to the Newsletter for the purpose of sending commercial information by electronic means. The personal data is processed following separate consent, on the basis of Article 6(1)(a) GDPR.
3. Providing rehabilitation services;
4. Keeping internal medical records;
5. Sending important notifications regarding our terms of service and policies;
6. Running, evaluating and improving our business (including developing new products and services; refining and enhancing our services; analysing our products);
7. Surveys on the quality of our services and feedback on the service provided;
8. Keeping accounts, settling financial matters and collecting payments, as well as other internal business functions;
9. Carrying out data analysis and processing (including market and customer research, customer satisfaction surveys, trend analysis, financial analysis);
10. Protecting against fraud and other unlawful activities, claims and other liabilities, establishing, exercising and defending rights, and conducting business in accordance with our legal and regulatory obligations under applicable law;
11. Ensuring the physical security of our premises;
12. Informing you about upcoming events, updates, news and the latest products, services, solutions and other offers, where this is in line with your communication preferences;
13. Running and managing our websites.

TYPES OF PERSONAL DATA PROCESSED. The Controller processes the following categories of the user’s personal data:

1. First and last name,
2. Date of birth,
3. Address,
4. Email address,
5. Telephone number,
6. PESEL (national identification number),
7. Health-related data (including medical records).

PERIOD FOR WHICH PERSONAL DATA IS RETAINED. Users’ personal data is retained by the Controller:

1. In accordance with the applicable legal provisions on the retention of medical records;
2. When you use the website, additional information may be collected, in particular: the IP address assigned to the user’s computer or the external IP address of the internet provider, the domain name, the browser type, the access time and the operating system type.
3. Navigation data may also be collected from users, including information about the links and references they choose to click, or other actions taken on the website. The legal basis for this type of activity is the legitimate interest of the Controller (Article 6(1)(f) GDPR), which consists in making it easier to use the services provided by electronic means and in improving the functionality of those services.

Providing personal data is voluntary on the part of the user.

Personal data will also be processed in an automated manner in the form of profiling, provided that the user consents to this on the basis of Article 6(1)(a) GDPR. The consequence of profiling will be that the person concerned is assigned a profile in order to make decisions about them, or to analyse or predict their preferences, behaviours and attitudes.

The Controller takes particular care to protect the interests of the persons to whom the data relates, and in particular ensures that the data it collects is:

1. processed lawfully,
2. collected for specified, lawful purposes and not subjected to further processing incompatible with those purposes,
3. substantively correct and adequate in relation to the purposes for which it is processed, and retained in a form that allows the persons to whom it relates to be identified for no longer than is necessary to achieve the purpose of the processing.

1. Users’ personal data is passed on to the service providers used by the Controller in running the website. Depending on the contractual arrangements and circumstances, the service providers to whom the personal data is passed on either act on the Controller’s instructions as to the purposes and means of processing this data (processors) or independently determine the purposes and means of processing it (controllers).
2. Users’ personal data is stored solely within the European Economic Area (EEA).

1. The person to whom the data relates has the right to access their personal data, and the right to rectify it, erase it, restrict its processing, the right to data portability, the right to object, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

Legal bases for a user’s request:

1. Access to data – Article 15 GDPR
2. Rectification of data – Article 16 GDPR.
3. Erasure of data (the “right to be forgotten”) – Article 17 GDPR.
4. Restriction of processing – Article 18 GDPR.
5. Data portability – Article 20 GDPR.
6. Objection – Article 21 GDPR
7. Withdrawal of consent – Article 7(3) GDPR.

1. To exercise the rights referred to in point 2, you may send an appropriate email to: kontakt@normanrehabilitacja.pl.
2. Where a user exercises a right arising from the above, the Controller either fulfils the request or refuses to fulfil it without undue delay, and in any case no later than within one month of receiving it. However, if – owing to the complexity of the request or the number of requests – the Controller is unable to fulfil the request within one month, it will fulfil it within the following two months, having informed the user in advance, within one month of receiving the request, of the intended extension of the deadline and the reasons for it.
3. If it is found that the processing of personal data infringes the provisions of the GDPR, the person to whom the data relates has the right to lodge a complaint with the President of the Personal Data Protection Office.

1. The Controller’s website uses “cookies”.
2. The installation of “cookies” is necessary for the proper provision of services on the website. “Cookies” contain the information required for the website to function correctly, and they also make it possible to compile general statistics on visits to the website.
3. “Session” “cookies” are temporary files that are stored on the user’s device until they log out (leave the site).
4. The Controller uses its own cookies in order to better understand how the user interacts with the content of the site. These files collect information about how the user uses the website, the type of page from which the user was referred, and the number of visits and the duration of the user’s visit to the website. This information does not record specific personal data about the user, but is used to compile statistics on the use of the site.
5. The user has the right to decide on the access of “cookies” to their computer by selecting the relevant options in advance in their browser window. Detailed information on the options and ways of handling “cookies” is available in the settings of the software (your web browser).

1. The Controller applies technical and organisational measures ensuring protection of the personal data processed that is appropriate to the risks and to the categories of data covered by that protection, and in particular safeguards the data against being disclosed to unauthorised persons, being taken by an unauthorised person, being processed in breach of the applicable provisions, and against alteration, loss, damage or destruction.
2. The Controller provides appropriate technical measures to prevent unauthorised persons from obtaining and modifying personal data transmitted by electronic means.
3. In matters not governed by this Privacy Policy, the provisions of the GDPR and other relevant provisions of Polish law apply accordingly.