Data controller
The controller of your personal data is:
GS Spółka z ograniczoną odpowiedzialnością
ul. Płaszowska 25 lok. 1, 30-713 Kraków, Poland
Tax ID (NIP): 6793317716 · KRS: 0001144358 · REGON: 540426181
Trade name: Centrum Terapeutyczne Płaszowska 25
You can contact the Controller about any matter relating to the processing of personal data at gabinety@plaszowska25.pl or by phone at +48 663 433 444.
Scope of data processed
Depending on your relationship with the Controller, we may process the following categories of personal data:
Room tenants (therapists, specialists)
- first and last name, business name,
- tax ID (NIP), REGON, business address,
- contact details: email address, phone number,
- billing data (bank account number, invoicing details),
- data on the services provided (professional qualifications, only to the extent necessary).
People contacting us via a form or email
- first and last name,
- email address and/or phone number,
- content of the correspondence.
Website users
- IP address, technical data about the device and browser,
- statistical data on the use of the website (to the extent resulting from cookies).
The Centre does not process the data of patients who use the therapy services provided by room tenants. The controller of a patient’s data is the therapist running their practice in the rented room.
Purposes and legal bases of processing
Personal data is processed for the following purposes:
- Concluding and performing the room rental agreement: legal basis Art. 6(1)(b) GDPR (necessity for the performance of a contract).
- Issuing invoices and settling accounts: Art. 6(1)(c) GDPR (legal obligation under tax and accounting regulations).
- Responding to enquiries sent via the contact form, the booking enquiry form, the room viewing form or email: Art. 6(1)(f) GDPR (the Controller’s legitimate interest in handling correspondence). Messages sent through the forms on the website are delivered using the Web3Forms service (see the “Data recipients” section).
- Marketing of our own services: newsletter and email communication: Art. 6(1)(a) GDPR (consent) in conjunction with Art. 10 of the Polish Act on the Provision of Electronic Services and Art. 172 of the Polish Telecommunications Law. The newsletter is sent via Mailchimp only to people who have given their explicit and voluntary consent (sign-up form or statement). Consent can be withdrawn at any time by clicking the “Unsubscribe” link in the footer of every message or by writing to gabinety@plaszowska25.pl.
- Other marketing: Art. 6(1)(f) GDPR (the Controller’s legitimate interest), only towards people who have expressed interest in the offer.
- Establishing, pursuing or defending claims: Art. 6(1)(f) GDPR.
- Keeping statistics and improving the website: Art. 6(1)(f) GDPR and, for analytics cookies, Art. 6(1)(a) GDPR (consent).
Data retention period
Personal data is stored for the following periods:
- Tenant data: for the duration of the agreement and for the period required by law (including 5 years for accounting records under the Polish Tax Ordinance).
- Correspondence data: for as long as needed to respond, no longer than 24 months, unless further cooperation is established.
- Marketing data: until consent is withdrawn or an objection to processing is raised.
- Technical data (cookies): for the period specified in the cookie policy of the given tool, up to a maximum of 24 months.
Data recipients
Your personal data may be shared with the following categories of recipients:
- entities providing accounting, legal and advisory services to the Controller,
- providers of IT, hosting, email, booking and calendar management tools, in particular:
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): Firebase services (Firestore, Authentication, Cloud Functions, Hosting) used by the Centre’s internal booking management system (CRM), and Google Analytics 4 used to collect anonymous statistics on the use of the website (only after the User gives consent via the cookie banner). Data may be processed in Google data centres in the European Economic Area and, where necessary, in the United States of America on the basis of standard contractual clauses approved by the European Commission (Commission Implementing Decision 2021/914) and the Data Privacy Framework.
- Intuit Inc. / The Rocket Science Group LLC d/b/a Mailchimp (675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA): the Mailchimp service used to send marketing correspondence and newsletters to people who have consented to it. Data is transferred on the basis of standard contractual clauses approved by the European Commission and the Data Privacy Framework, under which Mailchimp is registered.
- Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland): the Meta Pixel tool used to measure the effectiveness of ads on Facebook and Instagram and for remarketing, activated only after the User gives consent via the cookie banner. Data (including the IP address and information about activity on the website) may be transferred to Meta Platforms, Inc. in the United States of America on the basis of standard contractual clauses approved by the European Commission and the Data Privacy Framework, under which Meta is registered.
- Web3Creative (an entity registered in India, Kerala; Udyam registration no. UDYAM-KL-10-0039115): the Web3Forms service (web3forms.com) used to handle and deliver messages sent through the forms on the website (the contact form, the booking enquiry form and the room viewing form). Web3Forms does not permanently store the content of submitted forms: it processes them and forwards them to the Controller’s email address, and server logs containing data are deleted periodically (approximately every 2 months). Data is processed on servers located in the United States of America. Web3Forms acts solely as an intermediary forwarding the form content to the Controller’s email address. The transfer of data to a third country (USA) is necessary to handle the enquiry you submitted, and therefore takes place on the basis of Art. 49(1)(b) GDPR (transfer necessary for the implementation of pre-contractual measures taken at the data subject’s request), as an occasional transfer limited to data you voluntarily provided in the form and not permanently stored by the service provider.
- payment operators (for online payments),
- public authorities entitled to request access to data under the law.
Transfers of data to third countries outside the European Economic Area as part of the Firebase, Mailchimp and Meta Pixel (USA) services take place with the safeguards required by the GDPR, on the basis of standard contractual clauses and the Data Privacy Framework. For the Web3Forms service (servers in the USA), used to deliver messages from forms, the transfer is based on the derogation in Art. 49(1)(b) GDPR, as an occasional transfer necessary to handle the enquiry submitted at your request, limited to the data provided in the form and not permanently stored by the service provider.
Rights of the data subject
You have the following rights under the GDPR:
- the right of access to your data and to obtain a copy (Art. 15 GDPR),
- the right to rectification (Art. 16 GDPR),
- the right to erasure (“the right to be forgotten”, Art. 17 GDPR),
- the right to restriction of processing (Art. 18 GDPR),
- the right to data portability (Art. 20 GDPR),
- the right to object to processing (Art. 21 GDPR),
- the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
- the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, Poland).
To exercise these rights, please contact us at gabinety@plaszowska25.pl.
Cookies and tracking technologies
The plaszowska25.pl website uses cookies, i.e. small text files stored on the user’s device.
Types of cookies used
- Necessary cookies: required for the website to work properly (including remembering your cookie consent); they do not require consent.
- Analytics cookies (Google Analytics 4): used to collect anonymous statistics on the use of the website (number of users, visit duration, popular pages). They require the user’s consent given via the cookie banner. Data collected by GA4 is pseudonymised (with IP anonymisation) and processed by Google Ireland Limited.
- Marketing cookies (Meta Pixel / Facebook): the Meta Pixel tool provided by Meta Platforms Ireland Limited is used to measure the effectiveness of advertising campaigns on Facebook and Instagram and to show ads to people who have visited the website (remarketing). They require the user’s explicit consent given via the cookie banner and are not activated without it or when “Necessary only” is selected. Meta Pixel may set cookies (including _fbp) and transfer data (including the IP address and information about activity on the website) to Meta Platforms, Inc. in the United States.
- Functional cookies: remember the user’s preferences.
You can withdraw your consent to cookies at any time by:
- clicking the “Cookie settings” link in the footer of every page of the website, which opens a panel where individual cookie categories can be switched on or off at any time (after consent is withdrawn, we delete the stored analytics and marketing cookies),
- changing the settings of your web browser (including blocking cookies completely).
Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
Data security
The Controller applies appropriate technical and organisational measures to ensure the security of the personal data processed, in particular to protect it against disclosure to unauthorised persons, loss, destruction or damage.
In particular, we use:
- encryption of the connection to the server (SSL/TLS),
- encryption of data at rest in the Firebase Firestore database (AES-256),
- multi-factor authentication for people with access to the CRM system,
- regular backups of operational data,
- access control based on the principle of least privilege.
Changes to the Privacy policy
The Controller reserves the right to amend this Privacy policy in the event of changes in the law, technology or the scope of its business. The current version of the document is always available at plaszowska25.pl/polityka-prywatnosci.
Contact
For any matters relating to the processing of personal data, please contact us:
- email: gabinety@plaszowska25.pl
- phone: +48 663 433 444
- address: GS Spółka z ograniczoną odpowiedzialnością, ul. Płaszowska 25 lok. 1, 30-713 Kraków, Poland