Information Clause of Danucera Spa
Privacy Information Clause for DANUCERA SPA Clients
As part of the Privacy Policy implemented by DANUCERA sp. z o.o. and in connection with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), we inform you about the principles governing the processing of your personal data and your rights.
Contact Details
-
The controller of your personal data is DANUCERA sp. z o.o., with its registered office in Warsaw at ul. Górnośląska 16 lok. 33, 00-432 Warsaw, entered in the National Court Register under KRS number 0001097617 (hereinafter: the “Controller”).
-
The Controller has appointed a Data Protection Officer (DPO): Anika Karpińska. The DPO may be contacted regarding all matters relating to the processing of personal data and the exercise of rights related to such processing at kontakt@danucera.pl or by sending correspondence to the registered office of our company:
DANUCERA sp. z o.o., Data Protection Officer (DPO)
Górnośląska 16 lok. 33, 00-432 Warsaw
Purposes of Personal Data Processing
Your personal data is processed for the purposes indicated below:
a) for purposes related to entering into and properly performing the agreement constituting the basis for booking an appointment and providing DANUCERA SPA services, including processing reservations (e.g. via Booksy, by telephone or in person) and organisational communication regarding the appointment;
b) for the purpose of fulfilling the legal obligations incumbent on the Controller, including, in particular, tax settlements and inspections carried out by public authorities (e.g. inspections conducted by tax authorities or the National Labour Inspectorate);
c) in connection with the pursuit of the Controller’s legitimate interests, including the pursuit of civil claims and defence against such claims;
d) for the purpose of taking and maintaining “before/after” photographic documentation of treatments (recording treatment results, assessing outcomes, ensuring the quality of the service provided and, where applicable, handling complaints);
e) for the purpose of ensuring the safety of persons present on the premises and protecting property (video surveillance), whereby surveillance covers only publicly accessible areas and does not cover rooms such as toilets, changing rooms or treatment rooms, and does not record audio.
If, in connection with DANUCERA SPA services, you provide us with information about contraindications to a treatment or other health-related data (e.g. in a questionnaire), such data will be processed solely for the purpose of qualifying you for the treatment and ensuring its safe performance. Such data is processed on the basis of your explicit consent, provided separately (e.g. in a questionnaire).
If you give your consent, the Controller may process your image (photographs/recordings) for marketing purposes, in particular by publishing it on the Controller’s website and social media. Such data is processed on the basis of your consent, provided separately. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal of consent.
Retention Period for Personal Data
Your data will be stored in accordance with applicable law for no longer than necessary for the purposes for which it is processed, namely:
a) for data collected for purposes related to entering into and properly performing the agreement concerning the booking and provision of DANUCERA SPA services – for the period necessary to provide the service, and thereafter no longer than required by law from the date of completion of the service, as well as for the period necessary to establish, pursue or defend claims;
b) for data collected for the purpose of fulfilling the Controller’s legal obligations, in particular for tax settlements and maintaining accounting records;
c) for data collected in connection with the pursuit of the Controller’s legitimate interests, in particular the possible pursuit of civil claims and defence against such claims, and the handling of complaints;
d) for data processed for the purpose of creating and maintaining “before/after” photographic documentation of treatments – for the period necessary to fulfil this purpose, and thereafter for the period necessary to establish, pursue or defend claims;
e) for data processed as part of video surveillance – as a rule, for a period of up to 30 days, unless the recording constitutes evidence in proceedings or the Controller becomes aware that it may constitute such evidence (in which case, until the proceedings have been finally concluded);
f) for health data processed on the basis of explicit consent – until the consent is withdrawn, but no longer than necessary to fulfil the purpose, and thereafter no longer than required by law from the date of completion of the service, as well as for the period necessary to establish, pursue or defend claims;
g) for data processed on the basis of consent for marketing purposes (image) – until consent is withdrawn or the material is removed, but no longer than necessary for the purpose for which consent was given.
Legal Bases for Processing Personal Data
The legal bases for processing your personal data are:
a) Article 6(1)(a) GDPR – with regard to your consent to the processing of personal data for one or more specified purposes (where such consent is obtained);
b) Article 6(1)(b) GDPR – with regard to the purpose specified in point a) of the “Purposes of Personal Data Processing” section, including where it is necessary to perform a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract (e.g. booking an appointment and providing a service at DANUCERA SPA);
c) Article 6(1)(c) GDPR – with regard to the purpose specified in point b) of the “Purposes of Personal Data Processing” section, including where it is necessary to comply with legal obligations imposed on the Controller under EU or Polish law (e.g. tax and accounting obligations);
d) Article 6(1)(f) GDPR – with regard to the purpose specified in point c) of the “Purposes of Personal Data Processing” section, including where it is necessary to process your personal data for purposes arising from the legitimate interests pursued by the Controller, i.e. pursuing, establishing and defending against claims, and handling complaints;
e) Article 6(1)(b) GDPR or Article 6(1)(f) GDPR – with regard to the purpose specified in point d) of the “Purposes of Personal Data Processing” section, i.e. creating and maintaining “before/after” photographic documentation of treatments (depending on the scope and purpose of the documentation – performance of the contract and the Controller’s legitimate interest in ensuring service quality and being able to demonstrate that the service was properly performed);
f) Article 6(1)(f) GDPR – with regard to the purpose specified in point e) of the “Purposes of Personal Data Processing” section, i.e. video surveillance – the Controller’s legitimate interest in ensuring the safety of persons and protecting property;
g) Article 9(2)(a) GDPR – with regard to the processing of health data referred to in the “Purposes of Personal Data Processing” section on the basis of your explicit consent;
h) Article 6(1)(a) GDPR – with regard to the processing of your image for marketing purposes, as referred to in the “Purposes of Personal Data Processing” section, on the basis of your consent.
Provision of Data
Providing your data is:
a) voluntary, but necessary to make a reservation and to enter into and perform the agreement constituting the basis for the provision of DANUCERA SPA services;
b) voluntary in the case of health data; however, failure to provide such data may make it impossible or limit the performance of a treatment for safety reasons;
c) in the case of video surveillance – data is collected automatically in connection with being present in an area covered by surveillance.
Transfer of Personal Data
The Controller does not intend to transfer your personal data to other recipients, with the following exceptions:
a) entities providing services to the Controller, including IT, accounting, hosting, electronic payment processing and settlement services;
b) Booksy – the provider of the appointment booking system, to the extent necessary to process reservations and communication related to appointments;
c) legal advisers, attorneys-at-law, advocates and trainee legal advisers and advocates cooperating with the Controller;
d) social media service operators (including Meta Platforms Ireland Ltd.) exclusively where your image is published with your consent; they act as separate controllers with regard to their own services;
e) authorised public authorities – exclusively where the obligation to disclose data results from applicable law.
Transfer of Data to Third Countries
As a rule, your data is processed within the European Economic Area (EEA). If your image is published on social media (on the basis of your consent), the data may be transferred to third countries, including the United States. Such transfer is carried out on the basis of an implementing decision of the European Commission recognising an adequate level of data protection (the EU-US Data Privacy Framework), and, where it does not apply, on the basis of Standard Contractual Clauses (SCCs), with appropriate safeguards in accordance with Article 46 GDPR.
Rights
Subject to the limitations arising from Articles 15–22 GDPR, you have the right to:
a) access your data and receive a copy thereof;
b) rectify (correct) your personal data;
c) restrict the processing of your personal data;
d) erase your personal data;
e) data portability;
f) object to the processing of your data;
g) withdraw your consent at any time – with regard to data processed on the basis of consent (health data and image), whereby withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
You may exercise these rights at the registered office of the Controller, by correspondence, by electronic means of communication or by telephone.
If you become aware that your personal data is being processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO). The complaint is free of charge.
DANUCERA sp. z o.o. maintains a Privacy Policy available at: