Privacy policy

1. General information

1. This policy applies to the Website operating at the following URL: dermapure.pl
2. The Operator of the Website and the Controller of personal data is: Dermapure Krzysztof Pikuła Monika Nowacka spółka cywilna (a civil-law partnership), Grzybowska 3/U7, 00-132 Warsaw
3. The Operator’s contact e-mail address: KONTAKT@DERMAPURE.COM.PL. For matters concerning personal data, you can contact the Controller by e-mail at this address or by post at the address given in point 1.2.
4. The Operator is the Controller of your personal data that you provide through the form on the Website, by e-mail or by phone, and of the data collected on the Website using cookies and similar technologies.
5. The Website uses personal data for the following purposes:
   • Handling enquiries sent through the form, by e-mail or by phone, including booking appointments. The legal basis for processing is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and, where the message does not concern the Controller’s services, the Controller’s legitimate interest in replying to correspondence addressed to it (Article 6(1)(f) GDPR).
   • Presenting our services or information and ensuring the operation and security of the Website, including protecting the form against spam. The legal basis is the Controller’s legitimate interest in running and protecting its website (Article 6(1)(f) GDPR).
   • Statistics and analysis of how the Website is used (points 7.1 and 7.4). The legal basis is the consent given in the cookie settings (Article 6(1)(a) GDPR) for Google Analytics and, for Microsoft Clarity, the Controller’s legitimate interest in improving the Website (Article 6(1)(f) GDPR).
   • Marketing of the Controller’s services, including remarketing and measuring the effectiveness of Google and Meta ads (points 7.2, 7.3 and 7.5). The legal basis is the consent given in the cookie settings (Article 6(1)(a) GDPR) for Google Ads cookies and, otherwise, the Controller’s legitimate interest in the direct marketing of its own services and in measuring the effectiveness of its ads (Article 6(1)(f) GDPR).
   • Handling requests concerning personal data and demonstrating that consent was given, including recording the choice made in the cookie settings. The legal basis is the Controller’s legal obligation (Article 6(1)(c) GDPR in conjunction with Article 7(1) and Articles 12 to 22 GDPR).
   • Establishing, pursuing or defending legal claims. The legal basis is the Controller’s legitimate interest in protecting its rights (Article 6(1)(f) GDPR).
6. The Website collects information about users and their behaviour in the following ways:
   1. Through data entered voluntarily in forms, which is then added to the Operator’s systems.
   2. By storing cookies on end devices and using similar technologies, such as the pixels and scripts of the tools described in point 7.
7. Personal data of patients, including health data, which the Controller processes in connection with providing healthcare services (e.g. medical records), is subject to separate regulations, in particular Article 9 GDPR and the Polish Act of 6 November 2008 on Patient Rights and the Patient Ombudsman. Persons practising a medical profession are obliged to keep information related to the patient confidential. The Controller keeps medical records for the periods specified in Article 29 of that Act, as a rule for 20 years from the end of the calendar year in which the last entry was made. The Controller will provide information on the processing of patient data if you send a request by e-mail to the address given in point 1.3.

2. Selected data protection methods used by the Operator

1. The parts of the Website where personal data is entered are protected at the transmission layer (SSL certificate). As a result, personal data entered on the website is encrypted on the user’s computer and can only be read on the destination server.
2. The Controller applies appropriate technical and organisational measures to protect personal data. Within the Controller’s organisation, only persons authorised by the Controller have access to the data.
3. To protect data, the Operator regularly makes backup copies.

3. Hosting

1. The Website is hosted (technically maintained) on the servers of the provider: LH.PL

4. Your rights and additional information on how data is used

1. The Controller shares personal data with recipients to the extent needed for the purposes described in point 1.5. The recipients of the data are:
   • companies providing the Controller with hosting and e-mail services (LH.pl, Microsoft), which process data on its behalf (as processors)
   • authorised employees and associates who use the data to fulfil the purpose of the website
   • companies providing marketing services to the Controller
   • providers of the tools used on the Website, listed in point 8.8: Google, Meta, Microsoft, Cookiebot and justreview.co, as well as BootstrapCDN, from which the Website downloads files needed to display the page. Google, Meta and Microsoft also use some of the data for their own purposes, as controllers, under the terms described in their privacy policies.

   Appointment booking links lead to the Booksy service. Data provided when booking is processed by Booksy under its own terms, and the Controller receives from Booksy the data needed to handle the booked appointment.

2. The Controller stores personal data only for as long as it is needed for the purpose for which it was collected:
   • data from the contact form and e-mail correspondence: for the time needed to reply and deal with the matter and, if the correspondence may be relevant to establishing, pursuing or defending claims, until the limitation period for those claims set out in law, in particular in the Civil Code, expires;
   • data processed on the basis of consent: until consent is withdrawn;
   • data processed on the basis of the Controller’s legitimate interest: until an effective objection is made or that interest ceases;
   • information stored in cookies: for the lifetime of the given cookie (points 7 and 8.4) or until it is deleted in the browser;
   • data passed to the providers of Google, Meta and Microsoft tools, including data on phone calls from Google ads: for the periods set out in those providers’ policies.

   The Controller stores data for longer only where the law requires it.

3. You have the right to request from the Controller:
   • access to your personal data,
   • its rectification,
   • erasure,
   • restriction of processing,
   • and portability of the data that the Controller processes by automated means on the basis of consent or a contract.

   If processing is based on consent, you can withdraw it at any time (point 9.1). Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. You can send requests by e-mail or by post to the addresses given in points 1.2 and 1.3. The Controller replies without undue delay and in any case within one month; where necessary, owing to the complexity or number of requests, this period may be extended by a further two months, in which case the Controller will inform you within one month and give the reasons. If the Controller has reasonable doubts about your identity, it may ask for additional information needed to confirm it.

4. You have the right to object. You can object at any time to the processing of your personal data for direct marketing purposes, including profiling. The Controller then stops processing the data for this purpose. You can also object, on grounds relating to your particular situation, to other processing based on the Controller’s legitimate interest (Article 6(1)(f) GDPR). The Controller will uphold such an objection unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for establishing, pursuing or defending legal claims. You can submit an objection by e-mail to KONTAKT@DERMAPURE.COM.PL or by post to the address given in point 1.2. With regard to cookies and similar technologies, you can also object through your browser settings by blocking or deleting cookies (Article 21(5) GDPR). You can also limit the use of data for advertising in the Google, Meta and Microsoft ad settings (point 9.2).
5. You have the right to lodge a complaint about the Controller’s actions with the President of the Personal Data Protection Office (UODO), Stanisława Moniuszki 1A, 00-014 Warsaw.
6. Providing personal data is voluntary. A message cannot be sent without filling in all fields of the contact form. Refusing consent in the cookie settings does not limit access to the Website.
7. The Controller does not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. The Google and Meta advertising tools (points 7.2 and 7.3) tailor the Controller’s ads shown to you based on information about your use of the Website, which constitutes profiling. Google and Meta may combine this information with information from other sources under the terms described in their privacy policies. You can object to this as described in point 4.4.
8. The Controller uses tools and services from companies in the Google, Meta and Microsoft groups, including Microsoft e-mail (point 4.1). Data processed as part of these services, e.g. cookie identifiers, IP address, information about the device and use of the Website, the content of e-mail messages and, when measuring calls from Google ads, also the caller’s phone number, may be transferred to the United States. In Implementing Decision (EU) 2023/1795 of 10 July 2023, the European Commission found an adequate level of protection for data transferred to organisations in the USA that participate in the “EU-US Data Privacy Framework”. Google LLC, Meta Platforms, Inc. and Microsoft Corporation participate in this framework, so data is transferred to these companies on the basis of that decision (Article 45 GDPR). Current list of framework participants: https://www.dataprivacyframework.gov/s/participant-search. The Controller will provide more information on data transfers if you send a request by e-mail.

5. Information in forms

1. The Website collects information provided voluntarily by the user, including personal data, if provided.
2. The Website may record information about connection parameters (time stamp, IP address).
3. The contact form collects your first name, e-mail address, phone number and the content of your message. The Controller uses this data to reply to your message and, if you ask, to book an appointment. The purpose and legal basis of processing are described in point 1.5, and the retention period in point 4.2.
4. Please do not send information about your health, photos of skin lesions, test results or medical records through the contact form or by e-mail. Given the nature of such data, the Controller discusses it during a consultation at the clinic. If you send such information anyway, the Controller will use it only to the extent needed to reply to your message or book an appointment and will not keep it longer than necessary (point 4.2). The legal basis for processing it is Article 9(2)(h) GDPR (provision of healthcare), subject to the confidentiality referred to in Article 9(3) GDPR.

6. The Controller’s logs

1. Information about user behaviour on the Website may be logged. This data is used to administer the Website and ensure its security.

7. Key marketing techniques

1. The Operator carries out statistical analysis of Website traffic using Google Analytics (Google). The tool processes cookie identifiers, IP address and information about the device and how the Website is used. The Website also records clicks on the e-mail address and on Booksy links, and form submissions (without the message content), as events; clicks on the phone number are described in point 7.5. Google Analytics cookies (_ga, up to 400 days) are stored after you give consent in the cookie settings. Without consent these cookies are not stored, and Google Analytics receives at most signals that do not use cookies. You can view and change information about Google ads in Google’s ad settings: https://myadcenter.google.com/
2. The Operator uses Google Ads remarketing techniques. They make it possible to show the Operator’s ads to people who have previously visited the Website and to measure whether an ad led to contact with the Operator. For this purpose, Google processes cookie identifiers, IP address and information about the device and use of the Website. Google Ads cookies (e.g. _gcl_au up to 90 days, IDE up to 390 days) are stored after you give consent in the cookie settings. Without consent these cookies are not stored, and Google Ads receives at most signals that do not use cookies.
3. The Operator uses the Meta pixel (Meta owns Facebook and Instagram). The pixel stores the _fbp cookie (up to 90 days) and auxiliary cookies of the plugin that runs the pixel (with names containing “pys”, up to 365 days), and sends Meta information about the use of the Website, cookie identifiers, IP address and information about the device. The Operator uses this information to measure the effectiveness of ads on Facebook and Instagram and to show ads to people who have visited the Website. Meta may link this information to your Facebook or Instagram account and also uses it for its own purposes, under the terms described in Meta’s privacy policy: https://www.facebook.com/privacy/policy/. You can limit the use of this data by using browser settings that block cookies and trackers, by deleting cookies, by changing the ad settings in your Meta account (point 9.2) or by submitting an objection (point 4.4).
4. The Operator uses Microsoft Clarity (Microsoft), a tool for analysing how the Website is used. Clarity collects information about the device and browser, IP address and information about clicks, cursor movements and page scrolling. On this basis it creates statistics, click maps and replays of visits, which the Operator uses to improve the functioning and readability of the Website. Clarity uses cookies (_clck up to 365 days, _clsk up to 1 day) and the Microsoft MUID cookie (up to 390 days). Microsoft processes this data under the terms described in the Microsoft Privacy Statement: https://www.microsoft.com/pl-pl/privacy/privacystatement. You can limit Clarity by using browser settings that block cookies and trackers, by deleting cookies or by submitting an objection (point 4.4).
5. The Operator measures the effectiveness of Google Ads, including phone calls. If a user calls from a Google ad, the call may pass through a Google forwarding number before reaching the Operator’s phone. Google logs the date and time of the call, its duration, the area code, the caller’s phone number and which ad the call came from. Conversations are not recorded. This data is used only to assess the effectiveness of ads and is not linked to medical records. The legal basis for processing is the Operator’s legitimate interest in measuring the effectiveness of its ads (Article 6(1)(f) GDPR). Google processes this data as a separate controller, under the terms described in Google’s privacy policy: https://policies.google.com/privacy. The Operator also counts clicks on the phone number and on the “Call now” button, recording only the place on the page where the click occurred. The scope of data sent to Google depends on the choice made in the cookie settings.

8. Information about cookies

1. The Website uses cookies and similar technologies, such as pixels, scripts and the browser’s local storage. These technologies store information on your device or read information already stored on it.
2. Cookies are IT data, in particular text files, which are stored on the Website User’s end device and are intended for using the Website’s pages. Cookies usually contain the name of the website they come from, how long they are stored on the end device, and a unique number.
3. The entities that place cookies on the Website User’s end device and access them are the Website operator and the tool providers listed in point 8.8.
4. Cookies are used for the following purposes:
   1. necessary: ensuring that the Website works, including maintaining the session (PHPSESSID, until the browser is closed), remembering the language version (pll_language, up to 365 days), remembering the choice made in the cookie settings (CookieConsent, up to 365 days) and protecting the form against spam and abuse (Google reCAPTCHA, up to 180 days). Without these cookies the Website would not work properly, so they cannot be switched off in the cookie settings. You can block them in your browser, but then some Website features, e.g. the contact form, may not work;
   2. analytics: Google Analytics (point 7.1) and Microsoft Clarity (point 7.4), which show how users use the Website;
   3. marketing: Google Ads, including remarketing and measuring phone calls from ads (points 7.2 and 7.5), and the Meta pixel (point 7.3), which are used to show the Operator’s ads and measure their effectiveness;
   4. embedded content: the Google map on the contact page, the Facebook page plugin on the home page and the reviews widget (justreview.co). When you view a page with such an element, its provider receives your IP address and information about your device and may also store its own cookies.
5. The Website uses two main types of cookies: “session cookies” and “persistent cookies”. Session cookies are temporary files stored on the User’s end device until the User leaves the website or closes the software (web browser). Persistent cookies are stored on the User’s end device for the time specified in the cookie parameters or until the User deletes them.
6. Web browsing software (a web browser) usually allows cookies to be stored on the User’s end device by default. Website Users can change these settings. The web browser lets you delete cookies. Cookies can also be blocked automatically. Detailed information can be found in the help section or documentation of your web browser.
7. Restricting the use of cookies may affect some of the features available on the Website’s pages.
8. Cookies and similar technologies on the Website are also used by tool providers: Google (Google Analytics, Google Ads, Google Tag Manager, reCAPTCHA, Google Maps), Meta (Meta pixel, Facebook page plugin), Microsoft (Microsoft Clarity), Cookiebot (a tool for managing cookie consent) and justreview.co (reviews widget). These providers also process data under the terms described in their privacy policies. Data transfers to the USA are described in point 4.8.

9. Managing cookies: how do you give and withdraw consent in practice?

1. In the banner shown on your first visit to the Website, you decide whether you consent to Google Analytics and Google Ads cookies (points 7.1, 7.2 and 7.5). You can change your decision at any time, including withdrawing your consent: change cookie settings. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. You can also withdraw consent by deleting the Website’s cookies in your browser. If you do not want to receive cookies, you can change your browser settings. Please note that disabling cookies necessary for the Website’s security and for keeping user preferences may make it difficult, and in extreme cases impossible, to use the website.
2. To manage cookie settings, choose the web browser you use from the list below and follow the instructions:
   • Edge
   • Chrome
   • Safari
   • Firefox
   • Opera

   Mobile devices:

   • Android
   • Safari (iOS)

   Tool providers’ ad settings:

   • Google
   • Meta (Facebook, Instagram)
   • Microsoft

   You can also object to data processing by the tools described in point 7 by e-mail to KONTAKT@DERMAPURE.COM.PL (point 4.4).