Dear Sir or Madam,

Having regard to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the “GDPR”), in particular Articles 13 and 14 of the GDPR, we kindly inform you as follows.

  1. The controller of your personal data (hereinafter: Personal Data) is NEUROLOCUS CENTRUM LECZENIA BÓLU Sp. z o.o., with its registered office in Warsaw (04-281) at ul. Olszynki Grochowskiej 11/15, unit U3, entered in the register of entrepreneurs maintained by the District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register, under KRS number: 0001159800, NIP: 1133160938, REGON: 541092345, tel.: 6961887744, e-mail: neurolocus@gmail.com
  2. In matters related to the processing of Personal Data by NEUROLOCUS CENTRUM LECZENIA BÓLU Sp. z o.o., please contact us via the following e-mail address: neurolocus@gmail.com
  3. Depending on the specific situation, Personal Data may be processed by us for various justified purposes and for different periods of time. Below we present information including the purposes, legal bases and periods of processing of Personal Data:

Patients / persons authorised to access medical documentation

No. Purpose of processing Legal basis for processing Processing period
1. Registration and provision of medical services Article 9(2)(h) GDPR, Article 3 of the Act of 15 April 2011 on Medical Activity. Until the completion of activities related to registration and the provision of the medical service
2. Keeping and archiving medical documentation Article 6(1)(c) GDPR, Article 29 in conjunction with Article 25 of the Act of 6 November 2008 on Patients’ Rights and the Patients’ Rights Ombudsman For the period resulting from provisions of law, i.e. as a rule for a period of 20 years, counted from the end of the calendar year in which the last entry was made.
3. Pursuing the legitimate interests of our facility, such as establishing, pursuing and defending mutual claims Article 6(1)(f) GDPR Until the expiry of the limitation period for establishing, pursuing and defending mutual claims
4. Pursuing other purposes for which consent has been given Article 6(1)(a) GDPR Until the purpose has been achieved or consent has been withdrawn/an objection has been lodged

 

Providing your Personal Data is voluntary; however, failure to provide them will prevent the provision of medical services/access to medical documentation.

Business Partners / Clients / Potential Clients

No. Purpose of processing Legal basis for processing Processing period
1. Performance of a contract/service Article 6(1)(b) GDPR Until the contract/service has been performed
2. Taking steps prior to entering into a contract, e.g. for the purpose of submitting a commercial offer Article 6(1)(b) GDPR Until completion of activities related to entering into a contract
3. Performing obligations arising from generally applicable provisions, such as archiving tax documents containing Personal Data Article 6(1)(c) GDPR For the period resulting from provisions of law, e.g. with regard to archiving tax documents, the storage period for Personal Data is 5 years, counted from the end of the calendar year in which the deadline for payment of the tax related to the service provided expired
4. Pursuing the legitimate interests of our facility, such as establishing, pursuing and defending mutual claims Article 6(1)(f) GDPR Until the legitimate interest has been pursued, such as until the expiry of the limitation period for establishing, pursuing and defending mutual claims
5. Pursuing the legitimate interests of our facility, such as marketing our own services Article 6(1)(f) GDPR Until the legitimate interest has been pursued or an objection has been lodged
6. Pursuing other purposes for which consent has been given Article 6(1)(a) GDPR Until the purpose has been achieved or consent has been withdrawn.

Providing your Personal Data is voluntary; however, depending on the specific purpose, failure to provide them will prevent or hinder the conclusion/performance of the Contract, the establishment of cooperation/contact, the performance of legal obligations, as well as the pursuit of the legitimate interests of our company, such as marketing our own services.

Employees

No. Purpose of processing Legal basis for processing Processing period
1. Performance of obligations and rights arising from the employment relationship Article 6(1)(b) and (f) GDPR Article 22¹ of the Labour Code For the duration of the employment relationship
2. Keeping personnel files and payroll documents for the purpose of archiving them after termination of the employment relationship Article 6(1)(c) GDPR in conjunction with Article 125a(4) of the Act on Pensions and Disability Pensions from the Social Insurance Fund and in conjunction with Article 51 of the Act on the National Archival Resource and Archives For the period resulting from provisions of law: depending on the specific case, 10 or 50 years.
3. Performing obligations arising from generally applicable provisions: archiving tax documents containing Personal Data Article 6(1)(c) GDPR For the period resulting from provisions of law, e.g. with regard to archiving tax documents, the storage period for Personal Data is 5 years, counted from the end of the calendar year in which the deadline for payment of the tax related to the contract expired
4. Performing obligations arising from generally applicable provisions: archiving the report establishing the circumstances and causes of an accident at work together with the remaining post-accident documentation Article 6(1)(c) GDPR in conjunction with Article 234 § 3¹ of the Labour Code For a period of 10 years from the date the report was prepared
5. Pursuing the legitimate interests of our facility, such as: establishing, pursuing and defending mutual claims Article 6(1)(f) GDPR Until the expiry of the limitation period for mutual claims
6. Pursuing other purposes for which consent has been given Article 6(1)(a) GDPR Until the purpose has been achieved or consent has been withdrawn/an objection has been lodged

 

Providing your Personal Data is generally voluntary, unless it is a statutory requirement. Failure to provide them will prevent the establishment of an employment relationship and the performance of the employment contract.

Interns / Trainees

No. Purpose of processing Legal basis for processing Processing period
1. Completion of an internship or traineeship Article 6(1)(b) and/or (f) GDPR For the duration of the internship or traineeship
2. Pursuing the legitimate interests of our facility, such as: archiving Personal Data for the purpose of establishing, pursuing and defending possible mutual claims Article 6(1)(f) GDPR Until the expiry of the limitation period for possible mutual claims
3. Pursuing other purposes for which consent has been given Article 6(1)(a) GDPR Until the purpose has been achieved or consent has been withdrawn/an objection has been lodged

 

Providing your Personal Data is voluntary; however, failure to provide them will prevent the completion of an internship or traineeship.

Job candidates

No. Purpose of processing Legal basis for processing Processing period
1. Conducting the current recruitment process Article 6(1)(a) GDPR and/or Article 22¹ of the Labour Code For the duration of the recruitment process
2. Activities related to establishing an employment relationship, in particular preliminary medical examinations. Article 6(1)(b) GDPR For the duration of activities directly aimed at concluding a contract
3. Storing personal data for future recruitment processes Article 6(1)(a) GDPR For the period specified in the consent, but no longer than 12 months, or until consent is withdrawn/an objection is lodged

 

If consent has been given only for the current recruitment process, the Personal Data will be deleted immediately after the end of that process. However, if consent has also been given for future recruitment processes, we will process Personal Data for future recruitment processes until consent is withdrawn or an objection is lodged, or until the time specified in the consent, but no later than one year from the submission of application documents.

Providing Personal Data for recruitment purposes is voluntary; however, failure to provide them will prevent your candidacy from being considered. Providing Personal Data for activities related to establishing an employment relationship is a requirement for concluding an employment contract.

  1. In connection with the processing of Personal Data by our company, you have the right to:
    1. access Personal Data, including the right to obtain a copy thereof,
    2. request rectification of Personal Data – where the data are incorrect or incomplete,
    3. object to the processing of Personal Data,
    4. request deletion of Personal Data,
    5. request the transfer and restriction of processing of Personal Data,
    6. withdraw consent to the processing of Personal Data at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal, unless there is another legal basis for their processing.
  2. If you become aware of unlawful processing of Personal Data, you have the right to lodge a complaint with the President of the Personal Data Protection Office.
  3. Our facility does not process Personal Data for the purpose of automated decision-making, including so-called profiling.
  4. Personal Data are not transferred to Third Countries, in other words outside the European Economic Area, nor to any international organisations.