• the principles of personal data processing, namely lawfulness, fairness and transparency, purpose limitation and compatibility of processing purposes, as well as data minimisation, pseudonymisation and encryption, and integrity, confidentiality and availability;
• the principles of necessity and proportionality (applying also to the scope and volume of personal data processed, the retention period and access to the data subject’s personal data) of the processing with regard to the purpose of the processing operation;
• the nature, scope, context and purpose of the processing operation;
• the resilience and restoration of personal data processing systems;
• the training of the Controller’s authorised persons;
• the adoption of measures to identify without delay whether a personal data breach has occurred and to promptly inform the supervisory authority and the data protection officer;
• the adoption of measures to ensure the rectification or erasure of inaccurate data, or the exercise of other rights of the data subject;
• the risks of varying likelihood and severity for the rights and freedoms of natural persons (in particular accidental or unlawful destruction of personal data, loss or alteration of personal data, misuse of personal data – unauthorised access or unauthorised disclosure, assessment of risks with regard to the origin, nature, likelihood and severity of the risk associated with the processing, and identification of best practices to mitigate the risk).

Retention period of personal data and regular review

We process your personal data only for the period necessary to fulfil the purpose for which they were obtained, or for the period required by the applicable legislation. Specifically:

Once these periods have expired or the purpose has been fulfilled, the data are securely destroyed or anonymised.

Scope of personal data processing

We process in particular the following categories of personal data:

• Identification data: first name, surname, title, date of birth.
• Contact data: e‑mail address, telephone number, residential address.
• Transaction data: data on the services ordered, date and method of payment, invoice number.
• Communication data: the content of e‑mails, telephone or chat messages with customer support.
• Marketing preferences: consent to receiving news, data on e‑mail opens and link clicks.

Purpose of personal data processing

1. Performance of the contract and order processing – appointment bookings, issuing invoices, communication regarding the procedure.
2. Marketing and PR – sending newsletters, discount coupons and information about new services.
3. Customer support – handling complaints, answering questions by e‑mail, chat or telephone.
4. Compliance with legal obligations – accounting agenda, tax records.
5. Legitimate interest – protection of our legal claims, operational security of the website, internal statistics.

Legal basis for processing (grounds)

• Consent of the data subject pursuant to Article 6(1)(a) of the GDPR for marketing purposes.
• Performance of a contract pursuant to Article 6(1)(b) of the GDPR when our services are ordered.
• Compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR (accounting, tax agenda).
• Legitimate interest of the Controller pursuant to Article 6(1)(f) of the GDPR (internal administration, protection of legal claims).

Recipients and processors (subcontractors)

Your personal data may be made available to or processed by the following entities:

We have concluded a written personal data processing agreement pursuant to Article 28 of the GDPR with each processor, ensuring an adequate level of protection.

Last updated: 1 July 2025