Privacy Policy - Swisslaser

Privacy and Cookies Policy

1. This Privacy Policy defines the rules for processing personal data obtained via the swisslaser.pl website (hereinafter referred to as the “Website“).

2. The owner of the Website and the data controller is Swisslaser Sp. z o.o. with its registered office in Warsaw (03-713), ul. Wrzesińska 12/21, entered into the register of entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register under KRS number 0000447644, with a share capital of PLN 5,000, NIP: 5223002553, REGON: 146502760, hereinafter referred to as SWISSLASER.

3. Personal data collected by SWISSLASER via the Website are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), also known as GDPR.

4. SWISSLASER takes special care to respect the privacy of Users visiting the Website.

§ 1 Type of data processed, purposes, and legal basis

1. SWISSLASER collects information regarding natural persons conducting business or professional activity on their own behalf, and natural persons representing legal entities or organizational units that are not legal entities but are granted legal capacity by law, hereinafter collectively referred to as Users.

2. Users’ personal data are collected in the case of:

a) newsletter subscription, for the purpose of performing a contract for an electronically supplied service. Legal basis – consent of the data subject to the performance of the Newsletter service contract (Art. 6(1)(a) GDPR);

b) using the contact form service on the Website for the purpose of performing an electronically supplied service contract. Legal basis: necessity for the performance of the contact form service contract (Art. 6(1)(b) GDPR);

c) using the “Request a Quote” service on the Website for the purpose of performing an electronically supplied service contract. Legal basis: necessity for the performance of the contact form service contract (Art. 6(1)(b) GDPR);

d) using the chat service, for the purpose of performing a contract for an electronically supplied service or for the purpose of performing a sales contract, if the User places an order using the free chat service. Legal basis: necessity for the performance of the chat service contract or necessity for the performance of the sales contract – if the User places an order using the free chat service (Art. 6(1)(b) GDPR).

3. When registering on the Website, the User provides:

a) email address;
b) first and last name;
c) phone number.

4. When using the Newsletter service, the User provides only their email address.

5. When using the contact form service, the User provides the following data:
a. email address;
b. first and last name;
c. phone number.

6. When using the “Request a Quote” service, the User provides the following data:
a. email address;
b. first and last name;
c. Entrepreneur’s company name;
d. phone number.

7. When using the chat service, the User provides the following data:
a. first name.

8. During the use of the Website, additional information may be collected, in particular: the IP address assigned to the User’s computer or the external IP address of the Internet provider, domain name, browser type, access time, operating system type.

9. Navigation data may also be collected from Users, including information about links and references they choose to click or other activities undertaken on our Website. Legal basis – legitimate interest (Art. 6(1)(f) GDPR), consisting of facilitating the use of electronically supplied services and improving the functionality of these services.

10. For the purpose of establishing, pursuing, and enforcing claims, certain personal data provided by the User when using the functionalities on the Website may be processed, such as: first name, last name, data regarding the use of services, if claims arise from the manner in which the User uses the services, other data necessary to prove the existence of a claim, including the extent of the damage incurred. Legal basis – legitimate interest (Art. 6(1)(f) GDPR), consisting of establishing, pursuing, and enforcing claims, and defending against claims in proceedings before courts and other state authorities.

11. Providing personal data to SWISSLASER is voluntary.

§ 2 To whom are data disclosed or entrusted, and for how long are they stored?

1. The User’s personal data are transferred to service providers used by SWISSLASER in operating the Website. Service providers to whom personal data are transferred, depending on contractual arrangements and circumstances, either follow SWISSLASER’s instructions regarding the purposes and methods of processing these data (processors) or independently determine the purposes and methods of their processing (controllers).
a) Processors. SWISSLASER uses providers who process personal data solely on SWISSLASER’s instructions. These include, among others, providers offering hosting services, accounting services, marketing systems, website traffic analysis systems, and marketing campaign effectiveness analysis systems;

2. Location. Service providers are mainly based in Poland and other countries of the European Economic Area (EEA).

3. Users’ personal data are stored:
a) If the basis for processing personal data is
consent, then the User’s personal data are processed by SWISSLASER for as long as the consent is not withdrawn, and after the withdrawal of consent, for a period corresponding to the limitation period for claims that SWISSLASER may raise and that may be raised against it. Unless a specific provision states otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to business activity – three years.
b) If the basis for data processing is the performance of
a contract, then the User’s personal data are processed by SWISSLASER for as long as necessary for the performance of the contract, and thereafter for a period corresponding to the limitation period for claims. Unless a specific provision states otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to business activity – three years.

4. Navigation data may be used to provide Users with better service, analyze statistical data, adapt the Website to Users’ preferences, and administer the Website.

5. If the User subscribes to the newsletter, SWISSLASER will send electronic messages containing commercial information about promotions and new products available on the Website to their email address.

6. In the event of a request, SWISSLASER provides personal data to authorized state authorities, in particular organizational units of the Public Prosecutor’s Office, Police, the President of the Personal Data Protection Office, the President of the Office of Competition and Consumer Protection, or the President of the Office of Electronic Communications.

§ 2.1 Processing of medical data (GDPR)

1. Controller: SwissLaser Sp. z o.o. Clinic, ul. Wrześińska 12 lok. 21, 03-713 Warsaw, NIP: 522 300 25 53, email: info@swisslaser.pl, tel.: +48 221 201 690.
2. Purposes and legal bases:
a) Qualification for procedures, provision of health services, and maintenance of medical records – Art. 6(1)(b)/(c) GDPR (contract/legal obligation) and Art. 9(2)(h) GDPR (health data for diagnostic and healthcare purposes).
b) Organizational contact (phone: +48 221 201 690/email: info@swisslaser.pl) regarding appointments – as above.
c) Establishment/pursuit/defense of claims – Art. 6(1)(f) GDPR (legitimate interest).
d) Marketing (newsletter/offers) – solely based on separate consent (Art. 6(1)(a) GDPR).
3. Scope of data: identification and contact data (e.g., first name, last name, date of birth, phone, email) and health data necessary for qualification and treatment (medical history, medications taken, past illnesses and procedures, test results).
4. Source of data: primarily directly from the patient; exceptionally from other sources in accordance with the law and at the patient’s request (e.g., documentation from other facilities).
5. Data recipients (processors): providers of IT/hosting/communication systems acting on our behalf, including Tomedo (zollsoft) – based on data processing agreements; and entities authorized by law.
6. Transfer outside the EEA: only when necessary, with appropriate safeguards (e.g., standard EU contractual clauses); details available upon request.
7. Storage period: in accordance with medical records regulations (generally 20 years from the end of the calendar year in which the last entry was made; with exceptions provided by law) and for the period necessary to pursue or defend claims. Data processed based on marketing consent – until its withdrawal.
8. Patient rights: access, rectification, restriction of processing, data portability; in cases provided by law – objection/erasure. In the scope of medical records, erasure may be limited by regulations.
9. Obligation to provide data: data necessary for qualification and treatment are mandatory; failure to provide them may prevent the provision of services. Data for marketing purposes are voluntary.
10. Automated decisions: we do not make fully automated decisions that produce legal effects concerning the patient.
11. Complaint: the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

§ 3 Cookies mechanism, IP address

1. The Website uses small files called cookies. They are stored by SWISSLASER on the end device of the person visiting the Website, if the internet browser allows it. A cookie file usually contains the name of the domain it comes from, its “expiration time”, and an individual, randomly selected number identifying this file. Information collected through these types of files helps SWISSLASER adapt its offerings to the individual preferences and actual needs of Website visitors. They also allow for the development of general statistics on product visits on the Website.

2. SWISSLASER uses two types of cookies:
a) Session cookies: after the end of a given browser session or turning off the computer, the stored information is deleted from the device’s memory. The session cookie mechanism does not allow for the collection of any personal data or confidential information from Users’ computers.
b) Persistent cookies: are stored in the User’s end device memory and remain there until they are deleted or expire. The persistent cookie mechanism does not allow for the collection of any personal data or confidential information from Users’ computers.

3. SWISSLASER uses its own cookies for the purpose of:
a) analyses and research, and audience auditing, and in particular for creating anonymous statistics that help understand how Users use the Website, which allows for improving its structure and content.

4. SWISSLASER uses external cookies for the purpose of:
a) presenting on the Website’s information pages a map indicating the location of SWISSLASER’s office, using the maps.google.com service (external cookie administrator: Google Inc. based in the USA);
b) collecting general and anonymous statistical data via Google Analytics analytical tools (external cookie administrator: Google Inc. based in the USA);

5. The cookie mechanism is safe for the computers of Website Users. In particular, it is not possible for viruses or other unwanted or malicious software to penetrate Users’ computers this way. Nevertheless, Users have the option in their browsers to limit or disable cookie access to their computers. If this option is used, using the Website will be possible, except for functions that by their nature require cookies.

6. Below we present how to change the settings of popular web browsers regarding the use of cookies:

a) Internet Explorer browser;
b) Microsoft EDGE browser;
c) Mozilla Firefox browser;
d) Chrome browser;
e) Safari browser;
f) Opera browser.

7. SWISSLASER may collect Users’ IP addresses. An IP address is a number assigned to the computer of a person visiting the Website by an internet service provider. The IP number enables internet access. In most cases, it is assigned dynamically to the computer, i.e., it changes with each connection to the Internet. The IP address is used by SWISSLASER for diagnosing technical problems with the server, creating statistical analyses (e.g., determining from which regions we record the most visits), as information useful for administering and improving the Website, as well as for security purposes and potential identification of server-overloading, unwanted automatic programs for browsing Website content.

8. The Website contains links and references to other websites. SWISSLASER is not responsible for the privacy policies applicable on them.

§ 4 Rights of data subjects

1. Right to withdraw consent – legal basis: Art. 7(3) GDPR.
a) The User has the right to withdraw any consent given to SWISSLASER.
b) The withdrawal of consent is effective from the moment of withdrawal.
c) The withdrawal of consent does not affect processing carried out by SWISSLASER lawfully before its withdrawal.
d) The withdrawal of consent does not entail any negative consequences for the User, but it may prevent further use of services or functionalities that SWISSLASER can lawfully provide only with consent.

2. Right to object to data processing – legal basis: Art. 21 GDPR.
a) The User has the right to object at any time – on grounds relating to their particular situation – to the processing of their personal data, including profiling, if SWISSLASER processes their data based on a legitimate interest, e.g., marketing of SWISSLASER products and services, keeping statistics on the use of individual Website functionalities and facilitating the use of the Website, as well as satisfaction surveys.
b) Opting out of receiving marketing communications regarding products or services via email will constitute the User’s objection to the processing of their personal data, including profiling for these purposes.
c) If the User’s objection proves justified and SWISSLASER has no other legal basis for processing personal data, the User’s personal data, to the processing of which the User objected, will be deleted.

3. Right to erasure (“right to be forgotten”) – legal basis: Art. 17 GDPR.
a) The User has the right to request the erasure of all or some personal data.
b) The User has the right to request the erasure of personal data if:
a. the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
b. they have withdrawn specific consent, to the extent that personal data were processed based on their consent;
c. they have objected to the use of their data for marketing purposes;
d. the personal data have been unlawfully processed;
e. the personal data must be erased for compliance with a legal obligation in Union or Member State law to which SWISSLASER is subject;
f. the personal data have been collected in relation to the offer of information society services.
c) Notwithstanding a request for erasure of personal data due to an objection or withdrawal of consent, SWISSLASER may retain certain personal data to the extent that processing is necessary for the establishment, exercise, or defense of legal claims, as well as for compliance with a legal obligation requiring processing by Union or Member State law to which SWISSLASER is subject. This applies in particular to personal data including: first name, last name, email address, which are retained for the purpose of handling complaints and claims related to the use of SWISSLASER services, or additionally, residential address/correspondence address, order number, which are retained for the purpose of handling complaints and claims related to concluded sales contracts or service provision.

4. Right to restriction of processing – legal basis: Art. 18 GDPR.
a) The User has the right to request the restriction of processing of their personal data. Submitting a request, until it is considered, prevents the use of certain functionalities or services whose use would involve the processing of the data covered by the request. SWISSLASER will also not send any communications, including marketing ones.
b) The User has the right to request the restriction of the use of personal data in the following cases:
a. when they contest the accuracy of their personal data – in which case SWISSLASER restricts their use for the period necessary to verify the accuracy of the data, but no longer than 7 days;
b. when the data processing is unlawful, and instead of erasure, the User requests the restriction of their use;

§ 5 Terms and Conditions of Sale for Medical Services performed at the SwissLaser clinic in Warsaw, carried out via an online payment link

1. General Provisions
a. These terms and conditions (“Terms”) define the rules for making payments for medical services offered by SwissLaser Sp. z o.o. via individual payment links sent to patients electronically.
b. The sale of medical services does not take place in the form of an online store or through a shopping cart.
c. Each payment: a) concerns a specific, individually indicated medical service, b) is preceded by medical qualification, c) is assigned to a specific patient.
d. These Terms constitute an integral part of the medical service agreement concluded between the Patient and SwissLaser.

2. Seller’s (Service Provider’s) Details
a. The Service Provider is: SwissLaser Sp. z o.o. ul. Wrzesińska 12/21, 03-713 Warsaw KRS: 0000447644 NIP: 5223002553 REGON: 146502760 email: info@swisslaser.pl tel.: +48 221 201 690
b. SwissLaser is a medical entity performing medical activity in accordance with applicable law.

3. Scope of Services
a. The subject of sale are medical services in the field of ophthalmology, in particular vision correction procedures.
b. The exact name of the procedure, its scope, and price are always indicated in the content of the message containing the payment link.
c. Services are provided stationary, at SwissLaser facilities.

4. Rules for placing an “order”
a. The agreement is concluded by: a) sending the Patient an individual payment link, b) the Patient making the payment.
b. Making the payment is equivalent to: a) acceptance of these Terms, b) confirmation of the will to perform the indicated medical service.
c. SwissLaser reserves that payment does not replace a medical decision and does not override the doctor’s right to refuse to perform the procedure in case of medical contraindications.

5. Payments
a. Payments are made via an online payment operator (e.g., Tpay).
b. Available payment methods are determined by the payment operator.
c. The service price is given in Polish Zloty (PLN) and includes all applicable taxes.
d. After the payment is credited, the Patient receives confirmation electronically.

6. Service Performance
a. The medical service is performed on a date individually agreed with the Patient.
b. The conditions for performing the procedure are: a) positive medical qualification, b) absence of medical contraindications.
c. SwissLaser maintains medical records in accordance with applicable law.

7. Withdrawal from the contract and refunds
a. In accordance with Art. 38(1)(1) of the Consumer Rights Act, the right to withdraw from the contract does not apply if the service has been fully performed.
b. In the event of cancellation of the procedure before its performance, the rules for any refund are determined individually, taking into account: a) incurred costs, b) cancellation deadline, c) nature of the medical service.
c. In the event that the procedure cannot be performed due to medical reasons, SwissLaser will inform the Patient about further settlement options.

8. Complaints
a. The Patient has the right to lodge a complaint regarding payment or service organization.
b. Complaints should be submitted: a) in writing or b) electronically to: info@swisslaser.pl
c. Complaints are processed within 14 business days.

9. Personal Data Protection
a. The administrator of Patients’ personal data is SwissLaser Sp. z o.o.
b. Personal data, including health data, are processed in accordance with: a) GDPR Regulation, b) SwissLaser Privacy Policy, c) regulations concerning medical records.
c. Detailed information is contained in the Privacy and Cookies Policy, available on swisslaser.pl.

10. Final Provisions
a. These Terms are effective from the date of publication.
b. SwissLaser reserves the right to amend the Terms for important legal or organizational reasons.
c. For matters not regulated herein, Polish law shall apply.

§ 6 Terms and Conditions of Sale for Medical Services performed at the SwissLaser clinic in Krakow, carried out via an online payment link

1. General Provisions
a. These terms and conditions (“Terms”) define the rules for making payments for medical services offered by SwissLaser Kraków Sp. z o.o. via individual payment links sent to patients electronically.
b. The sale of medical services does not take place in the form of an online store or through a shopping cart.
c. Each payment: a) concerns a specific, individually indicated medical service, b) is preceded by medical qualification, c) is assigned to a specific patient.
d. These Terms constitute an integral part of the medical service agreement concluded between the Patient and SwissLaser.

2. Seller’s (Service Provider’s) Details
a. The Service Provider is: SwissLaser Sp. z o.o. ul Kluczborska 15/U3, Krakow NIP: 1133082541 REGON: 524152626 email: krakow@swisslaser.pl tel.: +48 12 383 33 60
b. SwissLaser is a medical entity performing medical activity in accordance with applicable law.