Privacy policy

This privacy policy describes how we process information about you, including personal data and cookies.

General information

This policy applies to the website operating at cisowianka.pl (the “Website”). The website operator and personal data controller is Nałęczów Zdrój Sp. z o.o., Drzewce 35, 24-150 Nałęczów (the “Controller”). The Controller’s contact email is biuro@cisowianka.pl. For personal data matters, contact rodo@cisowianka.pl.

The operator is the controller of personal data voluntarily provided on the Website. The Website obtains information about users and their behaviour through data voluntarily entered in forms and by storing cookies on users’ devices.

Sources of data and purposes of processing

Personal data comes from the data subjects or the Controller’s business partners. Data concerning representatives of business partners comes from those business partners.

Personal data is processed to: enter into and perform contracts; provide individual offers to interested persons; issue and retain accounting documents; conduct marketing activities; contact persons who send enquiries or messages through the contact form, email or telephone; analyse network traffic, maintain Website security and adapt content to users’ needs on the basis of the Controller’s legitimate interest.

The legal bases for processing are: Article 6(1)(a) GDPR — consent, when an enquiry form is submitted, marketing offers are sent or contact is made with the Controller; Article 6(1)(b) GDPR — processing necessary to enter into or perform a contract or to take steps at the data subject’s request before entering into a contract; Article 6(1)(c) GDPR — a legal obligation, when an invoice or another accounting document is issued and retained; Article 6(1)(f) GDPR — the Controller’s legitimate interest in establishing and pursuing claims, defending against claims, ensuring Website security and producing statistics and analyses to optimise it.

Your rights under the GDPR

You have the right to request access to and a copy of your personal data (Article 15 GDPR); request rectification or completion of inaccurate or incomplete data (Article 16 GDPR); request erasure (Article 17 GDPR); request restriction of processing (Article 18 GDPR), for example while the accuracy of disputed data is checked; and lodge a complaint about the Controller’s processing with the President of the Personal Data Protection Office.

Recipients of personal data

Recipients may include entities cooperating with Nałęczów Zdrój Sp. z o.o. under civil-law contracts, where this follows from their responsibilities, particularly providers of IT system and software servicing and maintenance. Data may also be transferred to courier companies or postal operators for sending or receiving consignments. Personal data may be disclosed to entities authorised under generally applicable law, particularly institutions authorised to supervise the Controller’s activities.

Retention period

Your data is retained for the duration of a contract and, after it expires, until the limitation period for possible claims ends; for the period required by applicable law; and, for marketing processing, until consent is withdrawn. If you bring a claim, retention and processing may be extended where necessary to examine the claim and defend against it.

Selected data protection measures used by the Controller

Login and personal data entry areas are protected in transit by an SSL certificate. Personal and login data entered on the Website is encrypted on the user’s computer and can be read only by the destination server.

Access to personal data is restricted to persons who need it to carry out the purposes and tasks described in this policy. Those persons are required to maintain confidentiality and process data lawfully.

To improve security, the Controller periodically changes administrative passwords and regularly creates backups. An important element of data protection is regularly updating all software used to process personal data, particularly software components.

Hosting

The Website is hosted and technically maintained on servers operated by cyberFolks.pl.

Information in forms

The Website collects information voluntarily provided by users, including personal data where supplied. It may record connection parameters such as timestamps and IP addresses. In some cases, it may record information linking form data to the email address of the person completing the form; that email address may then appear in the URL of the page containing the form.

Form data is processed for the purpose indicated by the particular form, for example handling a support request, a business enquiry or service registration. The context and description of each form explain its purpose.

Profiling

The Controller does not make automated decisions, including decisions resulting from profiling, on the basis of your personal data.

Important marketing techniques

The operator uses Google Analytics (Google Inc., based in the USA) for statistical analysis of Website traffic. The operator transfers anonymised information rather than personal data to that service. The service uses cookies on the user’s device. Users can review and edit information about preferences collected through Google’s advertising network at https://www.google.com/ads/preferences/.

Information about cookies

The Website uses cookies. Cookies are computer data, particularly text files, stored on the Website user’s device for use with the Website. They generally contain the name of the originating website, their storage period and a unique number. The Website operator places cookies on users’ devices and accesses them.

Cookies are used to maintain a logged-in user’s session so that the user does not need to enter a username and password on every page, and to fulfil the purposes described under “Important marketing techniques”.

The Website uses two main types of cookies: session and persistent cookies. Session cookies are temporary files stored until the user logs out, leaves the website or closes the browser. Persistent cookies remain for the period specified in their parameters or until deleted by the user.

Browsers usually allow cookies by default. Users can change these settings, delete cookies or automatically block them. Detailed guidance is provided in the browser’s help or documentation. Restricting cookies may affect some Website functions.

Cookies on users’ devices may also be used by entities cooperating with the operator, particularly Google (Google Inc., USA), Facebook (Facebook Inc., USA) and Twitter (Twitter Inc., USA).

Managing cookies — giving and withdrawing consent

If you do not wish to receive cookies, change your browser settings. Disabling cookies required for authentication, security or preferences may hinder, or in extreme cases prevent, use of websites.

To manage cookie settings, follow the instructions for your browser: Edge, Internet Explorer, Chrome, Safari, Firefox or Opera. For mobile devices, use the instructions for Android, Safari (iOS) or Windows Phone.