Privacy policy

This privacy policy is informative in nature, which means it is not a source of obligations for the users or clients of the Website. It sets out the rules under which the Controller processes personal data on the Website, including the legal bases, purposes and periods of processing, the rights of data subjects, and information about the cookies and analytics tools used on the Website.

The controller of personal data collected through the Website is Fundacja Rozwoju Przedsiębiorczości „Twój Startup", with its registered office in Warsaw, ul. Żurawia 6/12 apt. 766, 00-503 Warsaw, Poland, entered in the register kept by the National Court Register under number KRS 0000442857, tax identification number NIP 5213641211, statistical number REGON 146433467, acting through the organisationally separated project „Gabinet Psychologiczny Unique", operated at ul. Béli Bartóka 8/76, 02-787 Warsaw, e-mail address: gabinetunique@gmail.com, telephone number: +48 698 186 680 - hereinafter the „Controller".

Personal data on the Website is processed by the Controller in accordance with applicable law, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - hereinafter the „GDPR".

Official text of the GDPR

Using the Website is voluntary. Likewise, providing personal data by a user of the Website is voluntary.

The Controller takes particular care to protect the interests of the data subjects and in particular ensures that the data it collects is: (1) processed lawfully; (2) collected for specified, lawful purposes and not further processed in a way incompatible with those purposes; (3) accurate and adequate in relation to the purposes for which it is processed; (4) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of the processing; and (5) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Taking into account the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the Controller implements appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the GDPR. Those measures are reviewed and updated where necessary. The Controller applies technical measures preventing unauthorised persons from obtaining and modifying personal data sent electronically.

The Website collects no health data and no other special categories of data. Appointments are booked outside this website, and everything said during a consultation is covered by professional secrecy and has nothing to do with this document.

The Controller is entitled to process personal data where - and to the extent that - at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specific purposes; (2) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Controller is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Each instance of processing by the Controller requires at least one of the bases listed in clause 2.1 to apply. The specific bases for processing users’ personal data are indicated in the next chapter of this policy, in relation to each purpose of processing.

In each case the purpose, legal basis, retention period and recipients of personal data processed by the Controller follow from the actions taken by the given user or by the Controller.

The Controller processes personal data within the Website for the following purposes, on the following bases and for the following periods:

Use of the Website and ensuring that it works correctly and safely

Legal basis: article 6(1)(f) GDPR (the legitimate interest of the Controller in making the website available and protecting it from abuse). Retention: server log data held by the hosting provider is kept for no longer than 30 days.

Keeping statistics and analysing traffic on the Website

Legal basis: article 6(1)(a) GDPR (consent given in the cookie consent dialog). Retention: until consent is withdrawn, and no longer than 14 months from the last visit - that is the retention period configured in the analytics tool.

Contact by telephone or e-mail, including booking an appointment

Legal basis: article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract) and article 6(1)(f) GDPR (the legitimate interest in replying). Retention: for the duration of the correspondence and afterwards for the limitation period for claims.

Establishing, pursuing or defending claims

Legal basis: article 6(1)(f) GDPR (the legitimate interest of the Controller). Retention: for the limitation period for claims set out in law, in particular in the Polish Civil Code.

The Website contains no contact form. Contact with the Controller takes place by telephone or e-mail, and appointments are booked through the external service described in clause 4.3.

For the Website to function properly, the Controller must use the services of external entities. The Controller uses only those processors that provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the GDPR and protects the rights of data subjects.

The Controller does not transfer data in every case and not to all of the recipients or categories of recipients indicated in this policy. Data is transferred only where it is necessary to achieve a given purpose of processing and only to the extent necessary to achieve it.

Personal data of Website users may be transferred to the following recipients or categories of recipients:

Hosting provider: Cloudflare, Inc.

The Website is served from the edge network of Cloudflare, Inc. (101 Townsend St., San Francisco, California, United States). The provider processes the IP address and technical request data, which is necessary to display the page and to protect it. Transfers outside the European Economic Area are based on the standard contractual clauses approved by the European Commission and on the adequacy decision under the EU-US Data Privacy Framework.

Analytics provider: Google Ireland Limited

The Controller uses Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The service starts ONLY after consent has been given in the cookie consent dialog. Details in chapter 7.

Appointment booking widget provider: DocPlanner

The Website embeds the booking widget of the ZnanyLekarz service, operated by DocPlanner S.A., ul. Kolejowa 5/7, 01-217 Warsaw, Poland. Loading the widget transfers to that provider your IP address, device information and the address of the page the widget sits on, and stores that provider’s cookies. Booking an appointment in that widget is governed by the privacy policy of the ZnanyLekarz service, which is then a separate controller of your data.

Providers of accounting, legal and advisory services

In particular an accounting office or a law firm - the Controller discloses collected personal data to a selected provider acting on its behalf only where and to the extent necessary to achieve a given purpose of processing consistent with this privacy policy.

Google privacy policyZnanyLekarz privacy policyCloudflare privacy policy

The Website contains NO social media plugins. Links to the practice’s social profiles are ordinary links: until you click one, they transfer no data.

The GDPR obliges the Controller to provide information about automated decision-making, including profiling, referred to in article 22(1) and (4) GDPR and - at least in those cases - meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The Controller does NOT use profiling or automated decision-making producing legal effects on the Website. The statistics described in chapter 7 are aggregate and are not used to assess an individual person.

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Right of access, rectification, restriction, erasure and portability - the data subject has the right to request from the Controller access to their personal data, its rectification, erasure (the „right to be forgotten") or restriction of processing, and the right to data portability. Detailed conditions for exercising these rights are set out in articles 15-21 GDPR.

Right to withdraw consent at any time - a person whose data is processed by the Controller on the basis of consent has the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. You can withdraw consent to statistical cookies using the „Cookie settings" link in the footer of every page.

Right to lodge a complaint with a supervisory authority - a person whose data is processed by the Controller has the right to lodge a complaint with a supervisory authority in the manner and procedure set out in the GDPR and in Polish law. The supervisory authority in Poland is the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

Right to object - the data subject has the right to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them which is based on article 6(1)(e) or (f) GDPR, including profiling based on those provisions. The Controller shall then no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims.

Right to object to direct marketing - where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, including profiling, to the extent that it is related to such direct marketing.

To exercise the rights described in this chapter, you may contact the Controller by sending a message in writing or by e-mail to the address of the Controller indicated in clause 1.2.

Cookies are small pieces of text information sent by a server and stored on the device of the person visiting the Website (for example on the hard drive of a computer or laptop, or in the memory of a smartphone, depending on the device used).

Cookies that may be sent by the Website fall into the following categories:

By provider

First-party cookies, created by the Controller’s Website, and third-party cookies, belonging to persons or entities other than the Controller.

By storage period on the device

Session cookies, stored until the browser is closed, and persistent cookies, stored for the period defined by the parameters of each file or until they are removed manually.

By purpose

Essential, enabling the Website to work properly; functional, adapting it to the visitor’s preferences; analytical, gathering information about how the Website is used; marketing, advertising and social, gathering information about the visitor in order to display personalised advertising.

The Website uses only the categories listed below. It uses no social cookies. Since 9 September 2026 the Controller runs an advertising campaign in Google Ads and measures its results - advertising cookies serve ONLY that measurement, not profiling and not showing you ads on other sites:

Essential

Remembering your answer from the consent dialog so that you are not asked again on every visit. It is stored in the browser’s local storage under the name „ozzy:zgoda_v2" and is not sent to any server. It requires no consent, because without it the consent dialog could not work.

Analytical (statistical)

Keeping aggregate visit statistics: the „_ga" and „_ga_XPTCJHPNGB" files belonging to Google Ireland Limited, stored for up to 2 years. They are written ONLY after consent has been given in the consent dialog. Withdrawing consent deletes them from the browser.

Advertising (measuring ad results)

Checking which Google Ads advertisement led to contacting the practice: the „_gcl_au” and „_gcl_aw” files belonging to Google Ireland Limited, stored for up to 90 days. They are written ONLY after consent has been given in the consent dialog. Withdrawing consent deletes them from the browser. The Controller runs NO remarketing and no personalised advertising, so these files are not used to show you ads outside this site.

Cookies of the booking widget provider

The ZnanyLekarz booking widget stores its own cookies. They are necessary for booking to work, and that service is responsible for them as a separate controller.

Consent to analytical cookies and consent to advertising cookies are given in the consent dialog shown on your first visit. These are TWO SEPARATE consents: you may accept one and refuse the other. Until consent is given, the Website stores no analytical or advertising cookies. You can withdraw either consent at any time using the „Cookie settings" link in the footer - it works on every page and asks the question again.

By default most web browsers accept the storing of cookies. Everyone can define the conditions for using cookies through their own browser settings. This means that you can, for example, partly limit or completely disable the storing of cookies - in the latter case this may affect some functions of the Website.

Browser settings do NOT replace the consent given in the consent dialog. They are an additional tool: they let you delete previously stored files or block them regardless of the decision made in the dialog. Detailed information about changing these settings can be found in the help section of your browser:

ChromeFirefoxSafariMicrosoft EdgeOpera

The Controller uses Google Analytics 4 on the Website, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The service helps the Controller keep statistics and analyse traffic on the Website. The data gathered is aggregate and covers, among other things, the source and medium a visitor came from, their behaviour on the Website, device and browser information, approximate location and a truncated IP address. The service starts only after consent has been given, and strictly so: until then its code is NOT loaded at all, so no connection to Google servers and no cookie comes into being.

Independently of the consent dialog, it is possible to block sharing information about your activity on websites with Google Analytics by installing the browser add-on provided by Google.

Google Analytics opt-out add-on

The Website may contain links to other websites. The Controller encourages you to read the privacy policy established there after moving to another site. This privacy policy applies only to the Controller’s Website.

The Controller may amend this privacy policy, in particular where the set of tools used on the Website changes or where the applicable law changes. The date of the last change is given at the top of this document.