This is an English translation provided for information. The Polish version of this policy is binding.
This Privacy policy sets out the rules for processing personal data and using cookies in connection with the use of the website https://www.smilebonding.pl/ (the “Website”).
Part I – Introductory information
§ 1. General provisions
- The controller of personal data is Smile Bonding Studio spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Gdańsk, ul. Obrońców Westerplatte 32B, 80-317 Gdańsk, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number 0001197235, NIP (tax ID) 5842874340, REGON 542850115, share capital PLN 5 000.00 (the “Controller”).
- The Controller can be contacted on personal data protection matters by email at kontakt@smilebonding.pl or by phone: [PHONE NUMBER].
- The Privacy policy concerns the processing of personal data of people who:
- contact the Controller,
- book a visit or consultation,
- use healthcare services provided by the Controller (Patients),
- sign up for the Newsletter,
- consent to receiving marketing content from the Controller,
- use the Website.
- The terms used in this Privacy policy mean:
- Controller: Smile Bonding Studio spółka z ograniczoną odpowiedzialnością with its registered office in Gdańsk, ul. Obrońców Westerplatte 32B, 80-317 Gdańsk, KRS 0001197235, NIP 5842874340;
- Website: the website available at https://www.smilebonding.pl/;
- User: any person visiting the Website or using its features;
- Patient: a natural person using healthcare services provided by the Controller;
- Healthcare services: activities aimed at maintaining, saving, restoring or improving health, in particular in the fields of dentistry and aesthetic medicine, provided by the Controller;
- Medical records: records kept by the Controller in accordance with the Act on Patient Rights and the Patient Rights Ombudsman and its implementing regulations;
- Newsletter: email messages containing information about the Controller’s services and content on oral health and smile aesthetics, sent to the email address provided by the User;
- GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
- Act on Patient Rights: the Polish Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman.
- The Controller has not appointed a Data Protection Officer. [FOR LEGAL REVIEW]
Part II – Processing of personal data
§ 2. People contacting the Controller
- Scope of data: the Controller processes data provided voluntarily, in particular: first name and surname, email address, phone number and the content of the message.
- Purposes and legal bases of processing:
- replying to an enquiry: Article 6(1)(f) GDPR (the Controller’s legitimate interest),
- taking steps prior to entering into a contract: Article 6(1)(b) GDPR.
- Retention period: data are kept for the period necessary to handle the enquiry and for the limitation period for claims.
- Note: the Controller asks you not to include information about your health in messages. If such information is provided, the legal basis for its processing is Article 9(2)(a) GDPR (explicit consent resulting from providing the data voluntarily in order to receive a reply).
§ 3. People booking a visit or consultation
Bookings are made by phone, through the form on the Website or through the online booking system [SYSTEM NAME].
- Scope of data: first name and surname, email address, phone number, preferred date, type of service, and additional information provided voluntarily.
- Purposes and legal bases of processing:
- arranging and confirming the visit: Article 6(1)(b) GDPR,
- reminding you of the visit date: Article 6(1)(f) GDPR,
- establishing, pursuing or defending claims: Article 6(1)(f) GDPR.
- Retention period: data are kept for the period necessary to carry out the visit and for the limitation period for claims. If the booking results in the provision of a healthcare service, the data become part of the medical records and are subject to the periods stated in § 4.
§ 4. Patients using healthcare services
- Scope of data: first name and surname, PESEL number (or, if none, the type and number of an identity document), date of birth, home address, contact details, details of the legal guardian (if applicable), and health data, including the medical history, diagnosis, course of treatment, diagnostic images and photographic records, and information about medicines taken and contraindications.
- Purposes and legal bases of processing:
- providing healthcare services and managing healthcare services: Article 6(1)(c) GDPR and Article 9(2)(h) GDPR in conjunction with the Act on Patient Rights and the Act on Medical Activity,
- keeping and storing medical records: Article 6(1)(c) GDPR in conjunction with Article 24 et seq. of the Act on Patient Rights,
- fulfilling accounting and tax obligations: Article 6(1)(c) GDPR,
- establishing, pursuing or defending claims: Article 6(1)(f) GDPR and Article 9(2)(f) GDPR.
- Retention period: medical records are kept for 20 years from the end of the calendar year in which the last entry was made, with the exceptions provided for in Article 29 of the Act on Patient Rights. Accounting documents are kept for 5 years from the end of the year in which the tax obligation arose.
- Professional secrecy: people practising a medical profession at the Controller are obliged to keep confidential any information about the Patient obtained in connection with providing healthcare services.
- Voluntary nature: providing the data is a statutory requirement. Refusing to provide them makes it impossible to provide a healthcare service.
§ 5. People signing up for the Newsletter
- Scope of data: first name and email address.
- Purpose of processing: sending commercial and marketing information about the Controller’s services.
- Legal basis: Article 6(1)(a) GDPR (consent).
- Processing period: data will be kept until consent is withdrawn or the Newsletter service ends. Consent can be withdrawn at any time by clicking the unsubscribe link in the Newsletter or by sending a message to kontakt@smilebonding.pl.
§ 6. People who have consented to marketing contact
- Scope of data: first name, email address, phone number (if provided), and information about the consents given.
- Purposes of processing:
- sending commercial information by electronic means about the Controller’s services,
- direct marketing of the Controller’s own services, including contact by phone or text message,
- analysing the effectiveness of marketing activities.
- Legal basis: Article 6(1)(a) GDPR (consent).
- Processing period: until consent is withdrawn, but no longer than the limitation period for claims.
- Withdrawing consent: consent can be withdrawn at any time by clicking the unsubscribe link in an email or by sending a message to kontakt@smilebonding.pl. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.
- Right to object: the data subject has the right to object to the processing of their data for direct marketing purposes. If an objection is raised, the Controller will stop processing the data for that purpose.
§ 7. Data collected automatically
When the Website is used, technical data may be collected automatically, in particular: IP address, date and time of connection, browser type, operating system type, device data and server logs.
These data are used to ensure that the Website works properly, to ensure security, to detect abuse and for statistical analysis.
Legal basis: Article 6(1)(f) GDPR. Retention period: no longer than 3 years from when the data were obtained.
§ 8. Recipients of data
Personal data may be transferred to the following categories of recipients:
- entities providing technical and organisational services to the Controller, in particular providers of email, hosting and cloud services, IT infrastructure and practice management software, under data processing agreements;
- entities providing tools for booking visits and sending text message and email reminders;
- dental laboratories and diagnostic centres, to the extent necessary to provide the healthcare service;
- people practising a medical profession who cooperate with the Controller, including consulting doctors;
- entities providing electronic payment solutions;
- entities providing advisory, legal, tax, accounting or audit services to the Controller, to the extent necessary to provide those services;
- entities authorised to obtain data under applicable law, in particular courts, public administration bodies and law enforcement authorities.
Personal data are transferred only to the extent necessary for the specific purposes of processing and with the appropriate data protection measures required by law.
§ 9. Transfer of data outside the EEA
Where tools from providers outside the European Economic Area are used, data may be transferred outside the EEA. Such transfers take place only using the mechanisms provided for in Chapter V GDPR, in particular standard contractual clauses (SCCs), an adequacy decision or the EU-US Data Privacy Framework.
Medical records are not transferred outside the European Economic Area.
§ 10. Rights of data subjects
The data subject has the right to:
- access their data,
- rectify their data,
- erase their data,
- restrict processing,
- data portability,
- object,
- withdraw consent,
- lodge a complaint with the President of the Personal Data Protection Office (UODO).
Limitations concerning medical records. The right to erasure and the right to object do not apply to data contained in medical records for as long as the Controller is obliged to keep them under Article 29 of the Act on Patient Rights (Article 17(3)(b) and (c) GDPR). Data in medical records are rectified in the manner provided for by law, without deleting the original entry.
§ 11. Automated decision-making
Personal data are not used for automated decision-making or profiling.
§ 12. Voluntary provision of data
Providing data is voluntary but necessary to enter into and perform a contract, book a visit and receive the Newsletter. Not providing the data may make these activities impossible. In the case of healthcare services, the requirement to provide the data listed in § 4 arises from the law.
Part III – Cookies
§ 13. General information
The Website uses cookies and other tracking technologies. Cookies are computer data stored on the User’s end device.
§ 14. Purposes of using cookies
- ensuring that the Website works properly,
- maintaining the User’s session,
- statistical analysis,
- marketing activities (if applicable).
§ 15. Types of cookies
- First-party cookies: files placed on and read from the User’s device by the Website’s IT system.
- Third-party cookies: files placed on and read from the User’s device by the IT systems of external websites.
- Session cookies: files placed and read during a single device session. They are deleted when the session ends.
- Persistent cookies: files stored until they are deleted manually. They are not deleted automatically when the session ends, unless the User’s device is configured otherwise.
§ 16. Retention period
The cookies used by the Website are stored on the User’s device for the time specified in their parameters or until the User deletes them.
§ 17. Deleting and disabling cookies in the browser
The Controller’s right to store and access cookies is based on the consent given by the User. The User can return to these settings at any time and specify the conditions for storing or accessing this information.
By default, web browsers allow cookies to be placed on the device. The settings can be changed to block automatic handling of cookies or to be notified each time they are sent. Below are links to instructions for the most popular browsers:
Last updated: 23.07.2026