Privacy Policy

Controller and contact details

The controller of your personal data is Medical-Elektro Mariusz Bielecki, Marcinkowo 154, 11-700 Mrągowo, Poland, Polish tax identification number (NIP) 742-108-26-19. For matters concerning data protection and your rights, you can write to info@medical-elektro.pl or send a letter to the address above.

This policy explains how we process data when you use our website, contact us, enter into contracts with us and during their performance, or sign up for the newsletter we are preparing.

Enquiries and correspondence

When you use the contact form or email us, we receive the contact details and message content you provide. Our forms require your full name and email address. Company name, telephone number, postcode and city are optional. An enquiry sent from a product page also includes information about the selected device.

We use the data to respond, prepare an offer and conduct correspondence. If you contact us on your own behalf with a view to entering into a contract, the legal basis is taking steps at your request before entering into that contract — Article 6(1)(b) GDPR. In other cases, including contact with a company representative, the basis is our legitimate interest in handling enquiries and business contacts — Article 6(1)(f) GDPR.

Providing data is voluntary, but we cannot respond to an enquiry without contact details. We do not need patient data or information about patients’ health — please do not include it in your messages. We handle enquiries through email and do not transfer them to a CRM system.

Retention of correspondence

We retain enquiries for the time needed to respond and conduct discussions about the matter. We retain inactive enquiries that have not led to a contract for no longer than 6 months from the last contact concerning the matter. We delete them earlier if they are no longer needed for the purposes set out in this policy.

If correspondence is needed for a specific dispute, we retain the necessary data until the matter is concluded and for the time needed to establish, exercise or defend that claim. The basis is our legitimate interest in protecting our rights — Article 6(1)(f) GDPR.

We use OVHcloud email through Hosted Exchange and Email Pro. In the published specifications for Hosted Exchange and Email Pro, the provider states that backups are made daily and retained for 14 days. This period concerns the provider’s backups and is separate from the retention period for current correspondence.

OVHcloud also processes certain technical data as an independent controller to protect its services and meet legal obligations. It explains this in its data protection policy. It determines how long security-related data is retained on the basis of a risk assessment. For data used to identify users of hosted websites and electronic communications services, it applies the retention periods required by law. These rules concern processing by OVHcloud; they do not determine how long the content of our correspondence is retained.

Sales, accounting and complaints

If you enter into a contract with us, we process the data needed to perform it: identification and contact details, billing information, order information and data needed to hand over or deliver the equipment. The basis is performance of the contract — Article 6(1)(b) GDPR. We use company representatives’ data on the basis of our legitimate interest in maintaining business contacts — Article 6(1)(f) GDPR.

We issue invoices in the Subiekt system and pass them to the external accounting firm that handles our accounts. We process data used to fulfil tax and accounting obligations on the basis of a legal obligation — Article 6(1)(c) GDPR.

We retain tax documents until the limitation period for the tax liability expires — generally for 5 years from the end of the year in which payment of the tax fell due. This period may be extended in cases provided for by law, particularly where the limitation period is suspended or interrupted. Invoices submitted to Poland’s National e-Invoicing System are subject to a separate retention period in that system: 10 years from the end of the year in which the invoice was issued.

We retain data concerning contract performance, complaints or warranty matters for the time necessary to fulfil the relevant obligations and conclude the matter. To the extent required by law, the basis is Article 6(1)(c) GDPR; for fulfilling contractual obligations, it is Article 6(1)(b) GDPR. If necessary data is subsequently needed to establish, exercise or defend claims, we retain it under Article 6(1)(f) GDPR for the period applicable to the claim, taking ongoing proceedings into account. This does not mean retaining all correspondence regardless of its usefulness.

Providing the data necessary to enter into and perform a contract is a condition for its performance. Tax regulations determine which data must appear on an invoice. Without the required data, we cannot perform the contract or issue a correct invoice, as applicable. Providing any other data is voluntary.

Website operation and security

When you connect to the website, technical data is processed, such as your IP address, the date and time of the request, the address of the page opened and information about your browser and device operating system. This data is used to provide access to the website, detect errors and protect against abuse. The basis is our legitimate interest in ensuring the website’s operation and security — Article 6(1)(f) GDPR.

Our forms are protected by Google reCAPTCHA. The protection starts when you open the product enquiry form or begin using the contact form. Once started, it may remain active until you leave the page, including after you close the enquiry window. We do not load this service on pages without a form. Google processes this service’s data on our behalf under the Google Cloud data processing terms. The service analyses technical device and connection data and signals from interactions with the website to distinguish a user from an automated program. It may store a security cookie. It also works when you have not enabled statistics, the map or the newsletter form. If the protection prevents you from submitting a form, you can contact us directly by email or telephone.

The main website’s fonts are downloaded from our server. The newsletter form, which only loads after your consent, also uses Google Fonts. When its fonts are downloaded, Google receives connection data, including your IP address and browser information. Google Fonts is used to display text; we do not use this service to measure traffic.

Website backups allow us to restore the website’s operation in the event of a failure. In WordPress, we retain the 7 most recent daily database backups and the 2 most recent full backups made weekly. These are website backups; they do not determine how long email messages are retained.

In addition to the backups made in WordPress, our hosting provider cyber_Folks backs up the website’s files and database. In its published rules for shared hosting, the provider states that these backups are made daily and retained for up to 28 days.

Under section 5(2) of the cyber_Folks hosting terms, after the contract with the provider ends, data stored on the allocated server may be retained for 14–60 days and then deleted from its storage. This period concerns the end of the hosting service; it does not determine how long enquiries or messages in our email accounts are retained.

The retention periods for backups and data kept after the hosting service ends do not determine how long website access and error logs, server statistics data or technical email logs are retained. These are separate categories of data.

Google Analytics statistics

With your consent, we activate Google Analytics 4 to understand how visitors use the website and improve it. The service processes information about pages visited, events and the browser environment, linked to online identifiers. The legal basis is consent — Article 6(1)(a) GDPR.

In our Analytics configuration, the retention period is 2 months for event data and 14 months for user data. The user data period restarts with further activity. These settings do not determine the retention period for standard aggregated reports or the validity period of browser cookies. We describe cookie storage periods in the cookie policy.

More information is available in Google’s explanation of how it uses data when you use its partners’ sites and apps.

Interactive Mapbox map

When you enable Mapbox, we display an interactive map. The provider receives the data needed to handle the connection and display the map, including your IP address, browser information and the map elements requested. The basis for activating this service and transferring data is your consent — Article 6(1)(a) GDPR.

The map on our website does not obtain your device’s GPS location. Our company address and the directions link are available even when the map is disabled. The directions link leads to the external Google Maps service, whose rules apply once you open that service.

Mapbox generally retains IP addresses in connection logs for 30 days for billing, usage reporting and security. An exception applies to data needed for an ongoing investigation into a security incident, fraud or abuse. This period concerns Mapbox logs, not all records stored in your browser.

English-language newsletter

The newsletter form is provided by Ecomail. Loading it requires consent to this service in the cookie settings. Loading the form sends technical connection data to the providers of its resources, but does not subscribe you to the newsletter.

Subscribing requires a separate action: entering your email address and submitting the subscription form. The Medical Elektro newsletter is being prepared and will be sent in English. If you subscribe, we will use your email address to register your request and send the newsletter once mailing begins, on the basis of consent — Article 6(1)(a) GDPR. Consent to receive commercial messages is separate from consent to load the form.

The address submitted through the form is used to handle your subscription and send future newsletters. You can withdraw consent before mailing begins by writing to info@medical-elektro.pl.

We retain the data until you withdraw consent or we discontinue the newsletter, whichever occurs first. If we decide not to launch it, the purpose of retaining the addresses ceases to apply. After you unsubscribe, we may retain only data necessary to demonstrate that consent was given and withdrawn, honour your decision to unsubscribe or defend against specific claims — on the basis of the accountability obligation and, where applicable, our legitimate interest. We limit the scope and retention period to the relevant purpose. Disabling the form in the cookie settings does not remove your address from the subscription list.

Data recipients and service providers

Data is received by people authorised to handle correspondence and the website, and by providers of necessary services, to the extent appropriate to their tasks:

hosting provider cyber_Folks and email infrastructure provider OVHcloud;
our external accounting firm — in connection with accounting services and receiving invoices;
Google — in connection with Analytics, reCAPTCHA and downloading fonts for the newsletter form after consent to load it;
Mapbox, Inc. — when you use the interactive map;
ECOMAIL.CZ, s.r.o., based in Prague, and its infrastructure providers — when the form loads and in connection with the newsletter.

In connection with contract performance, data may also be received by payment service providers and, if we arrange delivery through an external party, the transport provider — to the extent necessary to provide the relevant service. We also disclose data to authorities and institutions legally entitled to receive it.

Providers that process data on our behalf do so within the scope of their service. Entities fulfilling their own legal obligations, such as banks or tax authorities, are responsible for processing within their own remit.

Processing outside the European Economic Area

Google, Mapbox and some of Ecomail’s infrastructure providers use international infrastructure. This may involve processing data outside the European Economic Area, particularly in the United States.

Transfers to US entities covered by the EU–US Data Privacy Framework take place under the European Commission’s adequacy decision for participants in that programme. For transfers not covered by such a decision, the providers’ terms provide for appropriate safeguards, particularly the European Commission’s standard contractual clauses.

For Google Analytics, these rules are set out in the data processing terms for Google Analytics services; for reCAPTCHA, they are set out in the Google Cloud data processing terms. Mapbox’s terms cover the Data Privacy Framework and standard contractual clauses. Ecomail uses infrastructure including Amazon Web Services; transfers to its providers are governed by the data processing agreement forming part of Ecomail’s terms and conditions. Documents describing the safeguards are available here:

You can obtain information about the safeguards relating to your data, including a copy of the relevant provisions, by writing to info@medical-elektro.pl.

Your rights

Under the conditions set out in the GDPR, you may request access to your data and a copy of it, rectification, erasure or restriction of processing. The right to data portability applies to data processed by automated means on the basis of consent or a contract.

If processing is based on our legitimate interest, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without giving a reason.

In the first panel, you can choose “Accept all” to enable Google Analytics, Mapbox and the Ecomail newsletter form, or “Necessary only” to decline all these services. Each choice takes one click. “Settings” lets you choose individual services. Declining does not prevent you from browsing our products or sending an enquiry.

You can withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal. You can change your consent for Analytics, Mapbox and loading the Ecomail form through “Cookie settings” in the footer. Withdrawing consent to load the form does not unsubscribe you from the newsletter.

Please send data-related requests to info@medical-elektro.pl. You may also lodge a complaint with the President of the Polish Personal Data Protection Office, or, in cases provided for by the GDPR, with a supervisory authority in another Member State, particularly where you habitually reside or work.

Automated analysis on the website

Google Analytics produces website usage statistics, and reCAPTCHA automatically assesses the risk of form abuse. We do not use these analyses on our website to make decisions about you that produce legal effects or similarly significantly affect you. If the protection rejects your submission, you can send your enquiry by email or telephone.