Privacy and Cookie Policy

1. General information

This Privacy and Cookie Policy sets out the rules for processing the personal data of users of the website of the Centre for Health and Social Prevention (“Website”), as well as the rules for using cookies and other technologies.

The Administrator takes particular care to ensure the security of personal data and the protection of users' privacy in accordance with applicable law, in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”),
• the Act of 10 May 2018 on the Protection of Personal Data,
• the Act of 12 July 2024 – Electronic Communications Law.

2. Data Administrator

The administrator of personal data is:

Animativ sp. z o.o., ul. Warszawska 146 lok. 5, 05-300 Mińsk Mazowiecki, Poland, e-mail: legal@animativhealth.com

The Website is operated in cooperation with Wroclaw Medical University (Uniwersytet Medyczny im. Piastów Śląskich we Wrocławiu), Department and Clinic of Pediatrics and Infectious Diseases, ul. Chałubińskiego 2a, 50-368 Wrocław.

For matters concerning the protection of personal data, you may contact the Administrator at the e-mail address: legal@animativhealth.com

3. Scope of processed data

The Administrator may process data provided voluntarily by the user, in particular:

• first and last name,
• e-mail address,
• telephone number,
• company name (if provided),
• the content of the message sent via the contact form or e-mail.

While using the Website, technical data may also be collected automatically, in particular:

• IP address (in shortened or anonymised form),
• date and time of the visit,
• browser type and version,
• operating system,
• address of the visited subpage,
• information about the user's device.

Technical data is used solely to ensure security, the proper operation of the Website, and to keep anonymous statistics.

4. Purposes and legal bases for processing data

Personal data may be processed for the following purposes:

• Contact with the user – in order to respond to a message sent via the contact form or e-mail. The legal basis for processing is Art. 6(1)(b) GDPR – as regards actions taken at the request of the person prior to entering into a contract, and in other cases Art. 6(1)(f) GDPR – the legitimate interest of the Administrator consisting in conducting correspondence.
• Provision of services or actions prior to entering into a contract – in order to present an offer or provide services rendered by the Administrator. Legal basis: Art. 6(1)(b) GDPR.
• Ensuring the security of the site – in order to protect the site against abuse and ensure the correct operation of the service. Legal basis: Art. 6(1)(f) GDPR.
• Keeping technical logs and site operation statistics – in order to ensure infrastructure security, error diagnostics and monitoring of the correct operation of the service. Legal basis: Art. 6(1)(f) GDPR – the legitimate interest of the Administrator.

5. Contact form

Using the contact form requires providing the data marked as mandatory.

Providing the data is voluntary; however, the absence of it will make it impossible to respond or prepare an offer.

Submitting the form means the conscious transfer of data to the Administrator in order to handle the enquiry.

6. Data recipients

Personal data may be entrusted to entities providing services to the Administrator, solely to the extent necessary to achieve the stated purposes, in particular:

• the hosting infrastructure provider (Vercel Inc.),
• IT service providers,
• the e-mail service operator,
• providers of infrastructure security services,
• entities providing accounting or legal services – where required.

The Administrator does not sell personal data and does not share it with third parties for marketing purposes.

In connection with the use of Vercel Inc. hosting infrastructure, some technical data (e.g. server logs or IP address) may be processed outside the European Economic Area.

In such cases, the Administrator ensures an adequate level of data protection in accordance with the GDPR, in particular through the use of Standard Contractual Clauses approved by the European Commission or other mechanisms provided for by law.

7. Tools used on the Website

The Website uses Umami Analytics (self-hosted) to keep anonymous visit statistics.

Umami Analytics:

• does not use cookies,
• does not use localStorage or sessionStorage,
• does not identify users,
• does not create user profiles,
• does not track users across websites,
• does not store full IP addresses.

Only anonymous statistical information is processed, such as: the number of visits, subpages visited, browser type, operating system, user's country, and the source of entry to the site.

The data is used solely to analyse the operation of the Website, improve the quality of services, and monitor performance and security. Due to the anonymous nature of the processing, the use of Umami Analytics does not require the user's consent.

8. Cookies

The Website does not use marketing or analytics cookies. Where technical cookies are used, they are used solely to the extent necessary for the proper operation of the Website and to ensure its security.

9. Managing cookies

The user can change cookie settings themselves using their web browser.

Disabling technical cookies may affect the proper functioning of some elements of the Website.

10. Data retention period

Personal data is stored for a period:

• necessary to respond to the enquiry,
• of conducting correspondence – no longer than 24 months after it ends, unless applicable law requires a longer retention period,
• of performing the contract or actions prior to entering into it,
• resulting from applicable legal provisions,
• until an effective objection to processing or a request to erase the data is submitted, unless the law imposes an obligation to retain it further.
• for technical logs – for the period necessary to ensure infrastructure security and in accordance with the hosting provider's retention policy.

11. Rights of data subjects

The data subject has the right to:

• access to the data,
• rectification of the data,
• restriction of processing,
• erasure of the data,
• object to processing,
• data portability,
• withdraw consent (where processing is carried out on its basis),
• lodge a complaint with the President of the Personal Data Protection Office.

The Administrator does not make decisions concerning users based solely on automated processing of data, nor does it apply profiling within the meaning of the GDPR.

To exercise their rights, the user may contact the Administrator at the e-mail address indicated in this Policy.

12. Data security

The Administrator applies appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, disclosure to unauthorised persons and modification of data. Security measures are updated on an ongoing basis according to the level of risk.

13. Links to external sites

The Website may contain links to third-party websites. The Administrator is not responsible for the privacy practices in force on those sites.

14. Changes to the Privacy Policy

The Administrator reserves the right to make changes to this Privacy Policy, in particular in the event of changes in the law, technological changes, development of the Website's functionality, or changes in the manner of providing services. The current version of the document is published on the Website each time.

15. Contact

For matters related to the protection of personal data, you may contact the Administrator at: legal@animativhealth.com

In matters not regulated by this Policy, the provisions of the GDPR and the relevant provisions of Polish law shall apply.

This Privacy Policy applies from the date of its publication on the Website.