Privacy Policy

Last updated: 18 September 2026

This is an English courtesy translation of our Polish Privacy Policy. In case of conflict between the two versions, the Polish version prevails.

1. Data Controller

The controller of your personal data within the meaning of Article 4(7) GDPR is [COMPANY NAME], seated in [CITY], address: [STREET], Tax ID: [NIP], Company Register (KRS): [KRS] (hereinafter “the Controller” or “we”).

For any questions related to personal data, contact us at: kontakt@lissemedical.com.

2. Purposes and Legal Basis of Processing

We process your personal data for the following purposes:

• Handling enquiries and providing responses — Article 6(1)(f) GDPR (our legitimate interest in responding to questions addressed to us).
• Concluding and performing service agreements for the lisse system — Article 6(1)(b) GDPR.
• Issuing invoices and maintaining accounting records — Article 6(1)(c) GDPR read with the Polish Accounting Act and Tax Ordinance.
• Direct marketing of our own services (newsletter, promotions) — Article 6(1)(a) GDPR (your consent), which you may withdraw at any time.

3. Recipients of Data

We may share your data with:

• our hosting providers (Fly.io Inc., Cloudflare Inc., Neon Inc.),
• our email service provider (Brevo / Sendinblue SAS),
• our legal and accounting advisers,
• entities authorised under applicable law.

We do not transfer your data outside the European Economic Area except when required by our service providers with infrastructure in the United States. In such cases, transfers are made under the European Commission’s Standard Contractual Clauses.

4. Retention Period

• Contact data: 12 months from your last interaction with us, unless an agreement is concluded earlier.
• Contract-related data: for the duration of the agreement plus 6 years thereafter (statute of limitations for civil claims).
• Invoices and accounting documents: 5 years from the end of the tax year (Tax Ordinance, Article 86).
• Medical records: 20 years from the last entry (Patient Rights Act, Article 29).
• Marketing data: until you withdraw consent or object to processing.

5. Your Rights

Under GDPR you have the following rights:

• Right of access to your data and to obtain a copy (Article 15).
• Right to rectification of inaccurate data (Article 16).
• Right to erasure (“right to be forgotten”) — Article 17. We implement this within our system while honouring statutory retention obligations under Polish law.
• Right to restrict processing (Article 18).
• Right to data portability (Article 20) — you receive your data in a ZIP archive of JSON files.
• Right to object to processing (Article 21).
• Right to withdraw consent at any time (Article 7(3)) — without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, address: ul. Stawki 2, 00-193 Warsaw, Poland; www.uodo.gov.pl).

6. Voluntariness of Providing Data

Providing personal data is voluntary but necessary for concluding and performing the service agreement for the lisse system and for us to respond to your enquiry. Providing data for marketing purposes is entirely voluntary.

7. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

8. Cookies

Details concerning cookies are described in our Cookie Policy.

9. Changes to this Policy

We reserve the right to make changes to this policy. We will notify you of any material changes prominently on the website and — where applicable — by email.