Information on the processing of personal data under Article 13 GDPR
Osteopatia Promenada™
Version dated 31 July 2026
1. Data Controller
The controller of your personal data is Maciej Sędłak, conducting business under the name Osteopatia – Maciej Sędłak, trading as Osteopatia Promenada™.
Address: ul. Kilińskiego 2B/1, 63-100 Śrem, Poland
NIP: 7851743839
Telephone: +48 690 900 690
Email: promenada@2b1.pl
Website: 2b1.pl
For questions about personal data or to exercise your rights, please contact the Controller using the details above.
2. Why we process personal data and the legal basis
We may process your personal data to respond to enquiries, arrange, change or cancel appointments, and take steps requested before entering into a service contract. The legal basis is Article 6(1)(b) GDPR.
We process ordinary personal data required to provide our services under Article 6(1)(b) GDPR. Where health information is necessary to assess treatment safety or provide a service, it is processed primarily on the basis of explicit consent under Article 9(2)(a) GDPR. In exceptional circumstances, including the establishment, exercise or defence of legal claims, other lawful bases permitted by the GDPR may apply.
We process payment, invoice and accounting information to comply with applicable legal obligations. The legal basis is Article 6(1)(c) GDPR.
We may process data to address complaints, protect our systems, establish, exercise or defend legal claims, and demonstrate compliance. The legal basis is our legitimate interest under Article 6(1)(f) GDPR and, where health information is relevant to legal claims, Article 9(2)(f) GDPR.
Marketing communications, photographs, testimonials, recordings and case descriptions are processed only where the required separate consent has been obtained. The legal basis is Article 6(1)(a) GDPR and, for health information, Article 9(2)(a) GDPR.
3. Categories of data and recipients
Depending on the matter, we may process identity and contact details, appointment and service information, health information, payment and invoice details, correspondence, consent records, and technical website data such as IP address and cookie identifiers.
Where necessary, personal data may be shared with appointment-booking, hosting, email, SMS, IT-support and payment providers; accountants; legal advisers; insurers; secure record-management providers; and authorised public bodies. Health information is not disclosed for advertising purposes.
4. Transfers outside the European Economic Area
Some technology, hosting, email, analytics or booking providers may process data outside the European Economic Area. If this occurs, the Controller will use a transfer mechanism permitted by the GDPR, such as an adequacy decision or Standard Contractual Clauses. Information about the safeguard used can be requested from the Controller.
5. Retention period
We retain data only for as long as necessary for the purpose for which it was collected. Enquiries and correspondence are kept for the period needed to close the matter and address potential claims. Appointment, service and health information may be retained for the duration required for safe service delivery, legal protection, insurance, and applicable limitation periods. Tax and accounting records are retained for periods required by law. Marketing data is retained until consent is withdrawn, an objection is raised, or the purpose ends. Technical logs and cookies are retained for the periods described in the website’s Privacy Policy and cookie settings.
6. Is providing data required?
Providing data is generally voluntary. However, certain information is required to answer an enquiry, book an appointment, provide a service safely, identify contraindications, issue an invoice, or meet legal obligations. Without necessary contact or health information, we may be unable to arrange or safely provide a service. Providing data for marketing, testimonials, photographs, or case descriptions is voluntary.
7. Your rights
Subject to the conditions and exceptions set out in the GDPR, you may request access to your data, rectification, erasure, restriction of processing, portability where applicable, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You may also object at any time to direct marketing.
To exercise your rights, email promenada@2b1.pl or write to the Controller at the address above. We normally respond within one month, subject to the GDPR rules on extensions for complex or numerous requests.
You may lodge a complaint with the Polish supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO).
8. Automated decision-making
We do not make decisions about patients or website users based solely on automated processing, including profiling, that would produce legal or similarly significant effects.
9. More information
This notice is a concise information obligation. For a fuller description of processing activities, cookies, retention, and external services, please read our Privacy Policy.