In an effort to ensure the best possible protection of the personal data that is provided to our company for the performance of services, we would like to inform you that we are fully prepared to protect your personal data at the highest level, taking into account the provisions of the Regulation of the European Parliament and of the Council of the EU 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data (RODO).

You are very much requested to read the following information:

1. 1 The administrator of your personal data is LUXMED - Uzdrowisko Nałęczów Sp. z o.o., 24-150 Nałęczów al. Kasztanowa 6, NIP 716 22 85 002, REGON 431094600.
2. 2. Kontakt do Inspektora Ochrony Danych, e-mail: iod@luxmednaleczow.pl - Piotr Harańczyk
3. (3) Your personal data shall be processed on the basis of: the consent of the data subject, a contract when the data subject is a party thereto or when it is necessary to take action prior to entering into a contract at the request of the data subject, and a legitimate interest pursued by the controller or recipients of the data when the processing does not violate the rights and freedoms of the data subject.
4. 4 Your personal data is processed for:
   - use of medical services (treatment procedures) and other services related to the activity,
   - presenting an offer, concluding and executing contracts and orders, in particular in connection with business correspondence realizing the right or fulfilling the obligation arising from the law, including in particular to issue and transfer invoices, keeping accounting books and tax documentation, realizing legal obligations incumbent on the Administrator (Article 6(1)(c) RODO)
   - to ensure safety and order and the protection of persons and property - video surveillance, telephone call recorder,
   - in case of consent in order to provide marketing content to your phone number and/or e-mail address (Article 6(1)(a) RODO), i.e. to provide promotional, advertising services, including providing newsletters, price lists, promotional offers, commercial information,
   - asserting and defending against business claims, as well as direct marketing of the administrator's own products and services, as part of the administrator's legitimate interest (Article 6(1)(f) RODO); - handling complaints;
   - for archival purposes.
   
5. (5) The personal data you provide will not be shared with other recipients; they will not be transferred to a third country.
6. (6) Recipients of your personal data will be only entities authorized to obtain personal data under the law and entities participating in the implementation of the service.
7. 7 Your personal data will be stored until you revoke your consent ( applies to marketing consents), until the expiration of the legitimate reason for storing them, and for the period indicated by the law to the extent necessary for the assertion of claims and in the provisions relating to: archiving of documentation, tax or banking law.
8. 8 You have the right of access to the content of your data and the right to rectification, erasure, restriction of processing, the right to data portability, the right to object, the right to withdraw consent at any time without affecting the legality of the processing performed on the basis of consent before its withdrawal.
9. (9) You also have the right to lodge a complaint about the Administrator's processing of your data to the President of the Office for Personal Data Protection (uodo.gov.pl)if you consider that the processing of your personal data violates the provisions of the RODO.
10. 10. providing your personal data is voluntary, however, if you do not provide them, it will not be possible to achieve the purposes of processing related to the provision of medical services, performance of the contract, issuance of an invoice. Provision of data for marketing purposes is voluntary, and their failure to do so, including failure to provide consent will not affect the manner in which other purposes of processing are carried out.
11. (11) The processing of personal data of a child staying with a legal guardian on a holiday stay shall be carried out only if the consent has been given by the person exercising parental authority or guardianship over the child, and only to the extent of the consent given. Once the purpose of processing (termination of the stay at the hotel) has ceased, the child's data will be deleted immediately.
12. 12. your data will not be processed by automated means including profiling.