Information on personal data processing

Personal Data Controller’s information (NFZ patients)

Dear Patients,
on the basis of Article 24 section 1 and Article 25 section 1 of the Act of 29 August 1997 on personal data protection (i.e. Journal of Laws from 2016 item 922) we inform that The Controller of your personal data is “Uzdrowisko Świnoujście” S.A. ul. Nowowiejskiego 2 Świnoujście represented by President of “Uzdrowisko Świnoujście” S.A. “Uzdrowisko Świnoujście” S.A. collects data to pursue the legal and statutory tasks.

At “Uzdrowisko Świnoujście” S.A. the Personal Data Protection Inspector acts on behalf of the Personal Data Controller, with the respective power of attorney with regard to performing the activities on behalf of The President of “Uzdrowisko Świnoujście” S.A. (ADO).

The Personal Data Protection Inspector acts is authorized to transfer the personal data to authorized entities according to the provisions of the law.

The legal basis for data processing results from the Act of 27th August 2004. on health care benefits financed from public funds (Journal of Laws of 2016 item 1793 as amended).

Patient, you have the right to access the content of your data, the right to correct them and the right to inspect the processed personal data according to Art. 32-35 of the Act of 29 August 1997 on personal data protection.

Patient , you have the right to make use of the right to information no more often than once every 6 months. The Personal Data Protection Inspector (IODO) is obliged, within 30 days, to notify you about your rights and provide information in writing. You can exercise the aforementioned rights in the headquarters of ADO. Additional information can be found on the website www.uzdrowisko.pl , or at the email address: iodo@uzdrowisko.pl

 

Information Clause related to personal data processing at “Uzdrowisko Świnoujście” S.A. (NFZ patients)

According to Article 13 section 1 and section 2 of Regulation of the European Parliament and the Council (EU) 2016/679 of 27 April 2016 on protection of natural persons with regard to the processing of personal data and on free movement of such data and repealing directive 95/46/EC (General Data Protection Regulation) I inform that:

The Controller of your personal data is “Uzdrowisko Świnoujście” S.A. based in Świnoujście at ul. Nowowiejskiego 2 represented by the Personal Data Protection Officer with regard to the personal data processed centrally and, to the extent of personal data processed at “Uzdrowisko Świnoujście” S.A.

Contact details to the data protection officer at “Uzdrowisko Świnoujście ” S.A. are the following:
iodu@uzdrowisko.pl,

Your personal data will be processed to pursue the legal responsibilities and statutory duties, in particular under the Act of 27 August 2004 on health care benefits financed from public funds (Journal of Laws of 2017 item 1938 as amended).

The Recipient of your data will only be entities having the authorization to acquire personal data under the commonly binding legal regulations.

Your personal data can be transferred to a third country based on the binding provisions of the commonly binding law.

Your personal data will be stored for the period necessary for the purposes of performing the statutory tasks of “Uzdrowisko Świnoujście” S.A., defend against claims as well as tasks resulting from special acts including the Act of 14 July 1983 on the national archival inventory and archives (Journal of Laws of 2018 item 217).

Your provision of the personal data is related to the statutory requirement resulting from the provisions of the Act of 27 August 2004 on health care benefits financed from public funds (Journal of Laws of 2017 item 1938 as amended) in connection with respective regulations of the Act of 14 June 1960 – Code of Administrative Procedure (Journal of Laws from 2017 item 1257 as amended). Your failure to provide the data can affect the resolution in the administrative procedure.

You have the right to access the content of your data and the right to rectify them, have their processing restricted, the right to transfer the data (if provided in the given case), the right to submit an objection, the right to withdraw your consent at any time without any effect on conformity with the processing law  (if the processing is conducted on the basis of your consent), which has been completed under the consent prior to the withdrawal.

You have the right to lodge a complaint to the President of the Personal Data Protection Office against the activities undertaken by personal data controller, in connection with personal data processing.

Your transferred data will not be used for automated decision making or profiling.

 

 

Information clause related to personal data processing (hotel)

 According to Article 13 section 1−2 and Article 14 section 1-2 of the Regulation of the European Parliament and the Council (EU) 2016/679 of 27.04.2016 on protection of natural persons with regard to the processing of personal data and on free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal EU L 119 p. 1) – further GDPR − we inform that The Controller of your personal data is “Uzdrowisko Świnoujście” S.A. based in Świnoujście at ul. Nowowiejskiego 2 represented by the Personal Data Protection Officer with regard to the personal data processed centrally and, to the extent of the personal data processed at “Uzdrowisko Świnoujście” S.A.

            Contact details to the data protection officer at “Uzdrowisko Świnoujście ” S.A. are the following:
iodu@uzdrowisko.pl,

            Objectives and basis for processing your personal data is to perform the agreement concluded with the Controller or take activities, at your request, prior to its conclusion, in particular provide answers to requests concerning the services provided (basis: Article 6 section 1 letter b of GDPR), to meet the legal obligations of the Controller, in particular resulting from the Accounting Act – in order to perform their reporting and accounting duties (basis: Article 6 section 1 letter c GDPR) resulting from the Controller’s legally justified interests: conduct direct marketing of goods and to determine, defend against and pursue claims (basis: Article 6 section 1 letter f of the GDPR).

 

 In other cases, your personal data will be processed exclusively on the basis of the previously granted consent in order to and in the scope resulting from the content of this consent.       

            Information on acquiring your personal data The Controller receives your contact details directly from you (e.g. at the moment of using our services) or by the agency of other people (e.g. other entities being intermediaries in offering our services which you have provided your data to). In the event of direct contact you have full control over the scope of the data being made available to the Controller. When the data are provided by another person, the Controller usually collects just basic contact details, including: name, last name, e-mail address, telephone number, and, if necessary, other data resulting from the contract or order in association with which the personal data are provided.

 

            The Recipients of your personal data can be the Controller’s subcontractors, entities providing accounting, IT, advertising marketing, audit, consulting, legal, transport, courier services for the benefit of the Controller.

            The period in which the data will be stored Your personal data will be processed for the period necessary to perform the agreement and for the period in which claims related to this agreement can be raised and also for the period required in the binding law in connection with our obligation to discharge tax obligations.

 

            You have the right to:

  1. demand access to your personal data (also obtain copies)
  2. demand your personal data to be corrected when the data are incorrect or complete.
  3. demand your personal data to be removed (“the right to be forgotten”) in the case of any of the following circumstances:

            – the data are not necessary for the purposes which they have been collected or otherwise processed for,          

            – the person the data relate to has withdrawn their consent the processing is based on and there is no other basis for processing,    

            – the person the data relate has submitted an objection against the processing,

            – the data are processed not in line with the law.

            – the data must be removed in order to fulfill an obligation resulting from legal regulations,          

  1. a request is submitted to have the processing of your personal data restricted, in the case of any of the following circumstances:

            – the person the data relate to questions the correctness of the personal data,

            – data processing is unlawful, and the person the data relate to objects to their removal, demanding the restriction in return,        

            – the controller does not need the data for its purposes but the person the data relate to needs them to determine, defend against or pursue claims,     

            – the person the data relate to has submitted an objection against the data processing until determination whether the legally justified basis on the controller’s side is superior as compared to the basis for the objection.                    

  1. to transfer your personal data when:

       – the processing is conducted on the basis of the consent of the person the data relate to or based on an agreement concluded with such person,          

– the processing is automated,

  1. f) to submit an objection against the processing of your personal data when:

            – there are causes related to your particular situation,

            – the data are processed based on Article 6 section 1 f namely necessity for the purposes resulting from legally justified interests pursued by the controller                             

 

            To the extent that you have granted the consent to processing of the personal data, you have the right to withdraw at any time your consent to processing of the personal data without effect on compliance with the law of any processing which was carried out on its basis before the withdrawal.

 

            You have the right to file a complaint to the supervisory body (namely to the President of the Personal Data Protection Office), if, in your opinion, the processing of your personal data breaches the provisions of GDPR.

 

            Condition to conclude an agreement  Provision of the data is voluntary but if you do not provide the data, the agreement will not be concluded and we will not be able to provide the service for your benefit.

           

            Data transfer to a third state (namely outside the European

Economic Area), an international organization. Your personal data will not be transferred to any third state (namely outside the European Economic Area) or any international organization.

           

            Your personal data are not subject to automated decision making including  profiling.