Regulamin/Rodo | DR MARTA ROTH

ORGANIZATIONAL REGULATIONS OF THE MEDICINAL ENTITY DR ROTH SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (hereinafter referred to as: "Regulations")

§ 1 GENERAL PROVISIONS

These Organizational Regulations are established for the medical entity DR ROTH spółka z ograniczoną odpowiedzialnością, established by the company DR ROTH spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw at ul. Mikołaja Kopernika 15 lok.21, 00-359 Warsaw, entered into the register of entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw. Warsaw in Warsaw, XII Commercial Division of the National Court Register under KRS number 0001031652, REGON: 525076590, NIP: 5252952636, entered into the Register of Entities Performing Medical Activity kept by the Mazovian Voivode, book number 000000263708 (hereinafter referred to as the "Medical Entity").
The Medical Entity performs medical activity in a medical facility under the name: DR ROTH (hereinafter referred to as the "Medical Facility").
The Medical Entity operates on the basis of:
generally applicable legal provisions, including in particular:
the Act of 15 April 2011 on medical activity (consolidated text: Journal of Laws of 2018, item 2190, as amended - hereinafter referred to as the "Act on Patient Rights and the Patient Rights Ombudsman");
the Act of 6 November 2008 on patient rights and the Patient Rights Ombudsman (consolidated text: Journal of Laws of 2009, item 417, as amended - hereinafter referred to as the "Act on Patient Rights").
entry into the relevant Register of Entities Performing Medical Activity;
these Regulations.

§ 2 GOALS AND TASKS OF THE MEDICAL ENTITY

The primary goal of the Medical Entity is to provide comprehensive and specialist health services in the field of plastic surgery and dermatology, as well as to promote health and promote health-promoting behaviors.
The goal of the Medical Entity is also to improve the appearance of clients through the use of various procedures and treatments that are aimed at revitalizing the skin, reducing wrinkles, improving body proportions and other activities aimed at emphasizing natural beauty.
The tasks of the Medical Entity include in particular providing health services in the field of outpatient specialist care, as well as:
performing the duties resulting from the status of a health care entity;

systematic improvement of professional knowledge and skills;

observance of professional ethics;

providing recognized treatment methods, consistent with current medical knowledge;

use of medical equipment, which is under constant technical supervision and meets all quality standards required by law;
providing medical services with particular consideration of the safety and needs of patients and respecting the rights of patients;
other tasks assigned by the Head of the Medical Entity.
The goals and tasks of the Medical Entity referred to in § 2 sec. 1-3 are implemented, among others, within the framework of:
performing diagnostic and laboratory tests performed to identify the state of health;
analysis of individual patient and client needs and adaptation of therapy to specific cases;
monitoring the patient's health;
providing medical advice and consultations;
monitoring the patient's compliance with recommendations;
monitoring progress and adapting therapy to ensure optimal aesthetic and health results;
education on healthy lifestyle, ageing prevention and skin and beauty care options in order to maintain the effects achieved through aesthetic medicine.

§ 3 TYPE OF MEDICINAL ACTIVITY AND SCOPE OF HEALTH SERVICES PROVIDED

The Medical Entity conducts medical activity in the form of outpatient health services.

As part of its business, the Medical Entity provides health services in the scope of: specialist outpatient treatment (HC.1.3.3), other outpatient care (HC.1.3.9) and ultrasound diagnostic tests (HC.4.2.1).

§ 4 ORGANIZATION AND TASKS OF THE ORGANIZATIONAL UNITS OF THE MEDICAL ENTITY AND CONDITIONS OF THEIR COOPERATION

The Medical Facility operates the organizational unit DR ROTH located in Warsaw at ul. Mikołaja Kopernika 15 lok. 21, which consists of the following organizational units:
Aesthetic medicine clinic;
Plastic surgery clinic;
Ultrasound laboratory;
Dermatology clinic.
The tasks of the organizational units include providing comprehensive care for patients by providing health services in the field of outpatient specialist care, and in particular providing medical advice and consultations, as well as directing and conducting diagnostic tests.
All organizational units and the persons employed in them cooperate with each other in order to ensure the efficient and effective functioning of the Medical Entity in terms of diagnostics, treatment and administration and economy.
The organizational units of the Medical Facility cooperate with each other in order to provide comprehensive patient care. The detailed rules of cooperation are determined by the manager of the Medical Facility. All rooms of the Medical Facility meet the requirements

om appropriate to the type of medical activity performed and the scope of health services provided.

§ 5 METHOD OF MANAGING THE ORGANIZATIONAL UNITS OF THE MEDICINAL FACILITY

The activities of the Medical Entity are managed by the management board of DR ROTH sp. z o.o. with its registered office in Warsaw, which is the manager of the Medical Entity within the meaning of the provisions of the act on healthcare (hereinafter referred to as the "Manager").
The Manager represents the Medical Entity externally and makes decisions regarding its functioning.
The Manager exercises all rights and obligations imposed on the Medical Entity by generally applicable provisions of law.
The Manager may appoint managers of individual organizational units and the Director of the Medical Facility.
The Manager makes decisions related to the current activities of the Medical Entity, in particular regarding:
management of the personnel of the Medical Entity, including determining the duties, competences and rights of individual persons;
approval of procedures, instructions and other internal normative acts, with the exception of the Regulations;
managing the work of the subordinate part (or the whole) of the Medical Facility;

distributing tasks (including permanent tasks) and resources for their execution, taking into account their rank, priority, professional qualifications and the current workload of direct contractors;
supervision over the efficiency and effectiveness of work organization;
official supervision over the performance of individual tasks by subordinate employees;
providing explanations and professional advice to subordinate employees;
supervision over the working conditions of employees, with particular emphasis on the regulations concerning safe occupational health and fire safety;
observance and supervision of compliance by subordinate employees with legal regulations, internal normative acts and applicable ethical standards;
conducting systematic employee assessments;
examining job candidates;
requesting to reward or punish subordinate employees;
putting forward proposals for improving work. The following job positions are available in the Medical Facility:
medical:
Dentist
Doctor
non-medical:
Cosmetologist
Receptionist/Patient Caregiver
The basic duties within the scope of the positions referred to in: § 5 point 6.1 include:
providing health services in accordance with due diligence and current medical knowledge;
determining and giving opinions on the patient's health condition;
educating patients;
monitoring the health condition of patients;
issuing opinions and certificates, issuing prescriptions, referring patients for additional specialist consultations by issuing a referral;
keeping medical records;
supervising the patient care process to the appropriate extent, including supervising the patient's compliance with recommendations.
§ 5 point 6.2.1 includes:
performing cosmetic treatments, indicated in the price list of the Medical Entity located in Annex No. 1 to the Regulations;
assessing the condition of patients' skin and selecting appropriate products and treatments, taking into account the individual needs of the client; providing cosmetic advice;
close cooperation with a doctor in the event of the need to provide assistance in the field of aesthetic medicine;
education of patients/clients.
§ 5 point 6.2.2 includes:
organizing the current work of the Reception Desk;
organizing and supervising the proper service of patients and clients at the Reception Desk, in particular answering telephones, booking appointments, providing information on the scope and principles of providing health services;
ensuring safe and hygienic working conditions;
ensuring the proper use and technical condition of the equipment located in the Medical Entity;
ensuring the correct and timely settlement of services provided, charging fees;
performing other assigned tasks by authorized persons.

§ 6 PLACE OF PROVIDING HEALTH SERVICES AND COSMETIC TREATMENTS

The Medical Entity provides health services and cosmetic treatments in the Medical Facility located at the following address: ul. Mikołaja Kopernika 15 lok. 21, 00-359 Warsaw.
Health services and cosmetic treatments are provided during the days and hours of operation of the Medical Facility or its individual organizational units.
In order to ensure the safety of patients and employees of the Medical Facility and to protect property, monitoring is carried out in the Medical Facility, in publicly accessible rooms, using devices that enable image recording. Image recordings obtained as a result of monitoring are used only for the purposes for which they were collected, and are stored for a period of no longer than 3 (three) months from the date of recording. After this period, image recordings containing personal data obtained as a result of monitoring are subject to destruction, unless their retention is required by law.

§ 7 PROCESS OF PROVIDING HEALTH SERVICES AND COSMETIC TREATMENTS

The Medical Facility provides health services and cosmetic treatments (hereinafter referred to as: "

Services") to the extent specified in these Regulations, ensuring proper availability and quality of Services in the organizational unit and all organizational units indicated in § 4 sec. 1, in a manner that guarantees patients the most convenient form of using the Services.

The Medical Entity provides Services:

for a fee in accordance with the current price list for the Provision of services indicated on the website: https://www.drmartaroth.com/

free of charge in the case of Services provided to a person in need of immediate assistance due to a threat to health or life, when it is indicated that the patient had no other possibility of obtaining assistance.

The Services are provided on set dates, after making a reservation.

Patients are registered for individual Services in the Medical Entity on-site at the Medical Entity's facility, by phone, e-mail or using the contact form on the website www.drmartaroth.com. The appointment is temporary and constitutes only a PRELIMINARY BOOKING of the date of the Service at the Entity. The booking is made when the patient pays a deposit of PLN 200, which means that without a prior payment of the deposit, the Medical Entity is not obliged to perform the Service covered by the booking. The booking is considered to be made when the deposit amount is posted on time to the bank account of DR ROTH SP. Z O.O. The preliminary booking then becomes a CONFIRMED Booking.

Patients are asked to pay the deposit before the visit, within 24 hours of making the preliminary booking, via the payment link received to the telephone number or e-mail address provided by them or immediately after arranging the appointment at the Medical Entity in cash or by payment card.

Failure by the Patient to pay the deposit in accordance with these Regulations is tantamount to the withdrawal by DR ROTH SP. Z O.O. from the agreement concluded with the patient for reasons attributable to the patient and withholding the deposit.
Payment of the deposit means acceptance of the conditions specified in these Regulations by the person making the reservation.
Services are provided on the date agreed with the patient on the days and hours of operation of the Medical Facility.
The provision of Services requiring the patient's personal presence is possible only after the patient has reported immediately before the provision of the health service for which the patient has been registered, at the reception desk of the Medical Facility after presenting an identity card with the patient's photograph.
Services are provided in a manner that ensures compliance with the legal requirements appropriate for individual Services, with due diligence and up-to-date medical knowledge by persons performing the medical profession and with respect for the patient's rights.
The patient who has made a reservation is obliged to arrive for the visit on time. If the patient's delay does not exceed 15 minutes, the delay time is deducted from the time planned for the procedure. In the event of a delay exceeding 15 minutes, the Medical Entity may refuse to provide the Service by withdrawing from the agreement for reasons attributable to the patient and retaining the deposit or, at the option of the Medical Entity, setting a new appointment date and retaining the deposit on account of the same.

Regardless of other cases described in the Regulations, the Medical Entity may refuse to provide the Service if:
The Patient has refused to consent to the provision of the Service according to the template applicable at the Medical Entity;
The Patient is not eligible for the Service, which will be determined by a doctor or cosmetologist;
The Patient does not consent to signing the required consents;
The Patient is in a condition that makes it impossible to provide the Service, e.g. is under the influence of alcohol or drugs or due to a grossly poor state of hygiene (does not apply to situations of direct threat to the Patient's life or health);
The Patient has not followed the doctor's recommendations, e.g. has not performed or has not presented for review appropriate diagnostic tests or additional consultations within the specified time; The Medical Entity is not able to verify the patient's identity based on the patient's identity document;
there was a power outage, water failure, etc. on the premises of the Medical Entity and in the building of the Medical Entity.
it is not possible to provide the service for other reasons, including sanitary and epidemiological reasons, including the need to ensure appropriate safety for the staff of the Medical Entity and other patients.
the Patient did not follow the recommendations of the staff of the Medical Entity regarding the need to prepare in a specific way for the visit, including in particular performing the necessary tests.
the Patient did not pay for the visit/Service in a manner consistent with the provisions of these Regulations.
the need to refuse to provide the Service by the Medical Entity, for

Services") to the extent specified in these Regulations, ensuring proper availability and quality of Services in the organizational unit and all organizational units indicated in § 4 sec. 1, in a manner that guarantees patients the most convenient form of using the Services.

The Medical Entity provides Services:

for a fee in accordance with the current price list for the Provision of services indicated on the website: https://www.drmartaroth.com/

free of charge in the case of Services provided to a person in need of immediate assistance due to a threat to health or life, when it is indicated that the patient had no other possibility of obtaining assistance.

The Services are provided on set dates, after making a reservation.

Patients are registered for individual Services in the Medical Entity on-site at the Medical Entity's facility, by phone, e-mail or using the contact form on the website www.drmartaroth.com. The appointment is temporary and constitutes only a PRELIMINARY BOOKING of the date of the Service at the Entity. The booking is made when the patient pays a deposit of PLN 200, which means that without a prior payment of the deposit, the Medical Entity is not obliged to perform the Service covered by the booking. The booking is considered to be made when the deposit amount is posted on time to the bank account of DR ROTH SP. Z O.O. The preliminary booking then becomes a CONFIRMED Booking.

Patients are asked to pay the deposit before the visit, within 24 hours of making the preliminary booking, via the payment link received to the telephone number or e-mail address provided by them or immediately after arranging the appointment at the Medical Entity in cash or by payment card.

Failure by the Patient to pay the deposit in accordance with these Regulations is tantamount to the withdrawal by DR ROTH SP. Z O.O. from the agreement concluded with the patient for reasons attributable to the patient and withholding the deposit.
Payment of the deposit means acceptance of the conditions specified in these Regulations by the person making the reservation.
Services are provided on the date agreed with the patient on the days and hours of operation of the Medical Facility.
The provision of Services requiring the patient's personal presence is possible only after the patient has reported immediately before the provision of the health service for which the patient has been registered, at the reception desk of the Medical Facility after presenting an identity card with the patient's photograph.
Services are provided in a manner that ensures compliance with the legal requirements appropriate for individual Services, with due diligence and up-to-date medical knowledge by persons performing the medical profession and with respect for the patient's rights.
The patient who has made a reservation is obliged to arrive for the visit on time. If the patient's delay does not exceed 15 minutes, the delay time is deducted from the time planned for the procedure. In the event of a delay exceeding 15 minutes, the Medical Entity may refuse to provide the Service by withdrawing from the agreement for reasons attributable to the patient and retaining the deposit or, at the option of the Medical Entity, setting a new appointment date and retaining the deposit on account of the same.

Regardless of other cases described in the Regulations, the Medical Entity may refuse to provide the Service if:
The Patient has refused to consent to the provision of the Service according to the template applicable at the Medical Entity;
The Patient is not eligible for the Service, which will be determined by a doctor or cosmetologist;
The Patient does not consent to signing the required consents;
The Patient is in a condition that makes it impossible to provide the Service, e.g. is under the influence of alcohol or drugs or due to a grossly poor state of hygiene (does not apply to situations of direct threat to the Patient's life or health);
The Patient has not followed the doctor's recommendations, e.g. has not performed or has not presented for review appropriate diagnostic tests or additional consultations within the specified time; The Medical Entity is not able to verify the patient's identity based on the patient's identity document;
there was a power outage, water failure, etc. on the premises of the Medical Entity and in the building of the Medical Entity.
it is not possible to provide the service for other reasons, including sanitary and epidemiological reasons, including the need to ensure appropriate safety for the staff of the Medical Entity and other patients.
the Patient did not follow the recommendations of the staff of the Medical Entity regarding the need to prepare in a specific way for the visit, including in particular performing the necessary tests.
the Patient did not pay for the visit/Service in a manner consistent with the provisions of these Regulations.
the need to refuse to provide the Service by the Medical Entity, for

TERMS OF SERVICE/PRIVACY POLICY

1. General information

This Privacy Policy sets out how we care for your personal information. In order to carry out its obligations under data protection laws and to ensure real data protection, the Controller has appointed a Data Protection Officer.

Contact with the Controller is possible to e-mail address: biuro@drmartaroth.com or postal address: DR ROTH spółka z ograniczoną odpowiedzialnością, ul. Mikołaja Kopernika 15/21, 00-359 Warszawa.

2. Definitions

The terms used in the Privacy Policy shall be understood as stated below:

1. Controller: DR ROTH spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw (00-359), at ul. Mikołaja Kopernika 15/21, registered in the National Court Register, kept by the District Court for the Capital City of Warsaw in Warsaw XII Economic Department under KRS number: 0001031652, NIP: 5252952636, REGON 525076590, with a share capital of PLN 5,000.00, email address: kontakt@drmartaroth.com, website address: www.drmartaroth.com.

2. Personal data: all information about an identified or identifiable natural person through one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person, including image, voice recording, contact data, location data, information contained in correspondence, information collected through recording equipment or other similar technology.

3. Policy: this Privacy Policy.

4. GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.

5. Data Subject: any natural person whose personal data is processed by the Controller, such as a person who visits the Controller's website or directs an email inquiry to the Controller,

6. Processing - means an operation or a set of operations performed on personal data or sets of personal data in an automated or non-automated manner, such as collecting, recording, organizing, structuring, storing, adapting or modifying, retrieving, viewing, using, disclosing by transmission, dissemination or otherwise making available, matching or linking, limiting, erasing or destroying.

3. Data processing by the Controller

In connection with its medical activities, the Controller collects and processes personal data in accordance with the relevant regulations, including in particular the GDPR and the data processing rules provided for therein.

The Controller ensures transparency of data processing, in particular, always informs about data processing at the time of collection, including the purpose and legal basis of processing, in particular for the purpose necessary for therapeutic diagnosis, provision of health care or health care services. The Controller shall ensure that the data is collected only to the extent necessary for the stated purpose and processed only for the period of time necessary.

When processing data, the Controller shall ensure its security and confidentiality, as well as access to information about such processing for data subjects. In the event that, despite the security measures in place, there is a breach of personal data protection (e.g., data "leakage" or loss), the Controller will inform data subjects of such an event in a manner consistent with the regulations.

4. Security of personal data

In order to ensure the integrity and confidentiality of data, the Controller has implemented procedures that allow access to personal data only to authorized persons and only to the extent necessary due to the tasks they perform. The Controller uses organizational and technical solutions to ensure that all operations on personal data are recorded and performed only by authorized persons.

In addition, the Controller shall take all necessary measures to ensure that its subcontractors and other cooperating entities also provide a guarantee of the application of appropriate security measures whenever they process personal data on behalf of the Controller .

The Controller conducts a risk analysis on an ongoing basis and monitors the adequacy of the data safeguards in place to address identified risks. If necessary, the Controller shall implement additional measures to enhance data security.

5. Purposes and legal grounds for data processing by the Controller

Conclusion of the agreement

Placing an order (purchase of goods or services) involves the processing of personal data. Provision of data marked as mandatory is required in order to accept and process the order, and failure to provide such data will result in a failure to process the order. Provision of other data is optional.

Personal data is processed:

· for the purpose of fulfilling medical obligations (e.g., health data, constituting sensitive data within the meaning of the GDPR), but only to the extent and for the purpose necessary for medical diagnosis, provision of health care, treatment or management of health care systems and services (basis - Article 9(2)(h) of the GDPR);

· for the performance of a contract (including, in particular, for the provision of medical services) only to the extent necessary to achieve the purposes of data processing. The legal basis for processing is Article 6(2)(f) of the GDPR; for data provided on an optional basis, the legal basis for processing is consent (Article 6(1)(a) of the GDPR);

· in order to carry out statutory obligations incumbent on the Administrator, arising in particular from tax and accounting regulations - the legal basis for processing is a legal obligation (Article 6(1)(a) GDPR);

· for the purpose of possible establishment and investigation of claims or defense against them - the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) to protect its rights;

· for the purposes of satisfaction surveys, in particular, by sending communications to the e-mail address with a request to give an opinion (review) or complete a satisfaction survey - the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) in maintaining high quality service and the level of satisfaction of patients/customers with the products and services offered;

· for the purposes of sending SMS or e-mail messages with information about the date of the next appointment and contacting the patient/client - the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) consisting of reminding the patient/client of the appointment date and maintaining contact with the patient/client in order to provide services.

Contact forms

The Controller provides the possibility to contact them using electronic contact forms. Using the form requires the provision of personal information necessary to contact the Data Subject and respond to the inquiry. The person may also provide other data to facilitate contact or handling of the inquiry. Provision of data marked as mandatory is required in order to accept and process the inquiry, and failure to provide such data will result in a failure to process it. Provision of other data is voluntary.

The personal data provided is processed for the purpose of identifying the sender and handling his/her inquiry sent through the form provided - the legal basis for processing is the necessity of processing for the performance of the contract/provision of services (Article 6(1)(b) GDPR).

E-mail and traditional correspondence

In the case of e-mail or traditional mail correspondence to the Controller, not related to the contract concluded with them or the sale of goods/services provided, the personal data contained in this correspondence is processed only for the purpose of communication and settlement of the matter to which the correspondence relates.

The legal basis for the processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), consisting of correspondence addressed to it in connection with its treatment activities.

The Controller processes only personal data relevant to the matter to which the correspondence relates. All correspondence is stored in a manner that ensures the security of the personal data and other information contained therein and is disclosed only to authorized persons.

Telephone contact

When contacting the Controller by telephone, on matters not related to the concluded contract or the sale of goods/services provided, we may request personal data only if it is necessary to handle the matter to which the contact relates. The legal basis in such a case is the legitimate interest of the 4(Article 6(1)(f) of the GDPR), consisting of the necessity to handle a reported case related to the medical activity.

Personal data collected in such cases are processed only for the purpose for which they were collected, and the Controller shall ensure their adequate protection.

Recruitment

As part of the recruitment processes, the Controller expects the transfer of personal data (e.g., in a bio or CV) only to the extent specified in the labor laws. Therefore, more extensive information should not be provided. In the event that the applications sent contain such additional data, the Controller shall consider that the candidate consents to its processing for recruitment purposes.

Candidates' personal data are processed:

· in order to comply with legal obligations related to the employment process, including primarily the Labor Code - the legal basis for the processing is a legal obligation incumbent on the Controller (Article 6(1)(c) of the GDPR in connection with the provisions of the Labor Code);

· for the purpose of conducting the recruitment process in the scope of data not required by law, as well as for the purpose of future recruitment processes - the legal basis for processing is consent (Article 6(1)(a) GDPR);

· for the purpose of establishing or asserting potential claims or defending against such claims - the legal basis for data processing is the legitimate interest of the Controller (Article 6(1)(f) GDPR).

Social media

The Controller processes the personal data of visitors to the Controller's profiles maintained on social media (e.g., Instagram) and those who have liked the Controller's social profiles maintained on popular social networks. The data is processed exclusively in connection with the maintenance of the profile, including for the purpose of informing Data Subjects about the Administrator's activities and promoting various events, services and products, as well as for the purpose of communicating with Data Subjects through the functionalities available on social media. Data of community members may also be processed for statistical and analytical purposes, as well as for the purpose of claiming and defending against claims. The legal basis for the Controller's processing of personal data for this purpose is its legitimate interest (Article 6(1)(f) GDPR) in promoting, protecting its own brand, and building and maintaining a brand-related community.

Data collection in business relation

In connection with its operations, the Controller also collects personal data in other cases - such as during business meetings or through the exchange of business cards - for the purposes of establishing and maintaining business contacts. The legal basis for the processing in this case is the legitimate interest of the Controller (Article 6(1)(f) GDPR), consisting of networking in connection with its business.

In connection with the Controller's cooperation with business partners, including, but not limited to, business clients and suppliers, the Controller processes the contact information of persons designated as business contacts in the relationship with the Controller, such as persons responsible on the partner's side for the performance of the contract with the Controller. The Controller processes the contact information of such persons for the purpose of ongoing communication with business partners and maintaining contacts with them. The legal basis for the processing in this case is the legitimate interest of the Controller (Article 6(1)(f) GDPR), consisting of communication with business partners.

Personal data collected in such cases are processed only for the purpose for which they were collected, and the Controller shall ensure their adequate protection.

Direct marketing

If a Data Subject has consented to receive marketing information via e-mail, SMS and other means of electronic communication, the Data Subject's Personal Data will be processed for the purpose of sending such information. The basis for data processing is the legitimate interest of the Controller to send marketing information within the limits of the consent given by the Data Subject (direct marketing). The user has the right to object to the processing of Personal Data for direct marketing purposes. Data will be kept for this purpose for the duration of the Controller's legitimate interest, unless the Data Subject objects to receiving marketing information.

6. Data processing in information systems

Personal data is processed in an IT environment, which means that it may also be temporarily stored and processed to ensure the security and proper functioning of IT systems, e.g. in connection with making security copies, testing changes to IT systems, detecting irregularities or protecting against fraud and attacks.

7. Information about cookies and similar techniques

The Controller uses cookies on its website. Cookies are IT data, in particular text files, which are stored on a Data Subject's terminal device and are intended, among other things, for the use of the Controller 's website. Cookies usually contain the name of the website from which they originate, the time they are stored on the end device and a unique number.

There are two main types of cookies used: "session cookies" and "persistent cookies". "Session" cookies are temporary files that are stored on a Data Subject's terminal device until they leave the website or turn off their software (web browser). "Permanent" cookies are stored on the Data Subject's terminal device for the time specified in the parameters of the cookies or until they are deleted by the Data Subject.

Web browsing software (web browser) usually allows cookies to be stored on a Data Subject's terminal device by default. Data Subjects can change their settings in this regard. The web browser allows for the deletion of the cookies. It is also possible to automatically block cookies. For details, please refer to the help or documentation of your web browser. Restrictions on the use of cookies may affect some of the functionality available on the Controller 's website.

Cookies are not used to process or store personal data, cannot be used to directly identify a Data Subject, and do not make configuration changes to the browser and telecommunication terminal device. A person can determine the conditions for the use of cookies technology themselves and can disable them at any time, using the settings of the Internet browser or the configuration of the service. This can result in the absence or improper display of most websites.

In some cases, it is possible to set the browser to ask for the Data Subject 's consent to cookies on the case by case basis. This gives the Data Subject control over cookies, but may slow down the browser.

If a Data Subject does not want to receive cookies, they can change their browser settings. We stipulate that disabling cookies necessary for authentication processes, security, maintenance of Data Subject's preferences may hinder, and in extreme cases may make it impossible to use the Controller's website.

To manage your cookie settings, please follow the instructions of your respective web browser. Failure to change the settings for cookies means that they will be placed on the Data Subject's terminal device, and thus the Controller will store information on the Data Subject 's terminal device and access it.

8 Recipients of data

In connection with the conduct of activities that require the processing of personal data, they are disclosed to external entities, including, in particular, entities providing accounting, human resources, legal services, suppliers responsible for the provision and operation of information systems and equipment, couriers.

The Controller reserves the right to disclose selected information concerning the data subject to the competent authorities or to third parties who make a request for such information, based on an appropriate legal basis and in accordance with the provisions of applicable law.

9. Period of personal data processing

The period of data processing by the Controller depends on the type of case and the purpose of processing. The period of processing of the data specified may also result from regulations, in case they provide the basis for processing. In the case of data processing on the basis of the legitimate interest of the Controller - e.g. for security reasons - the data are processed for a period of time allowing for its realization or until an effective objection to the data processing is made. If processing is based on consent, the data is processed until the consent is withdrawn. Where the basis for processing is necessity for the conclusion and performance of the contract, the data will be processed until the contract is terminated or expires.

The period of data processing may be extended in case the processing is necessary for the establishment, investigation or defense against possible claims, and thereafter, only if and to the extent required by law. After the conclusion of the processing period, the data is irreversibly deleted or anonymized.

10. Rights related to the processing of personal data

In connection with the Controller's processing of your data, you have a number of rights:

· you can obtain information about how and to what extent we process your data and, in addition, a copy of your personal data. In case your request includes copies of data you will help us by indicating a copy of what data you would like to receive. The Controller may charge a fee for second and subsequent copies, of which you will be notified. The amount of the fee will correspond to the cost of its preparation;

· you can request rectification of your data (if it has been erroneously recorded or if it has changed), deletion (if there is no basis for the Controller to process it), or restriction of processing (if you want the Controller to process your data only to a limited extent, pending the resolution of your objection or request for rectification, and if you want the data to be stored in connection with your claims);

· you may request that your data that you have provided to us be transferred in a structured, commonly used, machine-readable format. You can independently transfer the data you receive to the administrator of your choice. In addition, if it is technically feasible, with appropriate security standards, we can do this for you at your request.

· in case the processing of your data by the Controller is carried out on the basis of a legitimate interest, you may object to such processing;

· If you believe that our processing of your data violates your rights tell us about it. We try to respond to all comments and suggestions. You also have the right to file a complaint with the supervisory authority [President of the Office for Personal Data Protection].

The request for the enforcement of the rights of data subjects, may be submitted:

in writing to the address:

· Dr. Roth Spółka sp. z o.o. Mikołaja Kopernika 15/21, 00-359 Warszawa

· via email to: kontakt@drmartaroth.com.

The request should, as far as possible, indicate precisely what the request is about, i.e. in particular:

· what right the applicant wants to exercise (e.g., the right to receive a copy of the data, the right to deletion, etc.);

· what processing the request concerns (e.g., use of a specific service, activity on a specific website, etc.);

· what processing purposes the request relates to (e.g., marketing purposes, analytical purposes, etc.).

If the Controller is unable to determine the content of the request or identify the applicant based on the notification made, it will ask the requester for additional information.

Applications will be responded to promptly, no later than within one month of their receipt. If it is necessary to extend this period, the Controller shall inform the applicant of the reasons for such extension.

The response shall be provided to the e-mail address from which the application was sent, and in the case of applications sent by post, by regular mail to the address indicated by the applicant, unless the content of the letter indicates a desire to receive feedback to the e-mail address (in which case the e-mail address must be provided).

11. Final provisions

This Policy is reviewed on an ongoing basis and updated as necessary.

If you have any problems, questions or suggestions regarding the information presented on the Website, as well as questions regarding data protection, please contact us via e-mail: kontakt@drmartaroth.com or mailing address:

DR ROTH spółka z ograniczoną odpowiedzialnością, ul. Mikołaja Kopernika 15/21, 00-359 Warszawa.

Cookie Policy

1. Definitions

1. Controller - DR ROTH spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw (00-359), ul. Mikołaja Kopernika 15/21, entered in the National Court Register, maintained by the District Court for the Capital City of Warsaw in Warsaw XII Commercial Department under KRS number: 0001031652, NIP: 5252952636, REGON 525076590, with a share capital of PLN 5,000.00, email address: kontakt@drmartaroth.com, website address: www.drmartaroth.com.

2. Site- the website maintained by the Controller at the address https://www.drmartaroth.com

3. User - a natural person visiting the Site.

4. Device - an electronic device with software through which the User accesses the Site.

5. Cookies - text data collected in the form of files placed on the User's Device. Cookies collect information that facilitates the use of the website, e.g. by remembering the User's visits to the Site and the actions they perform.

§

1. Types of Cookies and the purposes for which they are used

The Controller uses cookies on its website. There are two main types of cookies used: "session cookies" and "persistent cookies". "Session" cookies are temporary files that are stored on a Data Subject's terminal device until they leave the website or turn off their software (web browser). "Permanent" cookies are stored on the Data Subject's terminal device for the time specified in the parameters of the cookies or until they are deleted by the Data Subject.

The Controller uses so-called service cookies primarily to provide the User with services provided electronically and to improve the quality of these services. Accordingly, the Controller and other entities providing analytical and statistical services to the Controller use Cookies to store information or access information already stored on the User's Device. Cookies used for this purpose include:

· Cookies with user input (session ID) for the duration of the session (user input cookies);

· authentication Cookies used for services that require authentication for the duration of the session (authentication cookies);

· User centric security cookies, such as those used to detect authentication abuse;

· multimedia player session cookies (e.g. flash player cookies), for the duration of the session;

· persistent cookies used to personalize the user interface for the duration of the session or slightly longer (user interface customization cookies),

· Cookies used to monitor website traffic, i.e. data analytics, including Google Analytics cookies (these are files used by Google to analyze how the User uses the Site, to create statistics and reports on the functioning of the Site). Google does not use the collected data to identify you, nor does it combine this information to enable identification. Detailed information about the scope and principles of data collection in connection with this service can be found at the link: https://www.google.com/intl/pl/policies/privacy/partners.

The Controller also uses Cookies for marketing purposes. For this purpose, the Controller stores information or accesses information already stored in the User's telecommunications Device. The use of Cookies and personal data collected through them for marketing purposes requires the User's consent. This consent can be expressed through the appropriate configuration of your browser, and can be withdrawn at any time, in particular by clearing the history of Cookies and disabling Cookies in your browser settings.

3. Cookies control

The User may at any time, on their own, change the settings for storing, deleting and accessing stored Cookies by any website.

Information on how to disable Cookies in the most popular computer browsers is available at: how to disable cookies or from one of the designated providers:

· Managing cookies in the Chrome browser

https://support.google.com/accounts/answer/61416?co=GENIE.Platform%3DDesktop&hl=pl

· Managing cookies in the Opera browser

https://help.opera.com/pl/latest/web-preferences/

· Managing cookies in the FireFox browser

https://support.mozilla.org/pl/kb/blokowanie-ciasteczek

· Managing cookies in the Edge browser

https://support.microsoft.com/pl-pl/microsoft-edge/usuwanie-plik%C3%B3w-cookie-w-przegl%C4%85darce-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

· Managing cookies in the Safari browser

https://support.apple.com/pl-pl/guide/safari/sfri11471/mac

· Managing cookies in the Internet Explorer 11 browser

https://support.microsoft.com/pl-pl/windows/usuwanie-plik%C3%B3w-cookie-i-zarz%C4%85dzanie-nimi-168dab11-0753-043d-7c16-ede5947fc64d#ie=ie-11

The User may at any time delete any Cookies stored to date using the tools of the User's Device through which the User accesses the services of the Website.

Services provided by third parties are beyond the control of the Controller . These entities may change their terms of service, privacy policies, purpose of data processing and ways of using Cookies at any time.

The Controller uses all possible technical measures to ensure the security of data placed in Cookies. The Controller is not responsible for the interception of this data, impersonation of the User's session or its deletion, as a result of the User's conscious or unconscious activity, viruses, Trojan horses and other spyware with which the User's device is or was infected.

You can cancel an order purchased in our online store within 14 days without giving a reason. The right to return is counted from the day the order is delivered. Remember, returned items must be in their original, unopened packaging in an unaltered condition.

You have the right to make a complaint if the product does not meet your expectations or is damaged.

How to make a return

Step 1: Fill out the return form, which you can download HERE. Send it to sklep@drmartaroth.com or print it out and include it in the package with the returned product.

Step 2: Send us the product to DR MARTA ROTH, ul. Mikołaja Kopernika 15 lokal 21, 00-359 Warsaw, together with proof of purchase (receipt or invoice). You cover the shipping costs, but you can also deliver the ordered products to the office address: ul. Mikołaja Kopernika 15 lokal 21, 00-359 Warsaw within 14 days from the date of reporting and sending the return form to our e-mail address.

We do not accept returns sent to a parcel locker or cash on delivery.

Step 3: If the product is eligible for a return, you will receive a refund within 14 days or, if you prefer, we will exchange it for another product or a gift certificate of the same value. The funds for the purchase will be returned to the account indicated in the form.

How to make a complaint

Step 1: Fill out the complaint form, which you can download HERE. Send it to sklep@drmartaroth.com along with photos of the product.

Step 2: Send the product you are complaining about to DR MARTA ROTH, ul. Mikołaja Kopernika 15 lokal 21, 00-359 Warsaw, together with proof of purchase (receipt or invoice). We will prepare a prepaid return label for you, which we will send to the email address provided. You can also deliver the products you are complaining about to any brick-and-mortar store within 14 days of sending the form.

Step 3: If the product qualifies for a complaint, we will exchange it for a new one or you will receive a refund within 7 days of a positive complaint. We will return the money to the account indicated in the form, or by the same method that was used to pay for the order.