Privacy Policy
1. General information
This Privacy Policy sets out the rules for processing personal data of users of the website neurospectrum.com.pl.
The controller of personal data is NEUROSPECTRUM spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw, ul. Gen. Augusta Emila Fieldorfa “Nila” 5A, 03-984 Warsaw, KRS: 0001221385, NIP: 1133192111, REGON: 543884174.
The Controller can be contacted by e-mail at: kontakt@neurospectrum.com.pl or by phone at +48 508 096 023.
2. What data we process
Depending on how the website is used, we may process the following data:
- data provided in the contact form: first and last name, e-mail address, message subject, message content and other data voluntarily provided by the user;
- data provided when subscribing to the newsletter: e-mail address and, where applicable, first name, if required by the form;
- data provided in the child questionnaire, including the child’s identification data, date of birth, age, gender, contact details of the parent or guardian, information concerning development, pregnancy and birth history, vaccinations, diagnoses, symptoms, tests, therapies, treatment and the child’s functioning;
- contact details provided by phone, e-mail or when scheduling an appointment;
- data necessary to issue an invoice, if requested by the user;
- technical and analytical data related to the use of the website, such as IP address, cookie identifiers, device data, browser data, operating system data, source of entry to the website and activity on the website.
Data concerning the child’s health, development, diagnoses, tests or therapies are treated as special category data and are processed with enhanced security measures.
3. Purposes and legal bases for data processing
We process personal data for the following purposes:
Contact with the user
Data from the contact form, e-mail messages or phone contact are processed in order to respond, handle the inquiry and conduct correspondence. The legal basis is the Controller’s legitimate interest consisting in handling inquiries and communicating with persons interested in the services, i.e. Article 6(1)(f) GDPR.
Scheduling an appointment, consultation or provision of services
Data provided for the purpose of scheduling an appointment, consultation, therapy or other service are processed in order to take steps prior to entering into a contract or to perform a contract, i.e. Article 6(1)(b) GDPR.
Child questionnaire and health data
Data provided in the questionnaire, including data concerning the child’s health, development, diagnoses, tests and therapies, are processed for the purpose of analysing the request, preparing the consultation, planning support and providing services. The legal basis for processing ordinary data is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR. The legal basis for processing special category data, including health data, is the explicit consent of the parent or legal guardian, i.e. Article 9(2)(a) GDPR, unless another legal basis provided for by law applies in a given case.
Newsletter
Data provided when subscribing to the newsletter are processed for the purpose of sending information, updates, educational materials or marketing content. The legal basis is the user’s consent, i.e. Article 6(1)(a) GDPR and the applicable provisions concerning electronic communication. Consent may be withdrawn at any time.
Website analytics
Data collected using analytical tools such as Google Analytics and Google Tag Manager are processed for the purpose of analysing website traffic, creating statistics, improving the operation of the website and assessing the effectiveness of marketing activities. The legal basis is the user’s consent, if required by the provisions concerning cookies.
Marketing and online advertising
Data collected using tools such as Meta Pixel/Facebook Pixel, Google Ads and similar technologies may be processed for the purpose of measuring advertising effectiveness, creating audience groups and conducting remarketing activities. The legal basis is the user’s consent.
Website security and spam protection
To protect forms against spam and abuse, we may use reCAPTCHA. Technical data may be processed to ensure website security and prevent automated submissions. The legal basis is the Controller’s legitimate interest, i.e. Article 6(1)(f) GDPR, and with regard to cookies or similar technologies — the user’s consent, if required.
Accounting and tax obligations
Data needed to issue an invoice and keep accounts are processed in order to fulfil legal obligations imposed on the Controller, i.e. Article 6(1)(c) GDPR.
Establishing, pursuing or defending claims
Data may also be processed for the purpose of establishing, pursuing or defending claims. The legal basis is the Controller’s legitimate interest, i.e. Article 6(1)(f) GDPR.
4. Voluntary provision of data
Providing data is voluntary, but may be necessary to handle an inquiry, send a newsletter, schedule an appointment, analyse a questionnaire or provide a service.
In the case of a child questionnaire, please provide only the data necessary to assess the request and prepare support.
5. Children’s data
Due to the nature of the services, the Controller may process children’s data, including data concerning their health, development and functioning. Children’s data should be provided only by a parent, legal guardian or another person authorised to act on behalf of the child.
6. Data recipients
Personal data may be transferred to entities that support the Controller in operating the website and providing services, in particular:
- hosting and IT service providers,
- e-mail service providers,
- newsletter system providers,
- entities handling contact forms,
- Google — with regard to Google Analytics, Google Tag Manager, Google Ads and reCAPTCHA,
- Meta Platforms — with regard to Meta Pixel/Facebook Pixel,
- entities providing accounting services,
- persons cooperating in handling requests, consultations and therapies,
- law firms or advisers, if necessary to protect the Controller’s rights.
Data may also be disclosed to public authorities if such an obligation results from legal provisions.
7. Transfers of data outside the European Economic Area
In connection with the use of Google, Meta or other technology providers’ tools, data may be processed outside the European Economic Area.
In such a case, data transfers take place on the basis of mechanisms provided for by the GDPR, in particular adequacy decisions, standard contractual clauses or other safeguards required by law.
8. Data retention period
We process data for the period necessary to achieve the purpose for which they were collected.
Data from the contact form are stored for the time needed to handle the inquiry and for the period necessary to protect against potential claims.
Data related to scheduling an appointment, consultation, therapy or questionnaire are stored for the time necessary to handle the request, provide the service and for the period required by law or justified by protection against claims.
Newsletter data are stored until consent is withdrawn or the user unsubscribes from the newsletter.
Accounting and invoicing data are stored for the period required by tax and accounting regulations.
Data collected using cookies are stored for the period resulting from the settings of a given cookie file or tool, or until the user withdraws consent.
9. User rights
The data subject has the right to:
- access their data,
- rectify data,
- erase data,
- restrict processing,
- data portability,
- object to processing,
- withdraw consent at any time, if data are processed on the basis of consent,
- lodge a complaint with the President of the Personal Data Protection Office.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
To exercise these rights, please contact the Controller at: kontakt@neurospectrum.com.pl.
10. Cookies and similar technologies
The website uses cookies and similar technologies.
Cookies may be used in particular for the purpose of:
- ensuring the proper operation of the website,
- remembering user preferences,
- keeping statistics and analytics,
- measuring advertising effectiveness,
- conducting marketing and remarketing activities,
- protecting forms against spam and abuse.
The website may use first-party cookies and third-party cookies, including Google and Meta cookies.
The user may manage cookie consents using the cookie banner available on the website and the settings of their web browser.
Cookies necessary for the operation of the website may be used without the user’s consent. Analytical, advertising and marketing cookies are used after obtaining the user’s consent, if such consent is required by law.
11. External tools
The following external tools may be used on the website:
Google Analytics — to analyse website traffic and create statistics.
Google Tag Manager — to manage scripts and tags on the website.
Google Ads — to run and measure the effectiveness of advertising campaigns.
Meta Pixel/Facebook Pixel — to measure advertising effectiveness, remarketing and create audience groups.
reCAPTCHA — to protect forms against spam and automated submissions.
The scope of data processed by the providers of these tools depends on the website settings, the user’s browser settings and the consents given by the user.
12. Profiling
In connection with the use of Google and Meta advertising tools, users may be profiled for the purposes of analysing advertising effectiveness, remarketing and matching advertising content.
The Controller does not make decisions concerning users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.
13. Data security
The Controller applies appropriate technical and organisational measures aimed at protecting personal data against unauthorised access, loss, destruction, alteration or disclosure.
Access to data is granted only to authorised persons and entities with which the Controller cooperates to the extent necessary to provide services.
14. Changes to the Privacy Policy
The Privacy Policy may be updated in the event of changes to the operation of the website, the tools used, legal provisions or methods of data processing.
The current version of the Privacy Policy is available on the Controller’s website.