DEMBICKA EDUCATION CENTER

PRIVACY AND COOKIES
POLICY

Dembicka Education Center

Effective from 14 September 2026

WHERE SCIENCE MEETS CLINICAL EXCELLENCE

§ 1. Personal Data Controller

1. The controller of the personal data of persons using the website and the services offered by Dembicka Education Center is:

hereinafter: the “Controller”.

2. The Controller may be contacted regarding the processing of personal data and the exercise of rights arising from personal data protection laws:

• e-mail: dianadembicka@hotmail.com

• correspondence address: ul. Krakowska 61/1, 33-100 Tarnów

3. The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), Polish law and other applicable provisions concerning personal data protection and privacy.

§ 2. Scope of the Policy

1. This Policy sets out the rules for processing personal data in connection with:

• use of the Dembicka Clinic & Education Center website and the Dembicka Education Center subpage;

• use of contact and registration forms;

• submitting enquiries regarding the offer;

• registering for training courses, courses, Masterclasses, webinars, conferences and other educational events;

• purchasing educational services online;

• making electronic payments;

• issuing invoices and handling settlements;

• communication with event participants;

• subscribing to the newsletter and receiving marketing information, where such functionality is available;

• use of cookies and similar technologies;

• use of analytics and marketing tools.

2. The Policy applies to website visitors, customers, participants in training courses and other events, and persons contacting the Controller.

§ 3. Personal data that may be processed

Depending on the type of contact, service purchased or manner of using the website, the Controller may process in particular:

• first and last name;

• e-mail address;

• telephone number;

• correspondence address;

• company or entity name;

• tax identification number (NIP) and data necessary to issue an invoice;

• information concerning the profession performed or place of work, where necessary for the organisation of a particular training course or event;

• information concerning the selected training course, course, Masterclass, conference or other event;

• order and payment data;

• the content of correspondence with the Controller;

• information voluntarily provided by the user in a form or message;

• technical data concerning use of the website, including IP address, device type, operating system, browser type and information stored using cookies or similar technologies.

The Controller applies the principle of data minimisation and processes only data that are adequate and necessary for the specified purpose.

§ 4. Purposes and legal bases for data processing

1. Contact and handling of enquiries

Data provided when contacting the Controller may be processed in order to respond, provide information regarding the offer and take steps at the request of the data subject prior to entering into a contract. The legal basis for processing is, as applicable, Article 6(1)(b) GDPR or the Controller’s legitimate interest in conducting communication and handling enquiries – Article 6(1)(f) GDPR.

2. Registration and provision of educational services

Data of participants in training courses, courses, Masterclasses, webinars, conferences and other educational events are processed in order to enter into and perform a contract, complete registration, organise the event and provide information necessary for its delivery. The legal basis is Article 6(1)(b) GDPR.

3. Order and payment processing

Data are processed in order to accept and fulfil an order, confirm a purchase, process payment and ensure proper delivery of the purchased service. The legal basis is Article 6(1)(b) GDPR.

4. Settlements, invoices and accounting obligations

Data necessary to issue accounting and tax documents are processed in order to comply with legal obligations incumbent on the Controller. The legal basis is Article 6(1)(c) GDPR.

5. Participant support

Data may be processed for organisational communication, preparation of participant lists, certificates or confirmations, and to ensure the proper organisation of the event. The legal basis is Article 6(1)(b) GDPR and, where appropriate, also Article 6(1)(f) GDPR.

6. Complaints and claims

Data may be processed for the purpose of handling complaints and establishing, pursuing or defending against claims. The legal basis is the Controller’s legitimate interest – Article 6(1)(f) GDPR.

7. Website security

Technical data may be processed to ensure website security, prevent abuse, diagnose errors and protect IT systems. The legal basis is the Controller’s legitimate interest – Article 6(1)(f) GDPR.

8. Newsletter and marketing

If the user gives the appropriate consent, their contact data may be used to send the newsletter and information about new training courses, Masterclasses, courses, webinars, conferences, events and other services offered by Dembicka Education Center. Where applicable law requires consent for a particular form of communication, such communication will only take place after consent has been obtained. The user may unsubscribe from such communications at any time.

9. Analytics and online marketing

After the required consent has been obtained, data concerning use of the website may be processed using analytics and marketing tools, in particular Google Analytics and Meta Pixel. The scope of processing depends on the consents given and the configuration of the respective tools.

§ 5. Voluntary provision of data

1. As a rule, providing personal data is voluntary.

2. However, providing certain data may be necessary to:

• enter into and perform a contract;

• register for a training course or event;

• provide the purchased service;

• process a payment;

• issue an invoice;

• respond to an enquiry that requires certain information to be provided.

3. Failure to provide data necessary for a specific purpose may make it impossible to provide the service.

4. Where processing is based on consent, giving consent is voluntary.

§ 6. Electronic payments – Stripe

1. Payments for training courses, courses, Masterclasses and other services available on the website may be made through the Stripe system.

2. In order to carry out a transaction, certain data concerning the user, order and payment may be transferred to Stripe to the extent necessary to process and service the transaction.

3. Stripe may process data as an independent controller or processor, depending on the type of data and the operations performed. Detailed rules governing data processing are set out in Stripe’s privacy policy.

4. As a rule, the Controller does not receive the user’s full payment card details where they are entered and processed directly within the Stripe environment.

5. Use of Stripe may involve international data transfers. The rules governing such transfers and the safeguards applied are described in Stripe’s documentation.

§ 7. Accounting and invoicing

1. Data necessary for settlements, issuing and storing invoices and fulfilling tax obligations may be transferred to an entity providing accounting services to the Controller.

2. Data are transferred only to the extent necessary to provide those services and fulfil the Controller’s legal obligations.

§ 8. Newsletter

1. If the website offers the option to subscribe to a newsletter, subscription is voluntary.

2. The newsletter may contain, in particular, information about:

• new training courses;

• courses and Masterclasses;

• webinars;

• conferences;

• educational events;

• new training dates;

• the educational activities of Dembicka Education Center;

• other services and events related to the Controller’s activities.

3. The user may unsubscribe from the newsletter at any time, in particular by using the appropriate link in the message or by contacting the Controller.

4. If an external newsletter management system is implemented, this Policy will be supplemented accordingly with information about its provider.

§ 9. Recipients of personal data

Data may be transferred to entities supporting the Controller in conducting its activities, in particular:

• hosting providers;

• IT infrastructure providers and administrators;

• entities ensuring website maintenance and security;

• payment operators, in particular Stripe;

• the entity providing accounting services;

• providers of accounting or invoicing software, where used;

• newsletter and mailing system providers, if implemented;

• providers of analytics and marketing tools;

• entities within the Google group in connection with the use of Google Analytics;

• entities within the Meta group in connection with the use of Meta Pixel;

• entities cooperating with the Controller in organising specific training courses, conferences or other events, where necessary for their delivery;

• entities providing legal, accounting, audit or advisory services;

• public authorities and other entities authorised to receive data under applicable law.

Entities processing data on behalf of the Controller may process such data only to the extent arising from the relevant agreements and applicable law.

§ 10. Transfers of data outside the European Economic Area

1. In connection with the Controller’s use of services provided by international technology providers, in particular Stripe, Google and Meta, data may be processed or transferred outside the European Economic Area.

2. Where data are transferred to a third country, such transfer is carried out in accordance with the rules set out in Chapter V of the GDPR.

3. Depending on the particular provider and place of processing, the transfer may be based in particular on:

• a European Commission adequacy decision;

• appropriate safeguards provided for in Article 46 GDPR, including standard contractual clauses;

• other mechanisms permitted under applicable law.

4. Information on the transfer mechanisms used by individual providers can be found in their privacy documentation.

§ 11. Data retention period

Data are retained no longer than necessary to fulfil the purpose for which they were collected, taking into account the Controller’s legal obligations.

• data related to performance of a contract – for the duration of its performance and thereafter for the period necessary to secure or pursue potential claims;

• data contained in accounting and tax documentation – for the period required by applicable law;

• data concerning complaints – for the period necessary to handle the complaint and secure potential claims;

• data related to correspondence – for the period necessary to handle the matter and thereafter for a period justified by the nature of the correspondence and the possibility of claims arising;

• data processed on the basis of consent – until consent is withdrawn or the purpose of processing ceases earlier;

• data used for direct marketing on the basis of legitimate interest – until an effective objection is raised or the purpose ceases;

• data related to cookies – for the lifetime of the relevant cookie or until consent is withdrawn, where consent was required.

§ 12. Rights of data subjects

Under the conditions set out in the GDPR, a data subject may have the right to:

• access personal data;

• obtain a copy of the data;

• rectify inaccurate data;

• complete incomplete data;

• erase data;

• restrict processing;

• data portability;

• object to processing based on Article 6(1)(f) GDPR;

• object to the processing of data for direct marketing purposes;

• withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise these rights, the Controller may be contacted at: dianadembicka@hotmail.com

§ 13. Right to lodge a complaint

A person who believes that their personal data are being processed in breach of applicable law has the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office.

Information on how to lodge complaints is available on the website of the Personal Data Protection Office: uodo.gov.pl.

§ 14. Google Analytics

1. The website uses Google Analytics to analyse how the website is used and to create statistics.

2. Depending on the configuration of the tool and the user’s consents, Google Analytics may process information concerning, among other things, use of the website, the device, browser, approximate location derived from technical data and interactions with the website.

3. Analytics tools that require access to information stored on the user’s device or the storage of such information are activated in accordance with the user’s choices regarding cookies and similar technologies.

4. The user may withdraw or change their consent using the consent management mechanism available on the website.

§ 15. Meta Pixel

1. The website uses Meta Pixel provided by Meta.

2. The tool may be used, among other things, to measure the effectiveness of marketing activities, analyse interactions with the website and – depending on its configuration and the consents given – create audiences for advertising activities.

3. Meta Pixel may process information concerning the user’s activity on the website, their device, browser and certain events related to use of the website.

4. Meta Pixel and related optional marketing technologies should be activated in accordance with the user’s choice made through the consent management mechanism.

5. The user may change their marketing cookie settings at any time.

§ 16. Cookies Policy

1. The website uses cookies and similar technologies.

2. Cookies are small files or pieces of information stored or read in connection with the use of a website.

3. Depending on the website’s functionality, the following categories may be used:

Essential cookies – necessary for the proper and secure operation of the website and use of its basic functionalities.

Functional cookies – enable selected user settings to be remembered, where used.

Analytics cookies – used to analyse how the website is used and to create statistics, including through Google Analytics.

Marketing cookies – used to measure the effectiveness of advertising activities and perform marketing functions, including through Meta Pixel.

4. Optional cookies that require the user’s consent should not be activated before such consent is given.

5. The user should be able to:

• accept all optional cookies;

• reject optional cookies;

• select individual categories;

• subsequently change or withdraw consent.

6. Withdrawing consent should be as easy as giving it.

7. The user may also manage cookies through their web browser settings. Restricting certain cookies may, however, affect the operation of selected website functionalities.

§ 17. Automated decision-making and profiling

1. In connection with the use of marketing tools, users may be profiled, in particular for audience analysis or the tailoring of marketing activities, depending on the configuration of the tools used and the consents given.

2. The Controller does not make decisions concerning the user based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them, unless this is separately indicated and an appropriate legal basis exists.

§ 18. Data security

The Controller applies appropriate technical and organisational measures to ensure a level of personal data security appropriate to the risk associated with their processing.

Data are protected in particular against unauthorised access, unlawful disclosure, loss, destruction and accidental or unauthorised alteration.

Access to data should be limited to persons and entities for whom it is necessary to perform the tasks entrusted to them.

§ 19. External services and social media

The website may contain links to external websites, payment systems and the Controller’s social media profiles.

After accessing an external service, the user’s data may also be processed by the controller of that service in accordance with its own privacy rules.

The Controller recommends reviewing the privacy policies of the relevant providers.

§ 20. Changes to the Privacy Policy

The Controller may update this Policy, in particular in the event of:

• changes to applicable law;

• changes to the way the website operates;

• expansion of the scope of services offered;

• implementation of new functionalities;

• changes of technology providers;

• implementation of a newsletter system or other tools;

• changes to the way data are processed.

The current version of the Policy will be published on the website.

§ 21. Final provisions

In matters not regulated by this Policy, the provisions of the GDPR and the applicable provisions of Polish law and European Union law shall apply.

The Privacy and Cookies Policy is effective from 14.09.2026.