Personal data privacy policy (GDPR)

Effective from: 2 April 2026. Last updated: 13 October 2026 (added §9 on the forum).

This is an English translation provided for information only. The Polish version of this document is legally binding.

§1

Identity of the data controller

  • The controller of the personal data provided while using the Website operated at www.sztukaharmonii.pl and in connection with the provision of services is Magdalena Raba, running a business under the business name RABA Magdalena Raba, ul. Konstantego Bergiela 4/10, 80-180 Gdańsk, NIP: 5833557278, who runs the “Psychological Centre Sztuka Harmonii”, e-mail contact for the data controller: rodo@sztukaharmonii.pl.
  • The rules for processing personal data are set out in the Cookie Policy, available at: www.sztukaharmonii.pl/polityka-cookies
  • This Privacy Policy covers the rules for processing the data of Users of the Website and of persons using the services provided by the data controller, as well as data collected through contact by electronic mail (e-mail address or by telephone).
  • Data are processed in accordance with the laws currently in force, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), the Act of 10 May 2018 on data protection, and the Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej).

§2

Definitions used

  • The following definitions are used in this policy:
  • Personal data controller - the entity that decides on the purpose and means of processing the data of Users of the Website and of persons using the services, i.e.: Magdalena Raba, running a business under the business name RABA Magdalena Raba, ul. Konstantego Bergiela 4/10, 80-180 Gdańsk, NIP: 5833557278, who runs the “Psychological Centre Sztuka Harmonii”,
  • Personal data - any information which, without excessive time and cost, may lead to the identification of a natural person, including their identification, address and contact details.
  • Website - the website available at www.sztukaharmonii.pl, through which the User can browse its content or contact the data controller, and use selected services available on the site.
  • User - a natural person to whom the data relate and who uses the services available on the Website, as well as persons who use the services of the personal data controller.

§3

Purposes of data processing

  • The personal data controller processes Users' personal data for the following purposes:
  • booking an appointment and/or online consultation, changing and/or cancelling an appointment, and providing a reply - on the basis of Art. 6(1)(b) GDPR, i.e. the necessity of the data for concluding and performing a contract at the request of the data subject,
  • providing psychological, psychotherapeutic and related services - on the basis of Art. 9(2)(a) GDPR, i.e. voluntary consent to the processing of sensitive data which the data subject may provide in the course of psychological/psychotherapeutic services and/or online consultations at the “Psychological Centre Sztuka Harmonii”, including data revealing: state of health, sexuality or sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person,
  • performing a contract to which the data subject is a party, or taking steps at the request of the data subject, i.e. preparing and concluding a cooperation agreement and/or service agreement and/or sales agreements, and performing it, on the basis of Art. 6(1)(b) GDPR,
  • replying to a question asked using the contact details available on the site, on the basis of Art. 6(1)(b) GDPR, i.e. the necessity of the data for performing a contract or before its conclusion, at the request of the data subject,
  • documenting the performance of services, including issuing a bill or invoice to a natural person, on the basis of Art. 6(1)(c) GDPR, i.e. in order to fulfil the legal obligations to which the personal data controller is subject, under Art. 70 of the Tax Ordinance Act of 29 August 1997 (Ordynacja podatkowa),
  • sending requested commercial information by electronic means, in accordance with Art. 6(1)(a) GDPR, i.e. on the basis of the consent of the data subject,
  • conducting recruitment for the position or role for which the data subject is currently applying, depending on the form of cooperation. The legal basis for processing the data is Art. 6(1)(b) GDPR, i.e. the necessity of the data for preparing and performing the concluded contract, as well as Art. 6(1)(c) GDPR, i.e. compliance with a legal obligation to which the data controller is subject, in particular for settling tax documentation, under the Tax Ordinance Act of 29 August 1997 (Ordynacja podatkowa). The legal basis for processing the data is also Art. 6(1)(c) GDPR, i.e. compliance with a legal obligation to which the data controller is subject, in particular under the Labour Code of 26 June 1974 (in the case of employment contracts, mandate contracts, etc.).
  • pursuing rights and claims by the data controller or the data subject, on the basis of Art. 6(1)(f) GDPR, i.e. for the purposes of the legitimate interests pursued by the data controller or the data subject.
  • Providing the data is necessary for preparing and performing contracts for the provision of services, issuing an accounting document, pursuing claims and answering questions. Providing any other data is voluntary.
  • Failure to provide the required data makes it impossible to perform the contract properly, to issue a bill or invoice or to make contact at the request of the data subject.

§4

Period of data processing

  • Users' personal data are processed for the period necessary to achieve the purpose for which they were collected, i.e.:
  • personal data processed for the purpose of conducting psychological/psychotherapeutic therapy and/or online consultations will be processed for the duration of the therapy and then for 5 years from the end of the calendar year in which cooperation with the patient ended, except where consent to the processing of special categories of data is withdrawn, unless a provision of a specific act provides otherwise or if longer storage is justified by the pursuit or defence of claims,
  • ordinary data may be processed for up to 5 years from the end of the calendar year in which your last appointment took place and the accounting documents relating to the service were issued, in connection with Art. 70 of the Tax Ordinance Act of 29 August 1997 (Ordynacja podatkowa). In the case of a structured invoice, however, once it has been sent to the National e-Invoice System (KSeF), the data will be stored for 10 years from the end of the year in which it was issued, under Art. 112aa(1) of the Act of 11 March 2004 on tax on goods and services,
  • for the purpose of replying by electronic means of communication (enquiries, information about available appointment dates, etc.) - data are processed only for the period necessary to reply, but no longer than 6 months from the date the enquiry was received, if no contract for the provision of services has been concluded,
  • for the purpose of recruitment, i.e. no longer than 6 months from the date the application documents were sent. After this period, the personal data are deleted. If the data subject consents, the data will be processed for the purposes of future recruitment. The basis for processing data for the purposes of subsequent recruitment will be Art. 6(1)(a) GDPR, i.e. consent. The personal data will then be processed for up to 12 months or until consent for this purpose is withdrawn,
  • for the purpose of sending requested commercial information by electronic means - until consent is withdrawn, without affecting the lawfulness of processing before its withdrawal.

§5

Data recipients

  • The User's personal data may be entrusted to other entities to perform services on behalf of the data controller, in particular for the purpose of:
  • hosting and maintaining the e-mail of the personal data controller,
  • servicing and maintaining the IT systems in which the data are processed, in particular systems for online booking, online consultations, live chat on the website, telephone and/or SMS contact, etc.,
  • providing accounting, HR and payroll, and administrative and marketing services.

§6

Processing of data outside the European Economic Area

  • As the Controller uses hosting tools and IT systems whose providers may have their registered office or technical infrastructure located outside the European Economic Area, personal data may be transferred to:
  • the United States of America, on the basis of the European Commission decision of 10 July 2023 finding an adequate level of protection of personal data ensured by the so-called “EU–US Data Privacy Framework” for providers entered on the US Department of Commerce list, such as Google LLC, Microsoft Corporation, Meta Platforms, Inc., Twilo Inc.
  • China - only when communicating with the Controller on the TikTok platform, data may be processed by entities of the TikTok group, including ByteDance Ltd., whose infrastructure may be located in China; accordingly, personal data may be transferred outside the EEA on the basis of European Commission Decision 2021/914 on standard contractual clauses for the transfer of personal data to third countries, included in the terms of service agreed between the data controller and the provider of the solution.

§7

Facebook and joint controllership of data

  • The Controller is also a joint controller of the data of its followers on social media - in particular of persons who use means of electronic communication (messenger) on the fan page run by the data controller on the Facebook social network. Otherwise, the controller of the data of Users of this social network is Meta Platforms Ireland Limited (formerly: Facebook Inc., with its registered office at 1 Hacker Way, Menlo Park, CA 94025, USA), and these data are processed in accordance with the rules described in the terms and privacy policies for users of these services, including at: https://www.facebook.com/privacy
  • The personal data of the fan page User will be processed in a third country, i.e. in the United States of America (USA). Data are transferred to the USA on the basis of the European Commission decision of 10 July 2023 finding an adequate level of protection of personal data ensured by the so-called “EU-US Data Privacy Framework” for providers entered on the US Department of Commerce list, such as: Meta Platforms, Inc., Menlo Park, California, USA.

§8

Rights of data subjects

  • The data subject has:
  • the right of access to the content of the data and to rectify them, as well as to receive a copy of the data,
  • the right to erasure of the data, unless other legal provisions require the data controller to archive the data for a specified period,
  • the right to data portability, if the processing is based on a contract or the consent of the data subject and is carried out by automated means,
  • the right to object to the processing of data for the purposes of direct marketing carried out by the data controller on the basis of its legitimate legal interest, as well as to the restriction of processing,
  • the right not to be subject to automated profiling, if the data controller were to take decisions based solely on automated profiling that produce legal effects concerning the data subject or similarly affect them,
  • the right to control the processing of data and to information on who the data controller is, as well as to obtain information about the purpose, scope and manner of processing the data, the content of the data, the source of the data and the manner of sharing it, including the recipients or categories of recipients of the data,
  • the right to withdraw consent at any time, if the processing was based on the consent of the data subject. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal,
  • the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), if the person considers that the processing of their data does not comply with the regulations currently in force in this area.

§9

Forum

  • The Controller runs a forum on the Website at www.sztukaharmonii.pl/forum, where the User can put a question to specialists working with the “Psychological Centre Sztuka Harmonii”. Using the forum is voluntary and free of charge. A question may be asked by a person aged 16 or over.
  • When asking a question, the User gives its title and content and, optionally, a nickname, the topic of the question and an e-mail address. The content of a question may include information about health or other special categories of data (sensitive data) referred to in Art. 9(1) GDPR, so the Controller recommends not including in the question a first name and surname, an address or any other information that would allow the User or other persons to be recognised.
  • When a question is sent, the Controller stores in the database a one-way hash of the User's IP address, created using a secret key. The IP address itself is not stored in the database - it is processed only temporarily in the server's memory to limit the number of questions sent from one address.
  • Forum data are processed for the purpose of:
  • specialists reading the question, publishing it on the forum (anonymously or under the nickname given) once a specialist approves it and answering it publicly - on the basis of Art. 6(1)(a) and Art. 9(2)(a) GDPR, i.e. explicit consent given by ticking the checkbox in the form,
  • notifying the User of an answer at the e-mail address given - on the basis of Art. 6(1)(a) GDPR, i.e. consent,
  • protecting the forum against spam and abuse, including limiting the number of questions sent from one IP address - on the basis of Art. 6(1)(f) GDPR, i.e. the legitimate interest of the Controller in keeping the Website secure.
  • A question is published only once a specialist approves it. Until then it is not publicly visible and only the specialists and the Controller's team have access to it. Rejected questions are not published. The e-mail address is never published. Published questions and answers are publicly available on the Internet and may appear in search engines.
  • The full content of a new question is sent to the Controller's team by e-mail, and its title and an excerpt to the team's internal messaging tool. Neither of these messages contains the User's e-mail address.
  • Forum data are entrusted to processors that, on the Controller's instructions, provide hosting of the Website, the database, e-mail, the sending of e-mail messages and the team's messaging tool.
  • The forum database is located on servers in the United States of America, and the other providers may also process data outside the European Economic Area, including in the United States of America. Data are transferred on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US Data Privacy Framework) for providers entered on the US Department of Commerce list, and otherwise on the basis of the standard contractual clauses referred to in Art. 46(2)(c) GDPR, adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021. A copy of the standard contractual clauses can be obtained by writing to rodo@sztukaharmonii.pl.
  • Data from a question, including the e-mail address and the IP address hash, are stored until consent is withdrawn, the Controller deletes the question or the forum is closed.
  • Consent can be withdrawn at any time by writing to rodo@sztukaharmonii.pl - preferably from the e-mail address given with the question and with a link to the thread. The Controller then deletes the question, together with the specialists' answers, from the forum, the database and the notifications sent to the team, and also deletes the e-mail address and the IP address hash from the database. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. A deleted question may remain visible in search engine results for some time, until they are updated.
  • Insofar as data are processed on the basis of the Controller's legitimate interest, the User has the right to object to their processing at any time on grounds relating to their particular situation (Art. 21(1) GDPR). The User's other rights are described in §8.
  • Providing data on the forum is voluntary. A question cannot be sent without giving consent, and without giving an e-mail address the User will not be notified of an answer.
  • Forum data are not used for profiling or automated decision-making.

§10

Final provisions

  • If the applicable privacy policy changes, in particular where required by the technical solutions used or by changes in the law on the privacy of data subjects, appropriate amendments will be made to the above text, which will apply within 14 days of their publication on the site.
Next free appointmentFree slotCheck available times online