Processing of clients' personal data 

1. The company as a controller processes the personal data of its clients to the extent specified in the request for the manufacture and dispensing of a medical device, on the voucher for the medical device and, if applicable, resulting from the measurement documents taken during the individual assessment, for the purpose of processing the client's order for the dispensing of a medical device or its manufacture and settlement of claims from public health insurance. The lawful basis for the processing of clients' personal data is the performance of the contract concluded between the client and the Company and the necessity of the processing for the provision of healthcare.
2. For the purpose of fulfilling the contract with the client, the Company obtains the personal data of clients and processes them directly or through its contractual partners (partner workplaces) as processors (this applies in particular if the request for the manufacture and dispensing of a medical device is signed in one of the partner workplaces).
3. The Company may transfer the personal data of its clients to external service providers (e.g. accounting service providers, computer network administrators, IT service providers, etc.) in order to fulfil the purpose of processing. The Company does not transfer this personal data outside the EU.
4. Personal data of clients are stored by the Company for the time necessary for the performance of the contract with the client and for no longer than the duration of the time limits for their storage resulting from generally binding legal regulations.
5. Clients have the right to request from the Company access to their personal data, their rectification or erasure, or restriction of processing, and the right to object to processing, as well as the right to data portability and the right to lodge a complaint with the Office for Personal Data Protection. Details of these rights are set out in the 'data subject rights' tab.
6. The provision of personal data of clients to the Company is entirely voluntary and is related to the client's choice of the Company as a seller/producer of the medical device. In the event that the Client's personal data is not provided, the Company will not be able to enter into a contract with the Client for the manufacture and/or dispensing of the medical device.

Processing of personal data of business partners and their contact persons 

1. In its activities as a controller, the company processes, among other things, personal data of business partners - natural persons engaged in business and personal data of contact persons of business partners.
2. The Company processes personal data of business partners and their contact persons for the purpose of performance of contracts or cooperation concluded with them and for the purpose of negotiations on conclusion of a contract or cooperation. The legal reason for processing the personal data of business partners - natural persons is the necessity for the performance of contracts concluded with them or for the implementation of measures prior to the conclusion of the contract. The lawful reason for processing personal data of contact persons of business partners is the necessity for the purposes of the legitimate interests of the Company (i.e. performance of the contract with the business partner), against which the interests or fundamental rights of the contact person do not prevail.
3. In fulfilling the purpose of processing, the Company may transfer the personal data of its business partners to external service providers (e.g. accounting service providers, computer network administrators, IT service providers, etc.). The Company does not transfer this personal data outside the EU.
4. The personal data of business partners and their contact persons are retained by the Company for the duration of the contractual relationship with the Company and for the duration of statutory archiving periods (e.g. in relation to tax documents); upon expiry of these periods, the personal data are deleted without delay to the extent applicable.
5. Business partners and their contact persons have the right to request from the Company access to their personal data, their rectification or erasure, or restriction of processing, and the right to object to processing, as well as the right to data portability and the right to lodge a complaint with the Office for Personal Data Protection. Details of these rights are set out in the 'data subject rights' tab.
6. The provision of personal data of business partners and their contact persons for processing by the Company is not obligatory, however, in the event of failure to provide such data, a contract with the business partner cannot be concluded or properly performed.
7. The Company obtains personal data of contact persons of business partners from these business partners.

Rights of data subjects 
Any data subject whose personal data is processed by the Company has the following rights:

1. the right to request access to his/her personal data, i.e. the right to obtain confirmation from the Company as to whether or not the personal data concerning him/her are being processed and, if so, the right to obtain access to them, as well as to the information referred to in Article 15(1) of Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR"), as set out in this Directive;
2. the right to have your personal data corrected if it is incorrect or inaccurate;
3. the right to request from the Company, under the conditions set out in Article 17 of the GDPR, the deletion of your personal data and the complete termination of their processing if all legal grounds for their processing cease to exist;
4. the right to restriction of processing in the cases referred to in Article 18(1) of the GDPR (in particular if the data subject contests the accuracy of the personal data processed or objects to their processing);
5. the right to object to processing where the processing is justified by the Company on the grounds of necessity for the performance of a task carried out in the public interest or in the exercise of official authority vested in it or on the grounds of necessity for the purposes of its legitimate interests;
6. the right to object at any time to the processing of personal data for direct marketing purposes;
7. the right to the portability of personal data, i.e. the right to obtain personal data about him/her processed by the Company in a structured, commonly used and machine-readable format and to transmit it to another controller if the processing is based on his/her consent or a contract concluded with him/her and if the processing is carried out by automated means;
8. the right to withdraw consent to the processing of personal data at any time where there is a legal ground for processing, without prejudice to the lawfulness of processing based on such consent prior to its withdrawal;
9. the right to lodge a complaint with the Office for Personal Data Protection.