Last updated: September 2026

Privacy Policy

1. Data Controller

The data controller is the Świat Bioniki Foundation based in Poznań, Poland (foundation pending registration in the National Court Register – KRS, NIP and REGON numbers will be added here immediately once registration is complete). Contact for data protection matters: via the contact form. The Foundation has not appointed a Data Protection Officer – given the scale of its activities, this is not currently required under GDPR.

2. What data we process and why

Below we list each processing purpose separately, together with its legal basis:

• Handling the contact form – name, email address, message content. Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the controller – responding to your enquiry).
• Newsletter – email address. Legal basis: Art. 6(1)(a) GDPR (your voluntary, separate consent). This service will launch once the Foundation's KRS registration is complete.
• Site traffic analytics – data on how you use the site, as described in the Cookie Policy. Legal basis: Art. 6(1)(a) GDPR (your consent given via the cookie banner).
• Fulfilment of the Foundation's statutory objectives (e.g. record-keeping, financial reporting). Legal basis: Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interest).

3. Data retention periods

Contact form data is kept for as long as needed to handle your enquiry, and for up to 12 months afterwards in case we need to refer back to earlier correspondence. Data processed on the basis of consent (newsletter, analytics) is kept until you withdraw that consent. Data we must keep under statutory obligations (e.g. the Foundation's accounting records) is kept for the period required by law – typically 5 years from the end of the tax year in which the obligation arose.

4. Who we share data with

Data may be shared with the following categories of recipients, strictly to the extent necessary for the purposes listed above:

• our website hosting provider (data storage on the server),
• the email provider that receives contact form submissions,
• Cloudflare, Inc. – our anti-spam verification provider (Cloudflare Turnstile), which processes IP addresses and browser technical data to distinguish humans from bots.

We do not sell or share data with third parties for marketing purposes.

5. Finders that use NFZ data

The page Where to fill your prosthesis prescription runs a clinic finder. When you press the search button, your browser connects directly to the server of Narodowy Fundusz Zdrowia, the National Health Fund of Poland, at api.nfz.gov.pl. Our server plays no part in that connection.

What reaches NFZ is your IP address, technical information about your browser and the query itself, meaning the region and the medical device code you selected. NFZ is the controller of that data. NFZ, not us, sets the rules for processing it.

The foundation never receives this data, stores none of it and does not know what you searched for. We keep no search results and set no cookies for this feature. If you would rather not connect to NFZ this way, simply do not use the finder. No query leaves your browser until you press the button.

The pain clinic finder. The page Where to get pain treatment runs a second finder, built in exactly the same way. It connects to the same NFZ server at api.nfz.gov.pl, the only difference being that the query carries the selected region and the name of the service instead of a medical device code. Everything described above applies to it unchanged. We keep no backup list of clinics.

Backup list of clinics. In case the NFZ server is down, we keep a backup list of clinics that hold an NFZ contract for prostheses. We download it once a week from the public NFZ Agreements API and show it only when NFZ does not respond. The list contains the provider's name, address, phone number, NFZ provider code and the prosthesis types covered by the contract. Where a clinic is run by a sole trader, the business name usually includes that person's first and last name, so to that extent we are the controller of their personal data. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR): helping people after amputation find where to fill a prosthesis prescription, in line with the foundation's statutory aims. We keep the data for as long as NFZ lists the clinic's contract. A clinic that no longer appears in NFZ data drops off the list at the next weekly refresh. Data subjects have the rights described in section 8, including the right to object (Art. 21 GDPR). Requests to correct or remove an entry can be sent through the contact form. A removed entry does not come back with later refreshes.

6. Transfers outside the European Economic Area

Cloudflare Turnstile may process data on infrastructure located outside the EEA. This takes place on the basis of Standard Contractual Clauses approved by the European Commission, used by Cloudflare as the legal basis for such transfers. Details: Cloudflare's own privacy policy, available on their website.

7. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

8. Your rights

You have the right to: access your data, rectify it, erase it, restrict its processing, port it, and object to processing based on legitimate interest. Where data is processed on the basis of consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To exercise these rights, reach us via the contact form.

9. Right to lodge a complaint

If you believe our processing of your data violates GDPR, you have the right to lodge a complaint with the President of the Polish Data Protection Authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

10. Changes to this policy

We will inform you of any material changes to this policy by publishing an updated version on this page, with the update date shown at the top of the document.

11. Contact