Privacy policy.

This is a translation of the Polish original for your convenience. In the event of any discrepancy, the Polish version prevails.

1. Data controller

The controller of personal data collected through the biale.studio website is Przemysław Krawczak, with a registered address in Wrocław (50-203), ul. Księcia Witolda 49/15, Tax ID (NIP): 8121749801 (hereinafter: the “Controller”).

Contact for matters relating to data protection: kontakt@biale.studio.

2. What data I process and where it comes from

I process only the data you provide voluntarily. Through the contact form:

• first name,
• phone number,
• e-mail address,
• type of practice (dentistry / aesthetic medicine / other),
• the content of your message (if you write one),
• technical data transmitted automatically when the form is sent (IP address, date and time of the enquiry).

Through the chat on this website, if you open it yourself and send a message:

• the content of the messages you send and receive,
• your e-mail address — only if you provide it, so that my reply reaches you after you close the tab,
• your IP address, the date and time of the conversation, and the page you started it from.

The chat is for talking about working together. Please do not send health data or your patients' data through it — if the matter calls for that, let's arrange a call.

Providing this data is voluntary, but necessary in order to respond to your enquiry.

3. Purposes and legal bases of processing

• Responding to your enquiry and arranging a review — Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Art. 6(1)(a) GDPR (the consent you give when sending the form);
• establishing, pursuing or defending claims — Art. 6(1)(f) GDPR (the Controller's legitimate interest);
• preventing abuse and spam (analysis of the technical data of the enquiry) — Art. 6(1)(f) GDPR.

4. How long I keep the data

• data from the form — for the duration of our correspondence and, once it ends, for a maximum of 12 months, unless we begin working together (in which case for the duration of that cooperation and any period required by law, for example tax law);
• chat conversations — 12 months from the start of the conversation; after that they are deleted automatically;
• if consent is withdrawn — I delete the data without undue delay, unless another legal basis for processing it exists.

5. Who I share the data with

Data may be entrusted to the providers whose services I use to run the website and communicate, solely to the extent necessary to provide those services:

• the website hosting and e-mail provider — dhosting.pl (Dhosting.pl Sp. z o.o.),
• Telegram (Telegram Messenger Inc.) — messages from the chat on this website are forwarded to my messenger so that I can reply to them. This applies only to conversations you start yourself. Telegram is based outside the European Economic Area, so the content of the conversation leaves the EEA — which is why I ask you not to send sensitive data through the chat.

I do not sell personal data and I do not transfer it to third countries other than in the cases described in this policy — the chat via Telegram (above) and the analytics tools and Meta pixel (point 7). Nor do I subject this data to automated decision-making producing legal effects, including profiling.

6. Your rights

In connection with the processing of your data, you have the right to:

• access your data and receive a copy of it (Art. 15 GDPR),
• rectify your data (Art. 16 GDPR),
• erase your data (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interest (Art. 21 GDPR),
• withdraw consent at any time — without affecting the lawfulness of processing carried out before its withdrawal,
• lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise your rights, write to kontakt@biale.studio. I respond within one month at the latest.

7. Cookies and tracking technologies

Cookies are small pieces of information saved by your browser on your device. This website does not save any analytics or marketing cookies until you consent to it in the window shown on your first visit.

After you click “I agree”, I start two tools that save cookies:

• Google Analytics 4 — counts visits and shows which content is being read.
• Meta (Facebook) pixel — makes it possible to see which adverts bring in enquiries and to target adverts at people who have visited the site. It saves the _fbp and _fbc cookies.

If you choose “Essential only”, neither of these tools starts and no cookies are created. You can change your decision at any time by clicking the “cookie settings” link in the footer — after consent is withdrawn I delete the previously saved Google and Meta files. You can also delete or block cookies in your browser settings; this does not affect access to the content.

Data may be transferred outside the European Economic Area: within Google Analytics to Google Ireland Limited and onward to Google LLC in the USA; within the pixel to Meta Platforms Ireland Limited and onward to Meta Platforms, Inc. in the USA. This is based on standard contractual clauses and an adequacy decision (Data Privacy Framework). I am a joint controller of the data collected by the pixel together with Meta Platforms Ireland — details in the Meta joint controller terms and in the Meta privacy policy.

Fonts and the remaining assets of this website are served from my own server, so simply visiting the site — without giving consent — does not connect your browser to Google or Meta servers.

In the blog's administration panel (accessible only to me) WordPress additionally saves session cookies for the logged-in user — these do not concern visitors.

The chat on this website stores a single conversation identifier in your browser, so that you can see my reply when you come back. It is created only at the moment you open the chat yourself and send a message, and it is not used for tracking. That is why I do not ask for consent for it: it is part of a service you explicitly requested. Until you write, the chat sends no requests and stores nothing.

8. Data security

I apply technical and organisational measures appropriate to the risk, including an encrypted connection (HTTPS), restricted access to data and anti-spam protection of the form.

9. Changes to the privacy policy

This policy may be updated, for example in the event of changes in the law or in the functionality of the website. The current version is always available at biale.studio/en/privacy-policy together with the date from which it applies.