Pursuant to Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR“), we inform you that:

1. Masdiag Limited Liability Company is the Data Controller of your personal data. Our contact details are as follows: Masdiag Ltd., 33 Żeromskiego Street, 01-882 Warsaw, Poland, Company Registration Number (KRS): 0000420325, Tax Identification Number (NIP): 5222996468, National Business Registry Number (REGON): 146121549, Tel: +48 602 228 824, Email: masdiag@masdiag.pl
2. For matters concerning your personal data, please contact our Data Protection Officer: Anna Kołodyńska, email address: DPO@masdiag.pl, mailing address: Masdiag Ltd., 33 Żeromskiego Street, 01-882 Warsaw, Poland.
3. Your personal data is processed based on:
   a) Article 6(1)(b) of the GDPR for the purpose of taking action at your request, prior to entering into a contract or performing a contract between you and the Data Controller.
   b) Article 6(1)(c) of the GDPR for the purpose of fulfilling our obligations as the Data Controller under legal provisions, including tax or accounting regulations.
4. Your personal data is processed by us as the Data Controller based on Article 6(1)(b) of the GDPR for the purpose of patient registration and issuing diagnostic results.
5. Your personal data is processed by the Data Controller based on Article 6(c) of the GDPR for the purpose of fulfilling the Agreement concluded with the Client, including ongoing communication and cooperation under the contract, as well as to fulfil a legal obligation incumbent on us as the Data Controller (e.g., arising from tax or accounting regulations).
6. Your personal data will be disclosed to other recipients, such as technical service providers (including providers of IT infrastructure), postal operators, carriers, and tax service providers.
7. Your personal data will be stored by us as the Data Controller for the period necessary to fulfil the contract with the Client, and after its expiration, for the period specified by specific legal provisions, namely for a period of 20 years from the end of the calendar year in which the examination was conducted, in accordance with Article 29 of the Act of 6 November 2008 on Patients’ Rights.
8. With regard to your personal data, we do not make decisions by automated means, and your data is not subject to profiling.
9. Your personal data will not be transferred outside the European Economic Area.
10. You have the right to:
    a) Request access to your personal data, their rectification, erasure, or restriction of processing, as well as the right to data portability to another Data Controller.
    b) Object to the processing of your personal data based on the legitimate interests of the Data Controller.
    c) Lodge a complaint with the Polish supervisory authority responsible for personal data protection (President of the Office for Personal Data Protection, 2 Stawki Street, 00-193 Warsaw) or with the supervisory authority of another European Union member state competent due to your habitual residence or place of work, or the alleged violation of the GDPR.
11. Providing your personal data is voluntary but necessary to take action prior to entering into a contract with you or to perform a contract in which you are a party, as well as to fulfil a legal obligation incumbent on the Data Controller (e.g., arising from tax or accounting regulations).
12. The Data Controller makes every effort to ensure the physical, technical, and organizational security measures for the protection of personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, in accordance with all applicable laws and regulations.

Pursuant to Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR“), we inform you that:

1. Masdiag Limited Liability Company is the Data Controller of your personal data. Our contact details are as follows: Masdiag Ltd., 33 Żeromskiego Street, 01-882 Warsaw, Poland, Company Registration Number (KRS): 0000420325, Tax Identification Number (NIP): 5222996468, National Business Registry Number (REGON): 146121549, Tel: +48 602 228 824, Email: masdiag@masdiag.pl
2. For matters concerning your personal data, please contact our Data Protection Officer: Anna Kołodyńska, email address: DPO@masdiag.pl, mailing address: Masdiag Ltd., 33 Żeromskiego Street, 01-882 Warsaw, Poland.
3. Your personal data is processed for the following purposes:
   a) Taking action at your request prior to entering into a contract or performing a contract between you and the Data Controller (Article 6(1)(b) of the GDPR).
   b) Fulfilling our obligations as the Data Controller under applicable laws, including tax or accounting laws (Article 6(1)(c) of the GDPR).
   c) Pursuing the legitimate interests of the Data Controller, including the pursuit or securing of potential claims, marketing purposes (Article 6(1)(f) of the GDPR).
4. Your personal data is processed for the purpose of taking action at the request of the data subject prior to entering into a contract or performing a contract in which the data subject is a party; fulfilling the legal obligations of the Data Controller (e.g., arising from tax or accounting regulations); and marketing our own products or services, as well as pursuing or securing claims.
5. Your personal data is processed by us, as the Data Controller, on the basis of Article 6(1)(c) and Article 6(1)(f) of the GDPR, for the purpose of performing the contract concluded with the Client, including ongoing communication and cooperation under the contract, as well as fulfilling our legal obligations as the Data Controller (e.g., arising from tax or accounting regulations) and pursuing or securing claims related to the contract.
6. Your personal data will be disclosed to other recipients, such as technical service providers (including providers of IT infrastructure), postal operators, carriers, tax, and legal service providers.
7. The data stored by us as the Data Controller will be retained for the period necessary to fulfil the contract with the Client, and after its expiration, for the period specified by specific legal provisions (such as tax or accounting laws, the Civil Code), including the period necessary for the protection or enforcement of any claims related to the contract
8. With regard to your personal data, we do not make decisions by automated means, and your data is not subject to profiling.
9. Your personal data will not be transferred outside the European Economic Area.
10. You have the right to:
    a) Request from us, as the Data Controller, access to your personal data, their rectification, erasure, or restriction of processing, as well as the right to data portability to another data controller.
    b) Object to the processing of your personal data based on the legitimate interests of the Data Controller (Article 6(1)(f) of the GDPR).
    c) Lodge a complaint with the Polish supervisory authority responsible for personal data protection (President of the Personal Data Protection Office, 2 Stawki Street, 00-193 Warsaw) or with the supervisory authority of another European Union member state competent due to your habitual residence or place of work, or the alleged violation of the GDPR.
11. Providing your personal data is voluntary but necessary for taking action prior to entering into a contract with you or performing a contract in which you are a party, fulfilling the legal obligations of the Data Controller (e.g., arising from tax or accounting regulations), marketing our own products or services, and pursuing or securing claims. Failure to provide the data will result in the contract not being concluded.
12. The Data Controller makes every effort to ensure the physical, technical, and organizational protection of personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, in accordance with all applicable regulations.