Privacy notice
Information under articles 13 and 14 GDPR. Version of 5 September 2026.
Controller
MEDSMITH spółka z ograniczoną odpowiedzialnością, ul. Janusza Wojsławica 3, 85-796 Bydgoszcz, Poland, KRS 0000929692. Contact for data matters: training@medsmith.pl. We have not appointed a data protection officer; we are not required to.
What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email, phone (optional), institution and VAT ID (optional), billing address — entered on our checkout page | Concluding and performing the contract, delivering access, tax-correct payment processing, responding to complaints | Art. 6(1)(b) GDPR; art. 6(1)(c) for accounting records | Duration of access plus the statutory accounting retention period (5 years from the end of the tax year) |
| Order record (modules, amounts, time, order reference) | Order page, customer support, accounting | Art. 6(1)(b), (c) | As above |
| Messages sent through the contact form or the chat panel (name, email, message, IP address) | Answering your question | Art. 6(1)(f) — our legitimate interest in replying | 12 months after the last exchange |
| Session identifier (cookie) | Keeping your cart and protecting forms | Art. 6(1)(f); strictly necessary | Until the browser is closed |
| Remembered address (cookie, only if you tick the box) | Pre-filling the checkout next time | Art. 6(1)(a) — consent | 180 days or until you click “forget” |
| Server logs (IP, time, page) | Security and error diagnosis | Art. 6(1)(f) | Up to 30 days |
Recipients
We collect your billing details ourselves and pass them to our payment service provider, which acts as merchant of record, processes the payment, applies the correct tax and issues the receipt; it is an independent controller for the payment and its own notice applies on its payment page. Your card details are entered only on that page and never reach our servers. Other recipients are our hosting provider (server location within the EU) and, where legally required, tax and other authorities. Photographs and the payment-method logos are loaded from public content-delivery networks (a stock-photo library and an icon library), which see your IP address when an image loads.
Transfers outside the EEA
The payment provider may process data in the United States under the EU–US Data Privacy Framework or standard contractual clauses. We do not otherwise transfer data outside the EEA.
Your rights
You may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interest; consent may be withdrawn at any time. Write to training@medsmith.pl. You can lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, or with the authority of your own country.
Automated decisions
We make no automated decisions with legal effect. The payment provider may use automated fraud screening on its own page.