Privacy policy

This policy covers the data you submit through the contact form and when enrolling on a course.

01Who is the data controller

We have not appointed a Data Protection Officer. For any data-related matter, email biuro@confivox.io.

02What data we process

Through the contact form we collect only the data you enter:

• full name,
• email address,
• phone number (optional),
• practice / clinic name (optional),
• your message.

If you enrol on a course, we additionally process:

• the course you selected,
• your profession or role,
• a discount code, if you enter one,
• invoicing details, if you request an invoice: buyer name, VAT ID and address.

In addition, our hosting automatically records standard technical logs (IP address, timestamp, browser type, request path) for security and diagnostics. We use no cookies or analytics tools (see section 10).

03Purpose and legal basis

• Replying to your enquiry and taking steps prior to a possible contract (e.g. arranging pilot terms): Art. 6(1)(b) GDPR, and where you write on behalf of an organisation, our legitimate interest in handling correspondence (Art. 6(1)(f) GDPR).
• Business communication, site security and abuse prevention, including server logs: our legitimate interest (Art. 6(1)(f) GDPR).
• Compliance with legal obligations (e.g. tax and accounting, if an engagement follows): Art. 6(1)(c) GDPR.
• Enrolling you on a course and delivering it: performance of a contract to which you are a party (Art. 6(1)(b) GDPR).
• Training newsletter: your consent (Art. 6(1)(a) GDPR) and Art. 398 of the Polish Electronic Communications Law. You can withdraw it at any time; withdrawal does not affect the lawfulness of messages sent before it.
• Issuing and settling an invoice, and where the buyer is a taxable person, submitting a structured invoice to the Polish National e-Invoicing System (KSeF): Art. 6(1)(c) GDPR. Invoices issued to private individuals are not submitted to KSeF.

Providing the data is voluntary. Required fields are needed to handle your enquiry; without a reply address we cannot answer. Phone and practice name are optional. Do not send us patient data, medical records or confidential information, either through the form or by email.

We add you to the newsletter only if you tick the consent box in the form.

04Who we share data with

Your message goes to our inbox at biuro@confivox.io. We are assisted by IT service providers (site hosting, email, and where a separate provider handles the form, that provider too) only to the extent needed to provide those services and under data-processing agreements. We do not sell your data or share it with others for marketing. Access is limited to authorised people at Confivox.

05Transfers outside the EEA

Form data goes to our mailbox on Proton Mail, a service run by Proton AG, based in Switzerland. Switzerland is a third country, meaning it lies outside the European Economic Area (EEA), but the European Commission has found that it ensures an adequate level of personal data protection (Decision 2000/518/EC, upheld in the review of 15 January 2024). The transfer takes place on the basis of that decision (Art. 45 GDPR), so no additional safeguards such as Standard Contractual Clauses are required.

The website is hosted on servers within the EEA. Apart from the case described above, we do not transfer personal data to third countries or international organisations.

06How long we keep data

We keep form submissions for as long as needed to handle the matter. If an engagement follows, we keep them for the period required by tax and accounting law (see below). If no contact or engagement follows, we delete the form data within 12 months. Server logs are kept for up to 12 months, then deleted or anonymised.

An address added to the newsletter is kept until you withdraw consent. After withdrawal we keep the address itself on a suppression list so we do not message you again.

Course enrolments are kept for as long as needed to organise and deliver the course and to handle any complaints. Accounting records, including invoices, are kept for 5 years from the end of the tax year in which the tax obligation arose. We cannot shorten this period on request, as it follows directly from tax law.

07Your rights

You have the right to:

• access your data and obtain a copy,
• rectify (correct) your data,
• erase your data (“right to be forgotten”),
• restrict processing,
• data portability, where we process the data under a contract or consent and by automated means (Art. 20 GDPR),
• object to processing based on legitimate interest,
• withdraw your newsletter consent at any time, without affecting the lawfulness of earlier messages.

To exercise any right, email biuro@confivox.io.

08Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

09Profiling and automated decisions

We do not profile your data and make no decisions about you by solely automated means.

10Cookies and analytics

This site uses no cookies and no tracking or analytics tools. Fonts are served from our own server (no Google Fonts), so your visit is not reported to third parties. We store nothing in your browser's local storage. The language version follows the address (/ for Polish, /en/ for English), not a saved setting.

11Changes to this policy

If we change how we process data (e.g. add an external form handler), we will update this policy and the date at the top.