Privacy Policy of Mercator Medical S.A.

In order to ensure the transparency of personal data processing processes, we present the rules of personal data processing valid in Mercator Medical S.A. established on the grounds of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, called ‘GDPR’).

1. DATA CONTROLLER The Data Controller, or the entity deciding upon the purposes and methods of personal data processing, is Mercator Medical S.A. with its registered office in Kraków (31-327), ul. Heleny Modrzejewskiej 30, Polish National Court Register (KRS): 0000036244.

If you have any questions or issues regarding the processing of personal data, please contact us by e-mail at: bok@mercatormedical24.eu.

Data Protection Officer The Data Controller has appointed the Data Protection Officer, whom you can contact by e-mail: iod@pl.mercatormedical.eu. The Data Controller encourages you to contact the DPO in connection with any doubts regarding the processing of your personal data.

2. DATA ACQUISITION AND PURPOSE OF DATA PROCESSING

When fulfilling our business functions, we process personal data for various purposes and within various scopes, e.g.:

2.1. Presentation and sending of marketing content

2.1.1. Purpose of processing:

- Sending of marketing messages with the use of means of electronic communication, e.g., by e-mail.

- Adjustment of marketing content to the status of the visitor (layperson/professional user) for the purpose of conformity with the rules of advertising medical devices.

- Implementation of the obligations under the law, particularly the Telecommunications Law and the Electronic Services Act.

2.1.2. Legal basis for processing:

- Article 6(1)(f) of RODO, i.e., the Data Controller’s legitimate interest, which is the marketing of its own products and services.

- Article 6(1)(c) of RODO, i.e., the implementation of the Data Controller’s legal obligations.

2.1.3. Data storage period:

- Until the revocation of consent or objection; however, personal data may be stored for the purpose of proving the correctness of the fulfilment of the Data Controller’s legal obligations and related claims (claim limitation periods are counted from the date of withdrawal of consent or the date of objection).

2.2. Registration of an account in the online store without purchase – potential customers

2.2.1. Purpose of processing:

- Registration and keeping of the account in the online store by filling in the form at the website.

- Ensuring the functionality and easier use of the website.

2.2.2. Legal basis for processing:

- Article 6(1)(b) of RODO, i.e., the necessity of processing for the purpose of providing the service of keeping an account in the online store – the provision of services by electronic means.

- Article 6(1)(c) of RODO, i.e., with regard to the implementation of the Data Controller’s legal obligations related to the provision of services by electronic means.

- Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (ensuring the functionality and easier use of the website).

2.2.3. Data storage period:

- Until deletion of the account, or submission of the request for its deletion.

2.3. Registration of an account in the online store with purchase – customers

2.3.1. Purpose of processing:

- Implementation of the contract with the customer.

- Provision of services by electronic means and fulfilment of related obligations.

- Keeping of settlements, books and financial reporting.

- Ensuring the functionality and easier use of the website.

- Enforcement and defence of claims.

2.3.2. Legal basis for processing:

- Article 6(1)(b) of RODO, i.e., the necessity of processing for the implementation of the contract and the provision of services by electronic means.

- Article 6(1)(c) of RODO, i.e., with regard to the implementation of the Data Controller’s legal obligations, particularly those related to the keeping of settlements, books and financial reporting, and the provision of services by electronic means.

- Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (ensuring the functionality and easier use of the website).

- Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (the enforcement and defence of claims).

2.3.3. Data storage period:

- During the validity and after the expiration of the contract, personal data may be stored for the purposes of proving the correctness of the fulfilment of the Data Controller’s legal obligations or until the expiration of claim limitation periods, depending on which period is longer.

2.4. Purchase without registering an account – customers

2.4.1. Purpose of processing:

- Implementation of the contract with the customer.

- Provision of services by electronic means and fulfilment of related obligations.

- Keeping of settlements, books and financial reporting.

- Ensuring the functionality and easier use of the website.

- Enforcement and defence of claims.

2.4.2. Legal basis for processing:

- Article 6(1)(b) of RODO, i.e., the necessity of processing for the implementation of the contract and the provision of services by electronic means.

- Article 6(1)(c) of RODO, i.e., with regard to the implementation of the Data Controller’s legal obligations, particularly those related to the keeping of settlements, books and financial reporting, and the provision of services by electronic means.

- Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (ensuring the functionality and easier use of the website).

- Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (the enforcement and defence of claims).

2.4.3. Data storage period:

- During the validity and after the expiration of the contract, personal data may be stored for the purposes of proving the correctness of the fulfilment of the Data Controller’s legal obligations or until the expiration of claim limitation periods, depending on which period is longer.

2.5. Submission of enquiries and complaints by e-mail and via website

2.5.1. Purpose of processing:

- Handling of complaints and responding to requests and inquiries submitted by e-mail or via website.

2.5.2. Legal basis for processing:

- Article 6(1)(b) of RODO, i.e., the necessity of processing for the implementation of the contract.

- Article 6(1)(c) of RODO, i.e., the legal obligation to handle complaints.

- Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (the provision of all information related to the pursuit of its business goals).

2.5.3. Data storage period:

- In the case of a purchase made by a consumer, the data will be processed until the expiration of the periods in which the seller is responsible for the non-conformity of the goods with the contract. However, not later than within one year from the lapse of the period stated in the first sentence, if this period – granted by the manufacturer – is longer than arising under the generally applicable provisions of law.

- In the case of a purchase made by an entity not being a consumer, the data will be processed until the expiration of the period for the exercise of complaint rights arising under the relevant provisions of law. Not later than within one year from the lapse of the period for the submission of the complaint, if this period – granted by the manufacturer – is longer than arising under the generally applicable provisions of law.

- In the case of data processing due to the handling of complaints – for the period of one year after the submission of the answer by the Data Controller.

2.6. Negotiation and implementation of contracts with business partners (applies to the business partner’s employees and associates, as well as business partners being natural persons)

2.6.1. Purpose of processing:

- Conclusion and implementation of the contract with a business partner.

- Keeping of settlements, books and financial reporting.

- Enforcement and defence of claims.

2.6.2. Legal basis for processing:

- Article 6(1)(b) of RODO, i.e., the necessity of processing for the implementation of the contract – in the case of business partners being natural persons.

- Article 6(1)(c) of RODO, i.e., the Data Controller’s legal obligation related to the implementation of the contract, particularly with regard to bookkeeping and tax settlements.

- Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (making it possible to conclude and implement the contract with a business partner) – applies to the business partner’s employees and associates.

- Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (the enforcement and defence of claims arising under the contract).

2.6.3. Data storage period:

- Until the expiration of claim limitation periods arising under the contract.

- Until the expiration of data storage periods specified in the law.

- Until the submission of effective objection (if processing is based on the Data Controller’s legitimate interest).

2.7. Correspondent

2.7.1. Purpose of processing:

- For the purpose of keeping correspondence and ensuring the circulation and archiving of documents. For information about the purpose of processing the data contained in the correspondence and related legal grounds, see other parts of the Privacy Policy (depending on what correspondence refers to).

2.7.2. Legal basis for processing:

- Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (keeping correspondence and ensuring the circulation and archiving of documents).

2.7.3. Data storage period:

- The period of storage of data contained in the correspondence depends on the purpose of data processing to which the correspondence refers.

2.8. Persons contacting the Service Office

2.8.1. Purpose of processing

- for the purpose of receiving incoming calls, during which consultants of Mercator Medical S.A. can receive the customer’s comments, complaints and inquiries or make statements. For information about the purpose of processing the data contained in the calls and related legal grounds, see other parts of the Privacy Policy (depending on the topics of the call);

2.8.2. Legal basis for processing:

· Article 6(1)(f) of RODO, i.e., the fulfilment of the Data Controller’s legitimate interests (receiving incoming calls and recording calls).

2.8.3. Data storage period:

- Data are stored for the period when their storage fits within the scope of the Data Controller’s legitimate interest regulated by the time of potential pursuit of claims. However, the period of storage of data contained in the correspondence depends on the purpose of data processing related to the call (if there are other data deletion periods, information about this can be found in the relevant part of the Privacy Policy).

3. DATA RECIPIENTS In connection with its activity, Mercator Medical S.A. may submit your personal data to the following recipients:

a) entities within the Mercator Medical Group,

b) state authorities and other legally entitled entities, if this is necessary for the fulfilment of legal obligations,

c) providers of external ICT systems,

d) auditing entities,

e) experts,

f) entities collaborating with the Data Controller within marketing campaigns,

g) banks,

h) an accounting or legal service provider,

i) companies recycling or archiving documents and other data carriers,

j) companies providing courier and postal services.

4. RIGHTS OF DATA SUBJECTS

Each data subject (i.e., person whose data are processed by the Data Controller) has the right to:

a) access their data,

b) rectification of their data,

c) erasure of their data,

d) restriction of processing of their data,

e) object to the processing of their data,

f) portability of their data,

g) if processing is based on the consent – to withdraw such consent at any time without prejudice to the lawfulness of processing that took place on the basis of the content before its withdrawal.

In addition, the data subject is entitled to file a complaint to the supervisory authority, i.e., the President of the Personal Data Protection Office.

5. DO YOU HAVE TO PROVIDE YOUR PERSONAL DATA? Providing your data is necessary for the conclusion and implementation of sales contracts and the settlement of activity being conducted, as well as the fulfilment of the Data Controller’s obligations imposed by the law. This means that in order to use the offer of Mercator Medical S.A., you have to provide your personal data.

In other respects (particularly with regard to processing for marketing purposes), providing your data is voluntary.

6. TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS Data will be processed in the European Economic Area; therefore, as a general principle, they are not transferred to third countries. Such transfer of data may occur in the context of IT infrastructure used by the Data Controller, where data can be transferred to the USA. In such case, in the absence of any decision of the European Commission ascertaining the relevant level of protection, data will be transferred only subject to the provision of appropriate safeguards indicated in RODO, particularly standard contractual clauses. In order to obtain more information and a copy of the aforementioned safeguards, please contact the Data Protection Officer: iod@pl.mercatormedical.eu.

7. AUTOMATED DATA PROCESSING Personal data will not be transferred in a manner leading to automated decision-making, producing legal consequences for or otherwise significantly affecting the data subjects.

8. AMENDMENT OF THE PRIVACY POLICY Whereas the Data Controller regularly revises and updates this Privacy Policy, there is a possibility of amending it. The current version of the Privacy Policy is available on the Data Controller’s website https://emercator.com

9. COOKIES

The website automatically collects information contained in cookies. Cookies are small text files recorded on your computer or smartphone when you visit our website. There are various types of cookies. For your convenience, we have divided them into two groups:

A. Cookies necessary for the use of our website are intended, among others, to ensure the stability of its functioning (they measure traffic to protect us against its overload), to save your privacy preferences, to fill in online forms made available by us, to save the content of the cart and to monitor the login status. These cookies are used by default, i.e., we save them on your computer or smartphone when you enter our website (pursuant to Article 173(3) of the Telecommunications Law Act).

B. Other cookies are used only when you give us your consent.

9.1. Consent to the installation of cookies

During your visit to our website, a banner will be displayed with information that our website uses cookies. If you choose the ‘Akceptuj wszystkie’ [‘Accept all’] option, this will mean that you accept all cookies placed on our website and you confirm that you have read the information about the cookies, the purposes of their use and cases in which data collected by means of cookies are transferred to our partners.

Please remember that your consent is not required in the case of necessary cookies because such files ensure the full and uninterrupted functioning of our website. These cookies are exempt from the obligation to obtain your consent pursuant to Article 173(3) of the Telecommunications Law Act.

9.2. Lack of consent to the installation of cookies

If you do not want our cookies to be saved on your device, you can choose ‘Odrzuć wszystko’ [‘Reject all’] option. By choosing this option, you will reject all cookies, except the technically required cookies we use on our website.

9.3. Modification of cookie settings

You can manage your cookie preferences specifically by selecting the ‘Zaawansowane ustawienia’ [‘Advanced settings’] box on the cookie banner displayed to you.

9.4. Withdrawal of consent

Please remember that you can change your consents at any time by clicking the icon in the lower-left corner of our website.

9.5. What cookies do we use?

[vendor]

[cookie]