[{"data":1,"prerenderedAt":80},["ShallowReactive",2],{"shop-legal:privacy:en:":3},{"documentId":4,"title":5,"version":6,"effectiveDate":7,"draft":8,"docLocale":9,"fallback":10,"variant":11,"html":12,"toc":13,"missing":75,"warnings":78},"polityka-prywatnosci-platformy","Art Oral Platform Privacy Policy","0.2.0","[to be completed]",true,"en",false,"realperio","\u003Ch2 id=\"sec-1-controller\">§ 1. Controller\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The controller of the personal data referred to in this privacy policy (hereinafter: “Policy”) is Adrian Jebara, conducting business activity under the business name “Art Oral Adrian Jebara”, ul. Namysłowska 6B\u002F84, 03-455 Warszawa, NIP 9141377852 (Polish tax identification number), REGON 302573966 (Polish business statistical number) (hereinafter: “Controller” or “we”).\u003C\u002Fli>\n\u003Cli>In matters concerning personal data, the Controller may be contacted:\u003Col>\n\u003Cli>by email at: \u003Ca href=\"mailto:support@realperio.online\">support@realperio.online\u003C\u002Fa>;\u003C\u002Fli>\n\u003Cli>by post at: ul. Namysłowska 6B\u002F84, 03-455 Warszawa.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>This Policy fulfils the information obligations under Articles 13 and 14 of Regulation (EU) 2016\u002F679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: “GDPR”).\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-2-scope-of-the-policy\">§ 2. Scope of the Policy\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The Website on which the User is viewing this Policy is the RealPerio Website, operated entirely by the Controller. This Policy covers all data processed on the RealPerio Website, including in the Shop, in the contact form and in connection with the use of cookies.\u003C\u002Fli>\n\u003Cli>This Policy also covers data processed in the Shop operated by the Controller on Partner Websites on which the same Account works. Other parts of Partner Websites are subject to the privacy policies of their owners.\u003C\u002Fli>\n\u003Cli>The owners of Partner Websites have no access to the data processed in the Shop and do not receive it from the Controller.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-3-data-protection-officer\">§ 3. Data protection officer\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The Controller has not designated a data protection officer, because it is not required to do so under Article 37(1) GDPR: it is not a public authority or body, and its core activities do not consist of processing operations which require regular and systematic monitoring of data subjects on a large scale or of processing on a large scale of special categories of data.\u003C\u002Fli>\n\u003Cli>In all matters concerning personal data, please use the contact details indicated in § 1(2).\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-4-one-account-across-several-websites\">§ 4. One Account across several Websites\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The Account is shared by all Websites on which the Controller operates the Shop. The Controller processes Account data in a single system (the Platform), regardless of the Website on which the Account was created.\u003C\u002Fli>\n\u003Cli>As a result, the Controller can see the User's activity in the Shop on each of the Websites, in particular: the Website on which the Account was created, the Website of the last login or purchase, the Website on which a given purchase was made and the Website on which a Film was played. This information is used solely for the purposes specified in § 6, in particular to ensure access to purchased Films on every Website, to send messages in the language and with the branding of the relevant Website, and to protect the Films.\u003C\u002Fli>\n\u003Cli>The owners of Partner Websites have no access to the Platform or to the data of Users and Buyers, including information about who created an Account, bought or played a Film on their Website. The Controller may provide Partners only with aggregate sales statistics that do not allow individuals to be identified.\u003C\u002Fli>\n\u003Cli>The Controller provides the current list of Websites on which the Account works upon any request.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-5-categories-of-data-and-their-sources\">§ 5. Categories of data and their sources\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The Controller processes the following categories of data:\u003Col>\n\u003Cli>Account data: first name and surname, email address, selected language, Account identifier, information on the login method, the Website on which the Account was created and the Website of last activity, the date the Account was created;\u003C\u002Fli>\n\u003Cli>authentication data: the password, stored only as a cryptographic hash by the authentication service provider, and, in the case of Google login: the Google account identifier, first name and surname, email address and the profile picture address, if made available by Google;\u003C\u002Fli>\n\u003Cli>data provided voluntarily: licence to practise number (on Websites where this is possible), telephone number, company details for autofilling forms;\u003C\u002Fli>\n\u003Cli>statements and consents: the time of acceptance of the Terms, the time the Professional Declaration was made, consent to receive information about new Films;\u003C\u002Fli>\n\u003Cli>order data: Film, Website, language, currency, amount, order status, transaction identifiers assigned by the Payment Operator, history of payment events (including refunds and payment disputes), order and payment dates;\u003C\u002Fli>\n\u003Cli>billing data: first name and surname or business name, address, NIP or EU VAT number, invoice number;\u003C\u002Fli>\n\u003Cli>proof of the Immediate Supply Statement: the version of the statement text, the time it was made, the IP address and browser information (user agent);\u003C\u002Fli>\n\u003Cli>access data: list of purchased Films, the date on which access was granted and, where applicable, revoked, together with the reason;\u003C\u002Fli>\n\u003Cli>playback data: the point at which playback of a Film was stopped, information that a Film has been watched, playback sessions (device identifier, IP address, browser information, session validity time), the playback log (§ 7);\u003C\u002Fli>\n\u003Cli>technical data: IP address, browser and device information, bot protection signals, entries in service providers' system logs;\u003C\u002Fli>\n\u003Cli>the content of correspondence with the Controller, including complaints and appeals.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>The data is obtained directly from the User, except for:\u003Col>\n\u003Cli>data provided by Google upon Google login (point 2 above);\u003C\u002Fli>\n\u003Cli>data provided by the Payment Operator: payment status, the billing data entered in the payment form and transaction identifiers;\u003C\u002Fli>\n\u003Cli>technical data generated automatically while the Shop is being used.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-6-purposes-legal-bases-and-retention-periods\">§ 6. Purposes, legal bases and retention periods\u003C\u002Fh2>\n\u003Col>\n\u003Cli>\u003Cstrong>Account.\u003C\u002Fstrong> Registration, login and maintenance of the Account, including verification of the email address and sending login links and password change links:\u003Col>\n\u003Cli>data: § 5(1)(1) to (3);\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(b) GDPR (performance of the contract for maintaining the Account);\u003C\u002Fli>\n\u003Cli>period: until the Account is deleted.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Statements at registration.\u003C\u002Fstrong> Recording acceptance of the Terms and of the Professional Declaration:\u003Col>\n\u003Cli>data: § 5(1)(4), except marketing consent;\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(b) GDPR (a condition for concluding the contract for maintaining the Account) and Article 6(1)(f) GDPR (the Controller's legitimate interest in being able to demonstrate that the statements were made);\u003C\u002Fli>\n\u003Cli>period: until the Account is deleted.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Sale of and access to Films.\u003C\u002Fstrong> Conclusion and performance of the Sales Contract, granting and maintaining access to Films on every Website, sending confirmations, handling complaints and refunds:\u003Col>\n\u003Cli>data: § 5(1)(5), (6), (8) and (11);\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(b) GDPR;\u003C\u002Fli>\n\u003Cli>period: for as long as the Account exists, because this data is necessary to ensure access to purchased Films; after the Account is deleted, order data is retained in pseudonymised form on the terms of paragraph 4.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Tax and accounting obligations.\u003C\u002Fstrong> Issuing invoices, including in the Krajowy System e-Faktur (KSeF, Polish National e-Invoicing System), keeping sales records and retaining documentation:\u003Col>\n\u003Cli>data: § 5(1)(5) and (6);\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(c) GDPR in conjunction with the ustawa o podatku od towarów i usług (Polish Value Added Tax Act) and the ustawa Ordynacja podatkowa (Polish Tax Ordinance Act);\u003C\u002Fli>\n\u003Cli>period: 5 years from the end of the calendar year in which the tax payment deadline expired; after the Account is deleted, the data is retained in pseudonymised form (without a link to the Account and without the email address), with the billing data required by tax legislation retained.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Proof of consent to immediate supply.\u003C\u002Fstrong> Demonstrating that the Consumer made the Immediate Supply Statement and acknowledged the loss of the right of withdrawal:\u003Col>\n\u003Cli>data: § 5(1)(7);\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(f) GDPR (the Controller's legitimate interest in demonstrating that the conditions of Article 38(1)(13) of the ustawa o prawach konsumenta (Polish Consumer Rights Act) are met and in defending against claims);\u003C\u002Fli>\n\u003Cli>period: together with the order data (paragraphs 3 and 4); the IP address and browser information are deleted when the Account is deleted, and the version of the text and the time the statement was made are retained together with the pseudonymised order data.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Protection of Films and Account security.\u003C\u002Fstrong> Watermark, limit on simultaneous devices, playback log and detection of Account sharing (details in § 7):\u003Col>\n\u003Cli>data: § 5(1)(1) and (9);\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(f) GDPR (the Controller's legitimate interest in protecting the copyright in the Films, preventing unauthorised sharing of Accounts and enforcing the Terms);\u003C\u002Fli>\n\u003Cli>period: playback log, 30 days from playback; playback sessions, until the session expires, but no later than the deletion of the Account; daily unusual activity reports, 90 days; data concerning an established breach and appeal proceedings, until the matter is closed and then until the limitation period for claims expires.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Abuse prevention.\u003C\u002Fstrong> Protection of login forms and login links against automated requests (Cloudflare Turnstile) and rate limiting:\u003Col>\n\u003Cli>data: § 5(1)(10), the email address entered in the form;\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(f) GDPR (ensuring the security and continuity of operation of the Platform);\u003C\u002Fli>\n\u003Cli>period: request counters store only a cryptographic hash of the identifier (IP address, email address or Account identifier) and are deleted at the end of the limit window, no later than after 24 hours.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Playback progress.\u003C\u002Fstrong> Remembering the point at which playback was stopped and marking watched Films:\u003Col>\n\u003Cli>data: § 5(1)(9), to that extent;\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(b) GDPR;\u003C\u002Fli>\n\u003Cli>period: until the Account is deleted.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Information about new Films.\u003C\u002Fstrong> Sending emails about new Films:\u003Col>\n\u003Cli>data: first name, email address, language;\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(a) GDPR (consent) and the consent required under the ustawa z dnia 12 lipca 2024 r. Prawo komunikacji elektronicznej (Polish Electronic Communications Law of 12 July 2024);\u003C\u002Fli>\n\u003Cli>period: until consent is withdrawn or the Account is deleted. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Correspondence.\u003C\u002Fstrong> Responding to messages sent to the Controller's address that are not related to a complaint:\u003Col>\n\u003Cli>data: email address, first name and surname, message content;\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(f) GDPR (responding to the message);\u003C\u002Fli>\n\u003Cli>period: until the correspondence ends and then for no longer than 3 years.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Claims.\u003C\u002Fstrong> Establishment, exercise and defence of legal claims, including handling payment disputes raised by card issuers (chargebacks):\u003Col>\n\u003Cli>data: those of the data listed in § 5 that are necessary for the given matter;\u003C\u002Fli>\n\u003Cli>legal basis: Article 6(1)(f) GDPR;\u003C\u002Fli>\n\u003Cli>period: until the limitation periods for claims expire and, if proceedings are initiated, until they are finally concluded.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-7-watermark-device-limit-and-playback-log\">§ 7. Watermark, device limit and playback log\u003C\u002Fh2>\n\u003Col>\n\u003Cli>\u003Cstrong>Watermark.\u003C\u002Fstrong> During playback of a Film, a moving mark containing the Account email address and a shortened Account identifier is displayed over the image. The mark is not saved in the Film file; it appears only on the User's screen and on any unauthorised screen recording, making it possible to identify the Account from which the recording originates.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Device limit.\u003C\u002Fstrong> In order to limit simultaneous playback to 2 devices, the browser receives a random device identifier, stored in its local storage. Each time a Film is started, the Controller records a playback session: Account identifier, Film, Website, device identifier, IP address, browser information and session validity time (up to 2 hours).\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Playback log.\u003C\u002Fstrong> Each start of a Film is recorded in a log comprising: Account identifier, email address, Film, Website, device identifier, IP address, browser information and time. The log is deleted automatically after 30 days.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Unusual activity report.\u003C\u002Fstrong> Once a day, the Platform compiles a list of Accounts in which the number of playbacks or of different IP addresses exceeds a set threshold and sends the list to persons authorised by the Controller. The list is only a signal for analysis; any decision to apply the measures provided for in § 14 of the Terms is taken by a human being, after analysing the circumstances, and the User is guaranteed the right to provide explanations and to appeal.\u003C\u002Fli>\n\u003Cli>The Controller has assessed that the interests and rights of Users do not override the interest in protecting the Films against dissemination, taking into account: the limited scope of the data, the short retention period of the log, the fact that the data is not used for marketing purposes and the fact that it is not disclosed to Partners. The User may object to this processing (§ 14(1)(6)); however, if the objection is upheld, it may no longer be possible to play Films, because these protection measures are a condition for making them available.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-8-payments\">§ 8. Payments\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Payments in the Shop are handled by Stripe Payments Europe, Limited, with its registered office in Dublin (Ireland). The payment form is hosted on the Stripe domain, and payment data (in particular card data and authentication data) is provided directly to Stripe.\u003C\u002Fli>\n\u003Cli>With regard to the processing of payment data, the execution of transactions, fraud prevention and compliance with obligations under payment services and anti-money laundering legislation, Stripe acts as a separate controller, in accordance with the Stripe privacy policy available at stripe.com.\u003C\u002Fli>\n\u003Cli>The Controller does not receive payment card data. From Stripe, the Controller receives information on the payment status, transaction and customer identifiers and the billing data entered in the payment form.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-9-recipients-of-data\">§ 9. Recipients of data\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Data may be disclosed to entities processing it on behalf of the Controller (processors), under data processing agreements:\u003Col>\n\u003Cli>Google Ireland Limited, with its registered office in Dublin (Ireland): the Firebase Authentication, Cloud Firestore, Cloud Functions and Firebase Hosting services on which the Platform runs; the database and server functions run in European Union regions;\u003C\u002Fli>\n\u003Cli>BunnyWay d.o.o., with its registered office in Ljubljana (Slovenia): storage, encoding and delivery of Films and Trailers via a server network (CDN), within which the IP address and technical browser data are processed;\u003C\u002Fli>\n\u003Cli>[to be completed]: sending emails (purchase confirmations, login links, notifications);\u003C\u002Fli>\n\u003Cli>Cloudflare, Inc., with its registered office in San Francisco (USA): the Turnstile service, which protects forms against automated requests;\u003C\u002Fli>\n\u003Cli>entities providing accounting, IT (maintenance and development of the Platform) and legal services to the Controller, to the extent necessary to provide those services.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>Data may be disclosed to entities acting as separate controllers:\u003Col>\n\u003Cli>Stripe Payments Europe, Limited (§ 8);\u003C\u002Fli>\n\u003Cli>Google Ireland Limited and Google LLC, with regard to Google login, in accordance with the Google privacy policy accepted by the User when creating a Google account;\u003C\u002Fli>\n\u003Cli>public authorities, including tax authorities via the Krajowy System e-Faktur, courts and other authorities entitled under the law;\u003C\u002Fli>\n\u003Cli>invoice purchasers, i.e. the business indicated by the User as the purchaser in the invoice details.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>The Controller does not sell personal data and does not disclose it to Partners or to other entities for marketing purposes.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-10-transfers-of-data-outside-the-european-economic-area\">§ 10. Transfers of data outside the European Economic Area\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Some recipients process data outside the European Economic Area, in particular:\u003Col>\n\u003Cli>the Firebase Authentication and Firebase Hosting services may process data on Google servers in the United States and in other countries;\u003C\u002Fli>\n\u003Cli>the servers of the BunnyWay CDN through which Films are delivered are located worldwide, and a Film is delivered from the server closest to the User;\u003C\u002Fli>\n\u003Cli>Cloudflare, Inc. processes data in the United States and across its global network;\u003C\u002Fli>\n\u003Cli>Stripe may transfer data to Stripe, Inc. in the United States.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>Transfers of data to the United States take place on the basis of the European Commission's decision of 10 July 2023 finding an adequate level of protection under the EU-US Data Privacy Framework, with regard to certified entities, and in other cases on the basis of standard contractual clauses adopted by the European Commission. Data is transferred to countries for which the Commission has adopted an adequacy decision on the basis of that decision.\u003C\u002Fli>\n\u003Cli>A copy of the safeguards applied to data transfers may be obtained by contacting the Controller.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-11-browser-storage-and-cookies-in-the-shop\">§ 11. Browser storage and cookies in the Shop\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The Shop stores information on, or reads information from, the User's device only where strictly necessary to provide the services requested by the User, which does not require consent under Article 399 of the ustawa z dnia 12 lipca 2024 r. Prawo komunikacji elektronicznej. These are:\u003Col>\n\u003Cli>\u003Cstrong>login session\u003C\u002Fstrong> (Firebase Authentication, IndexedDB or browser local storage): keeping the User logged in; stored until logout and, with the “shared computer” option, until the tab or browser is closed;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>email address for the login link\u003C\u002Fstrong> (local storage): completing login via an email link on the same device; deleted after login;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>device identifier\u003C\u002Fstrong> (local storage): enforcing the limit of 2 simultaneous devices (§ 7(2)); stored until the browser data is cleared;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>login handling\u003C\u002Fstrong> (cookies and storage on the Website's authentication domain and, for Google login, on Google domains): handling the login window;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>bot protection\u003C\u002Fstrong> (Cloudflare Turnstile, on the challenges.cloudflare.com domain): assessing whether the form is being filled in by a human;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>player\u003C\u002Fstrong> (BunnyWay, on the player provider's domain): playback settings, such as volume and image quality;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>payment\u003C\u002Fstrong> (Stripe, on the Stripe domain): handling the payment form and fraud prevention, in accordance with the Stripe policy.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>The Shop does not use cookies or similar technologies for advertising purposes.\u003C\u002Fli>\n\u003Cli>The User may at any time delete the data stored by the Website in the browser settings. Deleting the data listed in paragraph 1(1) to (3) logs the User out and causes the device to be recognised as new.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-12-other-parts-of-the-website\">§ 12. Other parts of the Website\u003C\u002Fh2>\n\u003Col>\n\u003Cli>\u003Cstrong>Contact form.\u003C\u002Fstrong> The data provided in the contact form of the RealPerio Website (first name and surname, email address, optionally telephone number, subject, message content), as well as the IP address and bot protection signals, are processed in order to respond and to protect the form against abuse, on the basis of Article 6(1)(f) GDPR and, if the message concerns the conclusion of a contract, on the basis of Article 6(1)(b) GDPR. The data is stored until the correspondence ends and then for no longer than 3 years.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Analytics.\u003C\u002Fstrong> With the User's consent, given in the cookie banner, the RealPerio Website uses Google Analytics 4, provided by Google Ireland Limited, to compile visit statistics and improve the Website. The tool stores the “_ga” and “\u003Cem>ga\u003C\u002Fem>*” cookies with a lifetime of up to 13 months, event data is retained in Google Analytics for 14 months, and the tool processes data on the device, the browser, the approximate location and the way in which the Website is used; data may be transferred to the United States on the terms of § 10(2). The legal basis for the processing is Article 6(1)(a) GDPR. The email address, first name and surname and Account identifier are not passed to the analytics tool. Without consent, the tool is not activated.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Cookie consent.\u003C\u002Fstrong> The choice made in the banner is stored in the browser's local storage for 12 months in order to remember it. Consent may be changed or withdrawn at any time using the “Cookie settings” link in the footer of the RealPerio Website.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-13-email-messages\">§ 13. Email messages\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Messages relating to the Account and purchases (email address confirmation, login and password change links, purchase confirmation including the text of the Immediate Supply Statement, notification of a failed payment, information about changes to the Terms, changes to Films and the application of measures under § 14 of the Terms) are sent regardless of marketing consent, because they are necessary for the performance of the contract or are required by law.\u003C\u002Fli>\n\u003Cli>Messages are sent from an address bearing the name of the Website on which the given event occurred, and in the language of that Website or of the order. In every case, the sender and controller is the Controller.\u003C\u002Fli>\n\u003Cli>Information about new Films is sent only with consent (§ 6(9)).\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-14-rights-of-data-subjects\">§ 14. Rights of data subjects\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Every data subject has the right:\u003Col>\n\u003Cli>of access to the data and to obtain a copy of it (Article 15 GDPR);\u003C\u002Fli>\n\u003Cli>to rectification of the data (Article 16 GDPR);\u003C\u002Fli>\n\u003Cli>to erasure of the data (Article 17 GDPR);\u003C\u002Fli>\n\u003Cli>to restriction of processing (Article 18 GDPR);\u003C\u002Fli>\n\u003Cli>to portability of data processed by automated means on the basis of consent or a contract (Article 20 GDPR);\u003C\u002Fli>\n\u003Cli>to object to processing based on Article 6(1)(f) GDPR, on grounds relating to their particular situation (Article 21 GDPR);\u003C\u002Fli>\n\u003Cli>to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;\u003C\u002Fli>\n\u003Cli>to lodge a complaint with a supervisory authority, which in Poland is the President of the Urząd Ochrony Danych Osobowych (UODO, Polish Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, or with the supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003C\u002Fli>\n\u003Cli>Requests may be submitted to the contact details indicated in § 1(2). To protect the data, the Controller may ask for the request to be sent from the email address assigned to the Account or for other confirmation of identity.\u003C\u002Fli>\n\u003Cli>The Controller responds without undue delay and in any event within one month of receipt of the request; where necessary, taking into account the complexity and number of the requests, that period may be extended by two further months, of which the Controller informs the data subject within one month.\u003C\u002Fli>\n\u003Cli>The right to erasure does not cover data whose retention is required by tax legislation or is necessary for the establishment, exercise or defence of legal claims (§ 6(4), (5) and (11)).\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-15-deletion-of-the-account\">§ 15. Deletion of the Account\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The User may delete the Account in the Account settings on any Website (after logging in again) or by sending a request to the contact details indicated in § 1(2).\u003C\u002Fli>\n\u003Cli>Upon deletion of the Account, the Controller deletes: the Account and profile data, authentication data, statements and consents recorded at registration, playback progress, playback sessions and playback log entries.\u003C\u002Fli>\n\u003Cli>Order data and data on access to Films are pseudonymised: the Account identifier is replaced by a derived identifier that cannot be linked to the Account without additional information, the email address is deleted, and the IP address and browser information are deleted from the proof of the Immediate Supply Statement. The billing data required by tax legislation is retained. This data is retained for the period indicated in § 6(4) and then deleted.\u003C\u002Fli>\n\u003Cli>Customer data stored by Stripe as a separate controller, as well as invoices issued in the Krajowy System e-Faktur, are not deleted together with the Account and are subject to the rules applicable to those entities and systems.\u003C\u002Fli>\n\u003Cli>Deletion of the Account results in permanent loss of access to purchased Films (§ 21 of the Terms).\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-16-automated-decision-making-and-profiling\">§ 16. Automated decision-making and profiling\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The Controller does not take decisions concerning Users based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them, within the meaning of Article 22 GDPR.\u003C\u002Fli>\n\u003Cli>Automated technical mechanisms, such as refusing playback on a third simultaneous device, rate limiting or Turnstile verification, operate according to uniform, predefined rules and are not used to evaluate individuals. The report referred to in § 7(4) is solely a signal for a human being.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-17-whether-providing-data-is-required\">§ 17. Whether providing data is required\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Providing data is voluntary. Providing an email address and first name and surname, making the Professional Declaration and accepting the Terms are conditions for creating an Account, and providing billing data in the payment form is a condition for concluding the Sales Contract.\u003C\u002Fli>\n\u003Cli>Providing invoice details by a business is a condition for issuing an invoice to that business.\u003C\u002Fli>\n\u003Cli>Providing a licence to practise number, a telephone number and company details in the profile is entirely voluntary.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-18-data-we-do-not-process-and-persons-shown-in-the-films\">§ 18. Data we do not process and persons shown in the Films\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The Controller does not process the data of Users' patients in the Shop. The User should not send the Controller data of their patients, in particular data concerning health, in correspondence, complaints or forms.\u003C\u002Fli>\n\u003Cli>The Controller does not process special categories of Users' data referred to in Article 9 GDPR in the Shop. The Professional Declaration and the licence to practise number do not constitute such data.\u003C\u002Fli>\n\u003Cli>This Policy does not concern the data of doctors participating in the production of the Films or of patients shown in the Films; such data is processed on the basis of separate agreements and consents. The image and data of patients are anonymised in the Films. A person who believes that they have been shown in a Film in an identifiable manner may report this to the Controller at the contact details indicated in § 1(2); the report will be dealt with without delay.\u003C\u002Fli>\n\u003Cli>The Shop is intended for adults practising medical professions or studying. The Controller does not knowingly process the data of persons under 18 years of age.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-19-security\">§ 19. Security\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The Controller applies technical and organisational measures appropriate to the risk, in particular: encryption of connections (HTTPS), encryption of data at rest by service providers, access control to the Platform based on individual administrative permissions, two-factor authentication for administrative accounts with service providers, database access rules restricting each User's access to their own data, protection of forms against abuse and automatic deletion of data after the retention periods expire.\u003C\u002Fli>\n\u003Cli>Only persons authorised by the Controller, who are bound by confidentiality, have access to the data.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"sec-20-changes-to-the-policy\">§ 20. Changes to the Policy\u003C\u002Fh2>\n\u003Col>\n\u003Cli>The Controller may change this Policy in the event of changes in the law, in the methods or purposes of data processing, in the recipients of data or in the functions of the Platform.\u003C\u002Fli>\n\u003Cli>The Controller informs Users of material changes to this Policy by email to the Account address or by a notice on the Websites before the changes are introduced.\u003C\u002Fli>\n\u003Cli>The version of this Policy and the date from which it applies are indicated in its header. This Policy applies from [to be completed].\u003C\u002Fli>\n\u003C\u002Fol>\n",[14,18,21,24,27,30,33,36,39,42,45,48,51,54,57,60,63,66,69,72],{"id":15,"text":16,"depth":17},"sec-1-controller","§ 1. Controller",2,{"id":19,"text":20,"depth":17},"sec-2-scope-of-the-policy","§ 2. Scope of the Policy",{"id":22,"text":23,"depth":17},"sec-3-data-protection-officer","§ 3. Data protection officer",{"id":25,"text":26,"depth":17},"sec-4-one-account-across-several-websites","§ 4. One Account across several Websites",{"id":28,"text":29,"depth":17},"sec-5-categories-of-data-and-their-sources","§ 5. Categories of data and their sources",{"id":31,"text":32,"depth":17},"sec-6-purposes-legal-bases-and-retention-periods","§ 6. Purposes, legal bases and retention periods",{"id":34,"text":35,"depth":17},"sec-7-watermark-device-limit-and-playback-log","§ 7. Watermark, device limit and playback log",{"id":37,"text":38,"depth":17},"sec-8-payments","§ 8. Payments",{"id":40,"text":41,"depth":17},"sec-9-recipients-of-data","§ 9. Recipients of data",{"id":43,"text":44,"depth":17},"sec-10-transfers-of-data-outside-the-european-economic-area","§ 10. Transfers of data outside the European Economic Area",{"id":46,"text":47,"depth":17},"sec-11-browser-storage-and-cookies-in-the-shop","§ 11. Browser storage and cookies in the Shop",{"id":49,"text":50,"depth":17},"sec-12-other-parts-of-the-website","§ 12. Other parts of the Website",{"id":52,"text":53,"depth":17},"sec-13-email-messages","§ 13. Email messages",{"id":55,"text":56,"depth":17},"sec-14-rights-of-data-subjects","§ 14. Rights of data subjects",{"id":58,"text":59,"depth":17},"sec-15-deletion-of-the-account","§ 15. Deletion of the Account",{"id":61,"text":62,"depth":17},"sec-16-automated-decision-making-and-profiling","§ 16. Automated decision-making and profiling",{"id":64,"text":65,"depth":17},"sec-17-whether-providing-data-is-required","§ 17. Whether providing data is required",{"id":67,"text":68,"depth":17},"sec-18-data-we-do-not-process-and-persons-shown-in-the-films","§ 18. Data we do not process and persons shown in the Films",{"id":70,"text":71,"depth":17},"sec-19-security","§ 19. Security",{"id":73,"text":74,"depth":17},"sec-20-changes-to-the-policy","§ 20. Changes to the Policy",[76,77],"MAIL_PROVIDER","DATA_WEJSCIA_W_ZYCIE",[79],"polityka-prywatnosci-platformy.en.md: placeholder(s) without a value: MAIL_PROVIDER, DATA_WEJSCIA_W_ZYCIE",1793829422008]