Privacy Policy

1. Personal Data Controller
   The controller of your personal data is ARALIYA SP. z o.o., located at Borowego 18 / 6, 30-215 Kraków, NIP: 679 318 3960, REGON: 383 207 046 (hereinafter referred to as the “Controller”).
   Contact details of the Controller:
   Email: info(at)araliya.info, Phone: +48 537 718 823
2. Purpose and Legal Basis for Processing Personal Data
   Your personal data is processed for the following purposes:
   Provision of therapeutic services: Personal data is processed to provide therapeutic services, in accordance with Article 6(1)(b) of the GDPR (processing necessary for the performance of a contract).
   Booking of therapy sessions through booking platforms (Fitssey, Booksy): Personal data such as name, surname, phone number, and email address is processed for booking appointments through external platforms, in accordance with Article 6(1)(b) of the GDPR.
   Billing and accounting: Data is processed for invoicing, accounting, and fulfilling legal obligations, in accordance with Article 6(1)(c) of the GDPR.
   Marketing communication (if applicable): If you have provided consent, data may be used to send marketing materials electronically, in accordance with Article 6(1)(a) of the GDPR.
3. Categories of Personal Data Processed
   We process the following categories of data:
   Identification data (e.g., name, surname),
   Contact data (e.g., phone number, email address),
   Health-related data (in the context of the provided therapeutic services, in accordance with Article 9(2)(h) of the GDPR),
   Data necessary for financial settlements (e.g., bank account number, tax identification number, address).
4. Recipients of Personal Data
   Your personal data may be shared with the following recipients:
   Booking platforms (Fitssey, Booksy) – for the purpose of booking appointments and managing schedules,
   IT service providers that support the Controller in managing IT systems and data storage,
   Accounting offices – for financial settlements and accounting purposes
   Entities authorized by law (e.g., tax offices, supervisory authorities).
5. Transfer of Personal Data to Third Countries
   The Controller does not intend to transfer your personal data to countries outside the European Economic Area (EEA), unless required in the case of using international service providers.
6. Personal Data Retention Period
   Your personal data will be stored for the period necessary to achieve the purposes for which it was collected, in particular:
   Data related to the provision of therapeutic services – for the duration of the contract and after its termination for the statute of limitations period (up to 6 years)
   Data processed for accounting purposes – for the period required by law (usually 5 years),
   Data processed based on consent – until the consent is withdrawn.
7. Rights of Data Subjects
   In accordance with the GDPR, you have the right to:
   Access your data,
   Rectify your data,
   Delete your data (“right to be forgotten”),
   Restrict the processing of your data,
   Data portability,
   Object to the processing of your data,
   Withdraw consent (for data processed based on consent).
   To exercise your rights, you may contact the personal data Controller.
8. Right to Lodge a Complaint with a Supervisory Authority
   If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO).
9. Voluntary Provision of Personal Data
   Providing personal data is voluntary but necessary for the provision of therapeutic services and registration for sessions via booking platforms. Failure to provide data will prevent the provision of services.
10. Automated Decision-Making
    The Controller does not make automated decisions concerning you, including decisions based on profiling.