§
PRIVACY POLICY OF THE LEKEXAM.PL WEBSITE
TABLE OF CONTENTS:
1. GENERAL PROVISIONS
2. LEGAL BASIS FOR DATA PROCESSING
3. PURPOSE, LEGAL BASIS, AND DURATION OF DATA PROCESSING ON THE WEBSITE
4. DATA RECIPIENTS ON THE WEBSITE
5. PROFILING ON THE WEBSITE
6. RIGHTS OF THE DATA SUBJECT
7. COOKIES ON THE WEBSITE AND ANALYTICS
8. FINAL PROVISIONS
1) GENERAL PROVISIONS
1. This Privacy Policy of the Website is for informa7onal purposes only, which means that it does not
cons7tute a source of obliga7ons for the Service Recipients of the Website. The Privacy Policy primarily
sets out the principles governing the processing of personal data by the Controller within the Website,
including the legal bases, purposes, and dura7on of personal data processing, as well as the rights of data
subjects, and informa7on regarding the use of Cookies and analy7cal tools on the Website.
2. The controller of personal data collected via the Website is Mikołaj Roszkowski, conduc7ng business
ac7vity under the name MIKROSYSTEM - MIKOŁAJ ROSZKOWSKI, entered into the Central Register and
Informa7on on Economic Ac7vity of the Republic of Poland maintained by the minister responsible for
economic affairs, having: the business address and address for service at ul. Jerzego Bajana 11 71-330
Szczecin TAX number: 9552316881, REGON: 368731537, email address: lekex[email protected]:
hereina`er referred to as the “Controller,” who is also the Service Provider of the Website.
3. Personal data on the Website are processed by the Controller in accordance with applicable law, in
par7cular in compliance with Regula7on (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protec7on of natural persons with regard to the processing of personal data and on
the free movement of such data, and repealing Direc7ve 95/46/EC (General Data Protec7on Regula7on),
hereina`er referred to as the “GDPR” or the “GDPR Regula7on.” The official text of the GDPR is available
at: hjp://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679.
4. The use of the Website is voluntary. Likewise, the provision of personal data by a Service Recipient using
the Website is voluntary, subject to two excep7ons: (1) conclusion of contracts with the Controlle, failure
to provide, in the cases and to the extent indicated on the Website and in the Website Terms and
Condi7ons and this Privacy Policy, the personal data necessary to conclude and perform a given contract
with the Controller (e.g., registra7on of an Account or purchase of a Subscrip7on) results in the inability to
conclude such a contract. In such cases, the provision of personal data cons7tutes a contractual
requirement, and if the data subject wishes to conclude a given contract with the Controller, they are
obliged to provide the required data. The scope of data required to conclude a contract is each 7me
specified in advance on the Website and in the Website Terms and Condi7ons; (2) statutory obliga7ons of
the Controller - the provision of personal data is a legal requirement resul7ng from generally applicable
laws imposing on the Controller the obliga7on to process personal data (e.g., for the purpose of
Page z 1 9
§
maintaining tax records), and failure to provide such data will prevent the Controller from fulfilling these
obliga7ons.
5. The Controller exercises par7cular diligence in protec7ng the interests of persons whose personal data are
processed and, in par7cular, is responsible for and ensures that the data collected are: (1) processed
lawfully; (2) collected for specified, legi7mate purposes and not further processed in a manner
incompa7ble with those purposes; (3) substan7vely accurate and adequate in rela7on to the purposes for
which they are processed; (4) stored in a form which permits iden7fica7on of data subjects for no longer
than is necessary for the purposes of processing; and (5) processed in a manner ensuring appropriate
security of personal data, including protec7on against unauthorized or unlawful processing and against
accidental loss, destruc7on, or damage, using appropriate technical or organiza7onal measures.
6. Taking into account the nature, scope, context, and purposes of processing, as well as the risk of varying
likelihood and severity for the rights and freedoms of natural persons, the Controller implements
appropriate technical and organiza7onal measures to ensure that processing is carried out in accordance
with the GDPR and to be able to demonstrate such compliance. These measures are reviewed and
updated where necessary. The Controller applies technical measures to prevent unauthorized persons
from obtaining and modifying personal data transmijed electronically.
7. Any words, expressions, and acronyms used in this Privacy Policy and beginning with a capital lejer (e.g.,
Service Provider, Website, Electronic Service) shall be understood in accordance with their defini7ons
contained in the Website Terms and Condi7ons available on the Website.
2) LEGAL BASIS FOR DATA PROCESSING
1. The Controller is en7tled to process personal data in cases where, and to the extent that: at least one of
the following condi7ons is met: (1) the data subject has given consent to the processing of their personal
data for one or more specific purposes; (2) the processing is necessary for the performance of a contract
to which the data subject is a party or in order to take steps at the request of the data subject prior to
entering into a contract; (3) the processing is necessary for compliance with a legal obliga7on to which the
Controller is subject; or (4) the processing is necessary for the purposes of the legi7mate interests pursued
by the Controller or by a third party, except where such interests are overridden by the interests or
fundamental rights and freedoms of the data subject which require protec7on of personal data.
2. The processing of personal data by the Controller requires, in each case, the existence of at least one of
the legal bases indicated in Sec7on 2.1 of this Privacy Policy. The specific legal bases for the processing of
personal data of the Website’s Service Recipients by the Controller are set out in the following sec7on of
this Privacy Policy- with reference to the respec7ve purposes of personal data processing carried out by
the Controller.
3) PURPOSE, LEGAL BASIS, AND PERIOD OF DATA PROCESSING ON THE
WEBSITE
1. The purpose, legal basis, dura7on, and recipients of the personal data processed by the Controller each
7me result from the ac7ons undertaken by a given Service Recipient within the Website.
2. The Controller may process personal data on the Website for the following purposes, on the following
legal bases, and for the following periods:
Purpose of Data Processing
Legal Basis for Data Processing
Data RetenUon Period
Page z 2 9
§
Purchase and performance
of a Subscrip7on, as well as
the use of other Electronic
Services available on the
Website.
ArUcle 6(1)(b) of the GDPR (contract):
processing is necessary for the
performance of a contract to which the
data subject is a party, or in order to take
steps at the request of the data subject
prior to entering into a contract.
The data are stored for the period
necessary to perform, terminate, or
otherwise expire the concluded contract.
Direct Marke7ng
ArUcle 6(1)(f) of the GDPR (legiUmate
interest of the Controller): processing is
necessary for the purposes of the
legi7mate interests pursued by the
Controller, consis7ng in safeguarding the
Controller’s interests and good
reputa7on, its Website, and in striving to
provide Electronic Services and sell
Subscrip7ons.
The data are stored for the dura7on of
the legi7mate interest pursued by the
Controller, but no longer than the
limita7on period for claims that the
Controller may have against the data
subject arising from the Controller’s
business ac7vity. The limita7on period is
determined by applicable law, in
par7cular the Civil Code (the general
limita7on period for claims related to
business ac7vity is three years).
The Controller may not process data for
the purposes of direct marke7ng if the
data subject has effec7vely objected to
such processing.
Provision of the Newslejer
Service
ArUcle 6(1)(a) of the GDPR (consent): the
data subject has given consent to the
processing of their personal data for the
purpose of receiving marke7 ng
informa7on from the Controller.
The data are stored un7l the data subject
withdraws their consent to the further
processing of their data for this purpose.
Maintenance of tax or
accoun7ng records
ArUcle 6(1)(c) of the GDPR in conjuncUon
with ArUcle 86 § 1 of the Tax Ordinance
Act of 17 January 2017 (Journal of Laws
of 2017, item 201, as amended) or
ArUcle 74(2) of the AccounUng Act of 30
January 2018 (Journal of Laws of 2018,
item 395, as amended): processing is
necessary for compliance with a legal
obliga7on to which the Controller is
subject.
The data are stored for the period
required by law obliging the Controller to
retain tax records (un7l the expiry of the
limita7on period for tax liabili7es, unless
tax laws provide otherwise) or
accoun7ng records (5 years, calculated
from the beginning of the year following
the financial year to which the data
relate).
Establishment, exercise, or
defense of claims that may
be raised by the Controller
or against the Controller
ArUcle 6(1)(f) of the GDPR (legiUmate
interest of the Controller): processing is
necessary for the purposes of the
legi7mate interests pursued by the
Controller, consis7 ng in the
establishment, exercise, or defense of
claims that may be raised by the
Controller or against the Controller.
The data are stored for the dura7on of
the legi7mate interest pursued by the
Controller, but no longer than the
limita7on period for claims that may be
brought against the Controller (the
general limita7on period for such claims
is six years).
Page z 3 9
§
4) DATA RECIPIENTS ON THE WEBSITE
1. For the proper func7oning of the Website, including the delivery of Digital Content and the provision of
Electronic Services by the Controller, it is necessary for the Controller to use the services of external
en77es (such as, for example, so`ware providers or payment service providers). The Controller uses only
the services of such data processors that provide sufficient guarantees for the implementa7on of
appropriate technical and organiza7onal measures, ensuring that the processing complies with the
requirements of the GDPR and protects the rights of data subjects.
2. The Controller does not transfer data in every case and not to all recipients or categories of recipients
indicated in this Privacy Policy. Data are transferred only when it is necessary to achieve a given purpose of
personal data processing and solely to the extent required for its fulfillment.
3. The personal data of the Website’s Service Recipients may be transferred to the following recipients or
categories of recipients:
a. providers of electronic payment or card payment services: in the case of a Service Recipient who
uses electronic payment methods or pays by card on the Website, the Controller makes the
collected personal data of the Service Recipient available to the selected payment service provider
opera7ng on behalf of the Controller, to the extent necessary to process the payment made by the
Service Recipient.
b. service providers supplying the Controller with technical, IT, and organiza7onal solu7ons enabling
the Controller to conduct its business ac7vity, including the opera7on of the Website, the provision
of Electronic Services, and the delivery of Digital Content (in par7cular providers of so`ware for
running the Website, email and hos7ng providers, as well as so`ware providers for business
management and technical support for the Controller)- the Controller makes the collected personal
Use of the Website and
ensuring its proper
func7oning
ArUcle 6(1)(f) of the GDPR (legiUmate
interest of the Controller): processing is
necessary for the purposes of the
legi7mate interests pursued by the
Controller, consis7ng in the opera7on and
maintenance of the Website.
The data are stored for the dura7on of
the legi7mate interest pursued by the
Controller, but no longer than the
limita7on period for claims that the
Controller may have against the data
subject arising from the Controller’s
business ac7vity. The limita7on period is
determined by applicable law, in
par7cular the Civil Code (the general
limita7on period for claims related to
business ac7vity is three years).
Sta7s7cal analysis and
traffic monitoring on the
Website
ArUcle 6(1)(f) of the GDPR (legiUmate
interest of the Controller): processing is
necessary for the purposes of the
legi7mate interests pursued by the
Controller, consis7ng in conduc7ng
sta7s7cal analyses and monitoring traffic
on the Website in order to improve its
func7onality.
The data are stored for the dura7on of
the legi7mate interest pursued by the
Controller, but no longer than the
limita7on period for claims that the
Controller may have against the data
subject arising from the Controller’s
business ac7vity. The limita7on period is
determined by applicable law, in
par7cular the Civil Code (the general
limita7on period for claims related to
business ac7vity is three years).
Page z 4 9
§
data of the Service Recipient available to a selected provider ac7ng on its behalf only where and to
the extent necessary to achieve a given purpose of data processing in accordance with this Privacy
Policy.
c. providers of accounUng, legal, and advisory services ensuring the Controller receives accoun7ng,
legal, or consultancy support (in par7cular an accoun7ng office, law firm, or debt collec7on
agency), the Controller makes the collected personal data of the Service Recipient available to a
selected provider ac7ng on its behalf only where and to the extent necessary to achieve a given
purpose of data processing in accordance with this Privacy Policy.
d. providers of social media plugins, scripts, and other similar tools embedded on the Website,
enabling the browser of a person visi7ng the Website to retrieve content from the providers of
such plugins and, for this purpose, to transmit the visitor’s personal data to those providers,
including:
o
Facebook Ireland Ltd., the Controller uses social media plugins of the Facebook service on
the Website (e.g., the “Like” and “Share” bujons) and, in this connec7on, collects and
shares the personal data of a Service Recipient using the Website with Facebook Ireland Ltd.
(4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), in accordance with the
scope and principles set out in the privacy policy available at: hjps://www.facebook.com/
about/privacy/ (this data includes informa7on about ac7vi7es on the Website, including
informa7on about the device, visited websites, purchases, displayed adver7sements, and
the manner of using services, regardless of whether the Service Recipient has a Facebook
account or is logged into Facebook).
e. providers of AI-based content generaUon services: in order to ensure the proper func7oning of
user communica7on services and the crea7on of automated summaries and responses, the
Controller uses the services of the following en77es: Pinecone Systems, Inc., based in the USA (548
Market St, PMB 20733, San Francisco, CA 94104), for the storage and processing of data in vector
databases necessary for the opera7on of search and content analysis systems; OpenAI, Inc., based
in San Francisco, USA (3180 18th Street, San Francisco, CA 94110), for the provision of services
involving data processing for the purpose of genera7ng responses, summaries, and educa7onal
content using ar7ficial intelligence. The Controller transfers personal data to these en77es only to
the extent necessary to provide the above services, in compliance with applicable law, in par7cular
the GDPR, and on the basis of data processing agreements concluded with them. The data may be
processed outside the European Economic Area, in par7cular in the United States, while ensuring
an adequate level of data protec7on, based on standard contractual clauses or other lawful data
transfer mechanisms.
5) PROFILING ON THE WEBSITE
1. The GDPR imposes an obliga7on on the Controller to inform about automated decision-making, including
profiling referred to in Ar7cle 22(1) and (4) of the GDPR, and- at least in such cases- to provide meaningful
informa7on about the logic involved, as well as the significance and the envisaged consequences of such
processing for the data subject. With this in mind, the Controller provides in this sec7on of the Privacy
Policy informa7on regarding possible profiling.
2. The Controller may use profiling on the Website for direct marke7ng purposes; however, decisions made
on this basis do not concern the conclusion or refusal to conclude a contract, the purchase of a
Subscrip7on, or the ability to use Electronic Services on the Website. The effect of profiling on the Website
may include, for example, reminders about incomplete ac7ons on the Website, sending a discount or an
offer that may correspond to a given person’s interests or preferences, or proposing more favorable
condi7ons compared to the standard offer of the Website. Despite profiling, the individual remains free to
decide whether to take advantage of such an offer or discount.
Page z 5 9
§
3. Profiling on the Website consists of the automated analysis or predic7on of a given person’s behavior on
the Website, or through the analysis of their previous purchases or ac7vity history on the Website. The
condi7on for such profiling is that the Controller possesses the personal data of the individual, enabling
the Controller to subsequently send, for example, a discount code or a tailored offer.
4. The data subject has the right not to be subject to a decision based solely on automated processing,
including profiling, which produces legal effects concerning them or similarly significantly affects them.
6) RIGHTS OF THE DATA SUBJECT
1. Right of access, recUficaUon, restricUon, erasure, and data portability- the data subject has the right to
request from the Controller access to their personal data, rec7fica7on, erasure (“the right to be
forgojen”), or restric7on of processing, as well as the right to object to processing and the right to data
portability. Detailed condi7ons for exercising the above rights are set out in Ar7cles 15-21 of the GDPR.
2. Right to withdraw consent at any Ume- where personal data are processed by the Controller on the basis
of consent (pursuant to Ar7cle 6(1)(a) or Ar7cle 9(2)(a) of the GDPR), the data subject has the right to
withdraw their consent at any 7me, without affec7ng the lawfulness of processing carried out on the basis
of consent before its withdrawal.
3. Right to lodge a complaint with a supervisory authority- the data subject whose personal data are
processed by the Controller has the right to lodge a complaint with a supervisory authority in the manner
and under the procedures specified in the provisions of the GDPR and Polish law, in par7cular the Personal
Data Protec7on Act. The supervisory authority in Poland is the President of the Personal Data Protec7on
Office.
4. Right to object- the data subject has the right to object at any 7me, on grounds rela7ng to their par7cular
situa7on, to the processing of personal data concerning them based on Ar7cle 6(1)(e) (public interest or
exercise of official authority) or (f) (legi7mate interest of the Controller), including profiling based on those
provisions. In such a case, the Controller may no longer process the personal data unless the Controller
demonstrates compelling legi7mate grounds for the processing which override the interests, rights, and
freedoms of the data subject, or grounds for the establishment, exercise, or defense of legal claims.
5. Right to object to direct markeUng- where personal data are processed for direct marke7ng purposes, the
data subject has the right to object at any 7me to the processing of personal data concerning them for
such marke7ng, including profiling, to the extent that the processing is related to such direct marke7ng.
6. Exercising rights in order to exercise the rights referred to in this sec7on of the Privacy Policy, the
Controller may be contacted by sending an appropriate request in wri7ng or by email to the Controller’s
address indicated at the beginning of this Privacy Policy.
7) COOKIES ON THE WEBSITE AND ANALYTICS
1. Cookies are small pieces of textual informa7on in the form of text files, sent by a server and stored on the
device of a person visi7ng the Website (e.g., on the hard drive of a computer, laptop, or on a smartphone’s
memory card, depending on the device used to access the Website). Detailed informa7on about Cookies,
including their history, can be found, among others, at: hjps://pl.wikipedia.org/wiki/HTTP_cookie.
2. Cookies that may be sent by the Website can be divided into different types according to the following
criteria:
Page z 6 9
§
3. The Controller may process data contained in Cookies while visitors use the Website for the following
specific purposes:
4. Verifica7on, in the most popular web browsers, of which Cookies (including their dura7on and provider)
are currently being sent by the Website is possible as follows:
By storage duraUon on the
visitor’s device:
1) session cookies (stored un7l
the user logs out of the
Website or closes the web
browser), and
2) persistent cookies (stored for
a specified period defined by
the parameters of each file or
un7l t he y a re m an ua ll y
deleted).
By purpose of use:
1) necessary cookies (enabling the
proper func7 oning of the
Website),
2) funcUonal/preference cookies
(allowing the Website to be
tailored to the preferences of the
visitor),
3) analyUcal and performance
cookies (collec7ng informa7on on
how the Website is used),
4) markeUng, adverUsing, and social
media cookies (collec7 ng
informa7on about the visitor in
order to display personalized
adver7sements and conduct other
marke7ng ac7vi7es, including on
websites other than the Website,
such as social media plaworms).
Purposes of the use of Cookies
on the Controller’s Website
iden7fying Service Recipients as logged in on the Website and indica7ng
that they are logged in (necessary cookies)
remembering data entered in forms, surveys, or login details for the
Website (necessary and/or func7onal/preference cookies)
customizing the content of the Website to the individual preferences of the
Service Recipient (e.g., regarding colors, font size, or page layout) and
op7mizing the use of the Website (func7onal/preference cookies)
compiling anonymous sta7s7cs on how the Website is used (analy7cal and
performance cookies)
remarke7ng, i.e., analyzing the behavioral characteris7cs of visitors to the
Website through the anonymous analysis of their ac7vi7es (e.g., repeated
visits to specific pages, keywords, etc.) in order to create profiles and deliver
adver7sements tailored to their an7cipated interests, including when they
visit other websites within the adver7sing networks of Google Ireland Ltd.
and Facebook Ireland Ltd. (marke7ng, adver7sing, and social media cookies)
Page z 7 9
§
5. By default, most web browsers available on the market accept the storage of Cookies. Each user has the
op7on to define the condi7ons for the use of Cookies through the sexngs of their own web browser. This
means that it is possible, for example, to par7ally restrict (e.g., temporarily) or completely disable the
storage of Cookies; however, in the lajer case, this may affect certain func7onali7es of the Website.
6. The web browser sexngs regarding Cookies are relevant for consent to the use of Cookies by the Website
—under applicable regula7ons, such consent may also be expressed through the browser sexngs.
Detailed informa7on on how to change Cookie sexngs and delete them independently in the most
popular web browsers is available in the browser’s help sec7on and on the following websites (simply click
the respec7ve link):
Chrome
Firefox
Internet Explorer
Opera
Safari
Microso` Edge
7. The Controller may use Google Analy7cs and Universal Analy7cs services on the Website, provided by
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These services help the
Controller compile sta7s7cs and analyze traffic on the Website. The data collected within these services
are processed for the purpose of genera7ng sta7s7cs that support the administra7on of the Website and
the analysis of traffic on the Website. These data are aggregated in nature. When using the above services
on the Website, the Controller collects such data as the sources and medium of acquiring visitors to the
Website, their behavior on the Website, informa7on about the devices and browsers used to access the
Website, IP address and domain, as well as geographic data and demographic data (age, gender) and
interests.
8. It is possible for a user to easily block the sharing of informa7on about their ac7vity on the Website with
Google Analy7cs, for example, by installing a browser add-on provided by Google Ireland Ltd., available
here: hjps://tools.google.com/dlpage/gaoptout?hl=pl.
9. The Controller may use the Facebook Pixel service on the Website, provided by Facebook Ireland Limited
(4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). This service enables the Controller to
measure the effec7veness of adver7sements, understand the ac7ons taken by visitors to the Website, and
In the Chrome browser:
(1) click the padlock icon on the
le` side of the address bar, (2) go
to the “Cookies” tab.
In the Firefox browser:
(1) click the shield icon on the le`
side of the address bar,
(2) go to the “Allowed” or “Blocked”
tab,
(3) click on “Cross-site tracking
cookies,” “Social media trackers,” or
“Content with tracking elements.”
In Internet Explorer:
(1) click the “Tools” menu,
(2) go to “Internet Op7ons,”
(3) open the “General” tab,
(4) go to “Sexngs,”
(5) click “View files.”
In the Opera browser:
(1) click the padlock icon on the
le` side of the address bar,
(2) go to the “Cookies” tab.
In the Safari browser:
(1) click the “Preferences” menu,
(2) go to the “Privacy” tab,
(3) click “Manage Website Data.”
Regardless of the browser, tools
available at, for example, the
following websites may also be
used: hjps://
www.cookiemetrix.com/ or
hjps://www.cookie-checker.com/
Page z 8 9
§
display tailored adver7sements to those users. Detailed informa7on about how the Facebook Pixel works
can be found at the following web address: hjps://www.facebook.com/business/help/
742478679120153?helpref=page_content.
10. The opera7on of the Facebook Pixel can be managed through the adver7sing sexngs in the user’s account
on Facebook.com: hjps://www.facebook.com/ads/preferences/?entry_product=ad_sexngs_screen.
8) SCOPE OF DATA AND DATA RELATED TO MEDICAL EDUCATION
8.1 Scope of Collected Data
As part of using the lekexam.pl Website, the Controller may process the following user data:
•
iden7fica7on data (e.g., email address, username),
•
data related to the use of the Website, including:
◦ answers to test ques7ons,
◦ test results,
◦ sta7s7cs and learning progress,
◦ user ac7vity history on the Website, technical data, such as IP address, device iden7fiers, and informa7on
about the browser and opera7ng system.
8.2 Data Related to Medical Educa7on (Health-Related Data)
The EgzaminLEK.pl Website is intended solely for educa7onal purposes and is not used for diagnosis, treatment,
or monitoring of health condi7ons.
The Controller does not collect or process users’ health data or pa7ents’ medical data.
However, the Website processes data related to user ac7vity in the context of comple7ng medical tests,
including test results and interac7ons with educa7onal content.
Due to the medical nature of the content available on the Website, such data may be classified by distribu7on
plaworms (such as Google Play) as health-related data.
These data are used exclusively for the following purposes:
• presen7ng user results,
• personalizing the learning process,
• improving the quality of educa7onal services.
These data are not used for making medical decisions or providing healthcare services.
FINAL PROVISIONS
The Website may contain links to other websites. The Controller encourages users, upon visi7ng such websites,
to review the privacy policy established there. This Privacy Policy applies solely to the Controller’s Website.
Page z 9 9