Privacy notice

This is a translation. In the event of any discrepancy between the Polish and the English version, the Polish version prevails.

The information below fulfils the duty under art. 13 of Regulation (EU) 2016/679 (GDPR). This is not a consent form — there is nothing here for you to accept.

1. Controller and contact

1. The controller of your personal data is Piotr Konkol, operating as Piotr Konkol Software Development, Szafarnia 11/F8, 80-755 Gdańsk, Poland, VAT ID (NIP) 5833451982.
2. Contact: kontakt@konkolmethod.pl, +48 604 809 887.
3. I am not required to appoint a data protection officer and have not appointed one. Direct all data protection matters to the address above.

2. What data I process and where it comes from

• From you when booking — first name, surname, phone number and e-mail address, provided through the booking system.
• From you in the intake form — information relevant to exercise safety, described in section 4.
• From me, during a Session — test results, notes and video recordings.
• From correspondence — the content of messages exchanged via WhatsApp, e-mail and Instagram.
• From payments — the data visible on a bank transfer or BLIK payment.

I do not buy data and do not obtain it from other sources.

3. Purposes and legal bases

Purpose	Legal basis
Performing the Service and contact about appointments	art. 6(1)(b) — performance of a contract
Settlements, accounting and tax obligations	art. 6(1)(c) — legal obligation
Establishing, pursuing and defending claims	art. 6(1)(f) — legitimate interest
Anonymising notes and test results for comparison	art. 6(1)(f) — the basis covers the act of anonymisation itself; once carried out, the data ceases to be personal data
Publishing material on Instagram or the Website	art. 6(1)(a) — consent

4. Health data

1. Information about injuries, procedures, complaints, medical and physiotherapy recommendations, test results and recordings of the body in motion constitute a special category of personal data within the meaning of art. 9 GDPR.
2. The basis for processing them is explicit consent — art. 9(2)(a) GDPR — collected in the intake form.
3. Without that consent I do not run Sessions. Load cannot be selected safely for a person whose injuries are unknown to me.
4. After consent is withdrawn I may retain that data solely to the extent necessary to establish, pursue or defend claims — art. 9(2)(f) GDPR.

5. Recipients

• Booksy — booking system: booking data and form responses.
• Google — Drive: recordings and notes.
• Meta — WhatsApp and Instagram, where we correspond through them.
• An accounting office or accounting software provider — settlement data.
• Cloudflare — hosting of the Website.
• Public authorities, where disclosure is required by law.

6. How long I keep data

Data originating from Sessions passes through three phases.

1. During the engagement I keep full documentation: notes, test results and video recordings.
2. After the engagement ends I keep the documentation until the limitation period for claims expires; for personal injury this is calculated in accordance with art. 442(1) of the Polish Civil Code. After that period I delete the source recordings and identifying data.
3. Long term, only an anonymised case record remains: numerical results, the course of the work and the response to load. The record contains no face, voice, name, calendar dates or location, and no key exists that would link it to a person. Information processed in this way is not personal data and is not subject to a time limit.

Outside that path:

• Settlement data — 5 years from the end of the tax year in which the tax obligation arose. The period follows from statute and cannot be shortened.
• Contact data — until the engagement ends and the limitation period for claims expires.

7. Your rights

1. You have the right to access your data, and to its rectification, erasure, restriction of processing and portability.
2. You have the right to object to processing based on legitimate interest.
3. You have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

8. Withdrawing consent

1. You may withdraw consent at any time, without giving a reason, by writing to kontakt@konkolmethod.pl.
2. Withdrawal does not affect the lawfulness of processing carried out before it.
3. Withdrawing consent to the processing of health data ends the possibility of running Sessions, as set out in section 4.
4. After consent to publication is withdrawn, I remove the material from the channels I control.

9. Is providing data mandatory

1. Providing your name, contact details and health information is a condition of concluding and performing the contract. Without them a Session cannot take place.
2. Consent to publication of your image is entirely voluntary. Refusing changes nothing in the scope or manner of the Service.

10. Profiling, transfers outside the EEA, cookies

1. I do not profile and do not take automated decisions concerning you.
2. Transfers outside the EEA — Google and Meta process data in the United States. The transfer is based on the European Commission’s adequacy decision under the EU-US Data Privacy Framework of July 2023.
3. The Website runs no analytics and sets no marketing cookies. The booking widget embedded on the “Book” page is loaded from Booksy’s servers and may store its own information on your device.

11. Changes to this notice

1. This notice carries a version number and a date. The current version is available at konkolmethod.pl/prywatnosc, and earlier versions remain available on the Website.
2. I will inform you before introducing a change that affects how your data is processed.
3. Editorial and housekeeping corrections take effect together with the updated date, without separate notification.