Privacy Policy

Last updated: 24 October 2026

1. Data controller

The controller of your personal data is the Polish Phlebological Society (Polskie Towarzystwo Flebologiczne), with its registered office in Katowice, ul. Ziołowa 45-47, 40-635 Katowice, Poland, entered in the National Court Register under KRS number 0000089956, NIP 9541570914, REGON 270222286 (hereinafter: “PTF” or the “Controller”).

For matters concerning the protection of personal data, please contact us:

e-mail: rodo@ptf.org.pl,
telephone: +48 513 190 514,
by post: ul. Ziołowa 45-47, 40-635 Katowice, Poland.

The Controller has not appointed a data protection officer, as it is not required to do so.

2. Purposes, legal bases and retention periods

2.1. Membership of PTF

Purpose: admitting members, keeping the register of members and exercising members' rights and obligations.
Legal basis: Art. 6(1)(b) GDPR (membership on the basis of the membership declaration and the Statutes) and Art. 6(1)(f) GDPR (legitimate interest – keeping the list of members in accordance with the Statutes).
Data processed: first name and surname, e-mail address, telephone number, address, specialty, information on membership and membership fee status.
Retention period: for the duration of membership and 5 years after it ends.

2.2. Membership fees and accounting

Purpose: collecting and recording membership fees, accounting.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR in conjunction with the Accounting Act (ustawa o rachunkowości).
Retention period: 5 years from the beginning of the year following the financial year to which the documents relate.

2.3. Physician Certification Programme

Purpose: receiving and assessing applications, issuing or renewing the certificate.
Legal basis: Art. 6(1)(b) GDPR (consideration of the application) and Art. 6(1)(f) GDPR (verification of the information provided in the application).
Publication on the list of certified physicians (first name, surname, city): Art. 6(1)(a) GDPR – consent, which may be withdrawn at any time.
Retention period: for the period of validity of the certificate and 5 years after it expires; unsuccessful applications – 1 year from the decision.

2.4. PTF grants

Purpose: receiving and assessing grant applications, awarding grants and settling them.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (settlement of the grant). Publication of information about grant recipients – Art. 6(1)(a) GDPR (consent).
Retention period: 5 years from the settlement of the grant.

2.5. Scientific events, congresses and training courses

Purpose: organising events, registering participants and speakers, documenting attendance and educational points.
Legal basis: Art. 6(1)(b) GDPR (participation in the event), Art. 6(1)(c) GDPR (documentation of physicians' educational points), Art. 6(1)(f) GDPR (documenting events, including photographs in which a person's image is a detail of the whole).
Retention period: 3 years from the end of the event; documentation of educational points – for the period required by law.

2.6. Correspondence and contact

Purpose: responding to enquiries and conducting correspondence.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest – communication with people who contact PTF).
Retention period: 2 years from the last contact, unless the correspondence concerns a matter covered by another point – in that case the period applicable to that matter applies.

2.7. Communication with members and information about events

Organisational messages to members (e.g. the general meeting, membership fees, membership matters): Art. 6(1)(b) and (f) GDPR, for the duration of membership.
Information about events organised by partners and other entities: only with consent (Art. 6(1)(a) GDPR and Article 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej)), until consent is withdrawn.

2.8. Website

Purpose: making the website available and ensuring its security and continuity of operation.
Legal basis: Art. 6(1)(f) GDPR.
Data processed: IP address and technical browser data recorded in server logs.
Retention period: in line with the log retention period applied by the hosting provider.

2.9. Governing bodies of the Society

Purpose: supporting the General Meeting of Members and the Board, drawing up minutes and resolutions, filings with the National Court Register.
Legal basis: Art. 6(1)(c) GDPR (the Associations Law (Prawo o stowarzyszeniach) and the National Court Register Act (ustawa o Krajowym Rejestrze Sądowym)) and Art. 6(1)(f) GDPR.
Retention period: archival records of the Society – indefinitely.

2.10. Exercise of rights and data protection

Purpose: handling requests from data subjects and keeping data protection records.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 12–22 and 33–34 GDPR.
Retention period: 5 years from the closure of the matter.

3. Do you have to provide your data?

Providing your data is voluntary, but in the cases described in points 2.1–2.5 it is necessary for admission to membership, for the consideration of an application or for participation in an event. Without this data we will not be able to do so. Consent to publication on the list of certified physicians, to publication of information about grant recipients and to receiving information about partners' events is voluntary and does not affect membership or the consideration of an application.

4. Recipients of data

Data may be disclosed to:

Sorga sp. z o.o. – the provider of the membership system (a processor acting on behalf of PTF),
providers of IT and hosting services: cyber_Folks S.A., based in Poznań (e-mail), and Netlify Inc. (website hosting) – as processors,
Autopay S.A., based in Sopot – the online payment operator, which processes data as a separate controller,
the accounting firm serving PTF,
co-organisers of events – to the extent necessary to organise them,
medical chambers, regional consultants and the applicant's superiors – for the purpose of verifying applications in the Certification Programme,
public authorities and courts – where required by law.

5. Transfers of data outside the European Economic Area

The website is hosted by Netlify Inc., based in the United States. Technical data from server logs (including the IP address) may be processed outside the EEA on the basis of standard contractual clauses approved by the European Commission or of a European Commission decision finding an adequate level of protection (EU-US Data Privacy Framework). We process all other data within the EEA.

6. Rights of data subjects

You have the right to:

access your data (Art. 15 GDPR),
rectify your data (Art. 16 GDPR),
erase your data (Art. 17 GDPR),
restrict processing (Art. 18 GDPR),
transfer your data (data portability, Art. 20 GDPR),
object to processing based on legitimate interest (Art. 21 GDPR),
withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR),
lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

Please send requests to rodo@ptf.org.pl. We respond without undue delay and in any event within one month.

7. Automated decision-making

Data is not subject to automated decision-making, including profiling (Art. 22 GDPR).

8. Cookies

The use of browser storage and cookies is described in the Cookie Policy.

9. Data security

We apply technical and organisational measures appropriate to the risk, in particular encryption of data in transit, access control for systems and accounts, two-factor authentication for administration panels, and data processing agreements with service providers.

10. Changes to the privacy policy

We update this policy when the ways in which we process data or the applicable law change. The current version is always available on this page, together with the date of the last update.