Controller and contact
The data controller is ADRIAN BYLIŃSKI - CHIROPRAKTYKA I PRACA MANUALNA, NIP 8561860460. The operator is Adrian Byliński. Address of the permanent place of business and service provision: Konrada Guderskiego 7/101, 03-982 Warszawa. Contact, complaints, privacy and data-rights requests: kontakt@bylinski.pl. Domain: https://bylinski.pl.
Data scope and exclusions
The form collects first name, last name, phone, email, language and selected time. Technical identifiers may be processed for abuse prevention. The form has no fields for health information, symptoms, diagnoses, medicines, PESEL, home address or free-text health details. Do not send such information through the form or messages about a booking.
Purposes and legal bases
Contact and appointment details are processed to create and confirm a technical booking and to handle cancellations and rescheduling. The primary basis is Article 6(1)(b) GDPR because processing is necessary for steps requested before a possible in-person visit and for managing the selected time. Security, rate limiting, abuse prevention and record integrity rely on Article 6(1)(f), based on the legitimate interest in protecting and operating the service. Establishing, pursuing or defending legal claims also relies on Article 6(1)(f). Article 6(1)(c) is used only where a specific legal duty applies. Consent is not the general basis for this processing, and this notice does not constitute consent. Confirmation and reminder messages serve the same purpose.
Required data
Name, phone, email, language, time and the required acknowledgement of the electronic service rules are needed to confirm a reservation. Health information and marketing consent are not required. Without required data the reservation and related messages cannot be completed. Choosing not to provide optional information does not affect the handling of a request or complaint.
Recipients and transfers
Hosting and the database: OVHcloud, under the contract with OVH Sp. z o.o.; the VPS is located in Warsaw (WAW), Poland. OVHcloud acts as processor for entrusted application and client data under its data processing agreement. Separately, OVHcloud is a controller for data relating to its customer and account relationship. The VPS location does not mean that all processing takes place exclusively in Poland or the EEA. Resend (Plus Five Five, Inc.) delivers transactional email from rezerwacje@bylinski.pl, with replies to kontakt@bylinski.pl. Resend processes entrusted message data on our behalf. Separately, it is an independent controller for account, billing and service-usage data, including some communication metadata. The sending region is Ireland (eu-west-1); this is not the storage location. Data handled by Resend, including message content and delivery data, is stored in the United States. Resend’s DPA applies through the contract entered into at signup and contains the European Commission’s Standard Contractual Clauses; information about transfer safeguards is available in that document (https://resend.com/legal/dpa). For the Free plan we use, Resend’s documentation states that email and log data is retained for 30 days and backups for 7 days. These are Resend’s periods, not retention periods for the BYLIŃSKI database. Cloudflare Turnstile (Cloudflare, Inc.) processes technical signals on our instructions to protect the form against automated abuse. Separately, Cloudflare is a controller for those signals when using them to improve bot detection. Signals include, for example, an IP address and information about the browser, connection and site origin. Cloudflare may process data outside the EEA; transfer information is set out in its Privacy Policy and, for processing on our behalf, its DPA. The roles are explained in the Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/). This description of provider documents is not an assurance of a complete legal transfer assessment. We do not deploy visitor analytics, advertising or marketing-tracking tools on the website. This does not exclude providers processing technical data for the described security and service purposes. There is currently no independent cloud backup provider. Encrypted backups are created daily on the service infrastructure. Encrypted copies are automatically transferred to storage controlled by the operator; if that storage is unavailable, transfers resume when it becomes available again.
Retention
Under the operator’s policy, ordinary booking and client operational history is generally retained for approximately three years from the client’s last relevant activity, such as a booking, visit or operational interaction. This is the operator’s policy, subject to final legal review, not a universal statutory three-year requirement under the GDPR. Data is not kept for longer than its purpose requires. Periodic manual review determines which data should be deleted or anonymised when no longer needed. Longer retention requires a specific continuing purpose, such as an active manual booking restriction, a complaint, a dispute, pursuing or defending a legal claim, or an applicable statutory obligation. The minimum data needed to maintain an active manual booking restriction may remain for as long as that restriction is active, including beyond the ordinary history-retention period; expiry of that period does not itself remove the restriction. Data identifying a client is not automatically deleted in its entirety solely because that period has elapsed. Deletion or anonymisation is purpose-based and scoped, and the need for continued retention is reassessed. After the first unannounced no-show the operator may manually restrict future online booking; there is no automatic block, penalty or debt, and manual unblocking remains possible. Other review and deletion targets are: incomplete or failed booking attempts, 30 days; rate-limit and security technical records, 30 days; notification, delivery and audit evidence, 12 months. Password-reset authority expires after ten minutes, with bounded technical cleanup of expired capabilities. Automatic application-data deletion remains disabled. These periods are not a promise of automatic deletion by the current system. Data for a complaint, dispute or another specific legal purpose is subject to a scoped legal hold for as long as that purpose requires, with periodic review. Accounting and tax documents are outside this website-data policy.
Rights and security
You may request access, correction, deletion, restriction or portability of your data, and object where processing is based on legitimate interests. Requests go to kontakt@bylinski.pl. We respond without undue delay, generally within one month, subject to the exceptions and limitations provided for in the GDPR. These rights depend on their legal conditions and may be limited by obligations or a scoped dispute hold. You may complain to the President of the Polish Personal Data Protection Office (UODO). The information in this policy is not a consent request.
Cookies, storage and version
The site stores the selected language in localStorage (adrian-site-language). Booking operations and result recovery use local storage for up to 24 hours (bylinski.booking.operations.v1); this is not a client account. The admin panel stores its theme in localStorage (bylinski-admin-theme), recoverable editing drafts and operation identifiers in sessionStorage. Admin login uses a password and secure admin_session and admin_csrf cookies; ordinary MFA/TOTP is not required. The historical admin_mfa_challenge cookie is retired. A one-time recovery code only authorises setting a new password through a ten-minute capability held in browser memory; reset revokes existing sessions. Turnstile uses Managed mode with pre-clearance disabled. The normal current flow uses a one-time Turnstile token; cf_clearance is not part of that flow. This is not a general assurance that the provider never uses cookies or other device storage. We do not deploy our own visitor analytics, advertising or marketing-tracking tools on the website; providers’ technical processing is described above. This storage information is not marketing consent.
Access security
Admin access uses password verification, attempt limits, failed-login lockout, secure sessions and CSRF protection. Recovery codes are one-time and cannot replace the password in ordinary login. There is no profiling or automated decision-making with legal effects. Incidents are assessed according to risk and legal requirements; automatic notification of every person after every event is not promised.
Document version
Document version: 3.