Privacy notice
Version 1.0 · Approved by counsel and last reviewed: 29 September 2026
1. Who we are
Veritas Clinical Innovations sp. z o.o., ul. Alfreda Dauna 14, 30-566 Kraków, Poland (KRS 0001248566, NIP 6793369239, REGON 545051811) is the controller of the personal data described in this notice. You can contact us at office@veritasclinix.com.
2. What we process, why, and on what basis
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Responding to a consulting enquiry, including an uploaded brief | Name, professional email, organisation, service area, timescale, optional budget range, project description, NDA preference, upload, IP address (hashed) | Art. 6(1)(b) steps prior to a contract; Art. 6(1)(f) legitimate interest in handling business enquiries | 12 months from submission unless an engagement follows, a legal obligation applies or renewal is documented |
| Arranging an introductory call | Name, professional email, organisation, reason for the call, proposed times, time zone | Art. 6(1)(b); Art. 6(1)(f) | 12 months unless an engagement follows |
| General contact messages | Name, email, message | Art. 6(1)(f) | 12 months |
| Free member account | Email, password (hashed), name, organisation, preferred language, course interests, security events | Art. 6(1)(b) performance of the membership terms | Until you delete the account; security logs 12 months |
| Course-related communications for themes you register interest in | Email, selected themes, preferred language | Art. 6(1)(b) | Until you withdraw or delete the account |
| Insights and event invitations | Email, consent record | Art. 6(1)(a) consent, optional and separate | Until you withdraw |
| Security, fraud prevention and audit | Hashed IP, user agent, timestamps, actions | Art. 6(1)(f) | 12 months |
| Privacy-friendly analytics | Aggregated, cookieless page statistics | Art. 6(1)(a) consent via the cookie banner | Aggregated only |
| Legal obligations, including accounting | Invoice and contract data (from the paid tier onwards) | Art. 6(1)(c) | As required by Polish law, typically 5 years |
We do not ask for, and you should not send, patient-identifiable or study-participant data. If such data are received they are deleted as soon as they are identified.
3. Recipients and processors
We use service providers established in, or processing exclusively within, the European Economic Area: application hosting with EU-region functions, a managed PostgreSQL database in the EU, EU object storage for uploads and media, an EU transactional email provider, EU-hosted analytics loaded only with consent, and an EU error-monitoring region. Processors act under Article 28 agreements. Personal data are not transferred outside the EEA. The specific providers in use are listed in the deployment documentation and can be requested by email.
4. Your rights
You may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interest. Consent can be withdrawn at any time, including through the one-click unsubscribe link in every marketing email; withdrawal does not affect prior processing. Members can download and delete their data from the account area. You can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.
5. Security
Data are encrypted in transit and at rest. Sensitive free-text fields are additionally encrypted at the application layer. Access to the administrator dashboard requires a password and a one-time code sent to the company inbox. Uploads are scanned for malware before they can be opened. Access and changes are recorded in an audit log.
6. Automated decisions
We do not make decisions producing legal or similarly significant effects by automated means.
7. Changes
We will publish updates to this notice on this page with a new version number and date.