Privacy and Cookie Policy

The Privacy Policy and Cookie Policy for the website available at traumalab.pl  (hereinafter referred to as the “Service”) has been in effect since 2025-04-01 and defines the principles for processing personal data obtained from users of the Service (natural persons using the Service, hereinafter referred to as “Users”). The owner of the Service is University of Warsaw, TIN: 5250011266 (hereinafter referred to as the “Service Owner”).

By using the Service, you agree to the terms described in this Privacy Policy.

GDPR

When we refer to “GDPR,” we mean Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation). This is a legal act adopted by the European Union that regulates personal data protection rules.

Personal Data Administrator

The administrator of personal data (hereinafter referred to as the “Administrator”) provided by Users is the Service Owner.

You can contact the Administrator/Service Owner:

• In writing – at 26/28 Krakowskie Przedmieście St., 00-927 Warsaw, Poland,
• Orally – at the Administrator’s registered office,
• By other means specified on the Service’s contact page.

Processing of Personal Data in Connection with the Use of the Service

The processing of Users’ personal data in connection with the use of the Service occurs in the following cases:

• For submitting and handling complaints regarding the use of the Service,
• To conclude and then perform a sales contract and grant a license through the Service,
• For registering and maintaining an account in the Service,
• Due to the storage of data in system logs, which may constitute personal data. System logs record activities performed during the operation of the Service and include the time of access, browser (user agent), User’s IP, and URL of the visited page. These data are processed for service provision, administrative, and technical purposes,
• To use the Google Ads advertising system and the Google Analytics web analytics tool, owned by Google LLC, headquartered in Googleplex, Mountain View, California, USA (hereinafter referred to as “Google”). The data is used for statistical and analytical purposes regarding the use of the Service and to optimize User experience. The Service uses cookies stored on the User’s device to analyze how the Service is used. Identifiers such as cookies or app instances measure User interactions with the website and application. Google may also share this information with third parties, but only in compliance with legal requirements or when third parties process data on behalf of Google. You can block cookie storage and prevent Google from collecting data about your usage by changing your browser settings.
• In connection with Google Analytics, user activity is tracked using tags on the Service. A tag is a small piece of website code that measures User behavior and traffic, collects information on ad effectiveness, and helps determine target audiences for ads while improving the website based on cookie data.

The processing of data by Google is subject to a separate privacy policy available at https://policies.google.com/privacy.

Purpose and Legal Basis for Processing Personal Data

The Administrator processes personal data to:

• Conclude and perform a sales contract and a license agreement through the Service. Processing is necessary for contract execution and pre-contractual actions upon User request (Art. 6(1)(b) GDPR),
• Register and maintain an account in the Service. Processing is required to fulfill an electronic service agreement or pre-contractual actions (Art. 6(1)(b) GDPR),
• Provide the Newsletter. Processing is based on the User’s explicit consent (Art. 6(1)(a) GDPR),
• Provide services via electronic means, including access to information and materials on the Service. Processing is necessary for contract execution (Art. 6(1)(b) GDPR),
• Pursue the legitimate interests of the Administrator related to running the Service, including analyzing User behavior and ensuring service security and reliability (Art. 6(1)(f) GDPR),
• Conduct direct marketing, including personalized selection of products and services based on cookies and similar technologies (Art. 6(1)(f) GDPR),
• Ensure compliance with legal obligations, particularly accounting and tax regulations (Art. 6(1)(c) GDPR).

Who Your Personal Data May Be Shared With

The Administrator may share personal data with:

• Entities authorized by law to obtain personal data,
• Entities cooperating with the Administrator to provide services and goods, including:
  • Entities providing telecommunication services,
  • Software providers supporting the Service,
  • Payment system operators,
  • Courier and postal service providers,
  • Legal and advisory firms,
  • Marketing partners in trusted cooperation with the Administrator,
  • Google (due to the use of Google Analytics and Google Ads).

Does the Company Use Automated Decision-Making?

The Service does not use automated decision-making, including profiling, as per Article 22 of GDPR.

Is Personal Data Transferred Outside the European Economic Area (EEA)?

Personal data is not transferred outside the EEA, except in cases related to Google Analytics or Google Ads. Before any data transfer, the Administrator ensures that the recipient country or entity provides an adequate level of protection, mainly through:

• Continuous cooperation with entities processing personal data under a relevant European Commission decision,
• Applying contractual clauses issued by the European Commission,
• Adhering to approved corporate regulations verified by the supervisory authority.

How Long Is Personal Data Retained?

The retention period depends on the type of service and the purpose of processing:

• For service provision, personal data is stored for the duration of the service or until potential claims expire,
• For responding to inquiries submitted via the contact form, data is retained until the response is provided or until potential claims expire,
• For handling complaints, data is stored until the complaint is resolved or until potential claims expire,
• Cookie data is stored for its lifecycle, as indicated in the “Use of Cookies in the Service” section.
• Google Analytics data is described as “non-expiring.”

User Rights Under GDPR

Users have the right to:

• Access personal data,
• Rectify inaccurate data,
• Request data deletion when no longer necessary,
• Restrict data processing,
• Data portability,
• Withdraw consent at any time,
• Object to data processing,
• Lodge a complaint with a supervisory authority if data protection laws are violated.

Use of Cookies in the Service

The Service uses cookies to ensure proper website functionality and the highest level of service provision. The Service uses:

• “Persistent” cookies, stored on the User’s device for a defined period or until manually deleted,
• “Session” cookies, temporary files stored until logging out or closing the browser.

By using Google Analytics, the Service utilizes first-party and third-party cookies for analytics and optimization, in compliance with applicable telecommunications and electronic service laws. Users can disable or limit cookie use through browser settings, though this may affect Service functionality.

This Privacy Policy is reviewed and updated regularly to reflect changes in data processing laws and cookie usage practices.