DATA PRIVACY INFORMATION CLAUSE

Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”), we hereby inform you that:

CONTROLLERS OF PERSONAL DATA

We hereby inform you that the following two entities are independent controllers of your personal data:

Smarter Diagnostics sp. z o.o., with its registered office in Olsztyn (10-417), at ul. Towarowa 20B, entered in the National Court Register maintained by the District Court in Olsztyn, 8th Commercial Division of the National Court Register, under KRS No. 0000826635, NIP No. 9512497221, REGON No. 385477710.

Smarter Diagnostics Polska sp. z o.o., with its registered office in Olsztyn (10-417), at ul. Towarowa 20B, entered in the National Court Register maintained by the District Court in Olsztyn, 8th Commercial Division of the National Court Register, under KRS No. 0001073123, NIP No. 7393992449, REGON No. 527108838.

CONTACT REGARDING THE PROCESSING OF PERSONAL DATA

For all matters concerning your personal data, including the processing of personal data and the exercise of rights relating to the processing of your personal data, you may contact the Controller by post at the address of its registered office or electronically at: privacy@smarterdiagnostics.com.

PURPOSES OF PROCESSING PERSONAL DATA

Your personal data are processed, inter alia, for the following purposes:

  • performing obligations arising from the subject matter of electronic correspondence, including correspondence connected with the business activities conducted by the Controller, on the basis of the Controller’s legitimate interest consisting in ensuring continuity of communication and enabling contact with the Controller in matters relating to its business activities — pursuant to Article 6(1)(f) GDPR;
  • compliance with legal obligations incumbent on the Controller in connection with the conduct of its business activities — pursuant to Article 6(1)(c) GDPR;
  • conducting promotional or marketing activities, in particular sending new offers and proposals for cooperation, thereby pursuing the Controller’s legitimate interest — pursuant to Article 6(1)(f) GDPR;
  • to the extent broader than that resulting from generally applicable law, for purposes arising from the Controller’s legitimate interests, such as the potential pursuit by the Controller of claims arising from a civil-law agreement — pursuant to Article 6(1)(f) GDPR;
  • performance of the services provided by us — pursuant to Article 6(1)(b) GDPR; for this purpose, we process special categories of personal data pursuant to Article 9(2)(a) GDPR.

DATA RETENTION PERIOD

Your personal data will be retained:

  • for the period necessary to protect the Controller’s interests;
  • with respect to other purposes based on the Controller’s legitimate interest, for as long as those purposes remain valid or until an objection is raised;
  • for the period required by applicable law and for the period during which potential claims may be pursued against the Controller;
  • for the duration of the relevant agreement and until the expiry of the limitation periods for potential claims arising from that agreement, with respect to personal data provided to us for the purpose of providing our services.

RECIPIENTS OF PERSONAL DATA

Recipients of your personal data may include:

  • employees, associates and members of the Controller’s governing bodies;
  • entities processing personal data on the Controller’s behalf for purposes and to the extent connected with the performance of a civil-law agreement, provided that such entities process the data under separate agreements entered into with the Controller and solely in accordance with the Controller’s instructions and within the scope specified by the Controller;
  • entities authorised to receive such data under generally applicable law.

TRANSFERS OF PERSONAL DATA OUTSIDE THE EEA

As a rule, the personal data provided by you are not disclosed to entities established outside the European Economic Area (EEA), i.e. in third countries.

Your personal data may be transferred outside the EEA where this is necessary for the Controller to perform its obligations arising from a civil-law agreement, including where proper performance of such agreement requires the involvement of the Controller’s subcontractors or associates established outside the EEA. Your data may be transferred to a third country only where the applicable legal requirements are met, i.e. where the European Commission has adopted an adequacy decision, where contractual clauses approved by the European Commission are used, or where appropriate safeguards are in place.

AUTOMATED DECISION-MAKING, INCLUDING PROFILING

Your personal data will not be subject to automated decision-making or profiling.

RIGHTS OF THE DATA SUBJECT

With respect to the personal data provided to the Controller, you have the right to:

  • access your personal data, request their rectification and obtain a copy of the personal data;
  • request erasure of the personal data or restriction of their processing, in the cases provided for by law;
  • object to the processing of personal data to the extent that the processing is based on the Controller’s legitimate interest;
  • withdraw your consent to the extent that the processing of personal data is based on consent. Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Consent may be withdrawn at any time;
  • data portability, i.e. to receive from the Controller the personal data concerning you in a structured, commonly used and machine-readable format, to the extent that your personal data are processed for the purpose of entering into and performing an agreement or on the basis of consent. You may transmit the personal data received to another controller;
  • lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw) where you consider that, in processing your personal data, the Controller has infringed the GDPR or other applicable personal data protection laws.

To exercise any of the above rights, please contact the Controller in the manner described above.

INFORMATION ON THE OBLIGATION TO PROVIDE PERSONAL DATA AND THE CONSEQUENCES OF FAILURE TO PROVIDE THEM

The provision of personal data is voluntary. In certain cases, providing your personal data may be necessary to achieve the purposes arising from the Controller’s legitimate interests indicated above.

Document version: Issue 4 / 22 June 2026