Privacy Policy

1. Data Controller

The controller of personal data processed in connection with the receptionos.com website (the "Website") is RECEPTION OS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (a Polish limited liability company), with its registered office at ul. Eugeniusza Kwiatkowskiego 9, 37-450 Stalowa Wola, Poland (the "Controller", "we", "us", "receptionOS").

• Registered in the National Court Register (KRS) under number 0001163060
• Tax identification number (NIP): 8652589170
• Statistical number (REGON): 541238501
• Share capital: PLN 50,000
• Date of registration: 24 March 2025

In all matters relating to personal data and the protection of privacy — including the exercise of your rights under the GDPR — you can contact us at: k@receptionos.com.

We have not appointed a Data Protection Officer (DPO). For any data protection enquiry, please write to k@receptionos.com.

2. What This Policy Covers

This Privacy Policy explains how we process personal data of visitors to the receptionOS landing page at receptionos.com — that is, people who browse the site, fill in the contact form, or use the on-site demo voice widget.

It does NOT cover the personal data that receptionOS processes within the receptionOS application on behalf of dental clinics (including patient data). In relation to that data, the clinic is the data controller and receptionOS acts as a processor. That processing is governed separately by a Data Processing Agreement (DPA) and the service agreement concluded with each clinic, not by this Policy.

3. Scope and Categories of Data

In connection with your use of the Website, we may process the following categories of personal data:

• Contact data from the sign-up form (provided via Typeform): your name, email address and phone number — only when you fill in the form yourself.
• Technical data: IP address, device identifiers, HTTP headers and server logs — collected to ensure the security and continuity of the service.
• Voice data: if you choose to use the demonstration voice widget on the Website (powered by ElevenLabs), we process the recording and/or transcript of the interaction for the sole purpose of operating the demo.
• Cookies and similar technologies, and the data read or stored through them — as described in section 8 below.

4. Purposes and Legal Bases (Art. 6 GDPR)

We process your personal data for the following purposes and on the following legal bases:

• Responding to your enquiry and contacting you about our services — when you submit the sign-up form. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Operating the demonstration voice widget — when you choose to use it. Legal basis: your consent given by voluntarily using the demo (Art. 6(1)(a) GDPR).
• Ensuring the security, integrity and continuity of the Website (server logs, technical data) and defending against abuse. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Analytics — measuring traffic and how the Website is used (Google Analytics 4, Microsoft Clarity). Legal basis: your consent (Art. 6(1)(a) GDPR), given via the cookie banner.
• Marketing — measuring the effectiveness of our advertising and form conversions (X/Twitter conversion pixel). Legal basis: your consent (Art. 6(1)(a) GDPR), given via the cookie banner.
• Establishing, exercising or defending legal claims. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Where processing relies on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal (see the "Cookies and Similar Technologies" section for how to change or withdraw your cookie consent).

5. Retention

We keep personal data no longer than necessary for the purposes described above:

• Contact form data: up to 12 months from our last correspondence with you.
• Server logs: up to 30 days.
• Google Analytics 4 (event data): up to 14 months.
• Microsoft Clarity: in accordance with the tool's configuration.
• Marketing data (X/Twitter conversion pixel): in accordance with the tool's configuration.

Where data is needed to establish, exercise or defend legal claims, we may retain it for the duration of the applicable limitation periods.

6. Recipients and Processors

To operate the Website we rely on trusted service providers acting as our processors on our documented instructions. Depending on the functionality you use, your data may be made available to:

• Netlify, Inc. — hosting and content delivery (CDN) for the Website.
• Google (Google Ireland Limited / Google LLC) — Google Analytics 4 traffic statistics (only with your consent).
• Microsoft — Microsoft Clarity statistics and session recordings (only with your consent).
• Typeform — operation of the sign-up / contact form.
• ElevenLabs — the on-site demonstration voice widget (only if you use it).
• X Corp — the X/Twitter conversion pixel for advertising measurement (only with your consent).

We may also disclose data to public authorities where required by law.

7. Transfers Outside the EEA

Some of our providers — Google, Microsoft, X Corp, ElevenLabs and Typeform — may process data in the United States, which means your personal data may be transferred outside the European Economic Area (EEA).

Where this happens, we ensure an appropriate level of protection. Transfers are based on the European Commission's Standard Contractual Clauses (SCC) and, where applicable, on the adequacy decision underpinning the EU-US Data Privacy Framework (DPF).

You can request a copy of the relevant safeguards or further details of the transfer mechanisms by writing to k@receptionos.com.

8. Cookies and Similar Technologies

We use cookies and similar technologies. The consent banner displayed on the Website distinguishes exactly three categories, matching the choices you can make there:

• Necessary — used without consent. Required for the Website to function, to remember your consent choices and to maintain security.
• Analytics — used only after you give consent: Google Analytics 4 (Google Ireland Limited / Google LLC) and Microsoft Clarity (statistics plus session recordings).
• Marketing — used only after you give consent: the X/Twitter conversion pixel (X Corp), used to measure the effectiveness of our advertising (conversions from the form).

You can change or withdraw your cookie consent at any time using the "Cookie settings" link in the footer of the Website, which reopens the consent banner. You can also manage or delete cookies through your browser settings.

9. Your Rights

Under the GDPR, you have the right to:

• access your personal data and obtain a copy of it;
• rectify (correct) inaccurate or incomplete data;
• erase your data (the "right to be forgotten");
• restrict processing;
• data portability;
• object to processing carried out on the basis of our legitimate interest;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, contact us at k@receptionos.com.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

10. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include encryption of data in transit (TLS/HTTPS), restricted access on a need-to-know basis, and storing credentials and keys in a secrets manager rather than in code. We choose providers that maintain recognised, independently audited security standards.

11. Voluntary Provision of Data

Providing your personal data is voluntary. However, providing the data requested in the sign-up form (name, email, phone) is necessary for us to respond to your enquiry and contact you — without it we cannot do so. Technical data is collected automatically as a necessary part of operating the Website.

12. Automated Decision-Making

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

13. Minors

The Website is intended for adults. We do not knowingly collect personal data of persons under the age of majority. If you believe a minor has provided us with personal data, please contact us at k@receptionos.com and we will take appropriate action.

14. External Links and Plugins

The Website may contain links to external websites and may embed third-party tools (such as the Typeform form, the ElevenLabs voice widget, and analytics/marketing tools). When you follow an external link or interact with an embedded tool, the relevant third party may process your data under its own privacy policy. We are not responsible for the content or privacy practices of external websites — we recommend reviewing their privacy policies.

15. Data Protection Officer

We have not appointed a Data Protection Officer. In all matters concerning the processing of your personal data, please contact us at k@receptionos.com.

16. Changes to This Policy

We may update this Privacy Policy, for example to reflect changes in the tools we use or in applicable law. The current version is always available on the Website, with the date of the last update shown at the top. We encourage you to review this Policy periodically.