Who is the data controller
The controller of your personal data is Dr Nylec Chirurgia Plastyczna (MasterClinic), Tadeusza Saloniego 1/2, Katowice, Poland, represented by Marcin Nylec, MD PhD ("I", "me"). You can contact me at dr.marcin.nylec@gmail.com or by phone at +48 570 977 130.
What data I collect and why
Consultation and contact forms. When you send the online consultation form or a message, I process the data you enter (name or nickname, e-mail address, optional phone number and country, your message) and any photos you attach. I use them only to assess your case, reply to you and, if you decide to have a procedure, to prepare it. Photos of intimate areas are health data. I process them on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the consent box in the form. You can withdraw the consent at any time by writing to me; this does not affect the lawfulness of processing before the withdrawal.
Server logs. The hosting server records technical data such as your IP address, browser type, the pages you visit and the time of access. These logs are used for security and to keep the website running (legitimate interest, Article 6(1)(f) GDPR) and are deleted automatically after a short period.
Cookies. This website uses only cookies that are necessary for it to work (for example to remember that a form was sent). It does not use advertising or tracking cookies. If analytics cookies are introduced in the future, you will be asked for consent first.
How long I keep your data
Form submissions and photos are kept for as long as needed to answer you and, if you become my patient, for as long as medical records must be kept under Polish law. If you do not become my patient, your submission is deleted no later than 12 months after the last contact, or earlier at your request.
Who has access to your data
Your data is stored on servers of my hosting provider, Krystal Hosting Ltd (United Kingdom), and in my e-mail account. Form submissions are sent to me by e-mail. I do not sell or share your data with third parties for marketing. Photos and case descriptions are never published without your separate written consent.
Transfers outside the European Economic Area
The website is hosted in the United Kingdom, a country recognised by the European Commission as providing an adequate level of data protection. My e-mail provider may process data outside the EEA under standard contractual clauses.
Your rights
- access to your data and a copy of it,
- rectification of inaccurate data,
- erasure of your data ("right to be forgotten"),
- restriction of processing,
- data portability,
- withdrawal of consent at any time,
- a complaint to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
To exercise your rights, write to dr.marcin.nylec@gmail.com.
Before and after photos on this website
All photographs in the gallery are published with the written consent of the patients shown. They are anonymised and must not be copied, downloaded or used elsewhere.
Changes to this policy
This policy may be updated when the website or the law changes. The current version is always available on this page. Last updated: September 2026.