Privacy policy

1. Controller and contact

The controller is Gabinet Fizjoterapii KINESIS Bartosz Czajka, ul. św. Antoniego 34 lok. 2, 97-200 Tomaszów Mazowiecki, Poland, tax ID (NIP) 7732296067, REGON 101082669. For privacy matters, contact rekrutacja@frscphysio.ch.

2. Data we collect

When you visit, the server may process your IP address, request date and time, page address, and browser and device information in technical logs. Fonts are served from the website's own server; loading them does not require a connection to Google Fonts.

If you email us or submit the form, we process the contact details and message you provide. The form also asks about experience, workplace, qualifications, interests and career plans. Providing data is voluntary, but fields marked with an asterisk are needed to submit the form. Please do not include health or patient data.

3. Purposes and legal bases

We use form data to review your application and contact you about collaboration on the basis of your consent (Article 6(1)(a) GDPR). You may withdraw it at any time by emailing us; this will not affect processing carried out lawfully before withdrawal. We answer direct emails on the basis of our legitimate interest in correspondence (Article 6(1)(f) GDPR).

We use technical data to run and secure the website and prevent abuse (Article 6(1)(f) GDPR). The anti-spam mechanism uses a hash of the IP address and timestamps to limit submissions to five per hour. The form sends applications by SMTP email and does not store them in a website database.

4. Recipients and international transfers

Data may be accessible to the website host, SMTP provider and our inbox provider (Google/Gmail) as needed to run the website and handle correspondence.

Google services may involve transfers outside the European Economic Area. In these cases, the provider uses mechanisms available under the GDPR, including — depending on the country — an adequacy decision or standard contractual clauses. You can ask the controller for information about the safeguards used.

5. Optional analytics and marketing

If the administrator configures a container ID, Google Tag Manager (Google Ireland Limited) starts analytics tools only after analytics consent. If a Meta Pixel ID (Meta Platforms Ireland Limited) is configured, the Pixel starts only after marketing consent to measure advertising and create advertising audiences on Meta platforms. Without an ID, the corresponding service remains off. The basis is voluntary consent (GDPR Article 6(1)(a)), taking account of applicable cookie rules and the Swiss Federal Act on Data Protection (FADP).

Providers may receive IP addresses, browser and device information, identifiers and visit data. Meta may link these to your account on its platforms and use them for advertising profiling. We do not send form fields or contact details to tracking services. Refusing does not restrict website use or contact. Privacy settings allow you to change your choice and withdraw consent, without affecting the lawfulness of earlier processing.

6. Cookies and remembering your choice

Your browser stores your choice locally under frsc-privacy-v1 for 180 days (notice version, choice date, enabled services and grants or refusals). This storage is used only to manage your preferences. A change to configured services or expiry triggers a new consent request. No banner is displayed when tracking is not configured.

After analytics consent, Google Analytics, if configured in GTM, may set _ga and _ga_* to distinguish visitors and sessions; the recommended configuration for this website limits these to 180 days without renewal. Meta Pixel may use _fbp and _fbc (usually up to 90 days) for measurement and advertising. Withdrawal stops further tracking, removes accessible service cookies on this website’s domain and reloads the page. You can remove Google/Meta domain cookies through your browser.

7. Retention

We keep correspondence and applications until discussions end and the application has been reviewed. We then delete them unless we begin collaborating or the data is needed to establish, pursue or defend claims; in that case, we keep it for the applicable limitation period. Server logs are retained according to the hosting provider's settings for the time needed to maintain security and diagnose errors.

The anti-spam mechanism considers timestamps for one hour. A technical file containing the IP hash may remain until the host clears temporary files.

8. Your rights

You have the rights to access, rectify and erase your data, restrict processing, obtain data portability and object, as provided by the GDPR. To exercise these rights, email rekrutacja@frscphysio.ch. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

We do not make decisions with legal effects for you solely by automated means.

Where Swiss law applies, you also have rights under the FADP, including access and rectification and the option to contact the Federal Data Protection and Information Commissioner (FDPIC).

9. Google reCAPTCHA — form protection

Once keys are configured, the form uses Google reCAPTCHA v2 Invisible (Google Ireland Limited). We load it only on submission, after separate verification consent (GDPR Article 6(1)(a)). Google may analyse IP addresses, browser, device and interactions and use cookies such as _GRECAPTCHA (up to 180 days) to assess automated submission risk. It may display an additional challenge. The server verifies the token; it is not included in your application email. Without a valid pair of keys, this service is not loaded: the form works without reCAPTCHA, separate Google consent or a token. Validation, a honeypot and submission limits still apply.

Verification is separate from analytics and marketing consent. You can decline and apply by email. Withdraw consent for a later submission by unticking the box or choosing not to use the form. Google and Meta processing may involve transfers to the USA; the administrator applies appropriate EEA and Swiss transfer mechanisms, such as an applicable adequacy decision for a certified recipient or standard contractual clauses. Ask the administrator for details about recipients and safeguards.