Skip to content

Privacy Policy

Version 2026-10 · updated 10/29/2026

This Privacy Policy sets out how personal data of users of the Future Life portal (the "Portal") is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Personal Data Protection Act of 10 May 2018. It fulfils the information obligation under Articles 13 and 14 GDPR.

1. Data controller

The controller of your personal data is Future by Life sp. z o.o., registered office at ul. Jana Kazimierza 11A lok. 6, 71-620 Szczecin, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001199212, NIP (tax ID) 9552591446, REGON 542960677 (the "Controller", "we" or "us").

  • postal address: ul. Jana Kazimierza 11A lok. 6, 71-620 Szczecin
  • e-mail: kontakt@futurebylife.pl
  • phone: see the Contact page

2. Data Protection Officer

The Controller [has / has not] appointed a Data Protection Officer. For all matters relating to the processing of personal data and the exercise of your rights under the GDPR, you may contact us at privacy@futurebylife.pl or in writing at the Controller's registered office, marked "Personal data protection".

3. What data we process

The scope of data processed depends on the Portal features you use:

  • account data obtained from Google when you sign in (Google Sign-In / OAuth 2.0): first and last name, e-mail address, Google account identifier (Google ID), profile picture (avatar) URL;
  • professional profile data provided by you: profession/specialisation, company or practice name, NIP, phone number, address, licence number or other professional authorisation number;
  • verification documents uploaded by you (e.g. a scan of a medical licence, diploma or certificate) – stored in a private, access-controlled file storage;
  • order data: products and courses ordered, invoicing data, delivery address, payment and correspondence history;
  • enquiry (lead) data: name, e-mail, phone, company, message content and proof of consent – timestamp, version of the consent text and a salted cryptographic hash of the IP address that does not allow the full IP address to be reconstructed;
  • cookie consent log: date and time, scope of consent given, version of the cookie information;
  • technical data: server logs (including IP address, date and time of the request, browser type) necessary for the security and continuity of the Portal;
  • analytics data (only with your consent): information on how you use the Portal collected by Google Analytics 4.

We do not process the password to your Google account – authentication is carried out by Google and we receive only the data listed above.

4. Purposes and legal bases of processing

Account and Google sign-in

Creating and maintaining your account, authentication and providing electronic services under the Terms – Art. 6(1)(b) GDPR (performance of the contract for electronic services).

Professional status verification

Verifying that you are a business or professional entitled to purchase medical devices and, for prescription-only (Rx) products, a physician holding a licence to practise: Art. 6(1)(c) GDPR (legal obligations under, among others, pharmaceutical and medical device laws) and Art. 6(1)(f) GDPR (legitimate interest in restricting the sale of professional products to eligible recipients).

Orders and training courses

Concluding and performing a sales contract or a training participation contract, issuing pro-forma and VAT invoices, delivery, handling complaints and service – Art. 6(1)(b) GDPR; keeping accounting and tax records – Art. 6(1)(c) GDPR in conjunction with the Accounting Act and tax laws.

Enquiries (leads)

Responding to your enquiry and preparing an offer at your request – Art. 6(1)(b) GDPR (pre-contractual steps); marketing contact if you have consented – Art. 6(1)(a) GDPR; documenting the consent given (accountability) – Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Closed professional club

Providing club content, moderation and ensuring that only verified professionals have access – Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (security of the community and enforcement of its rules).

Cookies and analytics

Strictly necessary cookies – Art. 6(1)(f) GDPR (ensuring proper operation of the Portal) in conjunction with Art. 399 of the Polish Electronic Communications Law; analytics (Google Analytics 4) and marketing – only on the basis of consent, Art. 6(1)(a) GDPR; keeping the consent log – Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Security and legal claims

Ensuring system security, preventing abuse, establishing, pursuing or defending legal claims – Art. 6(1)(f) GDPR.

5. Recipients of data

Your data may be disclosed only to entities processing it on our behalf under a data processing agreement (Art. 28 GDPR) or acting as separate controllers, in particular:

  • hosting provider – operator of a VPS server located in the European Economic Area: provider details available on request;
  • Google Ireland Limited / Google LLC – for Google sign-in and, only with your consent, Google Analytics 4;
  • e-mail (SMTP) service provider – our own mail server operated by the Company – for sending transactional messages and replies to enquiries;
  • accounting firm, law firm, courier and service companies – to the extent necessary to fulfil orders and legal obligations;
  • public authorities – only where required by law.

We do not sell personal data or share it with third parties for their marketing purposes.

6. Transfers outside the European Economic Area

Use of Google services may involve a transfer of data to the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, Standard Contractual Clauses approved by the European Commission are applied (Art. 46(2)(c) GDPR). You may obtain a copy of these safeguards by contacting us. Our other providers process data within the EEA.

7. Retention period

  • account and professional profile – until you or we delete the account (e.g. after prolonged inactivity, of which we will notify you in advance);
  • verification documents – for the lifetime of the account; after verification is completed we may retain only the information about its outcome;
  • orders and accounting documents – for 5 years from the end of the calendar year in which the tax payment deadline expired (Accounting Act, Tax Ordinance);
  • enquiries (leads) – up to 24 months from the last contact, after which the data is anonymised;
  • proof of consent and cookie consent log – for as long as the consent is valid and until the limitation period for any claims expires;
  • GA4 analytics data – according to the Google Analytics retention setting: 14 months;
  • server logs – up to 90 days, unless needed to investigate a security incident.

8. Your rights

Under the conditions set out in the GDPR you have the right to:

  • access your data and obtain a copy (Art. 15 GDPR);
  • rectification (Art. 16 GDPR);
  • erasure (Art. 17 GDPR) – you can delete your account yourself on the "My account" page;
  • restriction of processing (Art. 18 GDPR);
  • data portability (Art. 20 GDPR) – you can download an export of your data in JSON format on the "My account" page;
  • object to processing based on legitimate interest (Art. 21 GDPR);
  • withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR) – e.g. via the cookie settings in the Portal footer;
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) if you consider that the processing infringes the GDPR.

Requests can be sent to privacy@futurebylife.pl. We will respond without undue delay and in any event within one month.

9. Voluntary provision of data

Providing data is voluntary but necessary to create an account (Google sign-in), place an order, issue an invoice and perform the contract. Providing professional profile data and verification documents is a condition for purchasing professional products, Rx products and accessing the closed club. Providing data in an enquiry is a condition for receiving a reply. Consent to analytics and marketing cookies is entirely voluntary and does not affect your ability to use the Portal.

10. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Professional status verification is carried out by a member of the Controller's staff.

11. Data security

We apply appropriate technical and organisational measures, including connection encryption (TLS), secure session cookies with the __Host- prefix, storage of verification documents in a private storage with access control, pseudonymisation of IP addresses in consent records (salted hash), backups and restricting access to authorised persons only.

12. Changes to this Privacy Policy

This Policy may be updated following changes in law or in the Portal's features. The current version is marked with a version number and date. We will inform signed-in users of material changes.

Version: 2026-10. Effective date: 29.10.2026.