Privacy and cookies policy

Version 2.0, effective from 24 July 2026. Information about personal data processing and cookie preferences on www.pro-mente.pl.

Controller and scope

This policy applies to www.pro-mente.pl, forms available on the website, initial clinical trial inquiries and recruitment contact. Recorded calls are also covered by the separate Telephone Call Recording Information Clause.

The personal data controller is Promente Sp. z o.o., ul. Teofila Lenartowicza 33-35, 85-133 Bydgoszcz, Poland, KRS 0000921564, NIP 9671448844, REGON 389986034.

For data protection matters, rights requests and contact with a data protection officer if one has been appointed, write to kontakt@pro-mente.pl.

Data categories and sources

We obtain data primarily from you. Depending on how you contact us, we may process your name, email address, phone number, selected study, age, message content, recruitment documents and qualifications.

We process health-related information only if you voluntarily include it in a clinical trial inquiry and give explicit consent. Please do not include health information or other special-category data that is not needed to handle your inquiry.

Technical data may include an IP address, request date and time, visited address, browser and device information, anti-abuse signals, and a record of the version and grant or withdrawal of form or analytics consent.

Purposes and legal bases

  • Website delivery, maintenance, security, error diagnosis and abuse prevention: Article 6(1)(f) GDPR, our legitimate interest in keeping the website available and secure.
  • Responding to a general inquiry, arranging contact or taking steps at your request before a contract: Article 6(1)(b) or (f) GDPR depending on the inquiry, and Article 6(1)(a) where consent is requested.
  • Handling an initial clinical trial inquiry: Article 6(1)(a) GDPR; for voluntarily supplied health data, explicit consent under Article 9(2)(a) GDPR.
  • Employment or cooperation recruitment: Article 6(1)(b) GDPR for steps before entering into an agreement; where labour law determines the duty and scope of information, also Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Polish Labour Code; additional data and future recruitment: Article 6(1)(a).
  • Google Analytics measurement: Article 6(1)(a) GDPR, optional analytics consent.
  • Cookie-free website performance and Core Web Vitals measurement through Vercel Speed Insights: where the information is personal data, Article 6(1)(f) GDPR, our legitimate interest in maintaining and improving the website.
  • Establishing, exercising or defending legal claims and demonstrating consent and compliance: Article 6(1)(f) GDPR and, where special-category data is strictly necessary, Article 9(2)(f) GDPR.

Clinical trial inquiries and health data

The clinical trial inquiry form only records interest in a study and starts initial contact. Submitting it does not mean that you qualify for or have joined a clinical trial. Health-related information entered in that form is processed on the basis of your explicit consent.

The general contact form is not intended for health information. If we receive such information without explicit consent or another proper Article 9 GDPR basis, we do not use it and delete or redact it without undue delay; we may ask you to contact us again through the appropriate channel.

You may withdraw consent at any time by emailing kontakt@pro-mente.pl. Withdrawal does not affect the lawfulness of processing before withdrawal, but it may prevent us from continuing to handle the inquiry.

If you proceed to screening or participation, you will receive a separate study-specific notice identifying the relevant controllers, recipients, legal bases and retention periods. A website inquiry is not automatically disclosed to a sponsor or CRO merely because it was submitted.

Job and cooperation candidates

We use information submitted in response to an opening or as a spontaneous application to assess a candidacy, contact the candidate and conduct recruitment or cooperation discussions. Providing the information required by law or needed to assess the candidacy is voluntary, but without it participation may not be possible.

We do not require health information or other special-category data during initial contact. Additional information voluntarily supplied by a candidate is processed on the basis of consent where permitted by law. Special-category data supplied on the candidate’s initiative requires explicit consent under Article 9(2)(a) GDPR.

Consent for future recruitment is separate and optional. If recruitment results in employment or cooperation, subsequent processing will be based on the applicable law or agreement and covered by an appropriate notice.

Required and optional information

Required fields are marked with an asterisk. Without a name, valid email address, required message content and the applicable consent confirmation, we cannot process a form. A phone number is also required for a clinical trial application. Age, study selection and additional information are optional unless the form clearly states otherwise.

You can use the website without consenting to Google Analytics. Refusing analytics consent does not restrict access to content or forms.

Recipients and processors

Access is limited to people and entities that need the data for the stated purpose: authorized Promente personnel, including the relevant study or recruitment team; Vercel for hosting, technical logs and Speed Insights; Resend (Plus Five Five, Inc.) for technical delivery of form messages; Cloudflare for Turnstile anti-abuse protection; and Google for Google Analytics only after analytics consent.

Necessary recipients may also include email, IT maintenance, security, legal and audit providers bound by appropriate obligations, as well as public authorities where disclosure is required by law.

A sponsor, CRO or other partner of a particular study may receive data only at a later justified stage and under that study’s documentation. They are not automatic recipients of every website inquiry.

Transfers outside the EEA

Some technology providers are established outside the European Economic Area or use subprocessors in other countries. If a transfer outside the EEA occurs, the mechanism depends on the destination, provider and current service setup. It may be an adequacy decision of the European Commission or Standard Contractual Clauses with the safeguards required in the circumstances.

You may request information from the controller about the current transfer mechanism for a particular provider. The provider, subprocessor and transfer register is reviewed periodically; the existence of a provider’s public privacy notice does not by itself replace required contractual arrangements.

Retention periods

  • General inquiries and correspondence: up to 12 months after the matter is closed or the last substantive contact, and longer only while a relationship continues or where required for a legal obligation or claim.
  • Initial clinical trial inquiries, including voluntarily supplied health data: up to 6 months after closure or the last contact. Study-specific periods apply if screening begins.
  • A minimal record of consent or withdrawal: normally up to 3 years after consent-based processing ends, without retaining full health-related content where it is not needed.
  • Recruitment and cooperation candidates: until the process ends; technical deletion takes place without undue delay and no later than 30 days afterwards. Future recruitment with separate consent: no more than 6 months. Isolated information may be kept longer only where strictly necessary for a specific claim.
  • Standard technical logs controlled by Promente: normally up to 30 days, and longer only for an incident, legal obligation or claim.
  • Google Analytics user-level and event data: no more than 2 months in the service settings; aggregate reports without identifiers may be retained longer.
  • Vercel Speed Insights: according to the period applicable to the configured service and only while needed to assess performance; exported reports are kept only in aggregated form.

Cookies, local storage and consent choices

The website uses cookies and browser local storage. Your choice is stored locally under promente_cookie_consent_v1 so the website can remember it. It remains on the device until you change the choice, clear browser data or it is replaced by a newer preferences version.

Essential technologies support preferences, security, form protection and correct website operation. Google analytics cookies are optional and are used only after consent.

You can change your preferences at any time through the cookie icon in the lower-left corner. You can also block or delete browser storage, although blocking essential technologies may prevent the site from remembering your choice or securely processing a form.

Google Analytics 4

We use Google Analytics 4 directly, measurement ID G-TX726RHP3E. The Google Analytics script loads only after you opt in to the analytics category (Basic Consent Mode). Before consent, the website sends no page views or events to Google Analytics.

After consent, Google Analytics may set cookies, particularly _ga and _ga_*. Query parameters and URL fragments are removed before measurement. Form contents, the selected study and health-related information entered by a visitor are not sent to Google Analytics. Our business events are limited to a generic successful form submission and phone or email clicks. Google Analytics may create basic session-related technical events; Enhanced Measurement, including automatic form, scroll, click, file and video events, is disabled.

Withdrawing consent stops future analytics requests and clears Google Analytics cookies for the current domain to the extent available to the website. Withdrawal does not automatically erase information that was lawfully aggregated before it.

Vercel Speed Insights

Speed Insights provides cookie-free performance and Core Web Vitals measurement. We do not use it for advertising, cross-site tracking or decisions about a particular visitor. Vercel Web Analytics remains disabled.

The data may include a normalized page path, approximate country or region, device type, operating system, browser, network speed, Web Vital value and attribution, and event time. Query parameters and URL fragments are removed, while paths that could reveal interest in a particular study or health condition are grouped into general categories before sending. The referrer policy limits the outgoing header to its origin.

Form protection with Cloudflare Turnstile

Forms are protected with Cloudflare Turnstile. It evaluates technical request and browser signals, such as IP address, device characteristics and interaction with the security check, to distinguish a person from automated abuse. The basis is Article 6(1)(f) GDPR, our legitimate interest in protecting forms and the website.

We do not use Turnstile for advertising. If the protection prevents you from submitting a form, you can contact us by phone or email.

Your rights

Subject to the conditions in the GDPR, you may request access and a copy, rectification, erasure, restriction, and portability where processing is automated and based on consent or contract. You may object on grounds relating to your particular situation to processing based on Article 6(1)(f) GDPR.

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Send requests to kontakt@pro-mente.pl. We may ask for information needed to verify identity safely. Rights are not absolute and may be limited by a legal obligation or the need to protect legal claims.

You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl.

Automated decisions and policy changes

We do not use the data described in this policy to make decisions based solely on automated processing that produce legal or similarly significant effects. We do not profile candidates or people interested in clinical trials.

We update this policy when processing, providers or applicable law changes. The version and effective date appear at the top. A material change to a processing purpose or scope of consent does not apply retroactively and will require a new notice or consent where required.