Introduction
This Privacy Policy and Cookies document describes how WEBET Sp. z o.o. ("Administrator", "we", "us", "our") collects, processes, stores and protects your personal data in connection with use of the CheaperForDrug platform (taniejpolek.pl). This document has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR) and the Polish Personal Data Protection Act.
1. Data Controller
1.1 Controller's details
The controller of your personal data is:
WEBET SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. 1 Maja 30A
45-355 Opole, Poland
NIP: 7543346806
REGON: 520717497
KRS: 0000940072 (Sąd Rejonowy w Opolu, VIII Wydział Gospodarczy KRS), share capital PLN 5,000.00
Email: biuro@webet.pl
Phone: +48 798 908 242
1.2 Contact for data protection matters
On all matters relating to data protection you can contact us:
Email: biuro@webet.pl
Phone: +48 798 908 242 (Mon-Fri, 9:00-17:00)
By post: WEBET Sp. z o.o., ul. 1 Maja 30A, 45-355 Opole, Poland, marked "Data Protection"
2. Scope of personal data processed
2.1 Data provided by the user
Account data (mandatory):
- Email address
- Password (stored exclusively as a cryptographic hash - bcrypt with a salt, making it impossible to read the password even by the Service's administrators)
- First and last name (optional)
Subscription and payment data:
- Subscription type (free, annual)
- Subscription status and purchase date
- Payment information (processed by Stripe)
- Transaction history
Usage data:
- Shopping list and searched medicines
- Search and comparison history
- Saved user preferences
- Content of conversations with Medicine Cabinet AI (text messages; uploaded images are not stored)
- Inquiries to pharmacies nearby: items (including prescription medicines you type in), town and range, the device's location (if you share it), phone number (if you give it), comment and conversation with the pharmacy, the pharmacy's answer, pickup code
2.2 Automatically collected data
- IP address and approximate geographical location
- Browser type and version
- Operating system and device type
- Pages visited and time spent on the site
- Source of visit (referrer)
- Technical session data
- Cookies and similar technologies
2.3 Payment data
Important: Your payment card details (card number, CVV, expiry date) are processed exclusively by Stripe, Inc. - a PCI DSS Level 1 certified payment provider. We do NOT store and do NOT have access to your full payment card details.
We store only:
- Stripe Customer ID - a unique identifier in the Stripe system
- Stripe Subscription ID - the subscription identifier
- Stripe Payment Intent ID - the transaction identifier
- Payment amount and currency (in the currency of the user's market)
- Payment status (pending, completed, failed, cancelled)
- Last 4 digits of the card (for identification)
2.4 Pharmacy data
If you run a pharmacy or register one on its behalf, we process: the company name and tax number (NIP) of the entity running the pharmacy, the name and address of the pharmacy, the permit number, phone number, e-mail address, opening hours, location on the map, invoice details, the first and last name of the person signing up and the record of acceptance of the terms (version, date, IP address). We do this to conclude and perform the agreement and to settle it (Article 6(1)(b) and (c) GDPR). We keep the data for the duration of the agreement and, after it ends, for the periods in section 4 for billing data and for establishing, pursuing or defending claims.
From the public pharmacy register (Rejestr Aptek) we take the pharmacy's e-mail address and its name and postal address. We use them to propose cooperation to the pharmacy in an e-mail or in a letter sent by post. For each pharmacy we record how the e-mail contact went: when we sent the message, whether the mail server accepted or rejected it, and whether the pharmacy replied, unsubscribed its address or signed up for the programme. The legal basis is our legitimate interest in bringing pharmacies into the programme (Article 6(1)(f) GDPR). We do not check whether the message was opened.
The link in the message contains a code that lets us connect a visit to the pages for pharmacies with that message. We use it only if you consent to analytics cookies. In that case we store the code in your browser's storage for 90 days. We also record which pages for pharmacies you open, the signup form included, how long you stay on them, how far you scroll, what you click and which step of the form you reach. We do not record your IP address or anything you type into the form. Without consent the code is neither stored nor sent. The legal basis is consent (Article 6(1)(a) GDPR in conjunction with Article 399 of the Polish Electronic Communications Law, Prawo komunikacji elektronicznej). You can withdraw consent in Cookie settings (link at the bottom of the page).
Unsubscribing the address through the link in the message or by e-mail to biuro@webet.pl counts as an objection (Article 21(2) GDPR). After that we no longer write to that address, we stop recording visits and we delete the visit records. We keep only the address and the date of unsubscribing so that we do not write to it again. You can object to letters by e-mail to biuro@webet.pl. After that we send no more letters to that pharmacy. We delete all other records 12 months after the message was sent.
3. Purposes and legal bases of processing
We process your personal data only for specified purposes and on the basis of appropriate legal grounds in accordance with Art. 6 GDPR:
3.1 Performance of a contract (Art. 6(1)(b) GDPR)
- Creating and managing the user account
- Providing medicine price comparison services
- Operating the subscription (free or paid)
- Payment processing
- Sending service-related notifications
- Operating Medicine Cabinet AI and accounting for the question allowance and packs
- Handling inquiries to pharmacies nearby: passing on the pharmacy's answer, reservation and confirmation of pickup, settling the monthly inquiry limit
3.2 Compliance with legal obligations (Art. 6(1)(c) GDPR)
- Issuing and storing VAT invoices
- Fulfilling tax obligations
- Fulfilling consumer-law obligations
- Responding to requests of state authorities (to the extent required by law)
3.3 Legitimate interest (Art. 6(1)(f) GDPR)
- Ensuring security and detecting abuse
- Analysis and improvement of platform operations
- Handling complaints and disputes
- Pursuing claims or defending against claims
- Archiving data for compliance purposes
3.4 Consent (Art. 6(1)(a) GDPR)
- Sending newsletters with offers and promotions (direct marketing)
- Personalisation of marketing communication
- Setting and reading analytics and marketing cookies
Newsletter - combined legal basis:
Newsletters are sent on the basis of three legal grounds jointly: (a) Art. 6(1)(a) GDPR - your voluntary consent to processing your email address; (b) Art. 10(1) of the Polish Act of 18 July 2002 on the Provision of Electronic Services - your consent to receive commercial information by electronic means; (c) Art. 172(1) of the Polish Act of 16 July 2004 - Telecommunications Law - your consent to the use of telecommunications terminal equipment for direct marketing purposes. Consents are collected jointly by actively ticking a checkbox in the subscription form. You can withdraw any consent at any time by clicking the "Unsubscribe" link in the footer of every email or by contacting biuro@webet.pl.
You can withdraw consent at any time, which does not affect the lawfulness of processing carried out before its withdrawal.
4. Data retention period
We store your personal data for periods necessary to achieve the stated purposes, taking into account the periods required by law:
| Data category | Retention period |
|---|---|
| Account data (email, password) | For the duration of the active account + 30 days after deletion |
| Payment data and invoices | 6 years from the end of the calendar year of the transaction |
| Baskets — Account | Until the basket is deleted, basket consent is withdrawn or the Account is deleted. An Account without valid basket consent: from the day this version of the Policy takes effect storage only, with no pricing and no alerts, and 90 days after that day the baskets are deleted |
| Baskets — not signed in | 12 months after the last change to the basket, or until basket consent is withdrawn |
| Inquiry to pharmacies (items, answer, pickup code) | 12 months from the end of the inquiry |
| Phone number, comment and conversation with the pharmacy | 30 days from the end of the inquiry |
| Location given with the inquiry | 30 days from the end of the inquiry |
| Record of consent (date, document version, IP address) | 6 years from the consent being given |
| Conversations with Medicine Cabinet AI — logged-in User | Until the conversation or Account is deleted, no longer than 12 months from the last message |
| Conversations with Medicine Cabinet AI — not logged in | 12 months from the last message |
| Technical log of requests to the AI model (without message content) | 12 months |
| Data passed to the AI model provider (Anthropic) | Up to 30 days at Anthropic, longer only in the cases described in section 6.8 |
| Technical data (IP, logs) | 12 months |
| Marketing consent | Until consent is withdrawn |
| Correspondence and complaints | 3 years after the matter is closed |
5. Special categories of data - health data (Art. 9 GDPR)
The shopping list of over-the-counter medicines and supplements you create in the Service, and the messages you send to Medicine Cabinet AI, may reveal information about your health or the health of the people you are buying for. They are then data concerning health within the meaning of Art. 4(15) and Art. 9(1) GDPR. We always treat them that way, regardless of who you are buying for.
5.1 Legal basis of processing
Explicit consent of the User (Art. 9(2)(a) GDPR). We ask for two separate consents, each when it is needed: basket and price-comparison consent before the first product is added to the basket, and Medicine Cabinet AI consent before the first message to it. Searching does not need consent. Refusing one consent does not affect the other: without basket consent we do not create a basket on our server or compare its price, and without Medicine Cabinet AI consent we do not send messages. The other pages of the Service can be browsed without either. We ask for a separate consent for each request to nearby pharmacies (point 5.8.3).
5.2 Scope
Basket consent: names and quantities of the products in the basket, including the supply plan and price alerts attached to the basket. Medicine Cabinet AI consent: the text of messages and images sent to Medicine Cabinet AI, pasted lists, doses entered in the supply plan and the list of products built in the conversation. Also the items of a request to nearby pharmacies, including any prescription medicines you enter, the comment and the conversation with the pharmacy (point 5.8). We link them to the Account identifier, and without signing in to a random session and browser identifier.
5.3 Purpose
Basket consent: saving the basket and comparing the price of the whole basket in the online pharmacies presented in the Service, and on the Account also price alerts and basket reminders. Medicine Cabinet AI consent: answering your messages and saving the conversation so you can return to it, for up to 12 months after the last message. When you send a request to nearby pharmacies, also passing it to those pharmacies and handling the pickup (point 5.8).
On the basis of the same consent we also record the course of your visit: what you searched for, what you added to the basket, the comparison result and the links to pharmacies you opened. We do this solely to check and improve the search and the comparison. We do not use this data for advertising or profiling and we do not pass it on to advertising companies.
Every phrase you type into the search goes to our server, which finds the products. Before you give basket consent, we store it only for search statistics, without linking it to you. That record holds no session or browser identifier and no IP address, and we store the time of the search to the day (to the week outside Poland). We store what happens in the search before consent in the same way, for example a screen with no results or a suggestion you picked. Your browser keeps the phrases from the current visit in the open tab and sends them to us again, now linked to you, only at the moment you consent. If you refuse or close the tab, the browser deletes them, and we keep them only in the search statistics.
5.4 Withdrawal of consent
You can withdraw each of the two consents at any time, independently of the other: with the switch in Privacy settings (link at the bottom of every page; in your Account: Settings › Privacy) or by writing to biuro@webet.pl. Deleting a basket is not a withdrawal of consent. After you withdraw basket consent we delete from our server the saved baskets with their items, supply plan, share links, price history and forecasts, as well as price alerts, hidden products and e-mails about baskets; in comparison and event records we remove the link to you. The basket saved in your browser stays on that device. After you withdraw Medicine Cabinet AI consent we delete the saved conversations; copies passed to Anthropic disappear there within 30 days (point 6.8). We keep the record of giving and withdrawing consent for 6 years as proof (point 4). Withdrawal of consent does not affect the lawfulness of processing carried out before it. You withdraw consent to pass a request to pharmacies by cancelling the request (point 5.8.8).
5.5 No health profiling
The Administrator does NOT use this data for health profiling or personalised marketing. It is shared with processors named in sections 6.1–6.8 and 6.10, which act on its instruction, for the purposes described in sections 5.3 and 5.7 and, when you send an inquiry to pharmacies nearby, also with brick-and-mortar pharmacies, which are separate controllers (sections 5.8 and 6.9). The Service does not provide medical or pharmaceutical advice.
5.6 No transfer to marketing
This data is NOT transferred to marketing processors (Google Ads, Meta Platforms) or analytics providers beyond anonymised aggregates in which individual medicines are not identifiable at the level of a single User.
5.7 Medicine Cabinet AI and other artificial intelligence features
Medicine Cabinet AI is an assistant based on the Claude artificial intelligence model, provided by Anthropic Ireland, Limited (section 6.8). Based on your messages it looks up products in our catalogue, builds a shopping list and works out where the whole basket costs the least. We use the same model when we read product names from a pasted list or a photo, when we suggest cheaper equivalents for products in the basket, and when we rewrite a dose that you enter yourself in the supply plan.
What data: the content of your messages to Medicine Cabinet AI (names of medicines and supplements and anything you add to them), uploaded images, the history of the current conversation, the list of products built in the conversation and, for equivalents, the names, identifiers and prices of the products in the basket. We link the conversation to your Account. Conversations saved before 16 October 2026 without logging in are linked to a random session and browser identifier. We do not store images. We only record that an image was attached.
A product name is enough to look it up. Do not describe symptoms or illnesses, and do not upload photos of prescriptions or medical records. Medicine Cabinet AI does not give health advice.
Purpose: at your request, finding products, building a shopping list and comparing the basket price; saving the conversation so it can be continued; explaining errors in answers and preventing abuse.
Legal basis: your explicit Medicine Cabinet AI consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), separate from basket consent (point 5.1). We ask for it before the first message to Medicine Cabinet AI. It also covers reading product names from a pasted list or photo and transcribing a dose you enter in the supply plan. Without consent Medicine Cabinet AI does not send messages. Cheaper equivalents and the price forecast send the model only catalogue product names, without an identifier of the person, and rest on basket consent. We settle the question limit and question packs under the contract (Art. 6(1)(b) GDPR, section 7 of the Terms).
Recipient: Anthropic Ireland, Limited, as a processor, under a data processing agreement (section 6.8). We pass it the content of messages, images and the history of the current conversation. We do not pass your name, email address, Account identifier or IP address. Anthropic may not train models on this data and deletes it within 30 days, subject to the exceptions described in section 6.8. The data may be processed outside the European Economic Area on the basis described in section 7.
Answers are generated by an artificial intelligence model and may contain errors. You can check the price and composition on the product card and on the pharmacy's page. We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you (Art. 22 GDPR).
How long we keep the data: section 4. Your rights, including access to saved conversations and their deletion: section 8.
5.8 Inquiry to pharmacies nearby and pickup with a code
5.8.1. What it is. When you send an inquiry to pharmacies nearby, we pass it to community pharmacies within the range you chose, one after another starting with the nearest, until one answers. The nearest open pharmacy gets the inquiry first, the next one after about 10 minutes; if you have Premium, the inquiry goes straight to the two nearest pharmacies. We show you the pharmacy's answer, and when you reserve a pickup we issue a pickup code.
5.8.2. What data we collect.
- a) the items of the inquiry: names, packs and quantities of non-prescription medicines and supplements from the basket and, if you tick the consent next to them, also the names and quantities of prescription medicines you type in, with the payment level if you give it;
- b) the town and the range you chose (your own town or 5, 10 or 20 km) and, if you share the device's location, the coordinates;
- c) your mobile phone number, if you give it;
- d) the comment on the inquiry and the conversation with the pharmacy;
- e) the e-mail address: the Account address or, when you send an inquiry without logging in, the address given in the form, for which we create an Account without a password;
- f) the course of the inquiry: the times it was passed on and opened by pharmacies, the pharmacy's answer (availability, quantities, substitutes, prices), the pickup code and deadline, the time of pickup and your answer to the question after pickup on whether the price matched;
- g) the record of your consent: the date, the version of the consent text, the IP address and the browser identifier.
The names of medicines and supplements may reveal information about your health or the health of the person you are buying for. We treat them as health data, also when the products are non-prescription.
5.8.3. Legal basis. We pass the inquiry to pharmacies on the basis of your explicit consent (Article 9(2)(a) GDPR), which we ask for with every inquiry. Without consent we do not send the inquiry. We add prescription medicines to the inquiry only if you tick the consent next to prescription medicines; we will not send a basket consisting only of prescription medicines without it. We process the remaining data (e-mail address, town, course of the inquiry, inquiry limit) to perform the service you order by sending the inquiry (Article 6(1)(b) GDPR).
Text of the consent:
I give my explicit consent to passing my inquiry (the names and quantities of medicines and supplements, including prescription medicines, my comment, my first name and my phone number if I give it) to community pharmacies within the range I chose, one after another starting with the nearest, to get information on availability and price and to reserve a pickup. I know that this data may reveal information about health (Article 9(2)(a) GDPR) and that I can withdraw the consent by cancelling the inquiry. Details: Privacy Policy, section 5.8.
5.8.4. What the pharmacy sees. Pharmacies are separate controllers: they are themselves responsible for what they do with the data from the inquiry, and they process it to answer, prepare the reservation, and sell and hand over the products.
| Pharmacy | What it sees |
|---|---|
| A pharmacy that has your ongoing inquiry (it can answer, or its answer is waiting for your reservation or pickup) | Your first name (if it is on your Account), town, range and distance; names and quantities of products, including prescription medicines with the payment level; your comment and the conversation; your phone number, if you give it; the lowest price of the non-prescription part in online pharmacies at the time the inquiry was sent; after the reservation, the code and the pickup deadline |
| A pharmacy that answered, for 24 hours after the inquiry ends | the same without the phone number |
| A pharmacy that answered, afterwards | only the items of the inquiry with its own answer and the amounts; without the first name, town, conversation and pickup code |
| Any other pharmacy that received the inquiry (another one answered, you asked another, the inquiry expired or you cancelled it) | only the list of items: name, pack, quantity and the prescription marking; without data about you, the conversation, the code and another pharmacy's answer |
- Pharmacy: A pharmacy that has your ongoing inquiry (it can answer, or its answer is waiting for your reservation or pickup)
- What it seesYour first name (if it is on your Account), town, range and distance; names and quantities of products, including prescription medicines with the payment level; your comment and the conversation; your phone number, if you give it; the lowest price of the non-prescription part in online pharmacies at the time the inquiry was sent; after the reservation, the code and the pickup deadline
- Pharmacy: A pharmacy that answered, for 24 hours after the inquiry ends
- What it seesthe same without the phone number
- Pharmacy: A pharmacy that answered, afterwards
- What it seesonly the items of the inquiry with its own answer and the amounts; without the first name, town, conversation and pickup code
- Pharmacy: Any other pharmacy that received the inquiry (another one answered, you asked another, the inquiry expired or you cancelled it)
- What it seesonly the list of items: name, pack, quantity and the prescription marking; without data about you, the conversation, the code and another pharmacy's answer
The pharmacy does not see your e-mail address, surname or exact location. In the notification e-mail the pharmacy gets a list of up to eight items of the inquiry, the distance and the time by which it can answer, without your first name and phone number. The SMS to the pharmacy contains no data from the inquiry.
5.8.5. Who else receives it. We show the name and address of the pharmacy that answered in the answer, together with its information on data processing. We will give you the list of all pharmacies that received your inquiry on request sent to biuro@webet.pl. The e-mails with the pharmacy's answer and the pickup code are sent by our mail provider (section 6.3), and we store the data with our hosting provider (section 6.2). We do not pass data from inquiries to marketing entities (section 5.6) and we do not charge pharmacies fees that depend on the number or value of inquiries.
5.8.6. What you see about the pharmacy. You learn the name, address, phone number and opening hours only of the pharmacy that answered. While you wait you see only the distances of the pharmacies the inquiry has reached. Pharmacies do not learn each other's names.
5.8.7. How long we keep the data. The inquiry (items, answer, pickup code): 12 months from the end of the inquiry. Phone number, comment and conversation with the pharmacy: 30 days from the end of the inquiry. The location given with the inquiry: 30 days from the end of the inquiry. The record of consent (date, document version, IP address): 6 years from the consent being given. We keep the content of e-mails with the items of the inquiry as long as the inquiry itself. After the inquiry is deleted, the prices given by the pharmacy stay with us as price data, with no link to you. Deleting the Account deletes your inquiries at once.
5.8.8. Your rights. You have all the rights in section 8. In addition:
- a) You withdraw the consent by cancelling the inquiry. Pharmacies that have not answered then lose access to your data at once; a pharmacy that has already answered loses the phone number at once and the remaining data after 24 hours.
- b) Withdrawing the consent does not undo a transfer that has already taken place. Direct requests concerning data that a pharmacy has kept to that pharmacy.
- c) The phone number and the comment are optional.
- d) We do not take decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. The order of pharmacies results solely from distance.
- e) The link to the status of an inquiry sent without logging in is valid for 7 days.
6. Sharing of personal data
We share your personal data with processors (sections 6.1–6.8 and 6.10) solely to the extent necessary to achieve the purposes of processing; we have concluded a processing agreement with each of them under Article 28 GDPR. When you send an inquiry to pharmacies nearby, the data from the inquiry is also received by brick-and-mortar pharmacies (section 6.9). They are separate controllers and we do not conclude a processing agreement with them.
6.1 Stripe Payments Europe Ltd. and Stripe, Inc. (payment provider)
- Role: Processor
- Purpose of processing: Processing credit/debit card and other payment methods, managing subscriptions and automatic renewal, handling refunds and preventing payment fraud.
- Data scope: Stripe Customer ID, Subscription ID, transaction ID, amount and currency, payment status, last 4 digits of card, User's email address, IP address (for fraud verification). Full card details (number, CVV, expiry date) are entered directly into the Stripe system and do not pass through our servers.
- Location: Stripe Payments Europe Ltd. - Ireland (EEA); Stripe, Inc. - United States (global infrastructure).
- Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest - fraud prevention).
- Transfer basis outside the EEA: EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023) - Stripe, Inc. is a certified entity. Additionally Standard Contractual Clauses (SCCs) and PCI DSS Level 1 certification.
- Privacy policy: stripe.com/privacy
6.2 Hetzner Online GmbH (infrastructure hosting)
- Role: Processor
- Purpose of processing: Hosting the web application, API and PostgreSQL database, hosting the Elasticsearch search index and Redis cache.
- Data scope: full scope of User data stored in the database (account data, shopping lists, search history, session data, technical logs).
- Location: Germany (European Economic Area) - data does not leave the EEA.
- Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
- Transfer basis: not applicable - processing takes place entirely within the EEA. Hetzner holds ISO 27001 and ISO 9001 certificates.
6.3 Twilio SendGrid, Inc. (transactional emails and newsletter)
- Role: Processor
- Purpose of processing: Sending transactional emails (registration confirmations, payment confirmations, subscription renewal notifications, password resets, confirmation links) and marketing newsletters.
- Data scope: email address, first and last name (if provided at onboarding), message content, confirmation links, delivery/open status.
- Location: United States.
- Legal basis: Art. 6(1)(b) GDPR (performance of a contract - transactional emails) and Art. 6(1)(a) GDPR in conjunction with the Polish Act on Electronic Services and the Telecommunications Law (consent - marketing newsletter).
- Transfer basis outside the EEA: EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) - Twilio SendGrid is a certified entity. Additionally Standard Contractual Clauses (SCCs).
6.4 Amazon Web Services EMEA SARL (S3 file hosting)
- Role: Processor
- Purpose of processing: Storing attachment files, static resources and backups in Amazon S3 (Active Storage).
- Data scope: files attached by the User or generated by the Service (PDF invoices, GDPR data exports, static resources).
- Location: Amazon Web Services EMEA SARL - Luxembourg (headquarters). We store the data in a European Union region.
- Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation - invoice storage).
- Transfer basis outside the EEA: EU-US Data Privacy Framework (Amazon Web Services is a certified entity) and Standard Contractual Clauses (SCCs). AWS holds ISO 27001, ISO 27017, ISO 27018 and SOC 1/2/3 certificates.
6.5 Rollbar, Inc. (application error monitoring)
- Role: Processor
- Purpose of processing: Detection, reporting and diagnosis of application errors to maintain the quality and security of the Service.
- Data scope: error stack trace, session identifier, user agent, IP address, technical request context. User personal data is filtered (PII scrubbing) before transmission - first name, last name, email address, password and payment data are not transferred.
- Location: United States.
- Legal basis: Art. 6(1)(f) GDPR - legitimate interest of the Administrator in ensuring the security, stability and quality of the service provided.
- Transfer basis outside the EEA: Standard Contractual Clauses (SCCs - Commission Implementing Decision (EU) 2021/914). As of the date of this Policy, Rollbar, Inc. is not certified under the EU-US Data Privacy Framework - data is transferred exclusively on the basis of SCCs and additional technical measures (PII scrubbing).
6.6 Google Ireland Ltd. and Google LLC (Google Tag Manager, Google Analytics 4, Google Ads)
- Role: Processor - in respect of GA4 and Google Ads in accordance with the Google Ads Data Processing Terms.
- Purpose of processing: Traffic measurement, user behaviour analysis, measurement of advertising campaign effectiveness (conversions), retargeting and Enhanced Conversions. Google Tag Manager container ID: GTM-5ZLFN8Z7.
- Data scope: behavioural data (pages visited, session time, conversion path), conversion events, device identifiers (Google Client ID), IP address (truncated/anonymised). For Enhanced Conversions: user identifier and SHA-256 hashed email address.
- Location: Google Ireland Ltd. - Ireland (EEA); Google LLC - United States (global infrastructure).
- Legal basis: Art. 6(1)(a) GDPR (consent of the User expressed in the cookie banner) in conjunction with the Polish Telecommunications Law.
- Transfer basis outside the EEA: EU-US Data Privacy Framework (Google LLC is a certified entity - Decision (EU) 2023/1795). Additionally Standard Contractual Clauses (SCCs).
- Privacy policy: policies.google.com/privacy
6.7 Meta Platforms Ireland Ltd. and Meta Platforms, Inc. (Facebook Pixel)
- Role: Joint controller (in respect of conversion event measurement - in accordance with the Controller Addendum for Facebook Business Tools).
- Purpose of processing: Measurement of conversions of advertising campaigns on the Meta network (Facebook, Instagram), retargeting and creation of Lookalike Audiences. Pixel ID: 699317922143678.
- Data scope: conversion events (PageView, AddToCart, PharmacyClick - custom Service event), Meta user identifier (if present), standard parameters (URL, event time), IP address. Data is transferred without direct personal identifiers on the Service side.
- Location: Meta Platforms Ireland Ltd. - Ireland (EEA); Meta Platforms, Inc. - United States (global infrastructure).
- Legal basis: Art. 6(1)(a) GDPR (consent of the User expressed in the cookie banner) in conjunction with the Polish Telecommunications Law.
- Transfer basis outside the EEA: EU-US Data Privacy Framework (Meta Platforms, Inc. is a certified entity - Decision (EU) 2023/1795). Additionally Standard Contractual Clauses (SCCs).
- Privacy policy: facebook.com/privacy/policy
6.8 Anthropic Ireland, Limited (Claude artificial intelligence model)
- Role: Processor. The party to the agreement with the Administrator is Anthropic Ireland, Limited (Ireland). Anthropic uses the sub-processors listed at anthropic.com/subprocessors.
- Purpose of processing: generating Medicine Cabinet AI's answers, reading product names from text and images, suggesting equivalent products for the basket, and rewriting doses entered by the User in the supply plan — see section 5.7.
- Data scope: the content of messages and images sent to Medicine Cabinet AI, the history of the current conversation, the list of products in the conversation, and the names, identifiers and prices of products in the basket. No name, email address, Account identifier or IP address of the User.
- Location: Anthropic Ireland, Limited — Ireland (EEA); processing by Anthropic and its sub-processors also takes place outside the EEA.
- Legal basis: explicit consent of the User (Art. 6(1)(a) and Art. 9(2)(a) GDPR) — see section 5.7. Processing agreement (Art. 28 GDPR): Anthropic's Commercial Terms of Service together with the Data Processing Addendum, accepted by the Administrator. Anthropic may not train models on data passed by the Administrator.
- Transfer basis outside the EEA: Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) incorporated into Anthropic's Data Processing Addendum.
- Retention at Anthropic: inputs and outputs are deleted within 30 days; kept longer — up to 2 years — only where Anthropic's automated safety systems flag the conversation as violating its usage policy, or where the law requires it.
- Anthropic's data protection information: anthropic.com/legal/privacy; list of sub-processors: anthropic.com/subprocessors.
6.9 Brick-and-mortar pharmacies (recipients of inquiries)
- Category of recipients: community pharmacies in Poland that have concluded an agreement with us and are within the range you chose.
- Role: separate controllers. We do not conclude a processing agreement with pharmacies; a pharmacy does not process data on our behalf.
- Scope of data: section 5.8.4.
- Purpose: answering the inquiry, reservation, sale and handing over of products.
- Basis of transfer: your explicit consent (Article 9(2)(a) GDPR).
- Location: Poland.
6.10 SMSAPI (SMS notifications for pharmacies)
- Role: processor.
- Purpose of processing: sending SMS notifications to pharmacies that switched this channel on.
- Scope of data: the pharmacy's phone number and the content of the notification. No patient data.
- Location: Poland.
- Legal basis: Article 6(1)(b) GDPR (performance of the agreement with the pharmacy).
We have concluded data processing agreements (DPA) under Article 28 GDPR with all processors named above (sections 6.1–6.8 and 6.10). The Administrator has not appointed a Data Protection Officer (DPO) - processing does not meet the criteria for mandatory designation set out in Art. 37(1) GDPR. All data protection matters can be addressed directly to the Administrator at biuro@webet.pl.
7. Data transfers outside the EEA
Some data may be processed outside the European Economic Area. Processing outside the EEA concerns the following entities: Stripe, Inc. (United States), Twilio SendGrid, Inc. (United States), Amazon Web Services - global infrastructure (with Service data hosted in EU regions), Rollbar, Inc. (United States), Google LLC (United States), Meta Platforms, Inc. (United States), Anthropic — sub-processors of Anthropic Ireland, Limited outside the EEA. Data processed by Hetzner Online GmbH remains entirely in Germany (EEA). Transfer of data outside the EEA takes place on the basis of:
- (a) Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework - in respect of certified entities (Stripe, Twilio SendGrid, AWS, Google, Meta)
- (b) Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) - in other cases, including Rollbar, Inc. and Anthropic.
- (c) Organisational and technical measures compliant with PCI DSS Level 1, ISO 27001, SOC 2 - depending on the provider
- (d) Additional technical safeguards such as SSL/TLS encryption, pseudonymisation and filtering of personal data (PII scrubbing) before transmission
A copy of the Standard Contractual Clauses (SCCs) and information on specific transfer safeguards can be obtained by contacting the Administrator at biuro@webet.pl.
8. Your rights (GDPR)
Under the GDPR you have the following rights:
8.1 Right of access to data (Art. 15 GDPR)
You can obtain confirmation as to whether we process your data and access to that data.
8.2 Right to rectification (Art. 16 GDPR)
You can request rectification of incorrect data or completion of incomplete data.
8.3 Right to erasure - "right to be forgotten" (Art. 17 GDPR)
You can request the erasure of data if it is no longer necessary or you have withdrawn consent.
8.4 Right to restriction of processing (Art. 18 GDPR)
You can request restriction of processing in certain situations.
8.5 Right to data portability (Art. 20 GDPR)
You can receive your data in CSV or JSON format and transmit it to another controller.
8.6 Right to object (Art. 21 GDPR)
You can object at any time to data processing for marketing purposes.
8.7 Right to withdraw consent (Art. 7(3) GDPR)
If processing is based on consent, you can withdraw it at any time.
8.8 Right to lodge a complaint (Art. 77 GDPR)
You may lodge a complaint with the supervisory authority - in Poland the President of the Personal Data Protection Office:
Personal Data Protection Office (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
Email: kancelaria@uodo.gov.pl
Phone: +48 22 531 03 00
Website: uodo.gov.pl
How to exercise your rights?
To exercise any of the above rights, contact us:
- Email: biuro@webet.pl
- Phone: +48 798 908 242
- By post: WEBET Sp. z o.o., ul. 1 Maja 30A, 45-355 Opole, Poland (marked "Data Protection")
We will respond to your request without undue delay - no later than within one month of receipt of the request.
9. Data security
We apply appropriate technical and organisational measures to protect your personal data:
9.1 Technical measures
- SSL/TLS encryption for all data transmissions
- Hashing of passwords with the bcrypt algorithm with an individual salt (one-way, irreversible - the password cannot be recovered even by the administrator)
- Encryption of sensitive data in the database
- Regular encrypted backups
- Firewall and DDoS protection
- 24/7 security monitoring
9.2 Organisational measures
- Limited access to personal data
- Information security policies
- Regular staff training
- Confidentiality agreements with employees and contractors
- Periodic security audits
11. Children's privacy
The Service is intended for adults (18 years and older) in accordance with the Terms. The Administrator does not knowingly collect personal data from persons under 16. If it is determined that data from a person under 16 has been collected without verifiable consent of the parental authority (Art. 8(1) GDPR), it will be deleted without delay. If you are a parent or guardian and believe that a child has provided us with personal data, please contact us at biuro@webet.pl.
12. Changes to the privacy policy
We may update this privacy policy from time to time. We will inform you of material changes:
- By sending an email notification
- By a notice on the home page
- Through a notice in the Service after logging in
We will notify you of significant changes affecting the scope of processing of personal data at least 14 days before they enter into force. Where the processing requires your consent, we will ask for it separately.
13. Contact
If you have questions about this privacy policy or wish to exercise your rights, contact us:
Email: biuro@webet.pl
Phone: +48 798 908 242 (Mon-Fri, 9:00-17:00)
Address: WEBET Sp. z o.o., ul. 1 Maja 30A, 45-355 Opole, Poland
We respond to general enquiries within 3 working days and to GDPR requests within one month.
GDPR compliance: CheaperForDrug is fully compliant with the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and the Polish Personal Data Protection Act of 10 May 2018. Your data is processed in accordance with the highest standards of security and privacy.
Legal references of the document:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
- The Polish Act of 10 May 2018 on the Protection of Personal Data
- The Polish Act of 18 July 2002 on the Provision of Electronic Services
- The Polish Act of 16 July 2004 - Telecommunications Law
- The Polish Act of 30 May 2014 on Consumer Rights
- Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US Data Privacy Framework)
- Commission Implementing Decision (EU) 2021/914 (Standard Contractual Clauses)
Document change history
- 16 October 2026 — added section 5.8 (inquiry to pharmacies nearby and pickup with a code), section 6.9 (brick-and-mortar pharmacies as separate controllers), section 6.10 (SMS provider) and section 2.4 (pharmacy data); supplemented sections 2, 3 and 4; amended sections 5.1–5.5 and the introduction to section 6.
- October 16, 2026 — added section 5.7 (Medicine Cabinet AI and other artificial intelligence features) and section 6.8 (Anthropic Ireland, Limited as a processor), supplemented sections 2, 3, 4, 5 and 7 with conversations with Medicine Cabinet AI; from this version, consent to the processing of health data also covers messages to Medicine Cabinet AI and is collected before the first message.
- 3 July 2026 — document date update. Sections 5.7 and 6.8, described in the history at the time, were not published; their content is introduced by the version dated October 16, 2026.
- 13 May 2026 - compliance audit update: list of data processors updated (Stripe, Hetzner, Twilio SendGrid, AWS, Rollbar, Google, Meta instead of previously mentioned Vercel/Scalingo), special-category data section added (Art. 9 GDPR - health data in over-the-counter shopping lists), Terms-change clauses updated (active acceptance instead of silent) and automatic subscription renewal (notification 7 days in advance), bcrypt terminology corrected (hashing instead of encryption), age rules clarified (16/18), legal basis for newsletter updated.
- 17 November 2025 - initial version of the document.