Website Privacy Notice
How we handle the information you provide through this website.
Version 1.0 · Effective date: 31 August 2026
In brief
The controller of your personal data is Instytut Biodynamiki Nieliniowej, operating ExploreIris™, ul.
Chociszewskiego 25/1, 60-255 Poznań, Poland, Tax ID (NIP): 542-216-45-60.
Privacy contact: privacy@exploreiris.com
You may use this address for questions concerning this Privacy Policy or the exercise of your data-protection rights.
This Privacy Policy describes the processing of personal data in connection with your use of the ExploreIris™ website and communications with us through website forms, email or other contact channels.
The ExploreIris™ assessment service involves separate data-processing activities.
Before iris images or other service-related material are submitted, individuals receive separate privacy information and, where required, appropriate consent documentation.
Research and validation activities are also governed by separate information and consent documentation where applicable.
The website contains four contact forms.
Each collects a limited set of information.
| Form | Location | Information collected |
|---|---|---|
| Assessment enquiry | Home page | Name (required) · email address (required) · country · city or region · message |
| Professional enquiry | For Clinics | Name (required) · email address (required) · practice or organisation · country · subject of enquiry · message |
| Practitioner enquiry | For Therapists | As above |
| Research enquiry | Research | As above, with institution or organisation |
Technical information. IP address, date and time of the request, device and browser type, and security and error logs — processed by our hosting provider.
Correspondence. The content of your message and any information you choose to include in it.
This website is not intended to collect special-category personal data, including health information. Please do not include medical information, medical records, iris images or other sensitive information in website forms.
If such information is submitted despite this notice, we will limit its processing to what is necessary to handle the communication appropriately and, where appropriate, delete or minimise that information.
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and conducting correspondence | Art. 6(1)(f) GDPR — our legitimate interest in handling enquiries. Where the enquiry concerns entering into an agreement, also Art. 6(1)(b) |
| Indicating the availability of the service in the country stated in your enquiry | Art. 6(1)(b) — steps taken at your request prior to entering into a contract |
| Ensuring the security and proper operation of the website | Art. 6(1)(f) — our legitimate interest |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) |
We do not carry out electronic marketing or profiling through this website. Providing your information is voluntary, but without an email address we will not be able to reply.
ExploreIris™ does not currently use analytics, advertising or profiling cookies.
The website may use strictly necessary technical cookies or similar technologies where required for security, form submission, session management or other functionality explicitly requested by the user.
These technologies are not used for advertising, behavioural profiling or cross-site tracking.
If non-essential cookies or similar tracking technologies are introduced in the future, they will not be activated without prior consent where such consent is required by applicable law.
The website loads typefaces from Google Fonts.
During loading, the IP address of your device is transmitted to Google LLC, including outside the European Economic Area.
The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in consistent presentation of the website.
Personal data may be processed by service providers supporting the operation and security of the website and our communications, or disclosed to other recipients where this is necessary and lawful.
The legal role of each recipient depends on the nature of the service and the applicable legal framework.
| Category | Provider | Scope |
|---|---|---|
| Website hosting | Webio.pl — servers in Poland | Website hosting and technical logs |
| Webio.pl — servers in Poland | Receipt and handling of correspondence | |
| Form processing | Formspree Inc. — servers in the United States | Receipt and forwarding of form submissions |
| Fonts | Google LLC | Delivery of typefaces; IP address of the device |
| Professional advisers | Legal and accounting advisers | Where necessary |
| Public authorities | — | Where disclosure is required by law |
Website hosting and email are provided from servers located in Poland.
Some of our other service providers may process personal data outside the European Economic Area.
Where this occurs and the GDPR requires safeguards for such a transfer, we use an applicable legal transfer mechanism and appropriate safeguards.
Information about the relevant safeguards may be requested by contacting privacy@exploreiris.com.
| Type of information | Retention period |
|---|---|
| General enquiries that do not develop into an ongoing relationship | 12 months after the last contact |
| Ongoing partner or professional correspondence | 24 months after the last substantive contact |
| Service-availability enquiries | 12 months, unless they develop into a service relationship |
| Contractual and accounting information | For the period required by applicable law |
| Technical server logs | 10 days |
Depending on the applicable law and circumstances, you may have the right to access your personal data, request correction or deletion, restrict processing, receive certain data in a portable format and object to processing based on legitimate interests.
Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise your rights, contact privacy@exploreiris.com.
You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).
Where Swiss data-protection law applies, personal data is also processed in accordance with the Swiss Federal Act on Data Protection (FADP).
Questions or requests concerning the processing of personal data may be sent to privacy@exploreiris.com.
We use technical and organisational measures appropriate to the nature of the data and the risks involved to protect personal data against unauthorised access, loss, alteration or disclosure.
The website is provided over an encrypted connection.
Detailed security architecture is not published for security reasons.
This website and its contact forms are intended for adults.
We do not knowingly solicit personal data from persons under 18 through these forms.
We may update this Privacy Policy when our website, service providers or data-processing practices change.
The current version and effective date will always be published on this page.
Questions concerning privacy or the exercise of your rights: privacy@exploreiris.com