Privacy policy

1. Data controller

The controller of your personal data is Drewno Pilarscy Spółka Cywilna Andrzej Pilarski, Patrycja Kłos, Sebastian Pilarski, ul. Lipowa 29, 69-200 Sulęcin, Poland, VAT ID (NIP) 5993268962, REGON 523248620.

For any matter concerning personal data, contact us at kontakt@drewnopilarscy.com or by phone: +48 571 326 804.

2. What data we collect and why

Enquiry form. We collect the data you provide: your name or company name, phone number, e-mail address, the product you are interested in, approximate quantity, delivery timeframe, delivery location and your message. We also record the IP address the enquiry was sent from. The data is used solely to prepare a reply and a quotation.

Newsletter sign-up. We collect your e-mail address, confirmation of the consent given, IP address and the place on the site where the sign-up occurred. The data is used to send commercial information about material availability and our offer.

Server logs. Our hosting provider records standard technical data (IP address, date and time of the request, browser type) to keep the site secure and running.

We also store the IP address in order to limit the number of submissions from a single source and protect the forms against automated spam.

3. Legal bases

We process data under the GDPR:

• Article 6(1)(b): steps taken at your request prior to entering into a contract, when you send an enquiry;
• Article 6(1)(a): your consent, when you subscribe to the newsletter; you may withdraw it at any time;
• Article 6(1)(f): our legitimate interest: conducting business correspondence, keeping the site secure and preventing abuse;
• Article 6(1)(c): legal obligation, where an enquiry leads to a transaction covered by tax and accounting law.

4. How long we keep the data

Correspondence from the enquiry form is kept for as long as needed to reply and conduct commercial discussions, and afterwards for the period in which claims may be brought.

Data given at newsletter sign-up is kept until consent is withdrawn. After withdrawal we retain only the fact and date of withdrawal, so that we can demonstrate the request was carried out.

Accounting records are kept for the period required by tax law.

5. Who we share data with

We do not sell personal data and do not pass it on for other parties' marketing. Access is limited to:

• our hosting and e-mail provider, whose servers run the website and company mailboxes, acting as a processor;
• our accounting and legal advisers, to the extent set out in our agreements with them;
• public authorities, where they are entitled to request it under the law.

6. Directions on the contact page

On the Contact page we give our address as text plus two buttons that open Google Maps. We no longer embed a map in a frame, so until you click a button no data is sent to Google.

Once you click, you move to Google's service and Google's privacy policy applies from there. We pass none of your data along with that.

7. Cookies and analytics

We use Google Analytics 4 to see which pages are useful and where enquiries come from. The tool starts only after you consent in the banner. Until then the site sends no request to Google and stores no analytics cookies.

Google Analytics stores an identifier in your browser to tell visits apart. We collect page views plus form submissions, newsletter sign-ups and clicks on the phone, WhatsApp and e-mail links. The IP address is truncated and we do not link this data with form data.

You can withdraw consent at any time via the „Privacy settings” link in the footer. The legal basis is your consent (Art. 6(1)(a) GDPR); refusing does not limit your use of the site.

We do not profile users, we make no automated decisions and we use no marketing or advertising cookies.

Links to our social media profiles are ordinary links. Until you click them, no data is sent to those platforms.

8. Your rights

In connection with the processing of your data you have the right to:

• access your data and obtain a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased, where there is no basis for further processing;
• restrict processing;
• data portability, for data processed on the basis of consent or a contract;
• object to processing based on our legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

9. Is providing data voluntary

Providing data is voluntary. However, without a phone number or e-mail address we cannot answer your enquiry, and without an e-mail address and your consent we cannot add you to the newsletter.

10. Security

The site runs over an encrypted HTTPS connection. The forms are protected against automated spam, and access to the collected data is limited to people who need it to handle enquiries.

11. Changes to this policy

If we change how we process data, for example by adding an analytics tool or a newsletter delivery platform, we will update this document and change the date shown at the top of the page.