Privacy Policy

§ 1. General Provisions

1. The Personal Data Controller of the data collected via the website www.exoteak.pl is [Your Name / Company Name, e.g., XYZ Sp. z o.o.] with its registered office in [City/Town], address: [Exact business address], NIP (Tax ID): [Your NIP], REGON: [Your REGON] (hereinafter referred to as the Controller).
2. For matters related to personal data protection, you can contact the Controller via e-mail at: [Your e-mail address, e.g., contact@exoteak.pl].
3. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR.
4. The Controller takes special care to protect the interests of data subjects, and in particular ensures that the collected data is processed lawfully, collected for specified, legitimate purposes, and not subjected to further processing incompatible with those purposes.

§ 2. Purpose, Legal Basis, and Period of Personal Data Processing

Personal data of website users is processed for the following purposes, based on the following legal grounds, and for the periods specified below:

Handling inquiries and submissions via the contact form

Legal basis: Article 6(1)(f) of the GDPR – the legitimate interest of the Controller to handle correspondence, reply to the message, and build customer relationships. If the inquiry concerns taking steps prior to entering into a contract (e.g., presenting a commercial offer), the legal basis is Article 6(1)(b) of the GDPR.

Retention period: Data is stored for the period necessary to respond and conclude the correspondence, and after that time, it may be processed for the limitation period of any potential claims.

Establishment, exercise, or defense of legal claims

Legal basis: Article 6(1)(f) of the GDPR – the legitimate interest of the Controller to protect their property or non-property rights.

Retention period: Data is stored for the limitation periods of claims specified by law (in particular, the Civil Code).

§ 3. Types of Processed Personal Data

Using the contact/submission form on the website requires providing the data necessary for contact. The Controller processes the following data:

• First and last name (or company name),
• E-mail address,
• Phone number (if provided voluntarily),
• Content of the message entered into the form.

§ 4. Recipients of Personal Data

Access to the personal data of users may be granted exclusively to authorized employees or associates of the Controller, as well as external entities supporting the operation of the website on the basis of data processing agreements (processors). These include:

• The hosting and server provider where the website www.exoteak.pl is maintained,
• Providers of IT tools and correspondence management systems,
• Entities providing accounting, legal, or advisory services (if a need arises during the handling of the submission).

The Controller does not transfer personal data outside the European Economic Area (EEA) or to international organizations.

§ 5. Rights of Data Subjects

Every individual whose data is processed has the following rights under the GDPR:

• Right of access to their data and to receive a copy thereof (Article 15 of the GDPR),
• Right to rectification (correction) of their data (Article 16 of the GDPR),
• Right to erasure ("right to be forgotten") – if there are no grounds for its further processing (Article 17 of the GDPR),
• Right to restriction of processing (Article 18 of the GDPR),
• Right to data portability (Article 20 of the GDPR),
• Right to object to the processing of data based on the legitimate interest of the Controller (Article 21 of the GDPR).

In order to exercise these rights, the user may contact the Controller via the e-mail address specified in § 1 point 2.

If the user considers that their data is processed unlawfully, they have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

§ 6. Voluntariness of Providing Data and Profiling

Providing personal data in the contact form is voluntary, but necessary for the Controller to receive the message and reply to it. Failure to provide the data will result in the inability to send the form.

Users' personal data will not be used to make automated decisions, including profiling.

§ 7. Cookies and Analytical Tools

The www.exoteak.pl website uses cookies (small text files saved on the user's device) to ensure the proper functioning of the website, analyze traffic, and adapt content to user preferences.

The user can change the cookie settings in their web browser at any time (completely block or restrict them). Detailed information on this topic can be found in the settings and technical documentation of the specific web browser used.

§ 8. Final Provisions

The Controller reserves the right to make changes to this Privacy Policy in the future, e.g., due to changes in technology, website development, or amendments to applicable laws.

The current version of the Privacy Policy is always available on the website www.exoteak.pl.

This Privacy Policy is effective as of June 25, 2026.