ELGRECO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

Privacy Policy and Data Protection Notice

This Privacy Policy outlines how ELGRECO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (hereinafter referred to as the 'Controller' or 'Company') manages, processes, and protects the personal data of users interacting with our services. We are committed to maintaining the highest standards of data privacy in accordance with applicable data protection regulations, including the General Data Protection Regulation (GDPR) and local legislative requirements effective as of 2026-09-29. This document serves to ensure transparency regarding your rights and our obligations.

1. Scope of Data Collection

The Controller collects personal data only when it is strictly necessary to provide our services, respond to inquiries, or fulfill contractual obligations. The specific categories of data we process depend on your interaction with our landing page:

• Identifiers: Name, surname, and contact details such as email addresses and phone numbers provided via contact forms.
• Technical Data: IP addresses, browser type, device identifiers, and timestamps related to your session, gathered through automated technologies like cookies to ensure site functionality.
• Interaction Data: Details regarding your service preferences, feedback, and communication history with our support team.

We do not collect sensitive personal data (e.g., health information, political opinions) unless explicitly required by law or provided voluntarily by the user for a specific service request.

2. Purposes and Legal Basis for Processing

We process your personal data based on specific legal grounds to ensure compliance and fairness:

• Performance of a Contract: Processing is necessary to execute the service you requested, such as managing your order or providing customer support.
• Legitimate Interests: We process data to improve our service quality, secure our digital infrastructure, and perform internal analytics to enhance user experience.
• Consent: Where required, we rely on your explicit consent for marketing communications or non-essential cookies. You may withdraw this consent at any time.
• Legal Obligation: Processing is necessary to comply with tax, accounting, and other regulatory requirements mandated by the governing authorities.

3. Data Retention and Storage

ELGRECO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ strictly adheres to the principle of data minimization and storage limitation. We retain personal data only for as long as is necessary to fulfill the purposes for which it was collected:

• Data collected for contractual purposes is kept for the duration of the service agreement and subsequently for the period required by law for tax and audit purposes.
• Data processed based on consent is retained until such consent is withdrawn or the purpose of processing ceases to exist.
• Technical logs and analytical data are periodically purged or anonymized to ensure they are no longer identifiable.

4. Disclosure and Transfer of Personal Data

Your data is treated with the utmost confidentiality. We do not sell or lease your personal information to third parties. Disclosure to external entities occurs only under the following conditions:

• Service Providers: We engage trusted third-party processors (e.g., hosting providers, CRM systems, payment gateways) who act strictly under our instructions and are bound by data processing agreements ensuring equivalent protection levels.
• Legal Compliance: We may disclose data if required by law, regulation, or a valid court order from competent authorities.
• Business Transfers: In the event of a merger, acquisition, or asset sale, data may be transferred as part of the business transaction, subject to strict confidentiality and notification protocols.

5. Security Measures

We implement robust technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using SSL/TLS protocols.
• Restricted access to personal data, granting permissions only to authorized personnel who require the information to perform their job duties.
• Regular security audits and updates to our software infrastructure.
• Anonymization and pseudonymization techniques where appropriate.

6. Your Rights as a Data Subject

Under current regulations, you possess specific rights regarding your personal data held by us:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to correct inaccurate or incomplete data.
• Right to Erasure ('Right to be Forgotten'): You may request the deletion of your data when it is no longer necessary or if consent is withdrawn.
• Right to Restrict Processing: You can request that we limit the processing of your data under certain conditions.
• Right to Data Portability: You may request to receive your data in a structured, machine-readable format.
• Right to Object: You may object to the processing of your data based on our legitimate interests.

To exercise any of these rights, please contact our Data Protection Office at [email protected] or via our registered address at ul. Władysława Łokietka 15, 65-221 Zielona Góra, Poland. We endeavor to respond to all legitimate requests within 30 days. For urgent inquiries, you may also reach us at 48 608 414 418.

7. Updates to This Notice

This Privacy Policy is subject to periodic updates to reflect changes in our services or shifts in legal requirements. Any significant modifications will be communicated through our website. We encourage you to review this document periodically. The effective date of this version is 2026-09-29.