Privacy policy
Draft for legal review — the marked information must be completed before publication.
Controller and contact
The data controller is MAL-SPED Sp. z o.o., ul. Energetyków 13, 20-468 Lublin, KRS 0000367113, NIP 7122876375, REGON 432716480. For data protection matters, contact biuro@mal-sped.pl, call +48 814 417 531 or write to the address above.
[TO COMPLETE: whether a data protection officer has been appointed and, if so, their contact details.]
Contact and enquiries
The contact form collects your email address and message, and any name, family name and phone number you choose to provide. We use these to reply and handle correspondence. If you enquire on your own behalf about entering into a contract, the basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). For other enquiries, including those on behalf of a company, the basis is our legitimate interest in handling enquiries and correspondence (Article 6(1)(f) GDPR).
Newsletter and withdrawal of consent
The email address provided when subscribing is used to send the MAL-SPED newsletter containing commercial information. The basis is your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time by emailing biuro@mal-sped.pl. Withdrawal does not affect the lawfulness of processing before withdrawal. Subscribing is not a condition of contacting us or using the website.
[TO COMPLETE: confirmation that email withdrawals are handled, the newsletter delivery tool and any additional data recipients.]
Recipients and transfers outside the EEA
We use Netlify for hosting and form handling, and home.pl for email. Data may be accessible to authorised people handling correspondence and to providers and their subcontractors as necessary to deliver these services. Public authorities may receive data where required by law.
Netlify may process data in the USA. Its data processing agreement identifies the EU–US Data Privacy Framework as the basis for transfers to Netlify and, where that basis does not apply, the European Commission standard contractual clauses. Information about safeguards is available in the Netlify DPA; you can also request a copy from the controller at biuro@mal-sped.pl.
Netlify data processing agreement (DPA)
[TO COMPLETE: confirmation of the applicable Netlify account terms, DPA, current DPF status and transfers by subcontractors and external resource providers.]
How long we keep data
We retain correspondence for the time needed to handle the matter and, if it relates to a contract or claims, for the period required by law or needed to establish, exercise or defend claims. Newsletter data is processed until consent is withdrawn; evidence of consent and withdrawal may be retained as needed to demonstrate compliance and protect against claims.
[TO COMPLETE: specific retention periods or criteria for correspondence, consent records and logs, and deletion of copies in Netlify and home.pl. The principles above must be confirmed against company practice.]
Your rights
Subject to the conditions in the GDPR, you have the right to access, rectify and erase data, restrict processing, and receive portable data where processing is automated and based on consent or a contract. You may object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time. You may also withdraw consent. Send requests to biuro@mal-sped.pl. You have the right to complain to the President of the Polish Personal Data Protection Office (UODO).
Polish Personal Data Protection Office
Voluntary provision and automated decisions
Providing data is voluntary. Without an email address and message we cannot handle a form enquiry; without an email address and consent we cannot subscribe you to the newsletter. We do not make decisions about you based solely on automated processing, including profiling.
Cookies, external resources and technical data
The website code does not initialise analytics or advertising pixels. However, the website loads fonts and the WebFont library from Google, jQuery from CloudFront, the Swiper library from jsDelivr and images from the Webflow CDN. The homepage video is served from the website’s own resources. When resources are loaded, providers receive your IP address and request data, such as the time, browser type and requested address; transmission of the referring page address depends on browser settings. External links, for example to social media, open when clicked.
Hosting technical data is used to deliver and secure the website — our legitimate interest (Article 6(1)(f) GDPR). The code does not set our own analytics or advertising cookies. This does not guarantee that hosting or resource providers never use cookies or similar technologies. You can manage cookies in your browser; restrictions may affect website functionality.
[TO COMPLETE: review of cookies, log retention and resource transfers on the target hosting, and assessment of the basis for loading them before publication.]
