Privacy policy

Data controller

The controller of personal data is Extrone sp. z o.o., ul. Stefana Batorego 107B, 87-100 Toruń, Poland, entered in the Register of Entrepreneurs of the National Court Register under number KRS 0001159856 (District Court in Toruń, 7th Commercial Division of the National Court Register), NIP 8792764963, REGON 541100889, share capital PLN 5,000.

For matters relating to personal data, please contact us by e-mail at kontakt@extrone.pl or by post at our registered address. We have not appointed a data protection officer (DPO), as we are not required to do so.

Contact form and e-mail correspondence

The form collects your name, e-mail address, optionally your company name, the selected topic and the message. We process the same data – together with any data given in the message body and signature – when someone writes to us directly by e-mail.

Purpose: replying to the enquiry, preparing a quote or offer, further correspondence and – where the contract for the order is concluded by our partner – passing on to the partner the data needed to prepare and conclude that contract.

Legal basis: Art. 6(1)(b) GDPR where the enquiry is made by a person who is to become a party to a contract; Art. 6(1)(f) GDPR where the person acts on behalf of a company or institution or the enquiry does not concern a contract (legitimate interest: handling correspondence and business contacts).

Providing data is voluntary, but without an e-mail address we cannot reply.

If an enquiry is sent by an employee or associate of a company, or includes data of another person (e.g. a contact person), we process that person’s business contact data: name, position, company name, e-mail address and telephone number – for the same purposes and on the basis of Art. 6(1)(f) GDPR.

A message sent via the form is delivered to our mailbox; the website does not store it in any database. To prevent abuse, the server briefly keeps a hashed form of the sender’s IP address (number of messages sent).

Contracts, accounting and claims

If a contract is concluded following an enquiry, we process data to perform it (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for contracts with companies) and to issue invoices and keep the records required by tax and accounting law (Art. 6(1)(c) GDPR).

We may keep correspondence relating to an offer or contract in case of a dispute. Legal basis: Art. 6(1)(f) GDPR (legitimate interest: establishing, pursuing and defending claims).

Website operation and security

The server logs the IP address, date and time of the request, the address of the page opened and browser information. This data is used to operate the website, protect it against abuse and produce aggregate visit statistics in the hosting panel (without cookies and without identifying individuals). Legal basis: Art. 6(1)(f) GDPR (legitimate interest: website security and statistics).

The connection to the website is encrypted (HTTPS). Only authorised members of our team have access to data from the form and correspondence.

Recipients of data

We share data only to the extent necessary for a given purpose and only with entities acting on our behalf or involved in handling the enquiry:

• SEOHOST Sp. z o.o., ul. Obornicka 330, 60-689 Poznań, Poland – website and e-mail hosting;
• Łukasiewicz Research Network – Industrial Research Institute for Automation and Measurements PIAP – our technology partner. Where the contract for the order is concluded with PIAP, we pass on the contact details and the content of the enquiry – we inform you about this beforehand in our correspondence. From then on PIAP processes this data as a separate controller under its own privacy policy. Where we carry out the order ourselves and PIAP is involved in its execution, we pass on only technical data (e.g. model, dimensions, material), without personal data;
• IT service providers, accounting office, law firm and carriers – where needed to handle a contract, accounting or transport;
• public authorities – only where required by law.

We do not transfer data outside the European Economic Area and we do not sell it.

Retention period

• enquiries that did not lead to a contract – up to 12 months after the correspondence ends;
• correspondence relating to an offer or contract – until the limitation period for claims expires (Art. 118 of the Polish Civil Code: generally 6 years, or 3 years for claims related to business activity; the period ends on the last day of a calendar year);
• accounting documents (e.g. invoices) – for the period required by tax and accounting law;
• data used to protect the form against abuse – up to 24 hours;
• server logs – for the period set by the hosting provider.

Rights of data subjects

Every person has the right to:

• access their data and obtain a copy,
• rectification of their data,
• erasure of their data or restriction of processing,
• data portability (where we process data on the basis of a contract).

Please send requests to kontakt@extrone.pl or by post to our registered address. We reply without undue delay and no later than one month after receiving the request.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl).

Right to object

Where we process data on the basis of legitimate interest (handling correspondence and business contacts, defending claims, website security and statistics), you may object at any time on grounds relating to your particular situation.

Once we receive an objection, we will stop processing the data for that purpose unless we demonstrate compelling legitimate grounds that override the interests of the person, or grounds for establishing, pursuing or defending claims.

Automated decision-making

Data is not used for automated decision-making or profiling.

Cookies and external services

The website does not use cookies or analytics scripts and stores no information about visitors in the browser. The browser may only keep copies of the website's files (e.g. images and styles) to load it faster – this is the standard browser cache, which can be cleared in the browser settings. Fonts, images, videos and the PDF catalogue are loaded from our own server – without connections to external services.

The link to the Flowa shop (flowa.pl) leads to an external website with its own data-processing rules.

Changes to this privacy policy

We update this policy when the way we process data or the law changes. The current version is always available on this page, and the date of the last change is shown below.