Privacy notice

Controller. APATRIS Sp. z o.o., registered seat (KRS): ul. Żelazna 59A lok. 6.1, 00-848 Warszawa, Poland; KRS 0000849614, NIP 5252828706, REGON 386546470 (“APATRIS”, “we”). Contact for data-protection matters: biuro@apatris.pl. We have not appointed a data protection officer.

What we process and why.

Enquiries sent through the form or by e-mail. The form asks for your name, company, e-mail address, an optional phone number, the selected need or service, material, place of execution, expected dates and your message. Attachments — drawings, specifications and other technical documents — and the scope summary built in the configurator on the site are optional. Please do not include special categories of personal data, in particular health data, in your message or attachments. If we receive such data without needing to process it, we limit its use and delete it in line with our retention rules and technical possibilities. We process the data to receive and answer your enquiry and to prepare, negotiate and, where applicable, conclude a contract. Legal basis: where you are personally a party to the contract or ask us to take steps before entering into one, art. 6(1)(b) GDPR; where you write on behalf of a company, art. 6(1)(f) GDPR, our legitimate interest being to receive and answer business enquiries and to maintain business correspondence with the representatives of our business partners. Providing the data is voluntary, but without it we cannot answer. Phone number. If you give a phone number in the enquiry form, we use it only to contact you about your enquiry, to prepare an offer and to agree the details of any execution. Giving a phone number is voluntary and does not affect your ability to send an enquiry. We do not use the phone number for marketing without separate consent and do not share it with third parties for marketing purposes. We keep the phone number for the period that applies to correspondence about the enquiry, as set out in this privacy notice.
Establishing, exercising or defending legal claims, where a dispute or a credible claim arises in connection with an enquiry or a contract. Legal basis: art. 6(1)(f) GDPR.
Server logs. Our hosting provider records technical data about each visit (IP address, date and time, requested address, browser type) in server logs, used for security and fault diagnosis. Legal basis: art. 6(1)(f) GDPR.

How long we keep data. Enquiry correspondence that does not lead to a contract: 12 months after the last substantive contact, after which it is deleted from our mailbox and file storage. Where a contract is concluded: for the term of the contract and the limitation period of claims arising from it; records subject to statutory retention duties (for example accounting records) are kept for the periods the law requires. Material relevant to a dispute or claim: until the claim is settled or time-barred. Server logs: up to 14 days (confirmed in writing by the hosting provider). The website’s outgoing-mail log keeps a copy of the text of each enquiry e-mail (not the attachments) for 7 days for delivery diagnostics, then deletes it.

Recipients. Processors acting on our instructions: nazwa.pl sp. z o.o., ul. Pana Tadeusza 2, 30-727 Kraków, Poland (website hosting and server logs); Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft 365: the e-mail and file storage in which enquiries are received and kept), under the Microsoft Customer Agreement and the Microsoft Products and Services Data Protection Addendum, which also lists Microsoft’s sub-processors. Where necessary, data may be disclosed to our legal and accounting advisers, and to public authorities where the law requires it.

Transfers outside the European Economic Area. Our website hosting is in Poland. Our Microsoft 365 services (Exchange Online, SharePoint, OneDrive, Teams) store data at rest in Poland and are covered by Microsoft’s EU Data Boundary, under which customer data and personal data are stored and processed within the EU/EFTA. Microsoft documents limited exceptions in which data may still be accessed from or transferred outside the EU/EFTA, in particular remote access by Microsoft personnel for service operation and troubleshooting, technical support cases, security-incident investigation, and global replication of basic directory data (user name, e-mail address). Such transfers are governed by the Data Protection Addendum and the EU Standard Contractual Clauses included in it; Microsoft Corporation is additionally certified under the EU–U.S. Data Privacy Framework. Details: Microsoft’s EU Data Boundary documentation (learn.microsoft.com/privacy/eudb).

Your rights. You have the right to access your data and to obtain a copy, to rectification, erasure and restriction of processing, to data portability where processing is based on art. 6(1)(b), and to object at any time to processing based on our legitimate interests. To exercise these rights write to biuro@apatris.pl. You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

Automated decision-making. We do not take automated decisions, including profiling, in relation to you.

Cookies and similar storage. This website uses no analytics, advertising or tracking cookies and loads no content from third-party servers. It stores one functional cookie, pll_language, which remembers the language you selected, for 12 months; it is necessary to deliver the language version you asked for and is not used to track you. Because it serves only that purpose, no consent banner is shown (art. 399 of the Polish Electronic Communications Law, Prawo komunikacji elektronicznej).

Changes. We update this notice whenever the website or the law changes; the current version is always published on this page. Version 3.1 dated 10 October 2026 (added the optional phone number and the technical form fields; registered seat updated after the KRS entry).