Privacy policy

1. Data controller

The controller of your personal data is "SIROPOL" Spółka z ograniczoną odpowiedzialnością, ul. Wyzwolenia 111, 85-790 Bydgoszcz, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS 0000164230 (Sąd Rejonowy w Bydgoszczy), VAT ID 5541236780, REGON 091365222.

For data protection matters: info@siropol.pl, +48 607 133 455.

2. Purposes and legal bases

We process your data for the following purposes:

• Responding to your enquiry and preparing a quotation — Art. 6(1)(b) GDPR (steps prior to entering a contract).
• Commercial contact and correspondence — Art. 6(1)(f) GDPR (legitimate interest).
• Sending commercial information where you have consented — Art. 6(1)(a) GDPR.
• Accounting and tax obligations — Art. 6(1)(c) GDPR.
• Establishing, pursuing and defending claims — Art. 6(1)(f) GDPR.

3. Scope of data

Our RFQ form collects: your name, company name, work e-mail address, telephone number, and technical project information (part name, industry, polymer, volume, tolerance, target start of production) together with any technical documentation you choose to attach. To prevent abuse, we also create a short-lived, irreversible cryptographic identifier of the e-mail address and a submission counter; the plain e-mail address is not stored in this database.

Providing the fields marked as required is necessary for us to prepare a quotation. All other data is optional.

4. Recipients

The form data is processed on our behalf by Google Cloud EMEA Limited (application hosting in the europe-west4 — Netherlands region) and Domena.pl sp. z o.o., ul. Gdańska 119, 85-022 Bydgoszcz, Poland, KRS 0000090753 (company mailbox and e-mail server). Data may also be disclosed to legal advisers where necessary to establish or defend claims.

After submission, the form content and optional attachment are transferred over an encrypted connection to the company mailbox and made available to authorised sales staff. The website does not retain a separate copy of the enquiry content or documentation in a database or CRM system; Google Cloud Firestore stores only a short-lived identifier and counter used to prevent abuse.

Domena.pl processes data in Poland. Global Google services may involve access to data from outside the EEA; Google uses safeguards available under the GDPR, including the EU–US Data Privacy Framework or Standard Contractual Clauses, depending on the service and recipient.

5. Retention

Enquiries, correspondence and submitted technical documentation are retained in the company mailbox while the enquiry is handled and then, as a rule, for 3 years from the end of the calendar year in which the correspondence ended. Data may be kept longer if the enquiry results in a contract or where necessary to establish, pursue or defend claims.

Technical identifiers and rate-limit counters expire when their limiting window ends and are marked for automatic deletion no later than one additional hour afterwards; the cloud service may complete the physical deletion later. Data used to send commercial information is retained until consent is withdrawn or for 3 years from the last activity. Records subject to accounting or tax obligations are retained for the period required by law.

6. Your rights

You have the right to:

• access your data and obtain a copy,
• rectify inaccurate data,
• erasure,
• restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
• lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

7. Cookies and third-party services

The site itself sets no cookies on your device and uses no analytics, advertising or profiling tools, which is why it shows no general cookie consent banner. The Google services described below may use their own storage mechanisms. If we introduce analytics or advertising in future, we will run it only after obtaining your consent and update this policy.

The only thing the site stores in your browser is a session storage entry named “siropol-intro-seen”. It records that the homepage intro animation has already played, so it is not shown again. It contains no personal data and is deleted when you close the tab or browser.

The site is hosted on Google Cloud in the europe-west4 region (Netherlands); the homepage video is served from Cloud Storage in the europe-central2 region (Warsaw). Fonts are served from our own server, and the homepage film streams from Google Cloud Storage in the same region. When it loads, Google, acting as our hosting provider, receives your IP address and technical browser data. No cookies are set.

Google Maps. The footer shows a static map image. The interactive Google Maps map loads only when you click “Show map”. At that point Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) receives your IP address and technical browser data, and may set its own cookies on your device. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in showing directions at your request.

Google reCAPTCHA. We protect the RFQ form against spam with Google reCAPTCHA v3. The script loads only on the last step of the form, not elsewhere on the site. Google then receives your IP address, technical browser and device data and information about your interaction with the page, and may set or read cookies. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in protecting the form against spam and abuse.

Google Maps and reCAPTCHA are global Google services that cannot be restricted to the EU region, so data from them may be transferred to Google LLC in the USA under the EU–US Data Privacy Framework, in which Google LLC participates. Details: Google Privacy Policy — https://policies.google.com/privacy.

You can block cookies in your browser settings. If you block Google's cookies, the form's anti-spam check may fail; in that case, send your enquiry to info@siropol.pl.

8. Automated decision-making

We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects.