Last updated: 4 September 2026
1. Personal data controller
The controller of personal data processed through the nanekpol.pl website is NANEK-POL Sp. z o.o., a Polish limited liability company with its registered address at ul. Jana Pawła II 199A, 32-091 Michałowice, Poland, Tax Identification Number (NIP): 5130289941, Statistical Number (REGON): 526915005 and National Court Register Number (KRS): 0001065182, hereinafter referred to as the “Controller”.
The Controller has not appointed a Data Protection Officer.
For matters relating to personal data protection, please contact: biuro@nanekpol.pl.
2. Categories of personal data processed
The Controller may process the following personal data submitted through the contact form:
- full name;
- company name;
- email address;
- telephone number;
- information included in the message.
When the website is used, basic technical information may be recorded automatically, including the IP address, date and time of the connection, address of the visited page, browser type and information about the device. This information may be stored in server logs.
Please do not include any personal data in the contact form or email correspondence that is not necessary for handling your enquiry.
3. Purposes and legal bases for processing
Personal data may be processed for the following purposes:
- handling enquiries, conducting correspondence and presenting offers – based on the Controller’s legitimate interest in communicating with clients and business partners (Article 6(1)(f) of the GDPR);
- taking steps at the data subject’s request prior to entering into a contract – where the data subject is to become a party to that contract (Article 6(1)(b) of the GDPR);
- entering into and performing a contract – pursuant to Article 6(1)(b) of the GDPR where the data subject is a party to the contract, or Article 6(1)(f) of the GDPR in relation to representatives, employees and contact persons of a client or business partner;
- complying with the Controller’s legal, tax and accounting obligations (Article 6(1)(c) of the GDPR);
- ensuring website security, preventing misuse and diagnosing technical errors – based on the Controller’s legitimate interest (Article 6(1)(f) of the GDPR);
- establishing, pursuing or defending legal claims – based on the Controller’s legitimate interest (Article 6(1)(f) of the GDPR).
4. Contact form
Personal data submitted through the contact form is used to handle the message, provide a response, prepare an offer or take other action corresponding to the content of the enquiry.
Providing a full name, email address and message is voluntary but necessary to submit the form and receive a response. Providing a company name and telephone number is optional.
Ticking the box confirming that the user has read the Privacy Policy constitutes confirmation that information about personal data processing has been provided. It does not constitute consent to personal data processing.
A message submitted through the contact form is sent to the Controller’s email inbox.
5. Recipients of personal data
Personal data may be transferred to entities supporting the Controller’s business operations, to the extent necessary for the relevant purpose, including:
- hosting and email service providers;
- IT support providers;
- providers of software used to manage correspondence;
- accounting, legal and advisory service providers;
- authorised public authorities where the obligation to disclose data results from applicable law.
Entities processing personal data on behalf of the Controller, in particular hosting, email and IT support providers, act under appropriate agreements and only in accordance with the Controller’s instructions.
Certain recipients, particularly legal or accounting service providers and public authorities, may process personal data as independent controllers in accordance with applicable law.
6. Transfers outside the European Economic Area
As a rule, the Controller does not transfer personal data outside the European Economic Area.
If an IT service used by the Controller results in personal data being transferred outside the European Economic Area, the transfer will be carried out in accordance with Chapter V of the GDPR, in particular on the basis of a European Commission adequacy decision or standard contractual clauses.
The Privacy Policy will then be updated accordingly.
7. Retention period
Personal data relating to an enquiry is retained for the period necessary to conduct correspondence and resolve the matter, and subsequently until the expiry of the applicable limitation period for any claims connected with the matter.
Where correspondence results in a contract, personal data will be retained for the duration of the contract and subsequently for the period required under tax and accounting regulations and the applicable limitation periods for claims.
Technical data and server logs are retained for the period resulting from the settings and retention rules applied by the hosting provider, but no longer than necessary to ensure the security and proper operation of the website.
Personal data may be retained for a longer period where continued retention is required by law or is necessary for the establishment, exercise or defence of legal claims.
8. Data subject rights
Subject to the conditions specified in the GDPR, data subjects have the right to:
- access their personal data and receive a copy of it;
- rectify inaccurate data or complete incomplete data;
- request the deletion of personal data;
- request the restriction of processing;
- receive and transfer their personal data;
- object to processing based on the Controller’s legitimate interests.
To exercise these rights, please contact the Controller at biuro@nanekpol.pl.
A person who considers that their personal data is being processed in breach of applicable data protection law has the right to lodge a complaint with the President of the Personal Data Protection Office in Poland.
9. Automated decision-making
Personal data of website users is not used for automated decision-making or profiling that produces legal effects or similarly significantly affects the user.
10. Cookies and technical data
The website does not use analytical or marketing cookies.
In connection with the operation of the WordPress content management system, only strictly necessary cookies may be used to ensure website security, proper operation and basic functionality.
The website does not use analytical tools, behavioural advertising or user profiling mechanisms.
Users can manage cookies through their browser settings. Restricting necessary cookies may affect the proper operation of certain website functions.
If analytical or marketing tools, or external content requiring additional cookies, are introduced in the future, this Privacy Policy will be updated before such functions are enabled.
11. Data security
The Controller applies appropriate organisational and technical measures to protect personal data against unauthorised access, loss, alteration, destruction or disclosure.
The connection to the website is secured using the encrypted HTTPS protocol.
12. Amendments to the Privacy Policy
This Privacy Policy may be updated due to changes in applicable law, the scope of the Controller’s activities, the operation of the website or the IT services used.
The current version of the Privacy Policy is always available on the nanekpol.pl website.