Privacy policy

The controller of personal data is Zakład Metalowy „WB” Produkcja, Handel, Usługi Wiesław Bożek, Maria Bożek Spółka Jawna, with its registered office in Wola Mielecka, Wola Mielecka 620, 39-300 Mielec, entered in the register of entrepreneurs of the National Court Register (KRS) under KRS number 0000136482, NIP (tax identification number) 8171916425, REGON (statistical number) 831315186 (hereinafter: the “Controller”).

This policy explains how the Controller processes the personal data of visitors to the zmwb.eu website and of persons who contact the Controller through it. It also fulfils the information obligation referred to in Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the “GDPR”).

For matters relating to the processing of personal data, you can contact the Controller:

• by email: [email protected],
• by telephone: +48 17 583 84 59,
• by post at the registered office address: Wola Mielecka 620, 39-300 Mielec.

Data protection officer: [TO BE COMPLETED: whether the Controller has appointed a data protection officer, and their contact details].

The Controller processes personal data for the following purposes:

• Responding to enquiries submitted via the contact form (name and surname, email address, telephone number, content of the enquiry and attached files, e.g. technical documentation). The legal basis for processing is the consent given in the form (Article 6(1)(a) GDPR) and, where the enquiry concerns the conclusion of a contract, also taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
• Handling correspondence sent by email or conducted by telephone. The legal basis for processing is the Controller's legitimate interest in responding to and handling enquiries (Article 6(1)(f) GDPR).
• Ensuring the security of the website, including protecting the form against abuse. For this purpose, the IP address of the device is stored in the server's memory for 10 minutes in order to limit the number of messages sent from a single address. The legal basis for processing is the Controller's legitimate interest (Article 6(1)(f) GDPR).
• Establishing, exercising or defending legal claims, should the need arise. The legal basis for processing is the Controller's legitimate interest (Article 6(1)(f) GDPR).

• Data submitted via the contact form and in correspondence is kept for as long as necessary to respond and conduct discussions and, if no contract is concluded, for no longer than [TO BE COMPLETED: period, e.g. 12 months from the last contact].
• If a contract is concluded, data is kept for the term of the contract and thereafter for the period required by law (in particular tax and accounting law) and until the limitation periods for claims have expired.
• Data processed on the basis of consent is kept until consent is withdrawn.
• The IP address used to protect the form is deleted from the server's memory after 10 minutes.

Data may be disclosed to entities that process it on behalf of the Controller under data processing agreements, solely to the extent necessary to provide their services:

• the website hosting provider: [TO BE COMPLETED: name of the hosting provider],
• the provider of the service that sends messages from the contact form (Resend, United States of America),
• the Controller's email service provider: [TO BE COMPLETED: name of the email provider].

Data may also be disclosed to public authorities where required by law.

In connection with the use of the message delivery service (Resend) and, once the map is displayed, Google services, data may be transferred to countries outside the European Economic Area, in particular to the United States of America. Such transfers are carried out subject to the safeguards provided for in Chapter V of the GDPR, in particular on the basis of a European Commission adequacy decision or standard contractual clauses approved by the European Commission. A copy of the safeguards can be obtained by contacting the Controller.

The zmwb.eu website does not use cookies for analytics or marketing purposes and does not use tools that track user behaviour. The fonts used on the website are served from the website's own server, without connecting to third-party servers.

When you choose a language in the language switcher, the website stores the strictly necessary NEXT_LOCALE cookie in your browser (valid for 12 months) so that the website is displayed in the selected language on your next visit.

On the Contact page, you can display a location map provided by Google Ireland Limited. The map loads only after you click the “Show Google map” button. From that point on, Google may store cookies in your browser and process device data (including your IP address) in accordance with its own privacy policy, available at policies.google.com/privacy.

You can change your cookie settings in your web browser at any time, including blocking cookies from being stored or deleting stored cookies.

Every person whose data we process has the right to:

• access their data and obtain a copy of it (Article 15 GDPR),
• rectification of their data (Article 16 GDPR),
• erasure of their data (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• object to processing based on the Controller's legitimate interest (Article 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR).

To exercise these rights, simply contact the Controller as set out in section 2.

You also have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

Providing personal data is voluntary but necessary for us to respond to your enquiry. The form cannot be submitted without your name and surname, email address, telephone number and the content of your enquiry.

Personal data is not used for automated decision-making, including profiling, as referred to in Article 22 GDPR.

The Controller may update this privacy policy, in particular in the event of changes in the law or in the way the website operates. The current version is always available on this page. Date of last update: 25 September 2026