Privacy policy
This is an English translation provided for information only. The Polish version of this document is legally binding — read the Polish version. Contracts are concluded under Polish law.
[SUBJECT TO LEGAL REVIEW] Working draft. Requires review for compliance with the GDPR (Article 13), including the legal bases, retention periods and the list of data recipients.
Data controller
The controller of your personal data is Rafal Raczkowski IT Services (Rafał Raczkowski, sole trader registered in the Polish CEIDG register, Polish tax ID (NIP) 567 185 37 49), ul. Ostródzka 195E/11, 03-289 Warszawa, email kontakt@svalcon.pl.
What data we process and why
| Purpose | Data | Legal basis | Period |
|---|---|---|---|
| Quote requests and orders | full name, company, Polish tax ID (NIP), email, phone, address, photos of the board, device models | Article 6(1)(b) GDPR (contract / pre-contractual steps) | requests without an order: 24 months; orders: as required by tax law (5 years) |
| Consumer unit documentation (GPSR) | serial number, configuration, unit documents | Article 6(1)(c) GDPR (legal obligation) | 10 years from sale |
| Marketing (newsletter, review requests) | Article 6(1)(a) GDPR (consent) | until consent is withdrawn | |
| Analytics and advertising (cookies) | cookie identifiers, configurator events, email hash (enhanced conversions) | Article 6(1)(a) GDPR (consent) in conjunction with Article 399 of the Polish Electronic Communications Law | as set out in the cookie policy; consent valid for 12 months |
| Cookie consent records (accountability) | consent ID, version, categories, type and date of decision, language, GPC signal, HMAC hashes of the truncated IP and browser, account (if signed in) | Article 6(1)(c) in conjunction with Article 7(1) GDPR (obligation to demonstrate consent) — to be verified by a lawyer (D72) | 3 years from the decision |
Cookie consent records
We record every decision made in the cookie banner or settings so that we can demonstrate that consent was given or withdrawn (Article 7(1) GDPR). We never store the full IP address: it is truncated (IPv4 to /24, IPv6 to /48) and only a keyed hash (HMAC) is kept, likewise for the browser. You can see your consent ID on the “Cookie settings” page — quote it if you ask us about your consent. Records are deleted automatically after 3 years.
Recipients of data
Hosting provider (EU), payment provider [PROVIDER], email service provider, courier company (for shipments), accounting office. Google (GA4, Ads) only after you consent to cookies.
Your rights
Access, rectification, erasure, restriction, data portability, objection, withdrawal of consent, and the right to lodge a complaint with the President of the Polish Data Protection Office (UODO). Requests: kontakt@svalcon.pl.
Security
Encrypted connection (HTTPS), files stored outside the public directory, database backups with 30-day retention, hosting in the European Union.