I. General Provisions

The privacy policy defines how personal data of Users, necessary for providing electronic services via the website [www.hartmet.pl] (hereinafter: the Service), is collected, processed, and stored. The Service collects only the personal data necessary for the provision and development of the services offered therein. Personal data collected through the Service is processed in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter GDPR) and the Personal Data Protection Act of 10 May 2018.

II. Data Administrator

The administrator of personal data collected via the Service is HartMet® sp. z o.o., address: Tarnobrzeska 16, 26-600 Radom, VAT number: 796-25-20-893, email address: hartmet@hartmet.pl (hereinafter: the Administrator).

III. Purpose of Personal Data Collection

Personal data is used for:

• verifying the User’s identity,
• fulfilling the contract for services and e-services,
• communicating with the User (live chat, contact form, etc.),
• sending newsletters (with the User’s consent),
• promoting the Administrator’s offer,
• marketing, remarketing, affiliation,
• personalizing the Service for Users,
• analytical and statistical activities.

Providing data is voluntary but necessary for the conclusion of a contract or using other functionalities of the Service.

IV. Types of Personal Data Processed

The Administrator may process the following personal data of the User: name, surname, date of birth, residential address, email address, phone number, VAT number.

V. Personal Data Processing Period

Personal data of Users will be processed for the following periods:

• when the basis for processing is contract execution – until the statute of limitations for claims after its execution,
• when the basis for processing is consent – until it is revoked, and after revocation, until the statute of limitations for claims.

In both cases, the statute of limitations is 6 years, and for claims for periodic services and claims related to business activities – 3 years (unless a special provision states otherwise).

VI. Sharing of Personal Data

Users’ personal data may be transferred to: entities affiliated with the Administrator, its subcontractors, entities cooperating with the Administrator (e.g., e-payment services, courier/postal services, law firms). Users’ personal data will not/will be transferred outside the European Economic Area (EEA).

VII. Users’ Rights

The User of the Service has the right to: access their personal data, rectify it, delete it, restrict processing, transfer it, object to processing, and withdraw consent at any time (which does not affect the lawfulness of processing based on consent before its withdrawal). A request related to the exercise of the aforementioned rights should be sent to [email address]. The Administrator will fulfill or deny the request immediately – no later than within one month of receiving it. The User has the right to file a complaint with the President of the Office for Personal Data Protection if they believe that their rights and freedoms are being violated (GDPR).

VIII. Cookies

The Service collects information through cookies – session cookies, persistent cookies, and third-party cookies. Collecting cookies supports the correct provision of services in the Service and serves statistical purposes. The User may specify the scope of access to cookies on their device through browser settings.

IX. Automated Decision-Making and Profiling

Users’ data will not be processed in an automated manner that could result in decisions affecting them.

X. Final Provisions

The Administrator reserves the right to amend the Privacy Policy, while Users’ rights will not be restricted. Information about the changes will appear in the form of a notice available in the Service. In matters not regulated by this Privacy Policy, the provisions of the GDPR and Polish law apply.