This policy explains what personal data we collect in connection with your use of the amar-group.eu website, contact with us and business cooperation, why we do so, who we share it with and what rights you have. We apply it on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR, applied in the United Kingdom as the UK GDPR) and the ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych (Polish Personal Data Protection Act of 10 May 2018).
1. Data controller
The controller of your personal data is AMAR GROUP spółka z ograniczoną odpowiedzialnością (limited liability company), registered office in Sieraków Śląski, ul. Lubliniecka 1, 42-793 Ciasna, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number KRS 0000646490, NIP 5751891143, REGON 365841194 (hereinafter AMAR Group, we).
2. Contact on personal data matters
You can contact us on any matter concerning personal data:
- by email: am***@**et.pl (with the subject line “Personal data”),
- by post: AMAR GROUP Sp. z o.o., ul. Lubliniecka 1, Sieraków Śląski, 42-793 Ciasna, Poland,
- by phone: +48 660 798 074.
We have not appointed a data protection officer, as the nature of our activities does not require one (Article 37 GDPR). Data protection matters are handled by a designated person in our company.
3. What data we process, for what purpose and for how long
We process only the data needed for a given purpose. Below we describe the situations in which you come into contact with us.
| Situation | Data | Purpose and legal basis | Retention period |
|---|---|---|---|
| “Send enquiry” form on the website | email address, phone number, content of the enquiry, as well as the date sent, page URL and IP address | Responding to your enquiry, preparing a quotation and offer at your request (Article 6(1)(b) GDPR). If you write on behalf of a company: our legitimate interest, namely business contact with a customer (Article 6(1)(f) GDPR) | Until the discussions end and, if we do not conclude a contract, 12 months from the last contact |
| Call-back request (CallPage widget) | phone number, time of the request, call data | Calling you back at your request and presenting an offer (Article 6(1)(b) or (f) GDPR) | As above; technical call data in the CallPage system in line with the service settings, no longer than 12 months |
| Contact by phone, email and WhatsApp | data you give us: name, company, contact details, content of correspondence | Handling correspondence and conducting business discussions (Article 6(1)(b) or (f) GDPR) | Until the matter is closed and then until any claims become time-barred |
| Offer, sales contract, manufacturing and delivery | identification and contact details, company details (tax ID, address), delivery address, payment and finance details | Preparing an offer and concluding and performing the contract (Article 6(1)(b) GDPR) | For the duration of the contract and then for the period required for tax purposes and protection against claims |
| Complaints, statutory warranty, guarantee, servicing | contract data, description of the fault, photos, correspondence | Handling complaints and after-sales service (Article 6(1)(b) and (c) GDPR) | Until the end of the statutory warranty or guarantee period and until claims become time-barred |
| Settlements and accounting | data from invoices and accounting documents | Complying with tax and accounting obligations (Article 6(1)(c) GDPR) | 5 years from the end of the year in which the tax payment deadline expired |
| Contact persons of our customers and suppliers | name, job title, business email and phone, employer's name | Communication while performing the contract with the company you represent (Article 6(1)(f) GDPR). We usually receive the data from your employer or from public sources | For the duration of cooperation with your employer and then until claims become time-barred |
| Pursuing and defending claims | data from the contract and correspondence | Establishing, pursuing and defending claims (Article 6(1)(f) GDPR) | Until the limitation period expires: as a rule 3 years for claims related to business activity and 6 years in other cases (Article 118 of the Kodeks cywilny, the Polish Civil Code) |
| Commercial information about our products | name, company, email, phone | Direct marketing of our own products (Article 6(1)(f) GDPR). We send marketing emails and make marketing calls only to people who have consented to this (Article 398 of the Prawo komunikacji elektronicznej, the Polish Electronic Communications Law) | Until you object or withdraw consent |
| Statistics and online advertising | cookie identifiers, IP address, device and browser information, pages visited | Analysing website traffic and measuring and targeting Google and Meta adverts (Article 6(1)(a) GDPR, consent given in the cookie banner) | Until consent is withdrawn, no longer than the cookie lifetime described in the Cookie policy |
| Website security and protection of forms against spam | IP address, browser data, how the form was filled in, content and email address entered in the form | Protecting the website against abuse and spam (Article 6(1)(f) GDPR) | Server logs in line with hosting settings, data in the anti-spam service for up to 45 days |
| AMAR Group Facebook page | profile name, photo, comments, reactions, messages | Running the page, communicating with followers, page statistics (Article 6(1)(f) GDPR) | Until the content is deleted by you or by us; messages up to 12 months from the last contact |
When the retention periods expire, we delete the data or permanently anonymise it.
4. Do you have to provide data
Providing data is voluntary. However, without an email address or phone number we will not be able to respond to your enquiry, and without the data needed for the contract and invoice we cannot conclude or settle the contract. Consent to statistics and marketing cookies is not a condition for using the website.
5. Who we share data with
Your data may be received only by entities that help us run our business and by authorities entitled to it under the law. These are in particular:
- website hosting provider: WPEngine, Inc. (servers in a data centre in Frankfurt am Main),
- agency maintaining the website and running advertising campaigns: infoBrand Sp. z o.o., registered office in Warsaw,
- call-back widget provider: CallPage Sp. z o.o., registered office in Warsaw,
- form anti-spam protection provider: CleanTalk Inc.,
- email provider and providers of office and IT tools,
- Google Ireland Limited (Google Ads, Google Analytics, reCAPTCHA, Google Maps, fonts),
- Meta Platforms Ireland Limited (Meta Pixel, Facebook page) and WhatsApp Ireland Limited (WhatsApp messenger), if you use it,
- our accounting firm, law firms, banks and institutions financing equipment purchases,
- transport and courier companies, certification and equipment testing bodies,
- public authorities, where required by law.
We have concluded data processing agreements (Article 28 GDPR) with providers that process data on our behalf. Google, Meta and WhatsApp act as independent controllers for some of their activities and process data under their own rules.
For Facebook page statistics and data collection by the Meta Pixel, we are joint controllers together with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Article 26 GDPR). The essence of the arrangement is available at facebook.com/legal/terms/page_controller_addendum and facebook.com/legal/controller_addendum. Meta is primarily responsible for handling your requests concerning this data, but you can also address them to us.
6. Transfers of data outside the European Economic Area
Some of our providers are based in the United States or use US entities. In such cases your data may be transferred outside the European Economic Area (EEA). Transfers take place only with appropriate safeguards in place:
| Recipient | Scope | Basis for transfer |
|---|---|---|
| Google LLC (USA) | Google Ads advertising, Google Analytics statistics, reCAPTCHA, Google Maps | European Commission decision of 10 July 2023 finding an adequate level of protection under the EU-U.S. Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses |
| Meta Platforms, Inc. (USA) | Meta Pixel, Facebook page, WhatsApp | EU-U.S. Data Privacy Framework (Article 45 GDPR) and standard contractual clauses |
| WPEngine, Inc. (USA) | service access to data stored on servers in Germany | standard contractual clauses adopted by the European Commission (Decision 2021/914, Article 46(2)(c) GDPR) |
| CleanTalk Inc. (USA) | form data checked for spam | EU-U.S. Data Privacy Framework (Article 45 GDPR) |
You can obtain a copy of the safeguards applied by writing to the address given in point 2. Information on Data Privacy Framework participants is available at dataprivacyframework.gov.
7. Profiling and automated decisions
If you consent to marketing cookies, Google and Meta may use your activity on the website to show you targeted AMAR Group adverts on other sites. This is a form of profiling that produces no legal effects concerning you and does not similarly significantly affect you. We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR.
8. Your rights
In connection with the processing of your data, you have the right to:
- access your data and receive a copy of it (Article 15 GDPR),
- rectification of data (Article 16 GDPR),
- erasure of data (Article 17 GDPR),
- restriction of processing (Article 18 GDPR),
- portability of data we process on the basis of a contract or consent (Article 20 GDPR),
- object to processing (Article 21 GDPR),
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal (Article 7(3) GDPR),
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland (Article 77 GDPR).
Right to object. If we process your data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation. We always respect an objection to direct marketing, without you having to give a reason.
We respond to requests without undue delay and at the latest within one month. In complex cases this period may be extended by a further two months, and we will inform you of this within the first month. Before fulfilling a request, we may ask for information needed to confirm your identity.
9. Cookies
The website uses cookies and similar technologies. We set cookies necessary for the website to work without consent. We set statistics and marketing cookies only after you give consent in the banner that appears on your first visit. You can change your consent at any time using the cookie settings icon on the page or the “Cookie settings” link. A detailed list of cookies is available in the Cookie policy.
10. Data security
We apply technical and organisational measures appropriate to the risk: encrypted HTTPS connections, restricted access to the website admin panel, strong passwords, regular software updates, backups and agreements with entities processing data on our behalf. Only authorised persons bound by confidentiality have access to the data.
11. Changes to the policy
We update the policy when the law, our services or the tools used on the website change. The current version is always available at amar-group.eu/polityka-prywatnosci/, and its effective date is given at the top of the document.
