Privacy policy
Privacy Policy of beECOplastics.pl
Last updated: 11 September 2025
1. Data controller
The data controller is:
BEECOPLASTICS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ NOT FOR PROFIT
Tax ID (NIP): 7282894927
Registered office: ul. Wspólna 20, Czyżeminek, 95-030 Rzgów, Poland
Contact for data protection matters: biuro@beecoplastics.pl
2. Categories and sources of personal data
We process personal data voluntarily provided by persons contacting us via the website contact form: name, e-mail address, telephone number and the content of the inquiry. When a business relationship is established (B2B), we also process data necessary for contract performance and invoicing: delivery address and tax identification number (NIP). We do not process payment card data on the website (no e-commerce), and we do not maintain user logins.
3. Purposes of processing and legal bases
We process personal data for the following purposes and legal bases:
Handling contact requests and communication prior to contract conclusion — legal basis: Article 6(1)(b) GDPR (processing necessary to take steps at the request of the data subject prior to entering into a contract) and performance of contract where applicable.
Execution of B2B contracts and invoicing — legal bases: Article 6(1)(b) and Article 6(1)(c) GDPR (compliance with legal obligations, e.g., tax/accounting).
Ensuring IT security and administrative management (e.g., server logs) — legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller: securing services and detecting abuse).
Analytics and marketing — currently not used. If analytics or marketing tools are introduced in the future, they will be documented and, where required, consent will be sought.
4. Recipients / data processors
Personal data may be disclosed to processors acting on our behalf, including: hosting provider, Microsoft Corporation (Microsoft Forms), Google LLC (Google Maps), invoicing service provider, couriers/transport companies, accounting firm, and legal advisors. Microsoft and Google are located outside the EEA (United States); transfers are carried out pursuant to the EU-US Data Privacy Framework to which these entities adhere. Appropriate processing agreements are concluded with these processors.
5. Retention periods
Data will be retained for the period necessary for the purposes indicated:
contact form data: up to 2 years from the last contact or until the matter is resolved;
invoices and accounting records: as required by Polish tax and accounting law — typically 5 years;
server logs and security records: up to 12 months, unless retention is required for longer in connection with proceedings.
After expiry of retention periods data will be deleted or anonymized.
6. Rights of data subjects
You have the right to access your data, rectification, erasure, restriction of processing, objection (including where processing is based on legitimate interest), and data portability (where processing is based on consent or contract and data are processed electronically). Where processing is based on consent (e.g., future marketing), you may withdraw consent at any time without affecting processing prior to withdrawal.
To exercise rights please contact: biuro@beecoplastics.pl. You also have the right to lodge a complaint with the supervisory authority (President of the Personal Data Protection Office, PUODO), Poland.
7. Data Protection Officer (DPO)
A Data Protection Officer has not been appointed. For data protection matters contact the data controller at biuro@beecoplastics.pl.
8. Cookies and external services
The site embeds an interactive Google Map. Displaying the map may result in cookies being set by Google and the transfer of data (IP address, browser data) to Google. We do not control Google’s privacy policy. Currently we do not use analytics or advertising tools.
Technical recommendation: the Google Map should be loaded only after user consent (on-demand loading) or replaced with a static image/link to minimize unnecessary cookie placement.
9. Security measures
We implement appropriate technical and organizational measures: access restriction, account security controls, backups, software updates and internal incident procedures.
10. Data breach procedure
We maintain an incident response procedure: detection, risk assessment, notification to the supervisory authority within 72 hours where required, and notification of affected data subjects if necessary.
11. Changes
This policy may be updated. Last updated: 11 September 2025.
