Information on the Processing of Personal Data

1. Data Controller

The controller of your personal data is STARGLASS Przedsiębiorstwo Produkcyjno-Handlowo-Usługowe LTD Sp. z o.o., with its registered office in Ostrołęka, Poland.

2. Legal Basis for Processing

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – GDPR), the Polish Act of 10 May 2018 on the Protection of Personal Data and other applicable laws.

3. Categories of Personal Data We Process

In connection with our business activities, we may process in particular:

• first name and surname,
• job title or professional function,
• the name of the company or organisation you represent,
• business email address,
• telephone number,
• correspondence address,
• data contained in orders, quotations, contracts, invoices and other commercial documents,
• data contained in electronic and paper correspondence,
• data necessary for deliveries, complaints, servicing and other aspects of business cooperation.

4. Purposes and Legal Grounds for Processing

Establishing and Performing Business Cooperation

Personal data may be processed for the purposes of preparing quotations, taking steps prior to entering into a contract, concluding and performing contracts and managing ongoing business cooperation — pursuant to Article 6(1)(b) GDPR, where the data subject is a party to the contract.

Compliance with Legal Obligations

Personal data may be processed in order to comply with legal obligations imposed on the Controller, in particular tax, accounting and financial reporting obligations — pursuant to Article 6(1)(c) GDPR.

Legitimate Interests of the Controller

Personal data of persons acting on behalf of Customers, Suppliers and Business Partners may be processed for maintaining business relationships, conducting commercial arrangements, handling enquiries and complaints, establishing, pursuing or defending legal claims and ensuring the security of our business activities — pursuant to Article 6(1)(f) GDPR.

Consent

Where consent constitutes the legal basis for processing, personal data is processed pursuant to Article 6(1)(a) GDPR.

5. Commercial Communications and Marketing

Where STARGLASS uses electronic mail, telephone or other terminal equipment for direct marketing or the transmission of commercial communications, such activities are carried out in compliance with applicable consent requirements, including those arising from the Polish Electronic Communications Law of 12 July 2024.

Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

6. Sources of Personal Data

We may obtain personal data:

• directly from you,
• from the company, organisation or other entity you represent,
• from other persons involved in the performance of our business cooperation,
• from publicly available registers and databases, including the Polish National Court Register (KRS) and Central Register and Information on Economic Activity (CEIDG),
• from websites, business correspondence, business cards and other publicly available sources related to professional activities.

7. Recipients of Personal Data

Your personal data may be disclosed to entities cooperating with STARGLASS where this is necessary for the achievement of a specific purpose, including in particular:

• IT and hosting service providers,
• providers of IT systems and electronic communication services,
• accounting, legal and advisory service providers,
• courier, transport and logistics companies,
• banks and payment service providers,
• insurance companies,
• subcontractors involved in the performance of orders,
• public authorities and other entities authorised to receive data under applicable law.

Entities processing personal data on behalf of STARGLASS are granted access only to the extent necessary to perform the services entrusted to them.

8. Transfers Outside the European Economic Area

As a general rule, STARGLASS uses solutions designed to ensure that personal data is processed in accordance with the requirements of the GDPR.

Where the use of particular IT or technology services results in personal data being transferred outside the European Economic Area, such transfers will only take place using mechanisms permitted under the GDPR and providing an appropriate level of protection for personal data.

9. Data Retention Period

Personal data is retained only for as long as necessary to achieve the purpose for which it was collected.

In particular, personal data may be retained:

• for the duration of the business relationship,
• for periods required by tax, accounting and financial reporting regulations,
• until the expiry of applicable limitation periods for potential claims,
• where processing is based on consent — until consent is withdrawn or the purpose of processing ceases to apply.

10. Your Rights

Subject to the conditions and limitations set out in the GDPR, data subjects have the right to:

• access their personal data,
• rectify inaccurate personal data,
• request erasure of personal data,
• request restriction of processing,
• data portability,
• object to the processing of personal data,
• withdraw consent at any time where processing is based on consent.

To exercise your rights, please contact the Controller:

11. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection laws, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO) in Poland.

12. Automated Decision-Making

Personal data processed in connection with cooperation with Customers, Suppliers and Business Partners is not used for decisions based solely on automated processing which would produce legal effects concerning you or similarly significantly affect you.

Contact Regarding Personal Data

Any questions, requests or enquiries concerning the processing of personal data should be directed to: