Privacy notice

Controller

Adam Kotwicki, sole trader under Polish law, trading under the business name “Produkcja i Montaż Wyrobów Metalowych Adam Kotwicki” (brand: Kotwicki Balustrady)

Address

ul. Lipowa 18, 56-200 Góra, Poland

Address in Germany

Kaiserstraße 79, 51545 Waldbröl, Germany

Email

info@gelaendernachmass.de

Phone and WhatsApp

+48 604 203 983

Data protection officer

We are not required to appoint a data protection officer and have not appointed one.

The website is hosted on an OVH server in a data centre in Germany. On every request the server records in log files: IP address, date and time, the page requested (URL), the referrer URL (the page visited before), the HTTP status code and amount of data transferred, and the browser and operating system. We need this data to deliver the pages, fend off attacks and find faults. The log files are deleted after 7 days at most.

Cloudflare, Inc. only manages the domain's DNS records, which point to our server's address. Traffic to the website does not pass through Cloudflare.

Fonts and all other parts of the pages come from our own server; the site does not use Google Fonts.

The website, the enquiry form and file uploads are encrypted with TLS; you can tell by “https://” in the address bar.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is running the website securely and reliably.

The enquiry form lets you describe your project. We process what you enter:

• name, email address, postcode and town (required)
• phone number (optional)
• project details: system, where the railing goes, whether you want installation, approximate total length, and your message
• photos, sketches or PDF files you upload (optional)

We use these details to assess your enquiry, ask follow-up questions and prepare a quotation. If you enquire for yourself, the legal basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract). If you enquire for a company, a property manager or a client, or ask a general question, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is answering enquiries and preparing quotations. Without your name, email address, postcode and town we cannot reply or prepare a quotation.

The enquiry and its files are stored on our server in Germany. The server sends a notification with your details, without the files, to our mailbox at Hostinger. Access is limited to the people in our business who handle the enquiry and to an IT service provider, who runs and maintains the server for us as a processor under Article 28 GDPR.

Photos may show people, number plates or house numbers, and their file details may contain where they were taken. Please upload only the pictures we need for the railing, and show other people only if they agree. We use photos only to quote for and build your railing.

To block mass automated enquiries, the server counts enquiries per IP address for ten minutes (Article 6(1)(f) GDPR; legitimate interest: protection against spam and abuse). We do not use third-party services for this.

We do not make automated decisions or use profiling.

If you email or call us, we process your contact details and the content of your message to deal with your request. The legal basis is Article 6(1)(b) GDPR where it concerns a quotation or an order, otherwise Article 6(1)(f) GDPR (legitimate interest: answering your message). Emails are kept in our mailbox at Hostinger.

The WhatsApp link opens WhatsApp. WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, is responsible for your use of WhatsApp as a separate controller; WhatsApp shares data with Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. The WhatsApp privacy policy applies. If you write to us on WhatsApp, we process your phone number, your profile name and the messages and photos you send to deal with your enquiry, on the same legal bases as for email. We use the WhatsApp Business app without address book sync. We delete chats on the same schedule as enquiries. If you prefer not to use WhatsApp, you can reach us by email, phone or the form.

At gelaendernachmass.de/konfigurator you can draw your railing, see an indicative price and send an enquiry with your design. The controller is the same as for this website.

Once you create a design, we store it on our server and set the cookie “session_id”, which links the design to your browser. With the session we store the IP address and browser identifier to detect abuse. The cookie “_konfigurator_session” protects the configurator's forms against forged submissions, the cookie “locale” remembers a language you choose, and your browser's session storage remembers the view you last opened until you close the tab. This storage is strictly necessary for the service you asked for (Section 25(2) no. 2 TDDDG, Article 399(3) of the Polish Electronic Communications Law). The legal basis for the processing is Article 6(1)(b) GDPR, and for abuse detection Article 6(1)(f) GDPR (legitimate interest: protecting the service).

If you send an enquiry from the configurator, we process your name, email address, phone number, site address, message and your design as described under “How we handle an enquiry”. Designs without an enquiry are deleted once none of them has been changed for 90 days. If you asked for a link to your designs by email, we keep that email address and your designs until you ask us to delete them (Article 6(1)(b) GDPR).

On your first visit a notice asks whether you allow statistics cookies. Your choice, including a refusal, is stored in a cookie so the notice does not appear on every page. This cookie is strictly necessary to remember the setting you chose (Section 25(2) no. 2 TDDDG in Germany, Article 399(3) of the Polish Electronic Communications Law).

Only if you agree do we load Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Aggregated reports then show us which pages are visited and where visitors come from. For this Google processes device and browser details, pages viewed and interactions, and approximate location; Google states that it does not store the IP addresses of users in the EU. Data may be transferred to Google LLC in the USA. The legal basis is your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG, Article 399(1) of the Polish Electronic Communications Law).

Google processes this data as our processor (Article 28 GDPR). Google Signals, the Google Ads link and sharing data for Google's own purposes are switched off. Event data is deleted automatically after 2 months. More information: Google privacy policy.

If you decline, Google Analytics is not loaded. You can change your choice at any time with “Cookie settings” in the footer; withdrawal takes effect for the future. When you withdraw, we delete the Google Analytics cookies in your browser. Before you consent, no connection to Google is made.

gnm_cookie_notice

stores whether you allowed or refused statistics, 180 days, set by us

_ga

distinguishes visitors for statistics, 2 years, Google, only with consent

_ga_<ID>

stores the session state for statistics, 2 years, Google, only with consent

session_id

links your configurator design to your browser, 1 year, set by us only once you create a design

_konfigurator_session

protects the configurator's forms, until you close the browser, set by us

locale

remembers the language chosen in the configurator, 1 year, set by us

The following processors handle data on our behalf, only on our instructions and under a contract as required by Article 28 GDPR.

OVH Sp. z o.o., ul. Swobodna 1, 50-088 Wrocław, Poland

hosting the website on a server in Germany, storing enquiries and files

Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus

the info@gelaendernachmass.de mailbox

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

audience measurement with Google Analytics 4, only with your consent

IT service provider based in Poland

running and maintaining the server

Google may process data in the USA if you have agreed to statistics. Google LLC is certified under the EU-US Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795, Article 45 GDPR). Our server and the stored enquiries are in the EU. Our email provider uses subcontractors that may process data outside the EU; the European Commission's standard contractual clauses apply to those transfers (Article 46(2)(c) GDPR).

• connection logs on the server: 7 days at most
• enquiries that do not lead to an order, with their files and emails: 12 months after the last message, so we can answer questions about a quotation (Article 6(1)(f) GDPR)
• enquiries that lead to an order: until the warranty and the limitation period for claims under the contract have run out, for railings fixed to buildings usually five years after acceptance (Article 6(1)(f) GDPR); invoices and accounting records five years from the end of the calendar year in which the tax fell due (Article 86 § 1 and Article 70 § 1 of the Polish Tax Ordinance, Article 6(1)(c) GDPR)
• cookie notice: 180 days; Google Analytics cookies: 2 years or until you delete them or withdraw consent; statistics data at Google: 2 months

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You can withdraw consent at any time with effect for the future (Article 7(3)). An email to info@gelaendernachmass.de is enough.

Where we process data on the basis of legitimate interests (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Article 21(1) GDPR). We will then stop, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.

The authority responsible for us is the President of the Polish Personal Data Protection Office: Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl. Under Article 77 GDPR you can also complain to any other supervisory authority, in particular in the Member State where you live or work; in Germany that is the data protection authority of your federal state. That authority stays your contact and works with the Polish authority.