This document describes the rules for personal data on the ZEGGER TECH Sp. z o.o. website and in correspondence started through its forms. It is intended to help explain why we ask for information, what happens to an inquiry and where to send a request about your data. It is not purchasing terms or consent to marketing.
Who is responsible for the data and how can you contact them?
The data controller is ZEGGER TECH Sp. z o.o., ul. Lęborska 3B, 80-386 Gdańsk, NIP 1231425415, KRS 0000770654. For matters concerning data and the exercise of rights, you can write to [email protected] or send a letter to the address shown. Please describe the matter so that we can direct your message to the appropriate person.
What types of information might we receive?
The scope depends on how you contact us. We may receive your name, work or personal email address, telephone number, company name, information needed for a quotation or order, project address, correspondence and submitted files. The quotation form may also contain information about the fencing system, dimensions, gates, timing and transport. Distributor inquiries may contain the details of a person representing a business.
Recruitment may involve data from the form and CV, including education, qualifications and previous employment where relevant to the role. Simply visiting the website may involve processing technical connection data such as an IP address, request time and browser information. The scope of data collected by external services depends on which services have actually been enabled.
Where does the information come from?
Most often, people provide their information themselves when they write, call or complete a form. We may also receive the details of a company representative from their employer or colleague in connection with an inquiry or order. A project document, correspondence or reference may contain information about other people who have not sent it to us themselves.
For information received indirectly, the duty under Article 14 GDPR must be assessed. As a rule, information is provided within one month at the latest, at first contact with the person or before first disclosure to a recipient, depending on the circumstances and statutory exceptions. A scanned reference containing a name or signature needs a separate legal basis and assessment of the scope of public disclosure; merely receiving the document does not mean consent to unrestricted publication.
For what purposes and on what legal bases do we process data?
Each purpose needs its own legal basis. Processing does not become lawful merely because a form contains a checkbox.
You can scroll the table horizontally.
| Cel | Legal basis and limits |
|---|---|
| Responding to an inquiry and preparing a quotation for an individual | Article 6(1)(b) GDPR, where steps taken at the person's request are needed before entering into a contract. |
| Contact with a company representative and B2B cooperation | Article 6(1)(f) GDPR: legitimate interest in communication and managing a business relationship, after assessing the person's rights and expectations. |
| Fulfilling an order and billing | Article 6(1)(b) for a contract with an individual, point (f) for necessary B2B contact and point (c) for specific tax or accounting obligations. |
| Handling complaints and product defects | Article 6(1)(b) in connection with performing an obligation, point (c) for specific duties under law and point (f) for necessary claims handling; without requiring marketing consent. |
| Establishing, pursuing or defending specific claims | Article 6(1)(f) GDPR, only to the extent genuinely necessary; it is not a basis for keeping everything indefinitely. |
| Newsletter and additional marketing | Article 6(1)(a) GDPR where consent is chosen as the basis; in addition, prior consent to using the communication channel for commercial information under Article 398 PKE. |
| Recruitment | Article 6(1)(c) or (b) to the extent required by employment law and steps necessary for a particular recruitment process; point (a) for additional information and separate future recruitment, subject to the applicable conditions. |
| Website security | Article 6(1)(f), where specific technical data is needed to detect misuse and protect services, following an assessment of proportionality. |
Contact, quotations and orders
Information in a message is used to respond and continue the discussion about the matter raised by its sender. Technical details and attachments in the quotation form help establish the scope of the offer. An indicative calculation does not guarantee a price or the conclusion of a contract. Providing an email address for a reply does not in itself subscribe you to the newsletter.
For an inquiry from an individual, Article 6(1)(b) GDPR may be the appropriate basis for steps before a contract, while Article 6(1)(f) may apply to contact with a company representative. When an order is placed, we process the information needed to fulfill it; sales documents may be subject to tax and accounting obligations under Article 6(1)(c). Specific claims may justify limited retention under point (f), not indefinite retention of all correspondence.
Newsletter and marketing communication
Subscribing to the newsletter is a separate choice from business contact, placing an order or submitting a CV. If the company runs a newsletter, it uses the address provided for that purpose and information needed to manage sign-up, withdrawal of consent and evidence of how consent was given. Marketing consent cannot be a condition of answering an inquiry or accepting an application.
Commercial information sent by email, telephone or another channel covered by Article 398 of the Electronic Communications Law requires the end user's prior consent appropriate to the purpose and channel. Consent can be withdrawn; withdrawal does not affect the lawfulness of earlier processing. After an unsubscribe request, the company may need to retain minimal information to respect the refusal and show that it was handled, without keeping a full marketing profile without justification.
Recruitment and candidate documents
Candidate information is used to assess an application for a specific position, make contact and conduct recruitment. Article 22[1] of the Labour Code defines the information an employer may request. Information about education, qualifications and previous employment is requested to the extent necessary for the type of work or position. Additional information provided on the candidate's initiative or at the employer's request requires a separate assessment of the legal basis, including Article 22[1a].
A CV may accidentally contain special categories of data, such as health information. We do not ask for such information unless it is needed. Processing it requires additional conditions under the GDPR and Labour Code; Article 22[1b] links consent for special-category data to the initiative of the person applying for work. Refusing consent for additional information cannot result in unfavorable treatment. Participation in future recruitment is a separate, voluntary purpose and is not a condition for considering the current application.
Website, statistics and external tools
When you use the website, the server may receive an IP address, request time, resource address, browser information and errors.
Details of the technologies used and the user's choices are set out in the related Privacy and Cookies Policy. External tools such as a map, form protection or a reviews widget may establish separate connections with their providers; this does not automatically mean that the content of an inquiry is sent to them.
An indicative calculation does not in itself constitute a decision producing legal effects under Article 22 GDPR.
Who may receive the data?
Access to data should be limited to people authorized to handle inquiries, orders, recruitment and website maintenance within their duties. Data may be entrusted to providers maintaining hosting, email, the website system and necessary communication tools. ZEGGER uses dhosting for hosting and email. Depending on the matter, a recipient may also be an authorized public authority or a professional adviser bound by confidentiality.
Is data transferred outside the European Economic Area?
Where processing involves a transfer outside the EEA, the controller should identify the appropriate mechanism under Chapter V GDPR: an adequacy decision, suitable safeguards under Article 46 and how to obtain a copy of them, or another applicable basis. The exceptions in Article 49 are for specific situations, not a routine replacement for safeguards.
How long will data be retained?
The GDPR requires storage to be limited to the period needed for the purpose.
Is providing information mandatory?
For an ordinary inquiry, providing information that enables a response is voluntary, but without an email address or another specified contact channel, the company cannot reply. A form may technically require certain fields, such as a name and email address; this does not mean every such field is mandatory under law. Technical details, a telephone number or an attachment are needed only when the particular matter calls for them.
For an order, some information may be necessary to conclude or perform a contract and issue documents required by law. In recruitment, the information an employer may request is primarily defined by Article 22[1] of the Labour Code and the needs of the position. Additional consent for future recruitment and marketing consent remain optional. Refusing either should not prevent a basic reply or participation in the current recruitment.
What rights does a person have?
A person may request access to their data, a copy of it, correction of inaccurate information and restriction of processing in circumstances provided by law. The right to erasure is not unconditional: information may be retained where required by law or needed to establish, pursue or defend claims. Consent-based processing may be withdrawn at any time; this does not invalidate lawful actions taken before withdrawal.
An objection to processing under Article 6(1)(f) is considered in light of the person's situation and the controller's compelling legitimate grounds. An objection to direct marketing needs no justification and ends that processing. Data portability applies only where the basis is consent or a contract, processing is automated and the data was provided by the person. Rights are not identical for every legal basis or every document.
How can you make a request or complaint?
For matters concerning your data, you can write to [email protected] or send a letter to the controller's address. It helps to identify the form used and the approximate date of contact. Identity verification should be proportionate: a scan of an identity document is not routinely required, and additional information may be requested where there are reasonable doubts.
A reply is provided without undue delay, generally within one month. For complex or numerous requests, the period may be extended by a further two months, with notice of the extension and its reasons within the first month. A refusal must be explained. A person may lodge a complaint with the President of UODO at ul. Stanisława Moniuszki 1A, 00-014 Warszawa; contacting ZEGGER first is not a condition of making a complaint.
Data protection and updating this information
The controller should choose technical and organizational measures appropriate to the risk, type of information and how it is used. A short contact message needs different protection from a CV or construction project containing data about many people. Access restrictions, permission controls, secure storage, erasure and breach handling are necessary.
This notice should be updated when the purpose, legal basis, provider, retention period or operation of a form changes.