LEGAL INFORMATION
Privacy policy
This policy explains what data we process when you use the website or contact STREFO, why we process it and what rights you have.
Effective from 24 August 2026.
1. Data controller
The controller of your personal data is STREFO Sp. z o.o., with its registered office at 82G/2 Ossowska Street, 05-220 Zielonka, Poland, KRS 0001255268, NIP 1251812753, REGON 54530373800000.
For matters relating to personal data, contact us at biuro@strefo.pl, by telephone on +48 888 27 67 27, or by post at the address above.
2. Data we collect
Through the contact form, we may receive:
- your name, company name, e-mail address and, optionally, telephone number,
- information about the type and location of the facility and the requested scope of work,
- a description of the problem and any other information you voluntarily include in your message.
- UTM campaign parameters, the landing page and the referring page, where available, to identify the source of an enquiry.
When you use the website, the technical infrastructure may also process data required to deliver the website, maintain its security and diagnose errors, such as the IP address, date and time of the request, browser type and device information.
Please do not include special-category data, such as health information, or personal data relating to other people unless it is necessary for us to handle your enquiry.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to an enquiry and preparing a consultation, quotation or further cooperation | Article 6(1)(b) GDPR — steps taken at the request of the data subject before entering into a contract |
| Handling other correspondence and documenting its course | Article 6(1)(f) GDPR — our legitimate interest in handling enquiries efficiently and protecting against claims |
| Protecting the website and form, preventing abuse and carrying out diagnostics | Article 6(1)(f) GDPR — our legitimate interest in ensuring secure operation of the website |
| Measuring website use and traffic-source effectiveness with Google Analytics 4 | Article 6(1)(a) GDPR — voluntary consent, which may be withdrawn at any time |
| Complying with legal obligations arising from a business relationship | Article 6(1)(c) GDPR |
Contact-form data is not used for newsletters or direct marketing. Any future marketing communication would require a separate, freely given consent.
4. Is providing data mandatory?
Providing data is voluntary. Your name, company, e-mail address and problem description are, however, necessary to submit the form and receive a response. Other fields are optional. We cannot handle the enquiry without the fields marked with an asterisk.
Ticking the box below the form confirms that you have read this information. It is not consent to marketing and is not the legal basis on which we handle your enquiry.
5. Recipients of personal data
Data may be disclosed only where necessary to:
- authorised persons acting on behalf of STREFO,
- providers of hosting, IT infrastructure and website security services — currently Hostinger,
- Resend (Plus Five Five, Inc.), which provides the e-mail delivery service,
- Google Ireland Limited — only after analytics consent is given,
- legal, accounting or technical advisers where required for a particular matter,
- competent public authorities where disclosure is required by law.
We do not sell personal data or disclose it to other organisations for their own marketing.
6. Transfers outside the European Economic Area
Messages submitted through the form are delivered using Resend, whose principal processing operations are located in the United States. Resend states that it participates in the EU–U.S. Data Privacy Framework and, where required, uses the European Commission’s Standard Contractual Clauses. Details are provided in the Resend Data Processing Agreement.
If another technical provider processes data outside the EEA, we use that provider only where a transfer mechanism required under Chapter V of the GDPR is in place.
For Google Analytics, data may also be processed by Google LLC in the United States. Google states that it participates in the EU–U.S. Data Privacy Framework and uses appropriate transfer safeguards. Details are available in Google's information on data transfers for analytics services.
7. Retention periods
- Data relating to an enquiry is retained for as long as necessary to handle it and conduct correspondence, and then for the period required to document the matter and defend against claims, no longer than the applicable limitation periods.
- If an enquiry results in a contract, data is retained for the duration of the contract and then for the period required by law and the applicable limitation periods.
- Technical security data and logs are retained for the period necessary to operate and protect the website, in accordance with the hosting provider’s settings and retention periods.
- User-level and event data in Google Analytics 4 is retained according to the service configuration, for no longer than 14 months; aggregated reports may remain available for longer.
Data is deleted or anonymised when it is no longer required.
8. Your rights
Subject to the conditions set out in the GDPR, you have the right to:
- access your data and receive a copy,
- rectify inaccurate data,
- request erasure or restriction of processing,
- data portability, where applicable,
- object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR.
To exercise your rights, contact biuro@strefo.pl. We may request information necessary to verify the identity of the person making the request.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland. Contact details and complaint information are available at uodo.gov.pl.
9. Automated decision-making and profiling
We do not make decisions concerning contact-form users solely by automated means and we do not profile their data.
10. Cookies and analytics
After consent, the website uses Google Analytics 4 to measure page views, traffic sources and business-relevant events such as opening the contact form, clicking the telephone or e-mail link, downloading a resource and successfully submitting the form. We do not send form contents, names, e-mail addresses or telephone numbers to Google Analytics.
Analytics is disabled by default and starts only after “Accept analytics” is selected. Refusal does not restrict access to the website or form. The choice is stored locally in the browser. Consent can be withdrawn by choosing “Analytics settings” in the footer and rejecting analytics, or by deleting this website's stored data in the browser.
The hosting provider may separately process technical information necessary to transmit data, maintain security and deliver the website requested by the user.
11. Data security
We apply technical and organisational measures appropriate to the risk, including encrypted HTTPS connections, access restrictions, protection against automated form abuse and contractual data-protection arrangements with service providers.
12. Changes to this policy
This policy may be updated if the way the website operates, the service providers used or applicable law changes. The current version, together with its effective date, will always be available at this address.