We process your personal data and are committed to protecting your rights and privacy.

Therefore, in fulfilment of the information obligation arising from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), ISTRAIL Sp. z o.o., with its registered office in Golub-Dobrzyń, PTTK 56, 87-100 Golub-Dobrzyń, as the Data Controller, provides the following information regarding the implemented data processing activities:

2. How do we obtain data?

Your personal data may be obtained:

1. Directly from you – through:

a) contact forms on the website,
b) advertising forms used in campaigns on platforms such as Facebook/Meta, Google, LinkedIn or other marketing tools,
c) e-mail messages, telephone contact, or visits to our office,
d) quotation requests, orders, contracts, or exchange of correspondence,

2. From other companies within the ISTRAIL Group:

a) ISTRAIL AS (Norway)
b) ISTRAIL AB (Sweden)

– to the extent necessary for the performance of services, customer support, or forwarding an inquiry to the appropriate branch.

3. Purposes and legal bases of data processing

Your personal data will be processed for at least one of the following purposes:

3.1. Handling inquiries and commercial contact

Responding to an inquiry, presenting an offer, telephone or e-mail communication.
Legal basis: Article 6(1)(f) GDPR – legitimate interest of the controller (for contact purposes, statistical analysis, pursuing or defending claims).

3.2. Execution of concluded contracts or actions undertaken prior to concluding a contract

Where you act as a contractor or customer – including placing and fulfilling orders and their settlement, responding to questions about the offer, determining terms of cooperation, sales/purchase support, or handling complaints.
Legal basis: Article 6(1)(b) GDPR.

3.3. Direct marketing and advertising activities

a) telephone and e-mail contact regarding the offer,
b) sending commercial materials,
c) conducting advertising campaigns,
d) handling advertising forms (lead ads).

Legal basis: Article 6(1)(a) GDPR – consent (if granted), Article 6(1)(f) GDPR – legitimate interest of the controller (B2B relationships).

3.4. Analytics, statistics, CRM activities

a) evaluation of campaign performance,
b) segmentation of inquiries,
c) analysis of lead sources,
d) internal reporting.
Legal basis: Article 6(1)(f) GDPR – legitimate interest of the controller.

3.5. Compliance with legal obligations

For example, for tax settlements or obligations arising from decisions or rulings issued by competent authorities or courts.
Legal basis: Article 6(1)(c) GDPR.

3.6. Purposes related to your consent

(where applicable, e.g., storing data in cookies).
Legal basis: Article 6(1)(a) GDPR, and for special categories of data – Article 9(2)(a) GDPR.

4. Processing data in IT systems and profiling

We process your data in paper form – e.g., information contained in forms you have submitted, contracts we have concluded, and documents that support contract settlements.

We also use IT systems for processing (CRM, e-mail, advertising tools).

We do not make automated decisions that produce legal effects.

We may perform basic data analysis (segmentation, statistics), which:
a) does not result in decisions made about you,
b) serves solely to improve service quality and communication.

5. Transfer of data within the ISTRAIL Group (Poland – Norway – Sweden)

Due to the operations of the ISTRAIL Group, personal data may be transferred between:

a) ISTRAIL Sp. Z o.o. (Poland),
b) ISTRAIL AS (Norway – EEA country),
c) ISTRAIL AB (Sweden – EU).

Data are transferred solely to:

a) handle inquiries,
b) prepare offers,
c) provide customer service,
d) carry out production,
e) forward leads to the proper branch serving a particular market.

Transfer of data to Norway is not considered a transfer to a third country, as Norway is part of the EEA and applies GDPR.

6. Data recipients

Your data may be transferred only to:

a) entities within the ISTRAIL Group,
b) companies operating IT systems, CRM, and e-mail services,
c) advertising campaign operators (Meta, Google, LinkedIn) – only if their forms were used,
d) accounting, advisory, and legal service providers,
e) courier and logistics companies,
f) entities authorized under applicable law.

Each recipient processes data exclusively under a data processing agreement or relevant authorization.

7. Data retention period

We process data for the following periods:

1. Quotation requests / contact via advertising forms – up to 12 months from the last contact or until an objection is submitted.
2. Data processed on the basis of consent – until consent is withdrawn.
3. Client and contractor data – for the entire duration of cooperation and for the period required by tax regulations and limitation periods for claims.
4. Data processed for direct marketing – until an objection is submitted.

8. Rights of data subjects

You have the following rights:

a) the  right to access your data and obtain a copy,
b) the right to rectify (correct) your data if they are outdated or incomplete,
c) the right to erase your data where processing is not required for legal obligations or the establishment or defence of claims (“right to be forgotten”),
d) the right to restrict processing in specific situations,
e) the right to data portability (where technically feasible) – to another controller, if the processing is based on your consent,
f) the right to object to processing in specific situations, e.g., when processing is based on the Company’s legitimate interest for direct marketing,
g) the right to withdraw consent at any time, if consent was required to begin processing,
h) the right to lodge a complaint regarding the processing of your data with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

Withdrawal of consent does not affect the lawfulness of processing performed before the withdrawal.

9. Voluntary provision of data

Providing personal data is voluntary, but necessary to:

a) respond to an inquiry,
b) prepare an offer,
c) maintain commercial contact,
d) perform a contract.

Failure to provide data may prevent us from carrying out these processes.

10. Contact regarding personal data

To exercise your rights or obtain additional information, you may contact us by e-mail at: rodo@istrail.pl