Privacy Policy

How we process your personal data in accordance with GDPR

Last updated: 2 April 2026

1. Data Controller

The controller of your personal data is:

ULAMEX Zbigniew Zientek
Zawada 144
97-200 Tomaszów Mazowiecki, Poland
Email: [email protected]
Phone: +48 504 424 761

2. What Personal Data We Collect

We collect personal data only when you voluntarily submit it through the contact or inquiry forms on our website. This may include:

  • Full name
  • Email address
  • Phone number
  • Company name
  • Country
  • Product category of interest
  • Message content (your inquiry or question)

We do not operate user accounts, shopping carts, checkout processes, or newsletter subscriptions on this website. Data collection is limited to inquiry and contact form submissions.

3. Purpose of Data Processing

Your personal data is processed for the following purposes:

  • Responding to inquiries – to answer your questions and provide requested information about our products and services
  • Providing quotations – to prepare and send price quotations for steel, aluminum, and other products
  • Business communication – to maintain correspondence related to potential or existing business relationships
  • Website analytics – to understand how visitors use our website and improve its performance (via anonymized, consent-based analytics)
  • Website security – to protect our website against spam and abuse (via reCAPTCHA)

4. Legal Basis for Processing

We process your personal data on the following legal grounds under the General Data Protection Regulation (EU) 2016/679:

  • Article 6(1)(b) – processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract (e.g., responding to your inquiry, preparing a quotation)
  • Article 6(1)(f) – processing is necessary for our legitimate interests, namely maintaining business correspondence, ensuring website security, and improving our services
  • Article 6(1)(a) – processing based on your consent (e.g., consent to analytics cookies via our cookie consent banner)

5. Cookies and Tracking Technologies

Our website uses the following types of cookies:

Strictly Necessary / Functional Cookies

  • LiteSpeed Cache – technical cookies for website performance and caching. These do not collect personal data and are essential for the website to function properly.
  • Cookie consent preferences – stores your cookie consent choices so you are not asked repeatedly.

Analytics Cookies (consent-based)

  • Google Analytics 4 (GA4) – collects anonymized data about website usage, such as pages visited, session duration, and traffic sources. These cookies are only activated after you provide consent through our cookie banner. We use Google Consent Mode v2 to ensure that no analytics data is collected without your explicit consent.

Security Cookies

  • Google reCAPTCHA v3 – used on pages with contact and inquiry forms to protect against automated spam submissions. reCAPTCHA may set cookies and collect data about your interaction with the page. This service is provided by Google LLC. For more information, see Google’s Privacy Policy.

6. Google Analytics

We use Google Analytics 4 (GA4) to analyze website traffic and improve our services. GA4 is configured with the following privacy safeguards:

  • Google Consent Mode v2 – all analytics tracking is denied by default until you consent via our cookie banner
  • IP anonymization – GA4 does not store full IP addresses
  • No cross-site tracking – we do not use Google Signals or advertising features
  • Data retention – analytics data is retained for 14 months

You can opt out of Google Analytics at any time by declining analytics cookies in our cookie banner, or by installing the Google Analytics Opt-out Browser Add-on.

7. Data Recipients

Your personal data may be shared with the following categories of recipients, solely to the extent necessary for the purposes described above:

  • Hosting provider – our website is hosted on servers within the European Economic Area
  • Google LLC – as the provider of Google Analytics and reCAPTCHA (data processed under Standard Contractual Clauses)
  • Email service provider – for handling email correspondence related to your inquiries
  • Accounting and legal advisors – if required for fulfilling legal obligations

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

8. International Data Transfers

Some of our data processors (notably Google LLC) are based in the United States. Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46 of the GDPR.

9. Data Retention

We retain your personal data for the following periods:

  • Inquiry and contact form data – for the duration of the business relationship and any subsequent legal retention periods required by applicable law
  • Analytics data – 14 months (Google Analytics retention setting)
  • Cookie consent records – 12 months

After the applicable retention period, your data will be securely deleted or anonymized.

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15) – to obtain information about the data we hold about you
  • Right to rectification (Art. 16) – to correct inaccurate or incomplete data
  • Right to erasure (Art. 17) – to request deletion of your data (“right to be forgotten”)
  • Right to restriction (Art. 18) – to limit how we process your data
  • Right to data portability (Art. 20) – to receive your data in a structured, machine-readable format
  • Right to object (Art. 21) – to object to processing based on legitimate interests
  • Right to withdraw consent (Art. 7) – to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

11. How to Exercise Your Rights

To exercise any of the above rights, please contact us:

  • Email: [email protected]
  • Post: ULAMEX Zbigniew Zientek, Zawada 144, 97-200 Tomaszów Mazowiecki, Poland

We will respond to your request within 30 days of receipt.

12. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for the Data Controller is:

Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
https://uodo.gov.pl

You may also lodge a complaint with the supervisory authority in your country of residence.

13. Changes to This Policy

We reserve the right to update this Privacy Policy to reflect changes in our data processing practices or legal requirements. Any changes will be published on this page with an updated “Last updated” date. We encourage you to review this page periodically.