Version effective from 15 July 2026.
This policy describes the rules for processing personal data and using cookies on www.chemaxpol.com, including its language versions.
1. Data controller
The controller of your personal data is CHEMAXPOL spółka z ograniczoną odpowiedzialnością spółka komandytowa, with its registered office in Ostaszewo at Ostaszewo 38, 87-148 Łysomice, entered in the register of entrepreneurs of the National Court Register maintained by the District Court in Toruń, VII Commercial Division of the National Court Register, under KRS number 0000612445, NIP 8792684075, REGON 364185977 (the “Controller” or “CHEMAXPOL”).
For matters concerning privacy and the exercise of your rights, you can contact the Controller:
- by email: biuro@chemaxpol.com,
- by telephone: +48 56 674 04 89,
- by post: Ostaszewo 38, 87-148 Łysomice, Poland.
2. What data we process and why
2.1. Contact forms, quotation requests and equipment enquiries
Depending on the form selected, we may process: your first and last name, company name, email address, telephone number, message content, the selected offer or device, and the technical identifier of the submission. The data is used to respond, prepare a quotation, take steps before entering into a contract, conduct correspondence, and establish, pursue or defend claims.
The legal basis is Article 6(1)(b) GDPR — taking steps at your request before entering into a contract or performing a contract — or Article 6(1)(f) GDPR — the Controller’s legitimate interest in handling correspondence, conducting business and protecting against claims.
2.2. Service requests
When you submit a service request, we may additionally process the device serial number and a description of the problem. We use the data for diagnosis, provision of service, fulfilment of a warranty or contract, and documentation of the case. The basis is Article 6(1)(b) GDPR and, where necessary, also Article 6(1)(c) and (f) GDPR.
2.3. Voluntary marketing
If you select a separate, optional consent box, we may use the email address or telephone number provided to send commercial information and conduct direct marketing. The basis for processing is Article 6(1)(a) GDPR, and communications are sent in accordance with Article 398 of the Electronic Communications Law.
Marketing consent is not a condition for submitting a form or receiving a reply. You may withdraw it at any time by contacting us. Withdrawal of consent does not affect the lawfulness of actions carried out before its withdrawal.
2.4. Website and form security
To protect the website, detect abuse and diagnose errors, we process technical data such as the IP address, date and time of the request, the address visited, a device or browser identifier, and the User-Agent. We also use a WordPress nonce, a honeypot field and submission rate limiting based on an HMAC hash of the IP address, stored temporarily for approximately 10 minutes. The basis is Article 6(1)(f) GDPR — the legitimate interest of protecting the website and its users.
Forms are protected by Google reCAPTCHA v3. When you start interacting with a form, Google may receive, among other things, the IP address, reCAPTCHA token, browser information and interaction signals. The reCAPTCHA score is used solely to reduce spam and abuse. If the mechanism blocks the form, you can contact us by email or telephone. The Google Privacy Policy and Google Terms of Service apply.
2.5. Analytics, maps and video content
After obtaining the appropriate consent, we may use Google Analytics 4 to measure traffic and improve the website. Ad personalisation and Google Signals are disabled in the website configuration, and IP addresses are anonymised. Google Maps and YouTube content in privacy-enhanced mode are loaded only after consent to the appropriate category or after you deliberately select the button that launches the relevant content.
The basis for processing data using optional cookies or similar technologies is Article 6(1)(a) GDPR and Article 399 of the Electronic Communications Law.
3. Is providing data mandatory?
Providing the fields marked as required in a form is voluntary but necessary to handle the enquiry. Without this data, we will not be able to reply or process the request. Marketing consent and consent to optional cookies are voluntary. Refusing them does not affect your ability to browse the website’s essential content or contact CHEMAXPOL, but it may disable analytics, a map or a video.
4. Where the data comes from
We receive data directly from you when you complete a form, contact us or select privacy settings, while technical data is obtained automatically from your browser, device and server infrastructure.
5. Recipients of data
Data may be disclosed only to the extent necessary to fulfil the purposes described:
- cyber_Folks S.A. — as the provider of hosting, server infrastructure and email-related services, within the scope of the agreement concluded,
- providers of email, technical support, backup and security services, acting under an agreement or authorisation,
- Google Ireland Limited and Google group companies — in connection with reCAPTCHA, Google Analytics, Google Maps and YouTube,
- legal advisers, accountants or auditors, where necessary,
- authorised public authorities where an obligation to disclose data arises from the law.
We do not sell personal data.
6. Transfers of data outside the European Economic Area
In connection with the use of Google services, data may also be processed outside the European Economic Area. In such a case, the transfer is based on an applicable adequacy decision or safeguards provided for in Chapter V GDPR, in particular standard contractual clauses. Current information about Google’s practices is available in the Google Privacy Policy.
7. How long we retain data
- Enquiries and correspondence: for the time necessary to handle the matter, and then until the applicable limitation period for claims expires or a dispute ends.
- Service and contracts: for the period of service provision, warranty and settlements, and then for the period required by law or necessary to protect claims.
- Marketing: until consent is withdrawn and, after withdrawal, only to a limited extent and for the period necessary to demonstrate the correctness of previous actions or defend claims.
- Security data and logs: for the period resulting from infrastructure configuration and rotation, no longer than necessary for diagnosis, security or incident investigation.
- Cookie choice record: for the period necessary to remember and demonstrate the user’s choice and handle potential claims. The cookie storing the choice itself expires after 182 days.
- Backups: until replaced by subsequent backups in accordance with the hosting retention cycle, unless a copy has been secured for an incident or claim.
8. Your rights
Under the conditions set out in the GDPR, you have the right to:
- access your data and receive a copy,
- rectify inaccurate data,
- erase data,
- restrict processing,
- data portability — where processing is automated and based on consent or a contract,
- object to processing based on a legitimate interest, including direct marketing,
- withdraw consent at any time.
To exercise your rights, write to biuro@chemaxpol.com. We may ask for information needed to confirm your identity. You also have the right to lodge a complaint with the President of the Personal Data Protection Office: uodo.gov.pl.
9. Automated decision-making
We do not use data to make decisions about you that produce legal effects or similarly significantly affect you. reCAPTCHA automatically assesses the likelihood of abuse and may technically block form submission, but it is not used for commercial profiling or for making decisions about entering into a contract.
10. Cookies and similar technologies
Cookies are small pieces of information stored in the browser. We use an opt-in model: optional categories remain disabled until you give consent. The exceptions are technologies necessary to transmit a communication, remember your settings and language choice, and securely perform a function you request — for example, submitting a form.
10.1. Categories
- Necessary:
pressidium_cookie_consent(consent choices, 182 days),pll_language(selected language, 1 year), and reCAPTCHA technologies activated when a form is used. - Analytics: Google Analytics, typically including
_gaand_ga_*, for up to 2 years — only after analytics consent. - Preferences: Google Maps — after consent or deliberate activation of the map.
- Targeting/media: YouTube in privacy-enhanced mode — after consent or deliberate activation of the video.
Third-party providers may change the names and lifetimes of their own cookies. The current table of identifiers used is available in the cookie settings panel.
10.2. Changing or withdrawing consent
You can reopen the cookie settings at any time using the button visible on the website and change your selection. Withdrawing consent prevents the relevant category from being activated in the future. The website’s own analytics cookies are automatically deleted to the extent technically possible. Cookies set directly by external domains can additionally be deleted in your browser settings.
11. Changes to this policy
The policy may be updated when the law, website functions or service providers change. The effective date of the current version is always stated at the beginning of the document.