Privacy policy
Data controller
The controller of personal data processed in connection with the use of technocenter.pl (the “Website”) and with our business relationships is NEOFETCH Sp. z o.o., ul. Stefana Batorego 18/108, 02-591 Warszawa, Poland, entered in the register of entrepreneurs of the Polish National Court Register (KRS) under number 0001153738, NIP (tax ID) 7011245039, REGON 540850275, trading as Technocenter (“we”, “us” or the “Controller”).
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, “GDPR”) and Polish law.
The Website is intended for businesses. This policy mainly concerns people who contact us on behalf of companies (employees, contractors and representatives of customers) and sole traders.
How to contact us about personal data
We have not appointed a data protection officer. Send all questions about personal data, including requests to exercise the rights described below, to:
- email: [email protected],
- phone: +48 578 266 723 (Mon–Fri 9 am–5 pm Warsaw time),
- post: NEOFETCH Sp. z o.o., ul. Stefana Batorego 18/108, 02-591 Warszawa, Poland.
Where the data comes from
- From you: when you fill in a form on the Website, email us or call us.
- From the company you represent: when it names you as a contact person, for example in a quote request, an order or correspondence.
- From the Polish VAT taxpayer register (the “white list”) made available by the Ministry of Finance: when you enter a valid Polish NIP in a form, the Website retrieves the official company name and its VAT status. For sole traders, the company name may include the owner’s first and last name.
- From your browser: the technical data described under “Technical data” and in the Cookie policy.
What data we process
Website forms
Quick quote request (short form): business email address and a description of your needs or a file with the equipment list.
Quote request (full form): list of items (model or description, configuration or MPN, quantity, comment), company name, Polish NIP or EU VAT number, first and last name, business email address, phone number (optional), delivery city, expected deadline, preferred payment method, notes and an optional file.
Credit limit application: company name, Polish NIP or EU VAT number, contact person’s first and last name, business email address, phone number, estimated monthly purchase volume, requested limit, preferred payment term and notes.
Contact form: first and last name, email address, phone number (optional), company name (optional) and your message.
You can attach one file to a quote request: xlsx, xls, csv, pdf or docx, up to 10 MB. The file should contain the equipment list or requirements. Do not include personal data that is not needed to prepare a quote.
With every form we also receive: the address of the page it was sent from, the referring page address (referrer), campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid) if they were present in the page address, the page language, the date and time of sending and a request ID.
After you send a quote request or a credit limit application, we send an automatic confirmation with a copy of the submitted data to the email address you provided.
Correspondence and phone calls
When you email or call us, we process your email address or phone number, first and last name, company name, the content of the correspondence and any other data you choose to share (for example your job title in an email signature).
Customers and their representatives
If we enter into a contract with the company you represent, we process data of its contact persons and representatives: first and last name, business contact details, job title and the data needed for deliveries (delivery address, the person receiving the shipment, phone number) and invoicing.
Technical data
While you use the Website, the server records request data in its logs: IP address, date and time, requested page, response code, browser and operating system information (user agent) and the referring page. The application may also log errors and rejected abuse attempts, for example the IP address of a submission blocked as spam.
We also use the IP address to protect the forms by limiting the number of submissions sent from one address within a short time. The IP address is not added to the submission we receive.
Data stored in your browser
The Website stores your quote list, your catalog view and, when the address of a page with a form contains campaign parameters, information about the source of your visit in your browser’s storage. The Website sets no cookies. Details are in the Cookie policy.
Visit statistics
The Umami statistics tool records page views, events (for example a click on the phone number or a form submission, without contact details or form content) and a recording of how the visit goes: changes on the page, cursor movements, clicks and scrolling. Umami uses the IP address and browser data to tell visits apart and to derive an approximate location. The scope of data is described in the Cookie policy.
Purposes and legal bases
- Preparing a quote and replying to a quote request. Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) when you request a quote in your own name as a sole trader. Article 6(1)(f) GDPR (legitimate interest: handling requests and preparing quotes for businesses) when you act on behalf of a company.
- Reviewing a credit limit application. Same legal bases: Article 6(1)(b) or (f) GDPR.
- Entering into and performing a sales contract, including delivery and invoicing. Article 6(1)(b) GDPR when you are the party to the contract. Article 6(1)(f) GDPR for data of people who represent the customer or are named by it as contacts or recipients of deliveries.
- Sending an automatic confirmation with a copy of the submitted data. Article 6(1)(b) or (f) GDPR, as part of handling your request.
- Replying to messages and correspondence (contact form, email, phone). Article 6(1)(f) GDPR (legitimate interest: answering enquiries addressed to us).
- Maintaining business relationships with customers and their representatives. Article 6(1)(f) GDPR (legitimate interest: contact about current and future cooperation).
- Filling in the company name from the NIP using the VAT taxpayer register. Article 6(1)(f) GDPR (legitimate interest: correct company details in requests and quotes).
- Analysing where requests come from, based on the page address, referrer and campaign parameters sent with a form. Article 6(1)(f) GDPR (legitimate interest: knowing which pages and campaigns lead to requests).
- Website security and protection against spam and abuse (server logs, submission limits, a hidden honeypot field, file checks, anti-spam verification). Article 6(1)(f) GDPR (legitimate interest: keeping the Website secure and available).
- Visit statistics and visit recordings (Umami). Article 6(1)(f) GDPR (legitimate interest: analysing traffic, finding errors and improving the Website).
- Complying with legal obligations, in particular issuing and keeping invoices and accounting and tax records. Article 6(1)(c) GDPR in conjunction with Polish accounting and tax law.
- Establishing, exercising and defending legal claims. Article 6(1)(f) GDPR (legitimate interest: protecting our rights).
- Handling data protection requests and accountability. Article 6(1)(c) GDPR in conjunction with the GDPR.
Is providing data mandatory
Providing data is voluntary. Fields marked as required in the forms are, however, needed to handle your request: without an email address we cannot reply, and without company details we cannot prepare a quote or review a credit limit application. Providing the data needed to conclude a contract and issue an invoice is a condition of concluding the contract.
Recipients
Data may be shared only to the extent needed for the purposes described above with:
- the hosting and server infrastructure provider that runs the Website (including server logs);
- the email delivery provider for the forms (Resend), which delivers the submission with any attached file to our mailbox and sends the automatic confirmation to the email address you provided;
- the email service provider that hosts the [email protected] mailbox;
- the operator of the stats.scrape.pl statistics server that runs the Umami tool (visit statistics and visit recordings);
- Cloudflare, Inc., when the Cloudflare Turnstile anti-spam check is enabled: Cloudflare receives technical data about your browser and device, and our server sends it the verification token and your IP address;
- the Polish Ministry of Finance as the operator of the VAT taxpayer register API (wl-api.mf.gov.pl): our server sends only the NIP entered in the form and the current date, without your IP address or any other form data;
- carriers and courier companies, when ordered equipment is delivered;
- providers of accounting, legal and IT services to us, to the extent needed to perform those services;
- public authorities, where the law requires us to disclose data.
Service providers process data on our behalf under data processing agreements and, to the extent set out in their terms, as separate controllers. Only persons authorised by the Controller have access to the data.
Transfers outside the European Economic Area
Some of our providers, in particular Cloudflare and Resend, are based in the United States or may process data outside the European Economic Area (EEA). In that case, depending on the provider, data is transferred:
- on the basis of a European Commission adequacy decision, including the EU-US Data Privacy Framework where the provider is certified, or
- on the basis of standard contractual clauses approved by the European Commission.
The same rules apply to any other provider that processes data outside the EEA. To learn which safeguards apply and how to obtain a copy, write to [email protected].
How long we keep data
- Quote requests, credit limit applications and messages that did not lead to a contract: for as long as needed to handle them and the related correspondence, and then until any claims arising from them become time-barred. Under the Polish Civil Code, claims related to business activity are generally time-barred after 3 years, with the period ending on the last day of the calendar year.
- Contract data: for the term of the contract and then until claims become time-barred.
- Accounting and tax records, including invoices: for the period required by law, generally 5 years, counted under the Polish Accounting Act (from the beginning of the year following the financial year they relate to) or under the Polish Tax Ordinance (from the end of the calendar year in which the tax payment deadline expired).
- Data processed on the basis of legitimate interest: until you successfully object or the interest ceases.
- Visit statistics and visit recordings: for the period set in the Umami tool, no longer than needed to analyse traffic and improve the Website.
- Server logs: for the period set by the hosting provider, no longer than needed to keep the Website secure.
- IP addresses used for submission limits: in server memory only, never written to a database or disk. An address is taken into account for 10 minutes after a submission and then removed automatically.
- NIP lookup results from the VAT taxpayer register: in server memory only. A result is reused for 24 hours to reduce the number of requests to the Ministry of Finance API.
- Data stored in your browser (quote list, catalog view): until you delete it, as described in the Cookie policy.
Your rights
You have the right to:
- access your data and receive a copy (Article 15 GDPR);
- rectification of inaccurate or incomplete data (Article 16 GDPR);
- erasure (Article 17 GDPR);
- restriction of processing (Article 18 GDPR);
- data portability for data you provided to us, where we process it on the basis of consent or a contract by automated means (Article 20 GDPR);
- object to processing based on legitimate interest, on grounds relating to your particular situation (Article 21 GDPR);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, or the supervisory authority in the EU member state of your habitual residence, place of work or place of the alleged infringement.
Send requests to [email protected] or by post to our registered office. We reply without undue delay and within one month of receiving the request. Where justified, this period may be extended by two further months under Article 12(3) GDPR, and we will let you know. We may ask for information needed to confirm your identity before handling a request.
Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Credit limit applications are verified and reviewed individually by people acting on behalf of the Controller. The Website does not grant limits automatically.
Visit statistics and visit recordings are used only to analyse traffic and improve the Website. They are not used for profiling or for decisions about you.
Data security
We apply technical and organisational measures appropriate to the risk, in particular:
- encrypted HTTPS connections, with browsers instructed to always use a secure connection (HSTS);
- security headers that, among other things, prevent the Website from being embedded in frames on other sites and block Website pages from accessing the device camera, microphone and location;
- server-side validation of form data and checks of uploaded files (format, size and whether the content matches the format);
- protection of the forms against abuse: submission limits, a hidden honeypot field and, when enabled, anti-spam verification;
- access to data limited to authorised persons.
Cookies and browser storage
The Website sets no cookies, and visit statistics work without them. Information the Website needs to work, such as your quote list, is kept in your browser’s storage. The full list and retention periods are described in the Cookie policy.
Changes to this policy
We update this policy when the law, our services or the tools used on the Website change. The current version is always available on this page with the date of the last update. We will announce material changes affecting data we already process on the Website.