Last updated: 27 March 2026
§1. Data Controller
The controller of personal data collected through the concreate.pl website (hereinafter “Website”) is ConcreAte S.A., ul. Tenczyńska 18A, 32-067 Tenczynek, Poland (hereinafter “Controller”).
Contact: sprzedaz@concreate.pl
§2. Data We Collect
Contact Form
Name, email address, phone number (optional), subject and message content. Data provided voluntarily by the User to establish contact.
Automatically Collected Data
IP address, browser type and version, operating system, screen resolution, visit source, pages visited, time spent on page, browser language. Collected via cookies and server logs.
§3. Purposes and Legal Basis
Handling enquiries — responding to contact form messages and conducting commercial correspondence. Basis: Art. 6(1)(f) GDPR (legitimate interest).
Preparing and fulfilling offers — preparing quotations and cooperation terms. Basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR.
Contract performance — executing contracts, invoicing, logistics and complaints. Basis: Art. 6(1)(b) GDPR.
Legal obligations — maintaining tax and accounting documentation. Basis: Art. 6(1)(c) GDPR.
Website analytics — visit statistics, traffic sources, user behaviour. Basis: Art. 6(1)(a) GDPR (consent via cookie banner). Implemented via Google Analytics 4.
§4. Cookies
Necessary Cookies (no consent required)
PHP session, cookie_consent (remembering cookie preference), reCAPTCHA v3 (contact form protection — Google service).
Analytics Cookies (consent required)
Google Analytics 4 — collects anonymous traffic data. Loaded only after User consent via cookie banner. Data transferred to Google LLC (USA) under Standard Contractual Clauses.
§5. Data Retention
Contact form (cooperation established) — duration of contract plus 6 years.
Contact form (no cooperation) — 3 years from last contact.
Tax documentation — 5 years from end of tax year.
Analytics data — per browser settings and cookie expiry (up to 2 years).
§6. Data Recipients
Google LLC — reCAPTCHA v3 and Google Analytics 4. Transfer outside EEA under Standard Contractual Clauses.
Hosting provider (LH.pl sp. z o.o.) — data processing agreement, servers in Poland.
Entities related to the Controller — to the extent necessary for preparing offers and fulfilling contracts.
Personal data is not sold to third parties and is not used for automated decision-making or profiling.
§7. User Rights
Under GDPR you have the right to: access your data (Art. 15), rectify data (Art. 16), erase data (Art. 17), restrict processing (Art. 18), data portability (Art. 20), object to processing (Art. 21) and withdraw consent at any time.
To exercise your rights, contact: sprzedaz@concreate.pl
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.
§8. Changes to this Policy
The Controller reserves the right to amend this Privacy Policy. Changes are published on this page with the update date and take effect upon publication.