Privacy policy

This policy explains how SteelProfil sp. z o.o. processes the personal data of people who use ecoprofil.pl to browse building materials, contact us, obtain a quotation or negotiate a price. The controller is SteelProfil sp. z o.o., Dzierżenin 34 E, 06-114 Dzierżenin. We use form submissions to manage enquiries and prepare replies or quotations in our CRM system. Providing a telephone number in the form is optional. We enable Google Analytics and embedded maps after you choose to allow them. Form protection by reCAPTCHA runs when you submit a form to prevent spam. This policy covers processing purposes, recipients, retention, your rights and how to change your privacy settings.

Version dated 25 October 2026. Applies to ecoprofil.pl.

1. Controller and contact details

SteelProfil sp. z o.o., Dzierżenin 34 E, 06-114 Dzierżenin, Poland. Tax identification number (NIP) 5311664644, National Court Register number (KRS) 0000343080. For matters concerning personal data, email [email protected], write to the company’s postal address or call +48 500 409 109. Our branch details are on the Contact page.

2. Data we receive

The contact form collects your name or company name, email address, an optional telephone number and your message. The price negotiation form may also include the product, quantity, delivery location and delivery date. We record the address of the page from which you submit your enquiry to identify the product and website correctly. Please send sensitive data or identity documents only if they are needed to handle your enquiry.

When you use the cart, place an order or use an account, we process the data you enter in the relevant form, the products ordered and the information needed for fulfilment, billing or contact. Pressidium records your cookie categories, an identifier, the time of your choice, page address, browser information and a partially masked IP address to document your privacy choices under Article 6(1)(c) GDPR in connection with the obligation to demonstrate consent. The server and security systems also process your IP address, request time, visited page address and information about your browser and device.

3. Purposes and legal bases

  • Quotations and steps to enter into or perform your contract Article 6(1)(b) GDPR, where the enquiry concerns a contract to which you are or may become a party.
  • Correspondence, contact with business representatives and management of business relationships Article 6(1)(f) GDPR. Our legitimate interest is to respond to enquiries and communicate effectively in business matters.
  • Billing and statutory obligations arising from a contract Article 6(1)(c) GDPR, to the extent required by applicable law, including tax and accounting rules.
  • Website security, prevention of abuse and defence of legal claims Article 6(1)(f) GDPR. Our legitimate interest is to protect the website, its users and the company’s rights.
  • Optional analytics and Google Maps Your consent under Article 6(1)(a) GDPR, and consent to store or access information on your device where required. You can withdraw consent as described below.

Providing data is voluntary. We need the fields marked with an asterisk to handle an enquiry through the form. You can also contact us by telephone or email. Submitting an enquiry does not subscribe you to a newsletter or constitute consent to marketing. Information marked as required at checkout or registration is necessary to fulfil the order or operate the account. Without it, that action cannot be completed. Information required by billing legislation must be provided to the extent prescribed by law.

4. CRM, technical services and recipients

Form enquiries are sent to the Bitrix CRM system used by SteelProfil. Authorised staff handling the case and providers of technical support, hosting, email or system maintenance have access as necessary and on an appropriate legal basis. When fulfilling an order, we may share information with providers of delivery, billing or legal services to the extent necessary for their task. Competent authorities may receive data where required by law.

The website uses Cloudflare for security and content delivery. Google Analytics runs with analytics consent and Google Maps with map consent. Google reCAPTCHA protects form submissions against abuse on the basis of the controller’s legitimate interest. We load the script from recaptcha.net only when you submit the form. It secures the requested form service and is not used for advertising. These services may process IP addresses and technical device data, among other information. Google states that for reCAPTCHA it processes customer data as a processor under the Google Cloud terms. Further information is available in Google’s information on reCAPTCHA and the Google Cloud processing terms. For maps and Google’s consumer services, see Google’s privacy policy.

5. Processing outside the European Economic Area

Google and Cloudflare use international infrastructure. Using their services may involve processing outside the EEA, including in the United States. The providers explain the transfer mechanisms they use, including adequacy decisions and standard contractual clauses, in these documents Google’s data transfer framework and Cloudflare’s data processing addendum and transfers. Contact us for information about the safeguards applicable to a particular processing operation and how to obtain a copy.

6. How long we keep data

Retention depends on the purpose and progress of the matter. For an enquiry, we consider the time required to reply, complete follow-up discussions and close the matter. If a contract results, we consider the time needed for performance, complaints, mandatory document retention and applicable limitation periods. We keep data for as long as the current purpose and legal basis require. Legal obligations or the need to establish, exercise or defend legal claims may limit erasure.

For security logs, the criterion is the time needed to detect and investigate incidents and protect the site. For consent-based processing, we take withdrawal and the end of the purpose into account. Withdrawal stops the site from activating the service again. Data previously transferred are not all automatically erased, but you may request erasure. For storage periods on your device, see our cookie policy.

We keep cookie choice records for as long as needed to demonstrate consent and changes to it and to deal with related requests or claims.

7. Your rights

Under the conditions set out in the GDPR, you may request access to your data, a copy, rectification, erasure or restriction of processing. Where processing is automated and is based on consent or a contract, you may have a right to data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Use the cookie settings link in the footer to change analytics and map preferences. In Pressidium Cookie Consent, analytics is covered by performance and analytics cookies and embedded maps by functionality and preference cookies. You can also contact us by telephone or email. Address requests about your data to SteelProfil. You may lodge a complaint with the President of the Polish Personal Data Protection Office at uodo.gov.pl.

8. Automated protection of forms

reCAPTCHA uses technical signals and interaction patterns to assess the risk of abuse. The result may cause a submission to be rejected. It neither assesses creditworthiness nor decides whether to enter into a contract or offer a price. If it blocks your message, call +48 500 409 109 or email [email protected] and a member of staff will handle your enquiry.

9. Cookies and changes to this policy

Details of the technologies, choices and storage periods are set out in our cookie policy. We update this policy when website features or processing practices change. The current version and its date appear on this page.