Last updated: 16 August 2026

1. Data Controller

The controller of your personal data is Sevita Sp. z o.o., with its registered office at ul. Rudzka 103, 47-400 Racibórz, Poland, NIP (Tax ID): 6392040901, KRS (National Court Register No.): 0001258539, REGON (Statistical No.): 545404729 (hereinafter: the “Controller”).

For matters related to personal data protection, you can contact us at: biuro@sevita.pl or in writing at our registered office address.

We have not appointed a Data Protection Officer, as we are not required to do so under GDPR. For any data protection matters, you can contact the Controller directly using the details provided above.

2. Purposes and Legal Bases for Processing

We process your personal data for the following purposes:

Handling inquiries and B2B contact – we process data (e.g. name, email, phone number, company name) submitted via the contact form on our website in order to respond to your inquiry or present a commercial offer.
Legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest in building customer relationships and handling correspondence) or Article 6(1)(b) GDPR (steps taken to conclude a contract).

Performance of contracts and handling of wholesale orders – for the purpose of processing orders, issuing accounting documents (invoices), and organizing logistics and delivery.
Legal basis: Article 6(1)(b) and (c) GDPR (fulfilment of a legal obligation arising from tax regulations).

Website statistics and traffic analysis – to optimize the operation of our website, based on the cookies described in Section 7.
Legal basis: Article 6(1)(a) GDPR (consent) for analytical and functional cookies — see Section 7.

Displaying our office location map (Google Maps) – to help you find our office, the map is loaded only after you consent to functional cookies.
Legal basis: Article 6(1)(a) GDPR (consent).

Protecting the contact form against spam and bots – to verify that the form is being filled in by a human, we use the Cloudflare Turnstile service.
Legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest in protecting the website against abuse).

3. Data Recipients and Transfers Outside the EEA

Your data may be shared with entities processing it on our behalf, with whom we have concluded appropriate data processing agreements, including:

  • IT and website hosting providers,
  • Email software providers,
  • Our accounting office and logistics/transport service providers (in connection with B2B order fulfilment).

Our website also uses the services of the following external providers, which may involve the transfer of data (including IP addresses) outside the European Economic Area (EEA) to the United States:

  • Google LLC — for displaying Google Maps and Google Fonts. Data transfer is based on standard contractual clauses approved by the European Commission and/or Google’s participation in the EU-U.S. Data Privacy Framework.
  • CookieYes Limited (United Kingdom) — provider of the cookie consent management tool.
  • Cloudflare, Inc. — provider of the Cloudflare Turnstile service, used to protect the contact form against spam and automated submissions (bots). The service analyses selected, anonymized technical browser signals (e.g. IP address, device characteristics) solely to verify that the form is being completed by a human. Data transfer is based on standard contractual clauses approved by the European Commission.

The above Google services (map, fonts) are loaded on the website only after consent is given via the cookie banner — see Section 7. The Cloudflare Turnstile mechanism, on the other hand, is always loaded alongside the contact form, regardless of cookie consent, as it constitutes a necessary element of protecting the form against abuse (legal basis: Article 6(1)(f) GDPR — the Controller’s legitimate interest in protecting the website against spam). Apart from this mechanism, data from the contact form and order fulfilment is not transferred outside the EEA.

4. Data Retention Period

Your personal data will be retained for the period necessary to fulfil the purpose for which it was collected:

  • Contact form inquiries: until the matter has been resolved or an objection has been raised.
  • Data related to the fulfilment of B2B orders/contracts: for the period required by tax and accounting regulations (generally 5 years from the end of the calendar year in which the tax obligation arose).
  • Data processed on the basis of consent (cookies): until consent is withdrawn or for the validity period of the given cookie — detailed retention periods for individual cookies can be found in the consent management panel available on the website (the “Consent Preferences” button).

5. Your Rights (GDPR)

In connection with the processing of your personal data, you have the right to:

  • Access your data and receive a copy of it,
  • Rectify (correct) your data,
  • Erase your data (“the right to be forgotten”),
  • Restrict the processing of your data,
  • Data portability — to the extent that data is processed on the basis of consent or a contract, in an automated manner,
  • Object to processing based on legitimate interest,
  • Withdraw consent at any time — to the extent that processing is based on consent (e.g. cookies), without affecting the lawfulness of processing carried out before its withdrawal. You can withdraw or change your cookie consent at any time via the “Consent Preferences” panel available on the website,
  • Lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

6. Voluntary Provision of Data

Providing personal data via the contact form is voluntary, but necessary to respond to your inquiry. Providing data for the purpose of performing a contract/order is necessary for its conclusion and execution.

7. Cookies

The website uses cookies (small text files saved on your device) in the following categories:

  • Necessary — required for the website to function properly (e.g. remembering the selected language, remembering your cookie consent, anti-spam verification of the contact form performed by Cloudflare Turnstile). These do not require consent.
  • Functional — enable additional website features, e.g. displaying the Google Maps location of our office. These require your consent.
  • Analytics — allow us to analyse website traffic in order to optimize it. These require your consent.

Cookie consent is managed via the CookieYes tool. A full, up-to-date list of the cookies used, together with their name, provider, purpose, and retention period, can be found in the “Consent Preferences” panel, available in the cookie banner and in the website footer.

Managing consent: you can change, withdraw, or re-grant consent for individual cookie categories at any time via the “Consent Preferences” panel on the website. You can also restrict or block the saving of cookies in your browser settings, which may affect the functioning of certain website features (e.g. displaying the map).

8. Changes to this Privacy Policy

This Privacy Policy may be updated periodically, in particular in connection with changes in the law or website functionality. The current version is always available at this address, along with the date of the last update.