Effective date: 16.08.2026
§ 1. General provisions
This Privacy Policy and Cookie Policy (hereinafter: the "Policy") sets out the rules for processing personal data and using cookies and similar technologies in connection with the use of the website at www.eva-foam.eu (hereinafter: the "Website").
The controller of personal data collected through the Website is: CREA-FORM Spółka z ograniczoną odpowiedzialnością, Włostowo 3, 63-000 Środa Wielkopolska, Poland, VAT ID (NIP): 7861727167 (hereinafter: the "Controller" or the "Company").
The Policy has been prepared in accordance with:
Use of the Website is voluntary. Providing personal data by a user of the Website (hereinafter: the "User") is voluntary; however, in certain cases (e.g. using the contact form) it may be necessary to achieve the purpose for which the data was provided.
§ 2. Contact with the Controller
For matters relating to the protection of personal data and the exercise of rights under the GDPR, you may contact the Controller:
The Controller has not appointed a Data Protection Officer – for matters relating to the protection of personal data, please contact the Controller directly using the details above.
§ 3. Purposes, legal bases and periods of processing personal data
Users' personal data may be processed for the following purposes:
| Purpose of processing | Legal basis | Retention period |
|---|---|---|
| Responding to an inquiry submitted via the contact form / e-mail address | Art. 6(1)(f) GDPR (Controller's legitimate interest in communicating with Users) | Until correspondence is concluded, no longer than 3 years from the last contact |
| Preparation of a commercial offer / quotation, including pre-contractual negotiations | Art. 6(1)(b) GDPR (actions taken at the request of the data subject prior to entering into a contract) | For the duration of negotiations, and if a contract is concluded – for the term of the contract and the limitation period for claims |
| Conclusion and performance of a contract (sale of the Company's products/services) | Art. 6(1)(b) GDPR | For the duration of contract performance and the limitation period for claims arising from the contract (generally 6 years) |
| Issuing and storing accounting documents (invoices, receipts) | Art. 6(1)(c) GDPR in conjunction with tax law provisions (including the Accounting Act and the Tax Ordinance) | 5 years counted from the end of the calendar year in which the tax payment deadline fell |
| Direct marketing of the Company's own products and services, including newsletters (provided the User has given separate consent) | Art. 6(1)(a) GDPR (consent) in conjunction with Art. 10 of the Act on the Provision of Electronic Services | Until consent is withdrawn |
| Pursuing and defending against claims | Art. 6(1)(f) GDPR (Controller's legitimate interest) | Until any claims become time-barred |
| Analysis of Website traffic and visit statistics (analytical cookies) | Art. 6(1)(a) GDPR (consent given via cookie settings) | Until consent is withdrawn / in accordance with the validity period of individual cookies specified in § 8 |
| Ensuring the proper functioning and security of the Website (necessary cookies) | Art. 6(1)(f) GDPR (Controller's legitimate interest) | For the duration of the session or the period specified in § 8 |
Note: the table above contains purposes typical of corporate websites. If the Website uses additional functionalities (e.g. an online store, event registration, a recruitment form, social media), the table should be supplemented with the relevant purposes, legal bases and retention periods before publication.
§ 4. Recipients of personal data
Users' personal data may be disclosed to entities providing services to the Controller that are necessary for conducting its business activity and operating the Website, in particular:
These entities process data solely on the basis of a data processing agreement concluded with the Controller and exclusively in accordance with its instructions.
The Controller does not sell Users' personal data to third parties.
§ 5. Transfer of data outside the European Economic Area
Some of the tool providers used by the Controller (e.g. Google, as part of the Google Analytics service) may process data in countries outside the European Economic Area (EEA), including the United States.
In such cases, the transfer of data takes place with an appropriate level of protection ensured, in particular based on:
Users may obtain a copy of the relevant safeguards by contacting the Controller.
§ 6. Rights of data subjects
Every person whose personal data is processed by the Controller has the right to:
The above rights may be exercised by contacting the Controller as indicated in § 2 of the Policy.
§ 7. Automated decision-making and profiling
The Controller does not make decisions concerning Users based solely on automated processing of data, including profiling, which would produce legal effects concerning them or similarly significantly affect them. Analytical data (e.g. from statistical tools) is used solely for the purpose of aggregate analysis of Website traffic.
§ 8. Cookie Policy
8.1. What are cookies
Cookies are small text files saved on a User's end device (computer, tablet, smartphone) while using the Website. Similar functions may be performed by other technologies, such as local storage, web beacons or tracking pixels (hereinafter jointly referred to as "cookies").
8.2. Legal basis for the use of cookies
Cookies necessary for the proper functioning of the Website are used on the basis of Art. 6(1)(f) GDPR (Controller's legitimate interest) and in accordance with Art. 173 of the Telecommunications Law, which does not require separate consent for files necessary for the provision of the service.
Other cookies (analytical, functional, marketing) are used only with the User's consent, expressed through the appropriate settings in the cookie banner displayed on first entry to the Website, in accordance with Art. 173 of the Telecommunications Law and Art. 6(1)(a) GDPR.
Consent may be withdrawn at any time by changing the cookie settings on the Website or in the web browser – without affecting the lawfulness of processing carried out before its withdrawal.
8.3. Types of cookies used
| Category | Purpose | Example retention period | Consent required |
|---|---|---|---|
| Necessary (technical) | Ensuring basic functionality of the Website, e.g. remembering settings, form handling, security, remembering the cookie decision | session / up to 12 months | No |
| Analytical | Collecting anonymised/statistical information on how the Website is used (e.g. Google Analytics) | up to 24 months | Yes |
| Functional | Remembering User preferences (e.g. language, region) to improve the quality of using the Website | up to 12 months | Yes |
| Marketing/advertising | Matching advertising content and measuring the effectiveness of marketing campaigns (if used by the Website) | up to 12 months | Yes |
Note: the table above is illustrative. Before publishing the Website, a cookie audit (site scan) should be carried out and the table should be supplemented with the specific names of cookies, their providers (e.g. Google LLC – Google Analytics, _ga, _gid), actual validity periods, and the consent banner (Consent Management Platform) should be adjusted so that non-essential cookies are loaded only after consent has been given.
8.4. Managing cookies
On first visiting the Website, the User is shown a banner allowing them to:
The User may change their cookie preferences at any time using the settings available in the Website footer / in the consent management panel.
Regardless of the settings on the Website, the User may independently manage cookies through their web browser settings, including:
Instructions for popular browsers are available on their manufacturers' websites (Google Chrome, Mozilla Firefox, Microsoft Edge, Safari, Opera).
Restricting the use of cookies may affect some functionalities available on the Website.
8.5. Third-party cookies
The Website may use cookies from external providers (e.g. Google as part of Google Analytics, providers of social media plugins – if used). These entities have their own privacy policies, which are worth reviewing:
Google – data usage policy: https://policies.google.com/privacy
§ 9. Security of personal data
The Controller applies appropriate technical and organisational measures to protect the personal data processed, in particular against unauthorised disclosure, loss or destruction, appropriate to the risks and categories of data covered by protection, in accordance with the requirements of Art. 32 GDPR.
§ 10. Links to external websites
The Website may contain links to other websites. The Controller is not responsible for the privacy practices in force on those websites – it is recommended to review the privacy policy of each website visited.
§ 11. Changes to the Policy
The Controller reserves the right to make changes to this Policy, in particular in connection with changes in law, technological developments or changes to the functionality of the Website.
The current version of the Policy is always available on the Website at www.eva-foam.eu.
The Controller will inform Users of any material changes to the Policy by publishing appropriate information on the Website.
