Last updated: 24 September 2026. This is an English translation; in case of discrepancies, the Polish version prevails.
We respect the privacy of everyone who contacts us or visits our website. Below we explain what personal data we process, why, for how long and what rights you have — in accordance with Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council).
1. Data controller
The controller of personal data is BKM Control Sp. z o.o., ul. Działkowa 26/28, 95-050 Konstantynów Łódzki, Poland, VAT ID PL7272788141 (“Controller”, “we”).
For any matters relating to personal data, you can contact us in writing at our registered address or by email at kontakt@bkm-control.pl. The Controller has not appointed a Data Protection Officer — please contact the Controller directly with any data protection matters.
2. What data we process
- Contact form and correspondence data — full name, company name, email address, phone number and the content of your message.
- Data of business partners and their representatives — full name, position and contact details and, for businesses, also the company name, tax ID, company registration number, registered address and bank account number.
- Technical data — IP address, date and time of the visit, browser and operating system type, recorded automatically in server logs.
3. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Replying to an enquiry sent via the form, email or phone | Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) (legitimate interest — handling correspondence) |
| Concluding and performing a contract, including service | Art. 6(1)(b) GDPR |
| Issuing and storing invoices and accounting records, handling complaints | Art. 6(1)(c) GDPR (legal obligation) |
| Establishing, pursuing or defending legal claims | Art. 6(1)(f) GDPR |
| Ensuring website security and preventing abuse (server logs, spam protection of the form) | Art. 6(1)(f) GDPR |
| Sending information about our services to people who asked for it or with whom we cooperate | Art. 6(1)(f) GDPR; for electronic communication — on the basis of consent |
4. Recipients of data
Data may be disclosed only to the extent necessary to:
- the website hosting provider (Hostinger) and email service providers,
- the accounting office, law firms and advisers serving the Controller,
- subcontractors and partners carrying out projects with us — to the extent needed to perform the contract,
- courier and postal companies,
- public authorities and entities authorised by law.
Entities processing data on our behalf do so under a data processing agreement and only on our instructions.
5. Transfers outside the EEA
As a rule, we do not transfer data outside the European Economic Area. If an IT service provider processes data outside the EEA, this takes place on the basis of a European Commission adequacy decision or standard contractual clauses.
6. How long we keep data
- enquiries and correspondence — for as long as needed to reply and continue the conversation, but no longer than 12 months after the last contact, unless a contract is concluded,
- contract-related data — for the term of the contract and then until the limitation period for claims expires,
- accounting and tax records — for the period required by law (as a rule, 5 years from the end of the calendar year in which the tax payment deadline expired),
- server logs — for as long as necessary to keep the website secure, in line with the hosting provider’s settings,
- data processed on the basis of consent — until consent is withdrawn; on the basis of legitimate interest — until an effective objection.
7. Your rights
You have the right to:
- access your data and receive a copy,
- rectify (correct) your data,
- erasure of your data,
- restriction of processing,
- data portability,
- object to processing based on legitimate interest (Art. 21 GDPR) — an objection can be sent to the Controller at the address given in section 1,
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
If you believe that the processing of your data infringes the law, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority in your country.
8. Voluntary provision of data
Providing data is voluntary but necessary for us to reply to an enquiry or to conclude and perform a contract. Providing data required by law (e.g. for an invoice) is mandatory.
9. Automated decision-making and profiling
We do not make automated decisions and do not profile the people whose data we process.
10. Social media and cookies
The website contains plain links to our profiles on LinkedIn, Facebook and YouTube — it does not embed their plugins. Once you visit those services, their operators’ privacy policies apply.
Information about cookies can be found in our Cookie policy.
11. Changes to this policy
This policy may be updated, for example due to changes in the law or in our services. The current version is always available on this page.