Privacy Policy

§ 1

Personal data controller

The controller of your personal data is PPHU „SPIN" Konrad Kiersztyn, with its registered office at ul. Okólna 8/10, 95-020 Janówka, Andrespol municipality, Poland, Tax ID (NIP): 7262375638.

In all matters relating to the processing of personal data you can contact us:

• e-mail: [email protected]
• phone: +48 42 212 22 15
• correspondence address: Okólna 8/10, 95-020 Janówka, Andrespol municipality, Poland

§ 2

Purpose and legal basis of data processing

We process your personal data only for specific purposes and on an appropriate legal basis:

• Handling enquiries and orders – we process data in order to reply to messages sent via the contact form or e-mail and to fulfil orders (Art. 6(1)(b) or (f) GDPR).
• Provision of services – data necessary for the production and delivery of medals, trophies, pins and keychains (Art. 6(1)(b) GDPR).
• Marketing of our own products – informing you about the Spinfactory offer, only with your consent or on the basis of legitimate interest (Art. 6(1)(a) or (f) GDPR).
• Legal obligations – storing accounting documents and invoices in accordance with tax regulations (Art. 6(1)(c) GDPR).
• Measuring ad effectiveness and statistics – checking which ads and pages lead to enquiries (Google Analytics, Google Ads), only after you consent in the cookie banner (Art. 6(1)(a) GDPR).
• Keeping a database of enquiries – storing enquiries together with information about the campaign or page through which you reached the website, assessing their quality and protecting against spam and abuse (legitimate interest – Art. 6(1)(f) GDPR).
• Newsletter – with your consent, see § 8a.

Enquiries are automatically checked for spam, but a person always decides on the reply and the offer. We do not make decisions producing legal effects concerning you based solely on automated processing (Art. 22 GDPR).

§ 3

Scope of processed data

Depending on the purpose of processing, we may collect the following data:

• Full name or company name
• E-mail address
• Phone number
• Delivery address
• IP address and data on activity on the website (cookies, server logs)
• Invoicing data (tax ID, company address) – only for the purpose of fulfilling an order
• Content of the enquiry, selected products and quantity range
• Source of the visit – advertising campaign (UTM parameters), Google ad click ID (gclid), landing page and referring page (only after you consent to cookies)
• IP address and browser type at the time the form is sent (security, spam protection)

We do not process special categories of data (sensitive data) within the meaning of Art. 9 GDPR.

§ 4

Recipients of personal data

Your data may be shared only with entities that help us run the website and fulfil orders:

• IT, hosting and e-mail service providers – operating the website, the enquiry database and mailboxes
• Cloudflare, Inc. – content delivery network and protection of the website against attacks (processes, among others, IP addresses)
• Google Ireland Limited / Google LLC – Google Analytics and Google Ads (statistics, measuring ad effectiveness, remarketing, audience lists)
• Courier and transport companies – to the extent necessary to deliver orders
• Accounting service providers – to the extent necessary for invoicing and settlements

Google and Cloudflare may also process data in the USA. Transfers are based on the European Commission decision on the EU-US Data Privacy Framework or on standard contractual clauses.

§ 5

Data retention period

• Enquiries that did not result in an order – 24 months from submission; after that we delete the personal data and keep only anonymous statistics
• Data related to order fulfilment – for the duration of the contract and 3 years after its completion (civil claims)
• Accounting documents – 5 years from the end of the tax year, in accordance with tax regulations
• Newsletter – until consent is withdrawn; sign-ups not confirmed within 30 days are deleted
• Cookies – as described in § 7; statistical data in Google Analytics – 14 months

§ 6

Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Right of access – you can obtain information about what data we process and for what purpose
• Right to rectification – you can request the correction of inaccurate data or the completion of incomplete data
• Right to erasure – you can request the deletion of data when it is no longer needed for the purpose for which it was collected
• Right to restriction of processing – you can request that data processing be suspended in certain cases
• Right to data portability – you can receive your data in a machine-readable format
• Right to object – you can object to the processing of data for marketing purposes or processing based on legitimate interest
• Right to withdraw consent – you can withdraw your consent to data processing at any time, without affecting the lawfulness of processing before withdrawal

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, if you believe that the processing of your data violates the GDPR.

To exercise the above rights, contact us at [email protected]. We will reply within 30 days.

You may also lodge a complaint with the data protection authority in your country of residence.

§ 7

Cookies

We use the following types of cookies and similar technologies:

• Necessary (no consent required): remembering your choice in the cookie banner (spinfactory_cookie_consent_v1, 12 months), session for forms and the enquiry panel (PHPSESSID, until the browser is closed), Cloudflare security cookies (e.g. __cf_bm, 30 minutes).
• Analytics (with consent): Google Analytics 4 (_ga, _ga_*, up to 2 years) and remembering the source of the visit for the duration of the browser session (sf_attr in session storage).
• Marketing (with consent): Google Ads – conversion measurement and remarketing (_gcl_au, _gcl_aw, up to 90 days) and remembering the source of the visit to attribute an enquiry to an ad (sf_attr cookie, 90 days).

You can change or withdraw your consent at any time using the cookie settings button in the corner of the page. You can also manage cookies in your browser settings.

§ 8

Analytics tools

We use the following tools on the website:

• Google Analytics 4 – visit statistics; data is kept for 14 months; the tool is active only after you give analytics consent.
• Google Ads – measuring which ads lead to enquiries (conversions) and remarketing. If you have given marketing consent, after you send a form we pass your e-mail address and phone number to Google in encrypted form (SHA-256 hash) so that the enquiry can be attributed to an ad more accurately (enhanced conversions). Later we may inform Google about the outcome of the enquiry (e.g. an order or a rejection), linked only to the enquiry number and without your contact details.
• Google Consent Mode v2 – before you consent, Google tools do not store cookies and may send only signals without cookies or user identifiers.

Detailed information on how Google processes data can be found in the Google Privacy Policy.

§ 8a

Newsletter and advertising

If you subscribe to our newsletter (in the page footer or by ticking the consent box in the quote or contact form), we process your e-mail address — and, for form sign-ups, also your name or company name — to send you news and offers from Spinfactory and to show you our ads on Google services (Google Ads audience list; the address is passed to Google in encrypted form). The legal basis is your consent (Art. 6(1)(a) GDPR), which also covers receiving commercial information by electronic means.

The subscription must be confirmed via a link sent to the e-mail address provided. As proof of consent we store its wording, the date and the IP address of the sign-up and of the confirmation.

You can withdraw your consent at any time — using the “Unsubscribe” link in every message or by writing to us. Withdrawal does not affect the lawfulness of processing before it. We process the data until you withdraw your consent, and keep the proof of consent until any possible claims become time-barred.

§ 9

Changes to the Privacy Policy

We reserve the right to update this Privacy Policy in connection with changes in the law, the development of the services we offer or technical requirements.

We will inform you of any significant change by updating the date at the top of this document. We encourage you to review the Policy regularly.

§ 10

Contact regarding personal data

Please contact us in all matters relating to the protection of personal data.