Privacy Policy for kafar.eu

Last updated: October 23, 2026.

§ 1. Data Controller

The controller of personal data is KAFAR Sp. z o.o., registered office: ul. Przemysłowa 9A, 05-307 Dobre, Poland, KRS 0000624142, Tax ID (NIP) 8222354116. For matters concerning personal data, contact biuro@kafar.eu or write to the registered office.

If the Controller appoints a Data Protection Officer in the future, the DPO’s contact details will be published on the website as required by law.

§ 2. Personal Data We May Process

name and surname;
e-mail address;
telephone number, if provided;
message content and other information voluntarily provided in correspondence;
details of the company or institution represented by the person contacting KAFAR, if provided;
technical data related to website use, including IP address, date and time of connection, browser type, operating system, requested page and server-log data.

§ 3. Purposes and Legal Bases

handling enquiries submitted through the form, by e-mail or telephone – Article 6(1)(f) GDPR; KAFAR’s legitimate interest is conducting business communication and responding to enquiries;
taking steps at the user’s request before entering into a contract or performing a contract – Article 6(1)(b) GDPR, where applicable;
website security, prevention of abuse, troubleshooting and technical logs – Article 6(1)(f) GDPR;
establishing, exercising or defending legal claims – Article 6(1)(f) GDPR;
optional analytics, functional or marketing tools, where implemented – Article 6(1)(a) GDPR to the extent that personal-data processing is based on consent.

§ 4. Voluntary Provision of Data

Providing data is voluntary. An e-mail address is necessary if the user wishes to receive a response by e-mail. For the standard contact form, the telephone number should remain optional.

§ 5. Recipients

hosting, server and infrastructure providers;
IT, website administration and maintenance providers;
e-mail service providers;
cookie-consent management and security providers;
map or other external-content providers where the relevant feature is activated in accordance with the user’s choice;
legal, accounting, audit or advisory providers where necessary;
public authorities where disclosure is required by law.

Current third-party technologies using cookies or similar mechanisms should be identified in the ‘Cookie settings’ panel, together with their purpose, category and duration.

§ 6. Transfers Outside the EEA

Some third-party services may involve transfers of personal data outside the European Economic Area. Where such a transfer occurs, a transfer mechanism permitted by the GDPR is used, such as an adequacy decision or Standard Contractual Clauses together with any required supplementary safeguards. Information on the relevant provider and transfer mechanism should be available with the relevant service or in the cookie settings.

§ 7. Retention

contact enquiries – for the time needed to handle the matter and subsequently for the period justified by the possibility of establishing, exercising or defending legal claims;
contract-related data – for the duration of the contract and the periods required by law and applicable limitation periods;
data processed on the basis of consent – until consent is withdrawn or the purpose ends earlier;
technical logs – for the period resulting from system configuration and justified by website security.

§ 8. Your Rights

access to personal data and a copy;
rectification;
erasure;
restriction of processing;
data portability where the conditions of Article 20 GDPR are met;
objection to processing based on Article 6(1)(f) GDPR;
withdrawal of consent at any time where processing is based on consent;
lodging a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

IMPORTANT – RIGHT TO OBJECT: where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

§ 9. Automated Decision-Making

KAFAR does not make decisions concerning website users based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them.

§ 10. Security

The Controller applies appropriate technical and organisational measures proportionate to the risk. Website connections should use HTTPS, and access to contact-form data should be limited to authorised persons.

§ 11. Changes to the Policy

This Policy may be updated following changes in law, website functionality, technology providers or processing activities.

The controller is KAFAR Sp. z o.o., ul. Przemysłowa 9A, 05-307 Dobre, Poland, KRS 0000624142, Tax ID (NIP) 8222354116, e-mail: biuro@kafar.eu.

Data is processed to handle the enquiry and conduct correspondence. The legal basis is Article 6(1)(f) GDPR – the Controller’s legitimate interest in business communication and responding to enquiries. Where the enquiry concerns steps before entering into a contract or performance of a contract, Article 6(1)(b) GDPR may also apply.

Data may be disclosed to hosting, IT, e-mail and other providers supporting the handling of the enquiry, only to the extent necessary. Where a specific provider involves a transfer outside the EEA, information on the transfer and applicable safeguard is set out in the Privacy Policy or with the relevant service.

Data will be retained for the time needed to handle the matter and subsequently for the period justified by the possibility of establishing, exercising or defending legal claims. Providing data is voluntary; an e-mail address is required to receive a reply by e-mail.

Where applicable, you have the right of access, rectification, erasure, restriction, data portability, objection and the right to lodge a complaint with the President of UODO in Poland. KAFAR does not make decisions based solely on automated processing of contact-form data that produce legal effects or similarly significantly affect you.