dekoprintpro.com

Version 1.3 — effective from 06.11.2026 · version 1.2: 28.10.2026 · version 1.1: 24.10.2026 · version 1.0: 12.07.2026

1. Data Controller

The controller of the personal data of users of the dekoprintpro.com website (hereinafter: the “Website”) is P.P.H.U. DEOZE Sebastian Pietrzak with its registered office in Pabianice, ul. gen. Stefana „Grota" Roweckiego 8a, 95-200 Pabianice, Poland, VAT ID: PL7311938864, REGON: 100696122 (hereinafter: the “Controller”).

Contact on data protection matters: email sales@dekoprintpro.com, tel. +48 796 111 555. The Controller has not appointed a data protection officer — in all matters concerning the processing of personal data, please use the contact details above.

2. Scope of the data processed

Through the forms (wholesale inquiry, PDF catalogue) we process data provided voluntarily by the user: first name and surname, company name, Polish tax ID (NIP) or EU VAT number, email address, telephone number, website address, country, type of business, message content (including the product to which the inquiry relates) and uploaded attachments (e.g. logo, brief). Together with the inquiry we record technical data: device type, operating system, browser, language, screen resolution, time zone, the address of the form and the page from which the visit came.

Providing the data marked as required is voluntary, but necessary in order to reply to the inquiry.

So that the data entered is not lost, the inquiry form saves it continuously as a draft: in the browser and on our server. If the inquiry is not sent, the Controller may see this draft (also in an email message) and make contact about an offer. We delete drafts after 30 days.

3. Purposes and legal bases of processing

The data is processed for the purpose of:

a) replying to the inquiry and presenting a commercial offer — the legal basis is taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR);

b) performing a concluded contract — Art. 6(1)(b) GDPR — and fulfilling accounting and tax obligations — Art. 6(1)(c) GDPR; establishing and maintaining B2B business relationships, including direct marketing of our own products and contact about an unfinished inquiry — the legal basis is the legitimate interest of the Controller (Art. 6(1)(f) GDPR);

c) establishing, exercising or defending legal claims — the legal basis is the legitimate interest of the Controller (Art. 6(1)(f) GDPR);

d) analysing traffic and how the Website is used in order to improve it (statistics and analytics) — the legal basis is the user's consent given via the cookie banner (Art. 6(1)(a) GDPR).

e) obtaining references — we may use the contact details of customers who have placed an order with us to ask for a reference or an opinion on our cooperation; the legal basis is our legitimate interest in building the credibility of our offer (Art. 6(1)(f) GDPR). We publish the content of a reference, the company name or logo only with express consent, which can be withdrawn at any time by writing to sales@dekoprintpro.com (Art. 6(1)(a) GDPR): on the websites and blogs dekoprintpro.com, dekoprint.pl, deoze.pl; on the Facebook, Instagram, Threads, TikTok, LinkedIn and YouTube profiles; in the newsletter and in commercial offers and presentations (PDF). Separate consent is required for paid Google, Meta, TikTok and LinkedIn advertising.

4. Data recipients

The wholesale inquiry form transmits data via the service Web3Forms, which handles the technical delivery of messages to the Controller's mailbox. The service provider may process data on servers located outside the European Economic Area (EEA) — in that case, the transfer takes place on the basis of standard contractual clauses approved by the European Commission.

The PDF catalogue form and automatic inquiry confirmations are sent via the service Resend (Resend, Inc.), which may process the email address and message content outside the EEA on the basis of standard contractual clauses. We also store form submissions in databases provided by Cloudflare (D1 and KV services), to which only the Controller has access.

If consent to analytics and marketing cookies is given, technical data may be processed by providers of analytics and marketing tools: Google Ireland Ltd. (Google Tag Manager, Google Analytics, Google Ads) and Microsoft Ireland Operations Ltd. (Microsoft Clarity). These providers may transfer data outside the EEA on the basis of standard contractual clauses.

Hosting, the content delivery network (CDN) and email forwarding from the domain are provided by Cloudflare, Inc. If you use the telephone call request widget (callback), your telephone number is processed by CallPage (JustCall) in order to make the return call. These providers may transfer data outside the European Economic Area on the basis of standard contractual clauses approved by the European Commission.

Cloudflare also protects the inquiry form (using Turnstile): when it loads, Cloudflare processes the IP address and browser data to distinguish humans from bots; the form itself is delivered by the Cloudflare Workers service. The consent banner runs on the CookieHunter (RoasLens) tool, which belongs to the Controller. We record your cookie choice in a consent register so that we can demonstrate that consent was given or refused (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR): a random consent identifier, the decision, the date of the first and the most recent decision, the version of the banner text, the language, the country and the domain of the website — without the IP address and without information about what you view. You can see your consent identifier by clicking “Cookies” in the bottom bar of the page; quote it if you wish to access the entry or have it deleted. The browser retrieves the exchange rates used to convert prices into EUR and USD directly from the public service of the National Bank of Poland (api.nbp.pl). The Website's font is served from our own server — the browser does not connect to Google for this purpose.

The Controller's email, which receives messages from the form and business correspondence, is handled through Google Workspace (Google Ireland Ltd.).

If business cooperation begins, the data needed to issue an invoice (company name, VAT ID, address, contact details) is processed in the invoicing system Fakturownia (Fakturownia sp. z o.o.). Data on fulfilled orders may also be processed in the order management system BaseLinker (BaseLinker sp. z o.o.) — only after an order has been placed, in order to fulfil it.

For marketing activities (running and optimising advertising campaigns), the Controller may use the support of an external marketing service provider acting on behalf of and in accordance with the instructions of the Controller.

Data may also be entrusted to other service providers acting on behalf of the Controller and disclosed to entities authorised by law.

5. Retention period

We process data for the duration of correspondence and commercial negotiations and, after they end, for the period necessary to establish, exercise or defend claims, but no longer than the limitation period for claims under the law. We keep data processed for marketing purposes until an objection is raised. We process analytics data until consent is withdrawn or for the retention period set by the tool provider. We keep entries in the consent register for 3 years from the most recent decision. We keep invoices and other accounting documents for the period required by tax and accounting regulations, as a rule 5 years from the end of the year in which the tax obligation arose.

6. Rights of data subjects

Every person has the right of access to their data, to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest (including direct marketing — at any time). Where data is processed on the basis of consent, there is a right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, a message to sales@dekoprintpro.com is sufficient. There is also the right to lodge a complaint with the President of the Polish Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.

7. Cookies and analytics tools

The Website uses cookies and similar technologies. They fall into the following categories:

a) essential — necessary for the proper operation of the Website (e.g. remembering the cookie choice and the random identifier of that consent, the catalogue browsing state). Stored locally in the browser, they do not require consent;

b) analytics and statistics — installed only after consent has been given on the cookie banner. The Website uses Google Tag Manager, Google Analytics, Google Ads and Microsoft Clarity, which make it possible to analyse traffic and user behaviour and to measure the effectiveness of the Website and advertising campaigns.

Until consent is given, Google Analytics and Microsoft Clarity are not launched. The Google Tag Manager container with the Google Ads tag loads immediately, but operates in Google Consent Mode v2 — by default all consent categories have the status “denied”, so without consent the tags neither write nor read cookies, and only cookieless signals reach Google (e.g. information about a page view or form submission, together with the consent status). Consent can be changed or withdrawn at any time using the “Cookies” button in the bottom bar of the page, or by deleting cookies in the browser settings (the banner will then appear again).

c) our own anonymous measurement — regardless of consent, we measure how the Website is used, without cookies, without storing anything in the browser and without the IP address. For each page view we record: the subpage address, the page or domain from which the visit came, the campaign label from the page address, the page language, scroll depth, display time, page elements clicked (buttons, links, form fields — without the text entered), device type (phone or computer), page speed indicators and script error messages. This data cannot be used to establish who the visitor is; it is used solely to improve the Website and is deleted after 400 days.

Hosting servers may automatically record standard technical data (IP address, browser type, time of request) in system logs, which are used solely for security and diagnostic purposes.

8. Automated decision-making and profiling

Personal data provided in the form is not used for automated decision-making, including profiling, that produces legal effects concerning the user or similarly significantly affects them. The analytics tools (described in section 7) may process data in an automated way solely for statistical purposes and traffic measurement, on the basis of consent, without making decisions about any specific person.

Providing data is voluntary. The Controller does not transfer data to third countries other than as indicated in section 4 (tool providers on the basis of standard contractual clauses).

9. Changes to this Privacy Policy

The Controller may update this Privacy Policy, in particular if the law or the way the Website operates changes. The current version is always available at this address.