Privacy policy of protohumix.eu

The controller of personal data is: PROTOHUMIX SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (LLC), NIP (tax ID) 6762717047, KRS 0001233485, ul. Szlak 77/222, 31-153 Kraków, Poland (the "Controller").

Contact in matters related to personal data: info@protohumix.eu

Depending on how you use the site, we may process:

• data provided in forms: e.g. name, e-mail, phone, message content, company data (e.g. tax ID, address), information necessary to handle the order,
• data from the Polish register of VAT taxpayers (Wykaz podatników VAT, the so-called White List): company name, VAT status and business address — retrieved after a NIP (Polish tax ID) is entered in the B2B enquiry form or at the gate to the business price list,
• notes on the course of contact and commercial arrangements (communication register — date, channel and a summary of the conversation or correspondence),
• technical data: IP address, online identifiers/cookies, device and browser information, server logs (to the extent necessary for the operation and security of the site).

We receive data directly from you — when you fill in the contact form or place an order in the shop, or contact us by e-mail/phone. If you provide a NIP, we retrieve the company name, VAT status and business address from the public register of VAT taxpayers of the Polish Ministry of Finance.

We process data for the following purposes (in accordance with Art. 13 GDPR):

• A. Contact form — purpose: answering questions, correspondence and contact; legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller — communication and inquiry handling) or Art. 6(1)(b) GDPR if the contact concerns pre-contractual steps at your request.
• B. Shop order — purpose: accepting and handling the order, contact regarding fulfilment, commercial/organisational arrangements, possible establishment or defence of claims; legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual steps), and for legal obligations related to settlements/documentation — Art. 6(1)(c) GDPR; additionally Art. 6(1)(f) GDPR (legitimate interest — securing claims).
• C. Visit statistics — purpose: analytics and statistics of site usage; legal basis: the user's consent to analytical cookies (details in the Cookies policy).
• D. B2B cooperation enquiry and NIP verification — purpose: preparing and presenting a commercial offer tailored to the type of cooperation (distribution, farm, producer group, land reclamation) and the stated scale, conducting commercial talks and — if you provide a NIP — confirming that the company exists and is an active VAT taxpayer; legal basis: Art. 6(1)(b) GDPR (pre-contractual steps taken at your request) and Art. 6(1)(f) GDPR (legitimate interest of the Controller — verifying the counterparty before making an offer and securing claims). Providing a NIP is voluntary; we check the number in the register of VAT taxpayers kept by the Head of the National Revenue Administration of Poland (Szef Krajowej Administracji Skarbowej; the so-called White List) and store it — together with the company name, if the register returns it.

We do not send marketing offers (newsletters, e-mail/SMS campaigns, telephone marketing). Therefore, we do not process data for this purpose.

Data may be transferred to entities that support us technically and organisationally, in particular:

• hosting and server infrastructure providers,
• IT/administration service providers,
• form anti-spam protection providers (Cloudflare Turnstile — verifying that a form is submitted by a human, not a bot),
• the Polish Ministry of Finance / the Head of the National Revenue Administration, Szef Krajowej Administracji Skarbowej (register of VAT taxpayers — we send to the register only the NIP provided, to confirm that the company exists and to check its VAT status; we do not transfer any other data from the form there),
• the European Commission (the VIES system — we send to the system only the EU VAT number given in the order, to confirm that it is an active VAT number in a European Union Member State; we do not transfer any other data from the form there),
• Google Ireland Limited (Google Analytics 4 — anonymous visit statistics, only after consent to analytical cookies),
• e-mail/telecommunications providers (if we use them to handle contact),
• entities handling settlements and accounting (if applicable),
• public authorities — where required by law.

Depending on the location of suppliers' infrastructure (e.g. hosting/tool providers), data may also be processed outside the European Economic Area. In such cases, legally required transfer safeguards are applied (e.g. standard contractual clauses), and the details depend on the specific provider and the configuration of the services.

• contact form data: for the duration of correspondence handling, and then for the period needed to secure possible claims or demonstrate the course of arrangements,
• order data: for the time necessary to fulfil the order/contract, and then for the period required by law (e.g. tax/accounting) and the time needed to secure claims,
• B2B cooperation enquiry data, including the NIP and data from the register of VAT taxpayers: for the time needed to prepare the offer and conduct commercial talks, and then for the period needed to secure possible claims or demonstrate the course of arrangements; if a contract is concluded — thereafter as for order data,
• analytical/cookie data: in accordance with the Cookies policy and consent settings.

You have the rights of: access to data, rectification, erasure, restriction of processing, data portability (where applicable), objection to processing based on Art. 6(1)(f) GDPR, and the right to withdraw consent (where processing is based on consent).

You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

Providing data is voluntary, but:

• for the contact form — necessary for us to be able to respond,
• for an order — necessary to handle the order and contact about its fulfilment,
• for a B2B cooperation enquiry — the type of cooperation, company name, first and last name, e-mail and a description of the scale or a message are necessary for us to prepare an offer; the NIP and phone number are voluntary (we will also reply without a NIP; the offer is then prepared on the basis of the company name provided).

We do not make decisions about you in a solely automated manner, including profiling within the meaning of the GDPR.

Detailed information about cookies and how to give/withdraw consent can be found in the Cookies policy.