Privacy policy

Version 2. In force from 5 August 2026.

Who processes your data

The controller of personal data is BOL-MET Spółka z Ograniczoną Odpowiedzialnością, Rogowo 69, 87-515 Rogowo, Poland, KRS 0001214244, NIP 8921494308. On data matters write to kontakt@bol-met.pl or call 507 440 718.

What data and what for

Situation	Data	Purpose	Legal basis	How long
Placing an order	name, company name, tax identification number, address, telephone, email, order notes, colours chosen	concluding and performing the sales contract, delivery, contact about the order	Art. 6(1)(b) GDPR (contract)	until claims under the contract become time barred
Invoicing and accounts	buyer details from the invoice, amount, date	tax and accounting obligations	Art. 6(1)(c) GDPR	5 years from the end of the tax year
Complaint, return, warranty	order details, description of the case, photographs, correspondence	handling the report and defending against claims	Art. 6(1)(c) and (f) GDPR	until claims become time barred
Quote request or enquiry	name, telephone, email, content of the enquiry	answering the enquiry and preparing an offer	Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract); consent to contact by telephone and email follows from the Polish Electronic Communications Law (Prawo komunikacji elektronicznej)	up to 12 months from the last contact
Assembly cost calculator	postcode	working out the road distance and the cost of getting the crew to you	Art. 6(1)(b) GDPR	calculated distances are held in a cache with no link to you
Consent to commercial information	email, first name	sending information about equipment and promotions, asking for a review after purchase, one reminder about an unfinished order	Art. 6(1)(a) GDPR (consent) in connection with the Polish Act on providing services by electronic means (ustawa o świadczeniu usług drogą elektroniczną) and the Electronic Communications Law (Prawo komunikacji elektronicznej)	until consent is withdrawn
Reminders about equipment inspections	email, order number, delivery date	reminding you about the functional check and the annual inspection required by PN-EN 1176-7	Art. 6(1)(f) GDPR (safe use of the equipment sold)	for the warranty period, unless you object sooner
Submitting a referral	details of the referrer; first name, name or telephone number or email of the person referred	contacting the person referred and settling the commission with the referrer	Art. 6(1)(b) GDPR as regards the referrer; Art. 6(1)(f) GDPR as regards the person referred	details of the person referred, up to 3 months from the referral or until they object; details of the referrer, until settlement and the expiry of tax periods
Site security	IP address, date and time of a form submission, server logs	rate limiting submissions, detecting bots and abuse, demonstrating consent	Art. 6(1)(f) GDPR	IP address attached to a submission, kept with that submission; rate limit counters, 1 hour
Site statistics and ad measurement	visit data, cookie identifiers	measuring traffic and the effectiveness of advertising	Art. 6(1)(a) GDPR (consent given in the banner)	as set in the analytics tools, and no longer than until consent is withdrawn

Is providing data compulsory

Providing data is voluntary, but without it we cannot fulfil an order or answer an enquiry, so to that extent it is a condition of entering into the contract. Consent to commercial information is entirely voluntary: withholding it has no effect on the order, the price or the lead time.

Where we keep data

Orders and form submissions are saved as files on our hosting provider's server in the European Union, outside any directory reachable from the internet. Emails go out through an external sending provider. We do not run customer accounts, we do not collect passwords or card details, and there are no online payments in the shop.

The order status link contains a random key. Anyone holding that link can see the stage the order has reached, the items and the amount, so do not pass it on to people who should not see it.

Who we pass data to

Only to those without whom the service cannot be delivered:

• the courier company, to the extent needed for delivery,
• the accountancy office, as regards accounting documents,
• the provider of transactional and commercial email sending,
• the hosting company that stores the site data,
• Google, the postcode alone, when calculating distance in the assembly calculator,
• Google and Meta, visit data, only after you have consented in the cookie banner,
• finance providers, only where you choose instalments or leasing yourself and after this has been agreed with you; such a provider then becomes a separate controller and gives you its own privacy information,
• a law firm or a debt collection company, should a dispute arise.

We do not sell data and we do not share it with third parties for marketing purposes.

Transfers outside the European Economic Area

Analytics and advertising tools (Google, Meta) may process data outside the EEA, including in the USA. They run only after you have given consent in the cookie banner. These providers use standard contractual clauses approved by the European Commission, and US companies rely on the adequacy decision for the EU-US Data Privacy Framework. We will provide a copy of the safeguards on request.

Referral programme: where we got the details of the person referred

If we call or write to you and you never left us your details, they were most likely given by somebody who put you forward in our referral programme. This section is the information required by Art. 14 GDPR.

• Controller: BOL-MET Spółka z Ograniczoną Odpowiedzialnością, contact details at the top of the page.
• Where the data came from: from the referrer, who stated that they had told you their contact details were being passed on.
• Scope: name or institution name and a telephone number or email address, possibly with a short note about what is needed.
• Purpose and basis: a single contact with a proposal to work together, Art. 6(1)(f) GDPR, the legitimate interest of ours and of the referrer.
• How long: up to 3 months from the referral, and if you are not interested we delete the details straight after the call.
• Your rights: all those listed below, and in particular the right to object. Once you object we delete the data immediately and do not contact you again.

On first contact we say plainly who pointed us to you. Contact by telephone and email for direct marketing purposes requires the recipient's consent, so on that first contact we ask for it, and without it we do not get in touch again.

Your rights

You have the right of access to your data, the right to rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. You can object to direct marketing at any time and without giving reasons, and we then stop processing the data for that purpose immediately (Art. 21(2) GDPR). You can withdraw consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.

Just send your request to kontakt@bol-met.pl. We reply within a month, and in simple cases usually the same day. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, the supervisory authority in Poland.

Profiling

We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. Google's and Meta's advertising tools may profile ad audiences; this happens only after you have given marketing consent in the cookie banner, and you can withdraw it using the button in the footer.

Cookies

The use of cookies and local storage is described in a separate cookie policy. You can change your settings at any time using the button in the site footer.

Changes to this policy

The current version applies from the date given at the top of the page. We make previous versions available on request at kontakt@bol-met.pl.