GDPR
Privacy policy
How Thermoform processes personal data of people who write to us through the website, use the customer area, apply for a job or are contacts at companies we write to.
Version of 24.10.2026
1. Controller
The controller is THERMOFORM Spółka z ograniczoną odpowiedzialnością Spółka komandytowa, ul. gen. Wł. Sikorskiego 37, 87-300 Brodnica, Poland, VAT ID PL 8771476495, KRS 0000443450. Data protection contact: info@thermoform.pl, phone +48 56 474 82 44.
2. Purposes, legal bases and retention
| Situation | Purpose and legal basis | Retention |
|---|---|---|
| Quote request (form, files, drawings) | Preparing a quote, pre-contractual steps — Art. 6(1)(b) GDPR; contact with company representatives — Art. 6(1)(f) | 3 years from last contact; files without an order — 12 months |
| Contact form and call-back request | Answering — Art. 6(1)(f) (legitimate interest: handling correspondence) | 12 months from last contact |
| Customer area | Sending the login link and providing quotes — Art. 6(1)(b) and (f) | as long as quotes exist; login log 12 months |
| Recruitment | Running the recruitment — Art. 6(1)(c) (Art. 22¹ Polish Labour Code); additional data and future recruitments — consent, Art. 6(1)(a) | until the recruitment ends; with consent 12 months |
| Business contact with companies (public sources) | A single, individual message about Thermoform services — Art. 6(1)(f) (legitimate interest: direct marketing of own services) | until objection or 2 years without contact; then only a block entry |
| Contracts, invoices, complaints | Performing contracts and tax obligations — Art. 6(1)(b) and (c) | as required by tax law and limitation periods |
3. Data from public sources (Art. 14 GDPR)
Some business contacts are collected by us from public sources: company listings in Google Maps, company websites and registers (KRS, CEIDG, VIES). These are business data: name, address, phone, business e-mail, industry and public information on the website used to tailor the message. We do not buy address lists.
You can reply “no” to any message or write to info@thermoform.pl — we then block the contact permanently (objection, Art. 21 GDPR).
We prepare business messages with the help of AI tools, and every message is checked for factual accuracy before it is sent. For these messages we record whether they were opened and whether the link to our website was clicked (an invisible image and a link redirect) — to measure results and to avoid writing to the same people again; legal basis: Art. 6(1)(f) GDPR. We do not make automated decisions with legal effects (Art. 22 GDPR).
4. Recipients
- server provider for the website and system — Contabo GmbH, Welfenstraße 22, 81541 München (Niemcy), server in the EU;
- Thermoform e-mail service;
- Serper.dev / Google — company search in Google Maps (only “industry + place” queries, no visitor data);
- AI service analysing public company websites and drafting messages — OpenAI (USA) and Anthropic (USA); transfers outside the EEA under standard contractual clauses or the EU-US Data Privacy Framework;
- Telegram — internal team notifications;
- OpenStreetMap Foundation (United Kingdom) — the directions map in the Contact section; when it is displayed, your browser connects to OpenStreetMap servers and transmits your IP address (the United Kingdom is covered by an EU adequacy decision);
- accountants, lawyers, couriers — where needed for an order.
5. Your rights
You have the right of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests and to withdraw consent at any time. We reply within 30 days. You may lodge a complaint with a supervisory authority, in particular the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw).
6. Cookies
The website uses no analytics or advertising cookies and therefore shows no consent banner. The customer area and team panel use only a strictly necessary session cookie.
7. Security
The connection is encrypted (HTTPS). Customer drawings and files are stored outside the public directory, only authorised people have access and every download is logged. The team panel is only accessible after login, with optional two-factor login. The rules for using the website are set out in the Terms of use.