/ DOCUMENTS — GDPR
Privacy policy
This document explains what personal data we collect through the maxbis.pl website, why we process it and what rights data subjects have.
Version of 25 August 2026
1. Data controller
The controller of your personal data is MaxBis Company Sp. z o.o., registered office at ul. Hoża 86 lok. 410, 00-682 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000871251, tax ID (NIP) 9482625009, REGON 387629330.
For any matter concerning personal data you can reach us at:
- e-mail: mbc@opoczta.pl
- phone: +48 573 257 415
- by post: ul. Hoża 86 lok. 410, 00-682 Warsaw, Poland
We have not appointed a Data Protection Officer — please use the contact details above for all data protection matters.
2. What data we collect
We only collect data that you provide to us yourself, together with standard technical data recorded by the server.
- Contact form — full name, e-mail address, phone number (optional), enquiry subject and the content of your message.
- Direct contact — the data you provide when you e-mail us or call the number listed on the website.
- Technical data — IP address, date and time of the request, browser and operating system type, recorded automatically in the hosting server logs. We additionally attach the send date and time and the IP address of the device used to submit the form to the message itself — as protection against spam and abuse. This information sits in the body of the e-mail and is kept for as long as the correspondence itself.
We do not collect special categories of data (sensitive data) and we ask that you do not include such data in your messages.
3. Purposes and legal bases of processing
We process data in accordance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council):
| Purpose | Legal basis |
|---|---|
| Replying to an enquiry sent by form, e-mail or phone — where you write on your own behalf, as a natural person | Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract |
| Replying to an enquiry — where you contact us on behalf of a company or institution | Art. 6(1)(f) GDPR — our legitimate interest in conducting business correspondence |
| Submitting the form with the data processing consent box ticked | Art. 6(1)(a) GDPR — your consent, which you may withdraw at any time |
| Preparing an offer, negotiations and performance of a contract | Art. 6(1)(b) GDPR — performance of a contract or steps prior to entering into it |
| Accounting and tax obligations | Art. 6(1)(c) GDPR — legal obligation to which the controller is subject |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) GDPR — legitimate interest of the controller |
| Ensuring website security and protection against abuse (server logs) | Art. 6(1)(f) GDPR — legitimate interest of the controller |
| Protecting the contact form against abuse — we attach the send date and the sender's IP address to the message | Art. 6(1)(f) GDPR — legitimate interest in preventing spam and in being able to evidence the circumstances in which an enquiry was sent |
We do not profile visitors and we do not take decisions concerning you by automated means, including decisions that would produce legal effects or similarly significantly affect you.
4. How long we keep data
- Correspondence and enquiries — for as long as needed to deal with the matter and then for up to 3 years from the last contact, that is the period in which claims relating to the offer submitted may arise. If we start working together, the correspondence is kept together with the contract documentation.
- Contract-related data — for the term of the contract and, afterwards, for the limitation period for claims (as a rule 3 years for claims connected with business activity, 6 years in other cases) and for the period of liability under the statutory warranty for defects of a construction works (5 years from handover).
- Accounting records — 5 years, counted from the end of the calendar year in which the tax payment deadline fell.
- Server logs — up to 12 months, in line with the hosting server configuration.
- Send date and IP address attached to a message from the form — for as long as the message itself.
5. Who we share data with
We do not sell your data and we do not share it for marketing purposes. It may only be passed to entities that support our operations:
- the hosting and e-mail provider whose servers run the website and mailbox;
- our accounting office — to the extent necessary for settlements;
- the law firm advising the company — to the extent necessary for legal support;
- software and IT service providers maintaining our systems;
- public authorities, where the obligation to disclose data follows from the law.
With providers who process data on our behalf we conclude data processing agreements, or we rely on such agreements made available in their terms of service. The law firm advising the company acts as a separate controller, to the extent necessary to provide legal support.
The website does not embed content from external servers. Fonts, images and scripts are served solely from the server hosting the website, so simply viewing the page does not pass your data to any third party other than the hosting provider whose server runs the website.
6. Transfers outside the EEA
We process data within the European Economic Area. The website and our e-mail run on servers in Poland, and the website does not embed content from external providers to which visitors' data would be passed. Should data ever be transferred outside the EEA in the future, this would take place on the basis of a European Commission adequacy decision or standard contractual clauses.
Should such a transfer take place, you may obtain a copy of the safeguards applied by writing to mbc@opoczta.pl.
7. Your rights
In connection with the processing of your data you have the right to:
- access your data and obtain a copy of it (Art. 15 GDPR);
- rectify inaccurate data or complete incomplete data (Art. 16 GDPR);
- erasure of your data — the "right to be forgotten" (Art. 17 GDPR);
- restriction of processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- object to processing based on our legitimate interest (Art. 21 GDPR);
- withdraw your consent at any time where processing is based on it — without affecting the lawfulness of processing carried out before the withdrawal.
To exercise these rights, write to mbc@opoczta.pl. We respond without undue delay and no later than within one month.
You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. If you live or work in another EU country, you may also lodge your complaint with the supervisory authority of your habitual residence or place of work.
8. Voluntary nature of providing data
Providing your data is voluntary but necessary for us to reply to your enquiry. Without your name and e-mail address we will not be able to contact you. Providing a phone number is entirely optional.
9. Cookies and server logs
We do not use analytics, marketing or tracking cookies. We do not use Google Analytics, advertising pixels or remarketing systems, we do not build visitor profiles and we do not combine data from other sources. Because we do not use files that require consent, we do not display a cookie banner — consent is required only for files that are not necessary to provide the service properly.
The hosting server may store only technical files necessary for the correct and secure operation of the website (for example when handling the form or for server security). Such files are not used for tracking and do not require consent.
The hosting server records standard access logs (IP address, date and time of the request, URL, browser type). They serve solely to keep the website secure and working correctly and to diagnose errors.
Should we introduce analytics or marketing tools in the future, we will update this policy and ask for your consent before enabling them.
10. Data security
We apply technical and organisational measures appropriate to the risk: an encrypted connection (HTTPS), access control for mailboxes, a limited group of people with access to correspondence, and spam protection on the form.
11. Changes to this policy
We may update this policy when the law, the scope of our services or the tools we use change. The current version is always available at this address, together with its effective date.
This document is effective from 25 August 2026
This is a translation of the Polish original. In the event of any discrepancy, the Polish version available at maxbis.pl/polityka-prywatnosci.html prevails.
12. What this policy covers
This policy describes the processing of data of people who visit maxbis.pl and contact us through the contact form, by e-mail or by phone.
Separate rules and separate privacy notices apply to the remaining areas of our activity, in particular to:
- job candidates and people recruited to work in Poland, including foreign nationals;
- employees and contractors of MaxBis Company Sp. z o.o.;
- people representing our business partners and people they designate as contacts.
We provide the privacy notices for these groups directly when collecting the data. You may also request them by writing to mbc@opoczta.pl.
If your message contains the data of another person (for example a colleague or a contact person on your side), we process it for the same purpose and for the same period as your own data, on the basis of Art. 6(1)(f) GDPR. Please pass on the information about our privacy policy to that person.