Privacy Policy

1. Introduction

Daromeli ("we", "us", "our") operates the website daromeli.info and is committed to protecting the personal data of visitors and correspondents. This Privacy Policy describes how personal data is collected, used, stored, and protected in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and applicable Polish data protection legislation.

The data controller for personal data processed through this website is Daromeli, with its correspondence address at ul. Krucza 38, 00-551 Warsaw, Poland. For data-related enquiries, contact: [email protected].

2. Personal Data We Collect

We collect personal data only when it is voluntarily submitted by the user or when it arises automatically from site interaction. The categories of personal data collected include:

• Contact form submissions: name, email address, message content, and optional subject selection. This data is submitted when you use the contact form on the Contact page.
• Technical data: IP address, browser type, operating system, referring URL, and pages visited. This data is collected automatically via server logs and analytics cookies where consent is given.
• Cookie data: cookie identifiers and preferences where consent is given. See the Cookie Policy for full details.

We do not knowingly collect personal data from individuals under the age of 16. If you believe a minor has submitted personal data, please contact us at the address above and we will arrange deletion.

3. Legal Basis for Processing

We process personal data under the following legal bases as defined in Article 6 GDPR:

• Consent (Art. 6(1)(a)): For non-essential cookies and analytics tracking, where you have indicated acceptance via the cookie consent banner.
• Legitimate interests (Art. 6(1)(f)): For server log data retained for security and fraud prevention purposes. Our legitimate interest is the secure operation of the website.
• Contract performance (Art. 6(1)(b)): For contact form submissions where you initiate correspondence regarding a product enquiry or batch certificate request.

4. How We Use Personal Data

Personal data submitted through this website is used for the following purposes only:

• Responding to enquiries submitted via the contact form
• Fulfilling batch certificate requests where a lot number is provided
• Improving website performance and user experience where consent is given for analytics
• Maintaining security logs for fraud prevention and site security

We do not use personal data for unsolicited marketing communications, profiling for advertising purposes, or automated decision-making with legal or similarly significant effects.

5. Data Retention

Personal data is retained only for as long as necessary for the stated purpose:

• Contact correspondence: retained for 12 months from last communication, then deleted unless an ongoing relationship requires extended retention.
• Server logs: retained for 90 days for security purposes, then deleted automatically.
• Analytics data: retained in aggregated, anonymised form for up to 24 months where consent is given.

6. Third-Party Services

The website may use third-party services that process data on our behalf as data processors under GDPR Article 28 agreements. These include:

• Web hosting provider: processes server log data in the course of hosting the website.
• Google Maps (embedded on Contact page): may collect IP address and cookie data as a result of the map embed. Use of Google Maps is governed by Google's own Privacy Policy.
• CDN providers (Cloudflare, jsDelivr, unpkg): serve static assets and may log request data for performance and security purposes.

We do not sell personal data to third parties under any circumstances.

7. Your Rights Under GDPR

Under GDPR, you have the following rights with respect to your personal data:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate personal data.
• Right to erasure (Art. 17): You may request deletion of your personal data where no legitimate basis for retention exists.
• Right to restrict processing (Art. 18): You may request that processing of your data be restricted in certain circumstances.
• Right to data portability (Art. 20): Where processing is based on consent or contract, you may request your data in a structured, commonly used format.
• Right to object (Art. 21): You may object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. The website operates exclusively over HTTPS. Contact form submissions are transmitted over encrypted connections.

No method of transmission over the internet is entirely secure. We cannot guarantee absolute security but maintain reasonable and proportionate measures consistent with the sensitivity of the data held.

9. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be published on this page with an updated effective date. Continued use of the website after a policy update constitutes acknowledgement of the revised terms. Material changes will be communicated via a notice on the website homepage.

10. Contact

For all privacy-related enquiries: