Privacy Policy

Last updated: September 9, 2026

1. Personal data controller

The controller of personal data processed in connection with the use of the website, contact with the company, handling of inquiries, and provision of services is ARX MODULAR SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Świdnicka 40, 50-024 Wrocław, Tax ID (NIP) 8971970857, Statistical ID (REGON) 544549905, National Court Register (KRS) 0001236368, with its registered office in Karczew, 05-480, ul. Częstochowska 43c (hereinafter: "Controller").

To contact the Controller regarding personal data protection, please email m.kroc@arxmodular.com or write to our mailing address: ul. Częstochowska 43c, 05-480 Karczew.

2. Scope and purpose of the Policy

This Policy sets out the rules for processing personal data of individuals using the website, contacting the Controller, submitting inquiries, interested in the offer, cooperating with the Controller, and using forms and other website functionalities.

The Controller applies personal data protection principles resulting in particular from Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"), the Act of 10 May 2018 on the protection of personal data, and other applicable legal provisions.

3. Data processing principles

• lawfulness, fairness, and transparency of processing;
• purpose limitation — data is used for specific, explicit, and legitimate purposes;
• data minimization — the data processed is adequate, relevant, and limited to what is necessary;
• data accuracy;
• storage limitation;
• availability, integrity, and confidentiality, including protection against unauthorized access, loss, destruction, or alteration;
• accountability — the Controller is able to demonstrate compliance with applicable principles.

4. Categories of personal data

Depending on the method of contact and the extent of website usage, the Controller may process, in particular: first and last name, company name, position/job title, email address, phone number, mailing or delivery address, data contained in the content of messages or inquiries, contact history data, as well as technical data related to website usage, such as IP address, session identifiers, and information about the device and browser — to the extent that such information may constitute personal data.

As a general rule, the Controller does not expect the submission of special categories of data via the website, as referred to in Article 9 of the GDPR, nor data concerning criminal convictions and offenses. If the provision of such data is necessary or arises from the circumstances of a specific case, it will be processed solely on the basis of an appropriate legal ground.

5. Purposes and legal bases for processing

The periods indicated above are framework guidelines. The final retention period is determined based on the data category, the purpose of processing, legal obligations, and the statute of limitations for claims.

6. Contact forms and quote requests

Data provided via a contact form, quote request form, email, or other communication channels is processed for the purpose of responding, preparing a quote, conducting further correspondence, and, in the event a contract is concluded, for its performance.

Providing data marked as required is voluntary, but may be necessary to receive a response or to fulfill a requested service.

7. Data recipients and IT outsourcing

Personal data may be shared with entities supporting the Controller in their business operations, solely to the extent necessary to achieve specific purposes and while maintaining appropriate safeguards.

The Controller requires processors to apply appropriate technical and organizational measures and uses supervision and verification mechanisms appropriate to the risk. The mere fact of using IT outsourcing does not mean that the Controller transfers their responsibility for compliance with personal data processing.

Data may also be transferred to providers of hosting, email, CRM systems, accounting, legal, and courier services, as well as providers of analytical tools and other service providers, if necessary to achieve the stated purposes.

8. Information security and business continuity

The Controller implements technical and organizational measures appropriate to the risk to protect data against unauthorized access, loss, destruction, alteration, or disclosure.

Data protection is implemented within the framework of internal documents adopted by the company, in particular the Personal Data Protection Policy and the Information Security and Business Continuity Policy. These internal documents contain detailed procedures that the Controller does not publish for security reasons.

The scope and level of security are periodically assessed and adjusted to current risks, the state of the art, the nature of the processing, and organizational and technological changes.

9. Cookies and similar technologies

The website may use cookies and similar technologies. These may be used, among other things, to ensure the website functions properly, maintain sessions, remember settings, compile statistics, and — if the user provides the required consent — for analytical or marketing purposes.

Necessary cookies may be used to the extent required to ensure the website functions correctly. For technologies requiring consent, the Controller provides a consent management mechanism that allows you to grant, refuse, or change your consent.

10. Data transfers outside the EEA

If the Controller uses the services of providers whose infrastructure or subcontractors involve the transfer of personal data outside the European Economic Area, such transfer takes place solely by applying the mechanisms provided for in the GDPR, in particular an adequacy decision or appropriate safeguards, where required.

11. Data subject rights

The data subject has the right — under the terms and within the limits set out in the GDPR — in particular to:

• access to personal data;
• to rectification of data;
• to erasure of data ("right to be forgotten"), if the statutory conditions are met;
• to restriction of processing;
• to data portability, where Article 20 of the GDPR applies;
• to object to processing based on a legitimate interest, including objection to direct marketing;
• to withdraw consent at any time, if processing is based on consent;
• to lodge a complaint with the President of the Personal Data Protection Office.

12. How to exercise your rights

Requests regarding rights related to data processing can be sent to m.kroc@arxmodular.com or to the correspondence address: 05-480 Karczew, ul. Częstochowska 43c.

The Controller may take steps to verify the identity of the person submitting a request if it is necessary for data security.

The Controller responds to requests without undue delay, no later than within the time limits resulting from the GDPR, taking into account the exceptions and possibilities for extending the deadline provided for in the regulations.

13. Automated decision-making and profiling

The Controller [DOES NOT APPLY / APPLIES — PLEASE COMPLETE] automated decision-making to website users that produces legal effects or similarly significantly affects them. If profiling is used, its scope, purposes, legal basis, and consequences for the data subject must be described.

14. Children's data

The website is not generally directed at children. The Controller does not intend to knowingly collect children's data to the extent that it is not necessary and legally permissible.

15. Security measures and the nature of the business

Due to the nature of the business involving the design, production, and supply of shelters, bunkers, and prefabricated concrete elements, the Controller may process commercial, technical, and organizational information related to customer inquiries. This information does not always constitute personal data. However, if it does contain personal data, it is protected in accordance with this Policy and internal information security rules.

16. Personal data breaches

The Controller implements procedures for identifying, assessing, documenting, and managing personal data breaches. In the event of a breach that may result in a risk to the rights or freedoms of natural persons, the Controller takes the actions provided for in the GDPR, including — where required by law — notifying the President of the Personal Data Protection Office (UODO) and the data subjects.

Two things to complete before publication: point 5 does not contain the correct content (only a sentence about periods, without specifying the purposes/legal bases), and point 13 has an incomplete placeholder "[DOES NOT APPLY / APPLIES]".