Privacy policy

We care about your privacy. Below, we explain what personal data we collect via the website renggli.pl, for what purpose and on what basis we process it, and what rights you have. We have drawn up this document in accordance with the GDPR, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council.

Data controller

The controller of your personal data is:

• RENGGLI Spółka z ograniczoną odpowiedzialnością
• ul. Handlowa 6A, 15-399 Białystok
• NIP: 5423234535, REGON: 200818266, KRS: 0000485655
• Email: biuro@renggli.pl
• Telephone: +48 85 710 18 77

For all matters relating to personal data, you may contact us at the email address above, by telephone or by post at our registered office address.

Data Protection Officer

We have not appointed a Data Protection Officer. For matters relating to data processing, please contact us at the address given above.

What data do we process, for what purpose and on what basis?

You can browse the website without providing any personal data. We process personal data only in the situations described below.

Contact form

When you use the contact form, we process: your first name and surname, email address, optionally your company name and telephone number, the content of your message, the list of products added to your quote enquiry (with variant and quantity) and confirmation that you have read the information on data processing (including the wording of this statement, the language of the website and the date and time of submission).

• Purpose: to respond to your enquiry, prepare a quotation and conduct correspondence; and, if the enquiry leads to a business relationship, to take steps prior to entering into a contract. We process your confirmation that you have read this information in order to demonstrate that the processing complies with the law.
• Legal basis: Article 6(1)(b) of the GDPR (pre-contractual measures) and Article 6(1)(f) of the GDPR (our legitimate interest in handling enquiries, conducting business correspondence, demonstrating the lawfulness of processing, and establishing, exercising and defending legal claims).

We will record your enquiry on the website and, at the same time, forward its content to the office email address Renggli so that we can reply to you.

Newsletter

When you subscribe to the newsletter, we process your email address, website language, the date and wording of your consent, and an irreversible hash of your IP address.

• Purpose: to send information about Renggli’s range and new products, and to show when and to what you have consented.
• Legal basis: Article 6(1)(a) of the GDPR (your consent) in conjunction with the provisions of the Electronic Communications Act relating to marketing. You may withdraw your consent at any time by clicking the ‘unsubscribe’ link in any message or by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

Website security and protection against spam

To protect our forms from misuse (spam, bots), we process your IP address when you submit a form, and when you subscribe to the newsletter, we only store an irreversible hash of your IP address.

• Purpose: to limit the number of requests from a single address (rate limiting) and to ensure the security and continuity of the website’s operation.
• Legal basis: Article 6(1)(f) of the GDPR (legitimate interest in securing the website). We do not permanently store the IP address itself: we process it for the short period necessary for the security measures to function.

Google map on the Contact page

On the Contact page, we have embedded an interactive map showing how to get to our headquarters. The map loads automatically along with the page, rather than after clicking or giving consent. Google, as the provider of this service, may thereby gain access to information about your device, including your IP address, and set its own cookies.

• Purpose: to provide the location of our headquarters to people planning to visit us.
• Legal basis: Article 6(1)(f) of the GDPR (legitimate interest in indicating the location of the registered office). You may object to this processing by writing to our email address, and you may block the map itself by disabling third-party cookies in your browser.

Visitor statistics without cookies

We count page views, navigation between pages, clicks, page errors and the sources of visits (for example, the advertising campaign a visit came from). We do this with PostHog, Ahrefs Web Analytics and Cloudflare Web Analytics, including before you make a decision in the cookie banner and when you choose ‘Essential only’. These tools store nothing on your device. They process your IP address and browser data (type of device and browser, language, screen size, referring page). PostHog and Ahrefs use them to calculate a hash that links page views from a single day, together with a random value that changes daily; they do not store the IP address (in the case of Ahrefs, according to the provider’s assurances), and on the following day page views can no longer be linked to the same browser. We do not know who you are, and we do not combine these statistics with any other data.

• Purpose: visitor statistics for the website, evaluation of content and advertising campaigns, error detection and measurement of page speed.
• Legal basis: Article 6(1)(f) of the GDPR (legitimate interest in keeping statistics on the website and assessing the effectiveness of our activities). You may object to this processing by writing to biuro@renggli.pl.

Counting enquiries sent and newsletter sign-ups

When you submit the contact form or sign up for the newsletter, our server notifies PostHog. Without your consent to analytics cookies, this event contains neither your contact details nor an identifier of your browser. For an enquiry, it covers the products in the enquiry, the language and address of the page with the form, and the campaign the visit came from (UTM parameters, advertising network and landing page); for a newsletter sign-up, it covers the website language and where you signed up. In both cases, we do not attach your IP address or a location derived from it to the event.

• Purpose: to know how many enquiries and sign-ups the website brings in, for which products and from which campaigns.
• Legal basis: Article 6(1)(f) of the GDPR (legitimate interest in assessing the effectiveness of the website and campaigns). You may object to this processing by writing to our email address.

Analytics and session recordings with your consent

If you consent to analytics cookies, PostHog stores an identifier in your browser, recognises the browser on subsequent visits and combines these visits into a visit history: page views, clicks, the source of your first visit, your IP address and the approximate location determined from it. It also records the course of your visit: cursor movements, clicks, scrolling and the appearance of the page, what you type into form fields (except passwords), technical browser messages, and the content and headers of requests sent by the page, including the content of a submitted form.

• Purpose: to understand how visitors use the website, to improve its operation and content, and to detect errors.
• Legal basis: Article 6(1)(a) of the GDPR (your consent) in conjunction with Article 399 of the Electronic Communications Act. You may withdraw your consent at any time via the Cookie settings link in the website footer. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

Linking a quote enquiry to your visit history

If you have consented to analytics cookies and send a quote enquiry, a profile of you is created in PostHog. In it, we combine the data from the form (first name and surname, email address, telephone number, company name, website language, date of the first and the last enquiry) with your visit history and the source of your first visit (campaign parameters, advertising network, advert click identifier and referring page). We recognise the profile by the email address, so a further enquiry, including one from another device, is added to the same profile. This lets our sales team see which products were viewed before the enquiry, and lets us know which campaigns bring in enquiries. Without consent, we do not link enquiries to visit history.

• Purpose: to respond better to your enquiry and to assess the effectiveness of campaigns.
• Legal basis: Article 6(1)(a) of the GDPR (your consent). After you withdraw your consent, the profile is no longer updated; if you want it deleted before the period stated below, write to our email address.

Measuring traffic and the effectiveness of Google adverts

We use Google Tag Manager to run Google Analytics and Google Ads tags, which measure conversions (whether a visit from an advert ended with an enquiry) and are used for remarketing, i.e. showing Renggli adverts to people who have visited the website. The campaigns and the tag configuration are run on our behalf by the agency Infinity Group. The tags work in Google Consent Mode and treat consent as refused by default.

Google Analytics uses cookies once you consent to analytics cookies, and Google Ads once you consent to marketing cookies. Without consent to a given category, Google tags neither store nor read its cookies. They send Google only cookieless signals: the time, browser data, the referring page, the consent status, a random number generated each time a page loads and whether the visit came from an advert, without the click identifier. Google receives the IP address of your device in the process and, according to its own assurances, does not store it in Google Analytics. Google uses these signals for aggregate estimates of traffic and conversions. When an enquiry is sent, the tags then only receive the information that the form was submitted and the website language.

After you consent to analytics cookies, Google Analytics stores identifiers in cookies and measures traffic on the website. After you consent to marketing cookies, Google Ads checks whether a visit from an advert ended with an enquiry and may show you Renggli adverts on other websites, and after you send an enquiry, we pass your first name and surname, email address and telephone number to the Google tags, and the Google tag converts them into hashes (SHA-256) before sending them, so that Google Ads can attribute the enquiry to the advert click (enhanced conversions).

• Purpose: traffic statistics, measuring the effectiveness of Google adverts and showing adverts to people who have visited the website.
• Legal basis: for cookies, measurement after consent, enhanced conversions and remarketing, Article 6(1)(a) of the GDPR (your consent) in conjunction with Article 399 of the Electronic Communications Act; for cookieless signals sent without consent, Article 6(1)(f) of the GDPR (legitimate interest in aggregate measurement of advertising effectiveness), to which you may object. For Google Analytics and enhanced conversions, Google processes data on our behalf, and for the other Google Ads functions it acts as a separate controller, on the terms described in Google’s privacy policy and on the page How Google uses information from sites or apps that use its services.

Cookie consent register

We record every decision made in the cookie banner, including a refusal, a change of mind and closing the banner, in the consent register in the website’s database. An entry contains the random identifier of your browser (the same one that we store with the decision in its local storage), your choice in the ‘Analytics’ and ‘Marketing’ categories, the type of decision, the banner version, the language and address of the page, and the date and time. We do not record your IP address or any other data that would allow us to identify you.

• Purpose: to demonstrate that consent to cookies was given or withdrawn, and when.
• Legal basis: Article 6(1)(c) in conjunction with Article 7(1) of the GDPR (the obligation to demonstrate consent) and Article 6(1)(f) of the GDPR (legitimate interest in establishing, exercising or defending legal claims).

Data recipients

To operate our website, we use trusted service providers who process data on our behalf (data processors), on the basis of data processing agreements:

• Vercel Inc.: hosting and website delivery; server functions are operated from a data centre in Frankfurt, whilst files, including images, are stored on the Vercel Blob service, also in Frankfurt.
• Neon, LLC (a company within the Databricks group): the website’s database, in which we store form submissions, newsletter addresses and the cookie consent register; the data is stored in a data centre in Frankfurt.
• Plus Five Five, Inc., the operator of the Resend service: sending messages from the form and the newsletter.
• PostHog Inc.: visitor statistics, session recordings and linking enquiries to visit history; the data is stored in a data centre in Frankfurt.
• Google Ireland Limited: Google Tag Manager, Google Analytics and Google Ads enhanced conversions.
• Cloudflare, Inc.: visitor statistics and page speed measurement (Cloudflare Web Analytics).
• Ahrefs Pte. Ltd., based in Singapore: visitor statistics (Ahrefs Web Analytics).
• Infinity Group: an agency that runs our advertising campaigns and configures the Google tags on our behalf, with access to Google Analytics and Google Ads statistics.
• Outofplace: technical support and maintenance of the website.
• Email service provider for the Renggli office: storage of messages received in the office’s inbox.

Apart from the processors, Google Ireland Limited may receive data: automatically when you visit the Contact page, where we load the directions map, and for Google Ads (conversion tracking and remarketing), where Google acts as a separate controller. Data may also be disclosed to public authorities and other entities authorised by law.

We do not sell data. Apart from Google Ads, described above, we do not share it with other companies for their own marketing purposes.

Transfer of data outside the European Economic Area

Vercel, Neon, Resend, PostHog, Google and Cloudflare have their headquarters or parent companies in the United States. Although the website’s server functions, database and files as well as the data in PostHog are stored in Frankfurt, these providers may also process data in the US, for example when handling traffic, sending messages or carrying out maintenance work. The transfer takes place on the basis of Commission Implementing Decision (EU) 2023/1795, which recognises an adequate level of protection under the EU-US Data Privacy Framework (Article 45 of the GDPR), in which these providers participate, and the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (Article 46(2)(c) of the GDPR). You can obtain information about the safeguards in place by contacting us.

Ahrefs Pte. Ltd. is based in Singapore and, according to its privacy policy, stores data in the United States. The European Commission has not issued an adequacy decision for Singapore, and Ahrefs does not participate in the EU-US Data Privacy Framework, so data is transferred to Ahrefs on the basis of standard contractual clauses (Article 46(2)(c) of the GDPR).

How long do we retain data?

• Enquiries submitted via the contact form: 12 months from the date of submission, after which they are automatically deleted. If we enter into a contract, we retain the data necessary for its performance and settlement until the expiry of the limitation periods for claims and for the period required by tax and accounting regulations.
• Confirmation of having read the information and the status of messages sent to the office: we retain these for the same period as the notification itself, and delete them at the same time.
• Newsletter: until consent is withdrawn (unsubscription).
• Cookie consent register: 3 years from the decision.
• IP address and its hash (website security): IP address stored temporarily, without permanent recording; the hash recorded upon consent to the newsletter is deleted along with the subscription.
• Data provided to Google when visiting the ‘Contact’ page: we do not store this data; Google stores it in accordance with its own privacy policy.
• Visitor statistics without cookies: we keep events in PostHog, without the IP address and without a persistent browser identifier, for up to 12 months. The random value from which PostHog and Ahrefs calculate the hash linking page views is deleted after one day. Cloudflare keeps the full measurement data for 7 days and after that only an aggregated sample.
• Events about a sent enquiry or a newsletter sign-up in PostHog: up to 12 months.
• Visit history in PostHog with your consent: up to 12 months; session recordings: 30 days.
• PostHog profile linked to a quote enquiry: 12 months from the last enquiry, the same as the form submission, or less if you ask us to delete the data earlier.
• Google Analytics: data linked to cookie identifiers for the period set in the service, no longer than 14 months; aggregated reports without data on individual people may be kept longer.
• Google Ads: Google keeps the data as a separate controller, in accordance with its own privacy policy; Google Ads cookies in your browser expire after 90 days.

Your rights

In connection with the processing of your data, you have the right to:

• access their data and obtain a copy of it,
• rectification (correction) of data,
• deletion of data,
• restrictions on processing,
• to object to processing based on a legitimate interest, on grounds relating to your particular situation,
• data transfer,
• withdraw consent at any time, to the extent that processing is based on consent.

To exercise these rights, please write to us at the email address provided in the ‘Data Controller’ section. We will respond without undue delay, and no later than one month after receiving your request.

Complaint to the supervisory authority

If you believe that we are processing your data unlawfully, you have the right to lodge a complaint with the Polish supervisory authority, namely the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl. You may also lodge a complaint in the European Union country where you live, work or where the infringement occurred (Article 77 of the GDPR).

Voluntary provision of data

Providing your details is voluntary, but necessary to use this function: without your full name, email address, message content and confirmation that you have read the information, you will not be able to submit the form, and without an email address, we will not be able to subscribe you to the newsletter. Company name and telephone number are optional. Instead of using the form, you can write to us directly or give us a call. Consents to analytics and marketing cookies are voluntary: the website works the same without them.

Profiling and automated decisions

We do not make decisions regarding you based solely on automated processing, including profiling, which would produce legal effects or similarly significantly affect you (Article 22 of the GDPR). With your consent, we combine the history of your visits with the data from your quote enquiry in order to respond to it better and to assess the effectiveness of campaigns, and Google Ads may show you Renggli adverts based on your visits (remarketing). Without consent, we do not create a profile and do not recognise you on subsequent visits.

Cookies

The rules governing the use of cookies and similar technologies, a full list of the files stored, and how to change your settings via the banner are set out in a separate document: Cookie policy. The terms of use for the website are set out at Terms of service.

Changes to the privacy policy

We may update this policy, for example, if legislation changes, or if there are changes to how the website operates or to the suppliers whose services we use. The current version is always available on this page, and the date of the last update is shown at the top of the document.

This policy is a translation of the Polish original. In the event of any discrepancy between the language versions, the Polish version prevails.