Privacy policy and data protection (GDPR).

Last updated: August 2026.

1. Data controller

The controller of personal data is ODYLION SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ SPÓŁKA KOMANDYTOWA with its registered office at Syta 114z/1, 02-987 Warszawa (NIP 9512370578, REGON 146833994, KRS 0000474035). For matters concerning data protection you can contact us at iodo@odylion.com or by phone: +48 228 851 421.

2. Scope and purposes of processing

We process personal data for the following purposes:

• Material request form and contact — data provided in the material request form, via WhatsApp, phone or email (including name, phone number, email address, optional company name and VAT ID, description of the material, location) in order to prepare an offer and respond to the enquiry. Until submission, only structured draft choices, such as material and quantity range, are stored in the session storage of the current tab; phone numbers, email addresses, company names, VAT IDs, locations, notes, other free-text fields and photos are not stored there. Data from a submitted form is stored in our leads database (Supabase) and an email notification is sent (Resend) to our inbox. Optional material photos are stored in private Supabase Storage and made available to the team handling the enquiry only through secure, time-limited links.
• Concluding and performing transactions — data necessary to buy the material, settle payment and issue documents, including obligations arising from waste-management regulations.
• Newsletter and marketing — if you subscribe, we process your email address (stored in Supabase, delivered via Resend) to send commercial and industry information. The subscription becomes active only after email confirmation. You can withdraw consent at any time using the link in each message.
• Recruitment — data from submitted applications, solely for the purposes of the recruitment process being conducted.
• Statistics and improving the site — online identifiers and device and usage data (Google Analytics 4), only after consent to analytics cookies. We use them to create statistics and do not treat the source data as anonymous.
• Measuring advertising performance — when this feature is available and you give separate consent, Google Ads may process online identifiers and information about an ad click and conversion, such as a submitted form. Analytics consent is also required. We do not use this measurement for remarketing, ad personalisation or marketing profiling.
• Serving and securing the site — technical data such as IP address, request time, requested URL and browser information are processed in hosting logs to deliver the site, detect abuse and diagnose errors. Map tiles are fetched from OpenFreeMap, whose server receives technical connection data. The nearest-branch search accepts only a city or postcode; our server-side proxy sends the query to Nominatim without passing on your browser's IP address. We derive the country of connection from the IP address in transit in order to serve the matching language version; we do not store that information or build profiles from it, and your choice in the language switcher takes precedence over it.

3. Legal bases

We process data under Article 6(1) GDPR: to take steps at your request and perform a contract (point b), comply with legal duties including tax and waste-management obligations (point c), and pursue legitimate interests such as correspondence, handling enquiries, defending claims, security and selecting the language version of the site (point f). Newsletter and commercial communications rely on voluntary consent (point a and applicable electronic-communications law). Recruitment relies on employment law, pre-contractual steps and, for additional data or future recruitment, consent. Google Analytics and optional Google Ads measurement rely on the relevant consent to device storage or access and Article 6(1)(a) GDPR.

4. Data recipients and processors

Data may be received by infrastructure providers acting on our behalf and by operators of external channels you choose for contact. In particular we use:

• Vercel Inc. — hosting and site infrastructure (serving the website).
• Supabase — database of material requests (leads), private storage of optional material photos, and database of newsletter subscribers.
• Resend — sending email notifications about new enquiries and newsletter messages.
• Google Ireland Limited (Google Analytics 4 and Google Ads) — site-use statistics after analytics consent, where Google acts as our processor, and — if the feature is available and you give an additional, separate consent — advertising-performance measurement, in which Google acts as a separate controller and also processes the data for its own purposes under its own privacy policy.
• Meta Platforms Ireland (WhatsApp) — operator of an external contact channel opened only when you choose the WhatsApp link. Meta also processes data under its own privacy terms.
• OpenFreeMap and OpenStreetMap Foundation (Nominatim) — map tile delivery and server-side geocoding of a city or postcode to identify the nearest branch.

Providers acting as our processors work under agreements and documented instructions. An external-channel operator may act as a separate controller. We may also share data with legally authorised bodies and, for transactions, carriers, postal operators and accounting providers.

5. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Depending on the provider and configuration, we rely on a European Commission adequacy decision (including the EU–US Data Privacy Framework) or on Standard Contractual Clauses and required safeguards. You may contact us for information about the applicable mechanism or a copy of it.

6. Retention period

We retain data no longer than the purpose and legal basis require: enquiries while they are handled and during any cooperation, then until the relevant limitation periods expire; transaction documents for legally required periods; newsletter data until consent is withdrawn and afterwards only to the limited extent needed to demonstrate consent history or defend claims; recruitment data until the relevant process ends. Technical logs are retained for the shortest period supported by the configured services; data relating to an incident may be secured for longer. An unsent form draft disappears when sent, cleared or when the tab closes. Photos linked to an enquiry follow its retention; unlinked uploads are automatically scheduled for deletion after 24 hours.

7. Your rights

In connection with the processing of your data, you have the right to:

• access to your data and to receive a copy of it,
• rectification (correction) of your data,
• erasure of your data or restriction of its processing,
• data portability,
• objecting to processing based on legitimate interest,
• withdrawing consent at any time (without affecting the lawfulness of processing carried out before withdrawal),
• lodging a complaint with the President of the Personal Data Protection Office.

8. Cookies, analytics and ads measurement

The site uses mechanisms needed to provide requested features and — only with your consent — Google Analytics 4. When Google Ads measurement is available, we enable it only after an additional, separate consent and with analytics enabled. We do not use it for remarketing or ad personalisation. After the relevant consent is withdrawn, we stop further measurement and remove cookies and localStorage identifiers in that category accessible to us. Categories, providers and retention are described in our cookie policy. You can change your consent choice at any time via the „Cookie settings” link in the footer.

9. Voluntary provision of data

Providing data is voluntary, but fields marked as required are needed for the service you choose. We do not run remarketing or personalised advertising — advertising measurement serves only to attribute conversions to a campaign and does not build audience profiles. Nor do we make decisions about you based solely on automated processing, or use profiling producing legal or similarly significant effects within the meaning of Article 22 GDPR. You may withdraw consent at any time in Cookie settings.

10. Contact

For matters relating to the protection of personal data, write to us at iodo@odylion.com or by post to our registered office: ODYLION SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ SPÓŁKA KOMANDYTOWA, Syta 114z/1, 02-987 Warszawa.