Privacy policy and data protection (GDPR).

Last updated: September 1, 2026.

1. Data controller

The controller of personal data is ODYLION SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ SPÓŁKA KOMANDYTOWA with its registered office at Syta 114z/1, 02-987 Warszawa (NIP 9512370578, REGON 146833994, KRS 0000474035). For matters concerning data protection you can contact us at iodo@odylion.com or by phone: +48 228 851 421.

2. Scope and purposes of processing

We process personal data for the following purposes:

• Material request form and contact — data provided in the material request form, via WhatsApp, phone or email (including name, phone number, email address, optional company name and VAT ID, description of the material, location) in order to prepare an offer and respond to the enquiry. Until submission, only structured draft choices, such as material and quantity range, are stored in the session storage of the current tab; phone numbers, email addresses, company names, VAT IDs, locations, notes, other free-text fields and photos are not stored there. Data from a submitted form is stored in our leads database (Supabase) and an email notification is sent (Resend) to our inbox. Optional material photos are stored in private Supabase Storage and made available to the team handling the enquiry only through secure, time-limited links.
• Concluding and performing transactions — data necessary to buy the material, settle payment and issue documents, including obligations arising from waste-management regulations.
• Newsletter and marketing — if you subscribe, we process your email address (stored in Supabase, delivered via Resend) to send commercial and industry information. The subscription becomes active only after email confirmation. You can withdraw consent at any time using the link in each message.
• Recruitment — data from submitted applications, solely for the purposes of the recruitment process being conducted.
• Statistics and improving the site — online identifiers and device and usage data (Google Analytics 4), only after consent to analytics cookies. We use them to create statistics and do not treat the source data as anonymous.
• Measuring advertising performance — after separate consent, OpenAI measurement (the Pixel and server-side Conversions API) and — when available — Google Ads may process online identifiers and information about an ad click and conversion, such as a submitted form, to attribute the conversion to a campaign and measure its performance. The server-side OpenAI event contains a technical deduplication UUID, the page address, time and available oppref and obref identifiers, but no form data. When automatic advanced matching is active, the Pixel recognises contact details in the form and hashes them with SHA-256 before sending; it does not send the raw values. Analytics consent is also required. We do not use these data for remarketing or ad personalisation.
• Serving and securing the site — technical data such as IP address, request time, requested URL and browser information are processed in hosting logs to deliver the site, detect abuse and diagnose errors. Map tiles are fetched from OpenFreeMap, whose server receives technical connection data. The nearest-branch search accepts only a city or postcode; our server-side proxy sends the query to Nominatim without passing on your browser's IP address. We derive the country of connection from the IP address in transit in order to serve the matching language version; we do not store that information or build profiles from it, and your choice in the language switcher takes precedence over it.
• Cooperation with business partners — data of the companies we work with and of the people they designate as contacts for commercial, logistics, BDO (waste register) and settlement matters: first and last name or department name, area of responsibility, business email address and phone number. We process them in order to conduct and settle the cooperation, pass documents to the right people and keep the data in our systems up to date. A business partner can confirm and update this data in a form made available under an individual link. We send information about offers only to the designated commercial contact and only through the channels for which a separate consent has been given — email, phone, WhatsApp or SMS. Each of these consents can be withdrawn at any time.

We receive the data of business partners and of their contact persons from the business partners themselves, from the people they designate, and also from public registers: the REGON register kept by Statistics Poland (Główny Urząd Statystyczny), the KRS company register, CEIDG and the list of VAT taxpayers. Where a contact person's data was provided to us by their employer or principal, the scope usually covers the first and last name or the department name, the area of responsibility and business contact details.

3. Legal bases

We process data under Article 6(1) GDPR: to take steps at your request and perform a contract (point b), comply with legal duties including tax and waste-management obligations (point c), and pursue legitimate interests such as correspondence, handling enquiries, defending claims, security and selecting the language version of the site (point f). Newsletter and commercial communications rely on voluntary consent (point a and applicable electronic-communications law). Recruitment relies on employment law, pre-contractual steps and, for additional data or future recruitment, consent. Google Analytics and optional advertising measurement by Google Ads and OpenAI Ads rely on the relevant consent to device storage or access and Article 6(1)(a) GDPR.

4. Data recipients and processors

Data may be received by infrastructure providers acting on our behalf and by operators of external channels you choose for contact. In particular we use:

• Vercel Inc. — hosting and site infrastructure (serving the website).
• Supabase — database of material requests (leads), private storage of optional material photos, and database of newsletter subscribers.
• Resend — sending email notifications about new enquiries and newsletter messages.
• Google Ireland Limited (Google Analytics 4 and Google Ads) — site-use statistics after analytics consent, where Google acts as our processor, and — if the feature is available and you give an additional, separate consent — advertising-performance measurement, in which Google acts as a separate controller. For later lead qualification and the first transaction, Data Manager receives only the click identifier, a random conversion identifier and the stage time — not the phone number, email, VAT ID, company name, notes, photos or city.
• OpenAI Ireland Limited (ChatGPT Ads) — conversion measurement after a click on an ad in ChatGPT through the Pixel and server-side Conversions API. After separate consent, OpenAI receives online identifiers (including oppref and a pseudonymous browser identifier), a technical deduplication UUID, event data, the current page address and time and — when automatic advanced matching is active in the Pixel — SHA-256 hashes of recognised contact details; the server-side event contains no raw form data. OpenAI generally acts as a separate controller under the Ad Tools Terms.
• Meta Platforms Ireland (WhatsApp) — operator of an external contact channel opened only when you choose the WhatsApp link. Meta also processes data under its own privacy terms.
• OpenFreeMap and OpenStreetMap Foundation (Nominatim) — map tile delivery and server-side geocoding of a city or postcode to identify the nearest branch.

Providers acting as our processors work under agreements and documented instructions. An external-channel operator may act as a separate controller. We may also share data with legally authorised bodies and, for transactions, carriers, postal operators and accounting providers. When handling cooperation with business partners, recipients also include providers of our corporate email and of the IT systems in which we keep business-partner records, trading documents and settlements.

5. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Depending on the provider and configuration, we rely on a European Commission adequacy decision (including the EU–US Data Privacy Framework) or on Standard Contractual Clauses and required safeguards. You may contact us for information about the applicable mechanism or a copy of it.

6. Retention period

We retain data no longer than the purpose and legal basis require: enquiries while they are handled and during any cooperation, then until the relevant limitation periods expire; transaction documents for legally required periods; newsletter data until consent is withdrawn and afterwards only to the limited extent needed to demonstrate consent history or defend claims; recruitment data until the relevant process ends. Technical logs are retained for the shortest period supported by the configured services; data relating to an incident may be secured for longer. An unsent form draft disappears when sent, cleared or when the tab closes. Photos linked to an enquiry follow its retention; unlinked uploads are automatically scheduled for deletion after 24 hours.

7. Your rights

In connection with the processing of your data, you have the right to:

• access to your data and to receive a copy of it,
• rectification (correction) of your data,
• erasure of your data or restriction of its processing,
• data portability,
• objecting to processing based on legitimate interest,
• withdrawing consent at any time (without affecting the lawfulness of processing carried out before withdrawal),
• lodging a complaint with the President of the Personal Data Protection Office.

8. Cookies, analytics and ads measurement

The site uses mechanisms needed to provide requested features and — only with your consent — Google Analytics 4. We enable OpenAI measurement through the Pixel and server-side Conversions API and — when available — Google Ads only after an additional, separate consent and with analytics enabled. We do not use advertising-measurement data for remarketing or ad personalisation. After the relevant consent is withdrawn, we stop further measurement and remove the measurement identifiers in that category accessible to us; we retain the refusal record so that it is respected after the page is reloaded. Categories, providers and retention are described in our cookie policy. You can change your consent choice at any time via the “Cookie settings” link in the footer; this route also tells the server to stop future quality events for remembered requests. If you deleted browser data first, withdraw for an existing request via rodo@odylion.com.

9. Voluntary provision of data

Providing data is voluntary, but fields marked as required are needed for the service you choose. We do not use advertising-measurement data for remarketing or ad personalisation; the measurement lets us attribute conversions to a campaign. Nor do we make decisions about you based solely on automated processing, or use profiling producing legal or similarly significant effects within the meaning of Article 22 GDPR. You may withdraw consent at any time in Cookie settings.

10. Contact

For matters relating to the protection of personal data, write to us at iodo@odylion.com or by post to our registered office: ODYLION SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ SPÓŁKA KOMANDYTOWA, Syta 114z/1, 02-987 Warszawa.