Privacy and cookies
Your data.
Clear information.
How personal data is processed when you visit ironworkers.pl or contact our team.
Updated: 5 October 2026
- The configurator stores enquiries and, once sales are enabled, orders and files.
- We have not added advertising or analytics tools.
- Our administration team handles privacy enquiries.
1. Controller and contact
The controller is Iron Workers Sp. z o.o., ul. Batalionów Chłopskich 38/38, 70-764 Szczecin, Poland; KRS 0000913735, NIP 9552558466.
Privacy contact: p.tokarek@ironworkers.pl — Paulina Tokarek, administration. You may also write to our registered address. We have not appointed a data protection officer.
2. Contact and quotation enquiries
We process details you provide in correspondence or a conversation: your name, company details, email address, any phone number you give us, and your enquiry and attachments. Please provide only information needed to deal with your request.
- Preparing a quotation or performing a contract where you are a party: Article 6(1)(b) GDPR.
- Contact with company representatives and other correspondence: Article 6(1)(f) GDPR. Our legitimate interest is handling enquiries and business relationships.
- Legal obligations arising from a contract, such as accounting: Article 6(1)(c) GDPR.
- Establishing, exercising or defending legal claims where necessary: Article 6(1)(f) GDPR.
Providing data in an enquiry is voluntary. Without details of your request and a way to contact you, we may be unable to reply or prepare a quotation. Ordinary contact does not require marketing consent.
3. How the enquiry tool works
The configurator creates a browser preview and sends part parameters to the server for pricing. When you select a DXF for import, we upload and store its original and analysis result in protected hosting storage. Subsequent calculations use the import reference. Importing or calculating a price alone does not create an enquiry or order.
A working import remains accessible for 7 days. It then expires, and its files are removed during cleanup triggered by subsequent imports. Originals attached to submitted enquiries and orders are saved separately and follow the retention periods described in this notice. The cart, including parameters and a DXF copy, is also stored locally in the browser on your device.
Submitting the enquiry stores your name and email, optional contact/company/delivery details and comments, the specification, quantity, indicative price, one-part DXF and preview. Imported original DXF files are retained with the enquiry. Records and files use the hosting provider described below; access is restricted to authorised staff. Customer files are not published.
Provide only details needed for your enquiry. Downloading a DXF saves a file on your device. Existing email links and the short homepage form may still open your email app, where you send the message yourself. An enquiry is not a purchase or payment. A person verifies the final quotation; we do not perform marketing profiling.
4. Website operation and recipients
Serving and protecting the website involves technical data such as your IP address, request time, requested address and browser details. Keeping the website available and secure is our legitimate interest under Article 6(1)(f) GDPR. Separate rules apply to storing and reading cookies, as described below.
Recipients may include authorised members of our company, hosting and security providers (OpenAI / ChatGPT Sites and Cloudflare infrastructure), our business email provider (Microsoft 365), and, where needed, IT support, legal advisers and competent authorities. Data is shared to the extent needed for the relevant service or obligation.
5. Processing outside the EEA
Providers use global infrastructure, so data may be processed outside the European Economic Area, including in the USA. ChatGPT Sites does not guarantee storage exclusively within the EEA.
The Sites data processing terms provide for Standard Contractual Clauses or a European Commission adequacy decision for transfers from the EEA. Provider information: Sites data processing terms and Microsoft data protection terms. Contact our administration team for information about the safeguards applying to your data and how to obtain a copy.
6. Retention
We retain correspondence for as long as needed to handle an enquiry and related discussions. If it leads to a business relationship, the data becomes part of its documentation. Documents subject to legal retention requirements are kept for the period required by applicable law.
Where data is needed for legal claims, we take into account the relevant limitation period and any proceedings. Once the purpose and obligations end, the data should be deleted or anonymised. Cookie durations are described below; specific platform log retention periods require confirmation from the hosting provider.
7. Your rights
You may request access, rectification, erasure or restriction of processing under the conditions set out in the GDPR. Data portability applies to automated processing based on consent or a contract.
You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
Send requests to our administration team. You may also complain to the President of the Polish Personal Data Protection Office (UODO) or a competent supervisory authority in the country of your habitual residence, workplace or the alleged infringement.
9. Maps and social media
Links to Google Maps, TikTok and Instagram open external services. We do not load their embedded maps or videos. After you follow a link, the service processes data under its own rules: Google, TikTok, Instagram.
This notice describes the current website. Changes to enquiry handling, payment providers or measurement tools will require updated information and appropriate privacy settings.
10. Orders, payments and confirmations
For purchases, we store contact and billing details, company name and Polish tax ID where applicable, part specification, DXF, quantity, price, finishing, collection, the accepted terms and acknowledgements, and payment and fulfilment statuses. Processing is necessary to conclude and perform the contract (Article 6(1)(b) GDPR), comply with accounting obligations (c), and handle business contacts, security and claims (f). Acknowledging the privacy notice is not marketing consent or a consent required to perform the contract.
Once payments are enabled, Przelewy24 / PayPro SA receives the order reference, amount, currency, email and required payer details. The store does not retain bank credentials or BLIK codes. PayPro also acts as an independent controller under its payer privacy information.
Transactional confirmations are prepared for delivery through Resend once that service is configured. It receives the email address and confirmation content including order details; this channel is not used for marketing. Appropriate processor terms and safeguards for transfers outside the EEA are required. Microsoft 365 continues to handle business correspondence. Orders and files remain in the protected database and file storage described in the hosting section.
Order data is retained for fulfilment and after-sales support, followed by applicable tax/accounting retention periods or periods necessary for legal claims. Unpaid order data is used to reconcile payments and handle incomplete purchases, and is deleted or anonymised once these purposes and legal requirements cease. Accepted specifications and terms are retained as evidence of the contract.
The private status link grants access to the order and its documents. Do not share it. Payment credentials are stored server-side only. Test payments do not create production jobs.