Privacy and Cookie Policy
Effective from: 4 September 2026
1. Controller
The controller is BFZ Sp. z o.o., ul. Przemysłowa 9A, 59-700 Bolesławiec, Poland, KRS 0000478678, NIP 8982222053, REGON 363491910 (“BFZ”, “we”). Privacy enquiries may be sent to info@bfz.pl or by post to our registered office.
2. Data, purposes and legal bases
- Enquiries and quotations: name, company, email, phone number, message, selected product and any voluntarily attached file. We use these data to respond, prepare a quotation and take pre-contractual steps (Article 6(1)(b) GDPR), and for business correspondence, customer service and the establishment or defence of claims based on our legitimate interests (Article 6(1)(f) GDPR).
- Contracts and accounting: data are processed to perform contracts, meet tax and accounting duties and establish or defend claims (Article 6(1)(b), (c) and (f) GDPR).
- Website security: IP address, request time, visited address and browser/system data may be included in server logs to ensure security, diagnose errors and prevent abuse (Article 6(1)(f) GDPR).
- Analytics and advertising: Google Analytics 4 and Google Ads are activated only after voluntary consent to measure website use and advertising performance (Article 6(1)(a) GDPR and applicable rules on storage of, or access to, information on a user’s device).
- Google Maps and CallPage: both services are loaded only after consent. CallPage may process the phone number supplied and technical data to fulfil a callback request (Article 6(1)(a) GDPR and, after the request, Article 6(1)(b) GDPR).
Providing data is voluntary, but required fields are necessary to handle the enquiry. Please do not attach special-category data or documents that are not needed for the quotation.
3. Recipients
Data may be made available, where necessary, to providers of hosting, email, IT maintenance, accounting, legal and delivery services. Depending on consent, recipients may include Google Ireland Limited (Tag Manager, Analytics 4, Ads and Maps) and CallPage sp. z o.o. (callback service). If you choose to visit Facebook, Instagram or WhatsApp, data may be received by Meta Platforms Ireland Limited.
Google Tag Manager manages tags and does not create a separate user profile. The GA4 event sent after a successful form submission contains no form content, name, email address or phone number.
4. Transfers outside the EEA
Technology providers may process data outside the EEA. Where this occurs, transfers rely on an appropriate GDPR mechanism, such as an adequacy decision, the provider’s participation in the EU–US Data Privacy Framework, or Standard Contractual Clauses with supplementary safeguards where required.
5. Retention
- enquiries — until the matter is completed and then until possible claims become time-barred;
- contractual, tax and accounting records — for the period required by law;
- technical logs — for as long as needed for security and diagnostics under the hosting settings;
- GA4 event-level data — 2 months; user-level data — 14 months; the user identifier period resets on new activity. Standard aggregated reports may remain available for longer;
- the privacy choice stored in the browser — until changed, deletion or a maximum of 180 days.
6. Cookies and similar technologies
Before consent, we do not load Google Tag Manager, Google Analytics, Google advertising functions, Google Maps or CallPage. Essential storage is used only for operation, security and remembering your privacy choice.
| Category | Purpose | Examples / period |
|---|---|---|
| Essential | Operation, security and privacy choice | bfz_consent_v2 in local storage until changed, a new policy version, deletion, or a maximum of 180 days; technical server session until the session ends |
| Analytics | Visit statistics and submitted-form measurement | GA4, e.g. _ga, _ga_*; consent only, up to 2 years under Google settings |
| Advertising | Attribution and evaluation of Google Ads campaigns | Google identifiers, e.g. _gcl_*; consent only, period according to provider settings |
| Functional | Map and callback request | Google Maps and CallPage; consent only, period depends on the service |
7. Managing consent
You may choose “Accept all”, “Necessary only” or “Customise” and set analytics, advertising, and map/callback separately. Consents can be withdrawn or granted again at any time using “Privacy settings” in the footer. Withdrawal does not affect the lawfulness of earlier processing. Cookies can also be removed in browser settings.
8. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. Contact info@bfz.pl. You may also lodge a complaint with a competent data protection authority, particularly in the country of your habitual residence, place of work or the alleged infringement.
9. Profiling and automated decisions
After consent, advertising services may attribute visits and enquiries to campaigns and optimise advertising automatically. BFZ does not make decisions based solely on automated processing that produce legal or similarly significant effects for you.
10. External links, security and changes
Links to Google Maps, YouTube, Facebook, Instagram and WhatsApp lead to services controlled by other organisations. Their privacy rules apply after you click. We use appropriate organisational and technical safeguards, although internet transmission cannot be entirely risk-free. This policy may be updated when laws, website functions or providers change.