Privacy and cookie policy
Last updated: 4 September 2026.
1. Controller and contact
The data controller is EMFAL sp. z o.o., registered in Pyzówka, ul. Władysława Orkana 13C, 34-404 Pyzówka, Poland, KRS 0001179308, NIP 7352933272, REGON 542028697. Privacy enquiries may be sent to emfal@emfal.pl.
2. Data processed and purposes
Website operation and security
When you use the website, technical data such as the IP address, request time, requested URL, browser and device information and diagnostic data may be processed. They are used to deliver the website, prevent abuse, diagnose errors and protect legal claims. The legal basis is the controller’s legitimate interest (Article 6(1)(f) GDPR).
Google Analytics 4
After you give consent, we use Google Analytics 4 (measurement ID G-F06BQQNTYL) to measure visits, traffic sources, the selected language and clicks on contact details. The legal basis is consent (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law). We do not use Analytics for advertising or advertising profiling.
Contact, enquiries and service
If you contact us by email or telephone, we may process your name, company details, email address, telephone number and message. The data are used to answer the enquiry, prepare or perform cooperation, or provide service support. The legal basis is taking steps at your request before entering into and performing a contract (Article 6(1)(b) GDPR), legal obligations (point c) or the legitimate interest in handling correspondence and protecting claims (point f).
3. Recipients and data transfers
Recipients may include hosting, CDN, traffic-security, email, IT and analytics providers, advisers and public bodies authorised by law. Google Ireland Limited receives Analytics data, and Cloudflare services protect website traffic.
Some providers may process data outside the European Economic Area. In such cases, transfers rely on a European Commission adequacy decision or Standard Contractual Clauses and supplementary safeguards required by the GDPR.
4. Retention periods
- standard technical and security data — normally no longer than 30 days, unless needed to investigate an incident or claim;
- Analytics user-level and event data — no longer than 14 months; aggregated reports may remain available longer;
- enquiries that do not lead to cooperation — up to 12 months after correspondence ends;
- contract, warranty or service data — for the performance period and the applicable statutory and limitation periods.
5. Cookies and browser storage
| Name | Provider and purpose | Duration |
|---|---|---|
emfal_analytics_consent | EMFAL — stores the privacy choice in the browser’s local storage | 6 months |
__cf_bm | Cloudflare — protection against automated and malicious traffic | about 30 minutes |
_ga, _ga_* | Google Analytics — distinguishes sessions and measures traffic, only after consent | up to 6 months |
Mechanisms necessary for security and for remembering the privacy choice operate without consent. Analytics starts only after consent. The choice can be changed at any time with the “Privacy” button; after consent is withdrawn, the website blocks Analytics and removes the analytics cookies available to it. Cookies can also be deleted in browser settings.
6. Voluntary provision and rights
Providing data in an enquiry is voluntary, but without contact details we may be unable to reply. Analytics consent is voluntary and refusing it does not restrict use of the website.
You may request access, rectification, erasure, restriction and, where applicable, portability; object to processing based on legitimate interests; and withdraw consent without affecting prior lawful processing. You may lodge a complaint with the President of the Polish Personal Data Protection Office. We do not use automated decision-making or advertising profiling.
7. Changes to this policy
We update this policy when the website’s functions, providers or applicable law change. The update date appears at the beginning of the document.