Data protection
and transparent rules.

Basic information about data submitted through the Mega Mold website.

PRIVACY POLICY

Last updated: 07-10-2026

1. General provisions

This Privacy Policy sets out the rules for processing the personal data of people using the website available at megamold.pl (the “Website”).

This Policy applies to personal data processed in connection with use of the Website, in particular use of the contact form and quotation request form and the submission of technical documentation through the Website.

The Controller exercises due care to ensure the security of the personal data it processes and to protect the privacy of people using the Website.

This Policy has been prepared with particular regard to:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”);
the Polish Act of 10 May 2018 on the Protection of Personal Data;
the Polish Act of 12 July 2024 – Electronic Communications Law;
other applicable laws concerning personal data protection and privacy.

2. Personal data controller

The controller of personal data processed in connection with use of the Website is:

Mega Mold Sp. z o.o.
Jasionka 252E
36-002 Jasionka, Poland
NIP (tax identification number): 517-024-04-09
REGON (statistical identification number): 180289370
KRS (National Court Register number): 0000297136

hereinafter referred to as the “Controller”.

For matters relating to the processing of personal data, the Controller can be contacted:

by e-mail: info@megamold.pl

or in writing at the Controller’s registered office address.

The Controller has not appointed a Data Protection Officer if the obligation to appoint one does not arise under applicable law.

If the Controller appoints a Data Protection Officer, their contact details will be made available on the Website and this Privacy Policy will be updated accordingly.

3. Personal data that may be processed

Depending on how the Website is used, the Controller may process, in particular:

first name and surname;
company name;
e-mail address;
telephone number;
information about a job title or professional role;
project name;
information about the project completion date;
information about quantity or volume;
information about the expected deadline for preparing a quotation;
the content of messages and enquiries;
information contained in submitted technical documentation;
personal data contained in submitted files, if such data has been included in them;
IP address;
information about the device and web browser;
technical information relating to use of the Website.

The Controller applies the data minimisation principle and processes only data that is adequate, relevant and limited to what is necessary for the specified purposes.

4. Purposes of personal data processing

Personal data may be processed in particular to:

handle messages submitted through the contact form;
handle quotation requests;
prepare responses and quotations concerning the Controller’s services;
conduct correspondence relating to an enquiry;
analyse information and technical documentation submitted in connection with a quotation request;
take steps at a person’s request before entering into a contract;
enter into and perform a contract, if one is concluded;
ensure the proper operation and security of the Website;
detect and prevent attempted unauthorised access or other abuse;
establish, pursue or defend legal claims;
fulfil obligations arising under the law.

5. Legal bases for processing

The Controller processes personal data on one or more of the legal bases set out in Article 6(1) of the GDPR, as appropriate to the specific purpose of processing.

5.1. Steps taken before entering into a contract

If a person contacts the Controller to obtain information about services, request a quotation or take other steps at their request before entering into a contract, processing may be necessary to take those steps under Article 6(1)(b) of the GDPR.

5.2. Legitimate interests of the Controller

Under Article 6(1)(f) of the GDPR, data may be processed to pursue the Controller’s legitimate interests, in particular to:

conduct business communications;
handle enquiries and correspondence;
prepare quotations;
ensure the security of the Website;
prevent abuse;
protect IT infrastructure;
establish, pursue and defend legal claims;
ensure the continuity and proper operation of the Website.

Before relying on this basis, the Controller assesses whether its interests are overridden by the interests or fundamental rights and freedoms of the person concerned.

5.3. Legal obligation

Under Article 6(1)(c) of the GDPR, data may be processed to the extent necessary to comply with legal obligations imposed on the Controller.

5.4. Consent

Where processing in a particular case requires consent, data will be processed under Article 6(1)(a) of the GDPR.

Consent is voluntary and may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Withdrawal of consent does not prevent further processing where the Controller has another valid legal basis for processing the data.

6. Contact form and quotation requests

The Website enables users to contact the Controller and submit quotation requests.

Through the form, a user may provide in particular:

first name and surname;
company name;
e-mail address;
telephone number;
project name;
completion date;
quantity or volume;
expected deadline for preparing a quotation;
the content of the enquiry;
technical documentation.

Data provided in the form is used to handle the enquiry, respond, prepare a quotation and conduct related correspondence.

Providing data marked as required in the form is voluntary, but may be necessary to respond or prepare a quotation.

The Controller does not make the handling of an ordinary quotation request conditional on consent to data processing where another appropriate legal basis under Article 6(1) of the GDPR exists for that processing.

Detailed information on the processing of personal data is available in this Privacy Policy.

7. Technical documentation submitted through the form

A user may submit technical documentation relating to a project together with an enquiry, in particular drawings, CAD models, technical files, specifications, design documentation or other materials needed to prepare a response or quotation.

Technical documentation may contain personal data as well as information about the projects, products, processes or technical solutions of the user or their company.

The Controller uses such documentation only to the extent necessary to handle the enquiry, analyse the project and prepare a response or quotation.

The Controller does not use technical documentation for advertising or marketing purposes.

Documentation submitted through the form is retained for as long as necessary to handle the enquiry, subject to the specific periods set out below or arising from the law.

If the Controller applies a technical automatic-deletion period of 30 days from submission, the documentation is deleted after that period unless further retention is necessary:

to comply with a legal obligation;
in connection with entering into or performing a contract;
to establish, pursue or defend legal claims.

Before this version of the Policy is published, it should be confirmed that the above period and method of deleting documentation correspond to the actual configuration of the server, e-mail system and backups.

8. Data of persons acting on behalf of companies

The Website is intended in particular for businesses and people representing companies.

Data of contact persons, employees, authorised representatives, members of company governing bodies and other natural persons acting on behalf of companies may constitute personal data within the meaning of the GDPR and is protected under applicable law.

This applies in particular to a person’s first name and surname, business telephone number, business e-mail address, position and other information enabling the identification of a specific person.

Where personal data is obtained directly from the person concerned, the Controller provides the information required by Article 13 of the GDPR.

Where personal data is obtained from other sources, the Controller provides the information required by Article 14 of the GDPR, unless a statutory exemption from that obligation applies.

9. Recipients of personal data

Personal data may be disclosed to entities supporting the Controller in operating the Website or conducting its business, in particular:

hosting and server service providers;
entities providing maintenance, administration and technical support for the Website;
IT service providers;
e-mail service providers;
providers of tools used to handle forms, if such tools are used;
providers of legal, accounting or advisory services, where necessary;
entities entitled to receive data under the law.

Where an external entity processes personal data on the Controller’s behalf as a processor, the Controller enters into a data processing agreement with that entity if required by the GDPR.

The Controller does not sell personal data or disclose it to third parties for their own marketing purposes unless the person gives separate consent or the processing is permitted on another legal basis.

10. Transfers outside the European Economic Area

As a rule, the Controller does not plan to transfer personal data to countries outside the European Economic Area.

If the use of a particular service involves a transfer of personal data outside the EEA, the Controller will ensure that the transfer complies with Chapter V of the GDPR, in particular by applying an appropriate transfer mechanism provided for in the GDPR.

11. Data retention periods

The Controller retains personal data for no longer than is necessary for the purpose for which it was collected, taking into account legal obligations and the Controller’s legitimate interests.

In particular:

data submitted through the contact form – for the period necessary to handle the enquiry and related correspondence;
data relating to the preparation of a quotation – for the period necessary to prepare and handle the quotation and conduct related correspondence;
technical documentation – for the period necessary to handle the enquiry, taking into account the rules set out in section 7;
data relating to the conclusion and performance of a contract – for the period necessary to perform it and for the period resulting from legal obligations;
data needed to establish, pursue or defend legal claims – for a period corresponding to the limitation periods applicable to those claims;
data whose retention is required by law – for the period specified by that law;
technical data and information in server logs – for the period necessary to ensure the security and proper operation of the Website and, where applicable, to establish, pursue or defend legal claims.

After the relevant periods have expired, data is deleted or anonymised unless further retention is required by law.

12. Rights of data subjects

A person whose personal data is processed by the Controller has, subject to the rules set out in the GDPR, in particular the following rights:

the right to access their personal data;
the right to obtain a copy of the data;
the right to rectify inaccurate data;
the right to complete incomplete data;
the right to have data erased in cases provided for by the GDPR;
the right to restrict processing;
the right to data portability in cases provided for by the GDPR;
the right to object, on grounds relating to their particular situation, to processing based on Article 6(1)(e) or (f) of the GDPR;
the right to object to the processing of data for direct marketing, if such processing takes place;
the right to withdraw consent where processing is based on consent.

The scope of individual rights and the ability to exercise them may be limited in cases provided for by law.

13. Exercising your rights

To exercise your rights, please contact the Controller:

Mega Mold Sp. z o.o.
Jasionka 252E
36-002 Jasionka, Poland
e-mail: info@megamold.pl

The Controller takes appropriate steps to respond to a data subject’s request without undue delay and no later than one month after receiving it.

If a request is particularly complex or a large number of requests have been received, this period may be extended by a further two months under the rules set out in the GDPR. The Controller will inform the person concerned of such an extension, together with the reasons for the delay, within one month of receiving the request.

Where permitted by the GDPR, the Controller may take appropriate steps to verify the identity of the person making the request.

14. Right to lodge a complaint

If a data subject believes that the processing of their personal data breaches the GDPR, they have the right to lodge a complaint with the supervisory authority responsible for personal data protection.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).

Exercising the right to lodge a complaint does not restrict any other rights available to the person under the GDPR or other laws.

15. Cookies and similar technologies

The Website uses cookies and similar technologies to the extent necessary for its proper operation, security and basic functions.

Cookies are small pieces of information stored on a user’s device while using the Website; they may be read during subsequent visits to the Website.

15.1. Essential cookies

The Website may use cookies necessary to:

ensure that the site works properly;
maintain the Website’s basic functions;
ensure security;
handle forms and other Website functions;
maintain a user session where required by the technical solutions in use.

15.2. WordPress

The Website is based on WordPress. Depending on the Website’s configuration and the functions used, WordPress or its components may use technical cookies necessary for the Website to work properly.

15.3. Analytics, marketing and advertising cookies

As of the date this Policy was last updated, the Controller does not use the following on the Website for analytics or advertising purposes:

Google Analytics;
Google Ads;
Meta Pixel;
remarketing systems;
advertising profiling tools;
newsletters or marketing automation systems.

The Controller does not use cookies to profile users for advertising purposes.

If the Controller begins using additional analytics, marketing or advertising technologies in the future, this Privacy Policy will be updated accordingly and, where required by law, appropriate mechanisms for obtaining user consent will be introduced.

15.4. Cookie settings

Users may also manage cookies through their web browser settings.

Restricting or disabling some cookies may cause certain Website functions to work incorrectly.

The description of cookies should reflect the Website’s actual configuration. If new plugins, tools, external services or scripts are installed, this section should be updated accordingly.

16. Server logs

Use of the Website may result in technical information being automatically recorded in server logs.

The logs may contain, in particular:

the device’s IP address;
the date and time of the connection;
information about the web browser;
information about the device;
the address of the page visited;
information about errors and technical events.

Server logs are used primarily to:

ensure the proper operation of the Website;
ensure security;
detect attempted unauthorised access;
diagnose technical problems;
protect IT infrastructure;
establish, pursue or defend legal claims.

The legal basis for processing data contained in logs is Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in ensuring the security and proper operation of the Website.

17. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against:

unauthorised access;
unauthorised disclosure;
loss;
destruction;
alteration;
accidental or unlawful processing.

Access to personal data is limited to people who need it to perform their duties.

The Controller also takes measures to secure its IT infrastructure and protect the Website against unauthorised access.

The scope of the security measures applied is adapted to the nature, scope and purposes of processing and the risk to the rights and freedoms of natural persons.

18. Automated decision-making and profiling

Personal data collected through the Website is not used to make decisions about users that produce legal effects or similarly significantly affect them solely on the basis of automated processing.

The Controller does not profile users for advertising purposes through the Website.