6es7.pl · data protection

Privacy Policy

Information on the processing of personal data, security and the use of cookies in the 6es7.pl store.

Version 29.09.2026 effective from the date of publication

Data ControllerZakład Automatyki Przemysłowej Polrad

Contactkontakt@6es7.pl

Shop6es7.pl · B2B sales

CookiesNecessary without consent; analytics and marketing with consent

Data Controller

The controller of personal data processed in connection with use of the 6es7.pl store is the business operating under the name Zakład Automatyki Przemysłowej Polrad, Jodłowa 32, 87-123 Brzozówka, Poland, Tax ID (NIP): 8791609290, hereinafter the “Controller” or “POLRAD”.
For matters concerning personal data, you can contact the Controller at kontakt@6es7.pl, by phone at +48 507 544 233 or by post at the address indicated above.
The Controller has not appointed a Data Protection Officer unless the obligation to appoint one arises from laws applicable to the activity conducted. For privacy matters, contact the Controller directly.
This Policy fulfils the information obligations arising in particular from Article 13 and, where applicable, Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”).

What data we process

The scope of data depends on how the Store is used. It may include in particular: first and last name, company name, Tax ID (NIP), registered office or delivery address, e-mail address, phone number, contact-person details, user account details, and information concerning an order, payment, delivery, complaint or warranty.
When using the website, technical data may also be processed, such as IP address, browser type and version, operating system, device or session identifiers, date and time of the request, address of the page visited, traffic-source information and data stored in cookies or similar technologies.
If a business provides data concerning its employees, contractors, representatives or contact persons, the Controller may process their business contact details to the extent necessary to manage the commercial relationship. In such a case, the source of the data is the contractor or the person acting on its behalf.
The Controller does not require special-category data referred to in Article 9 GDPR. Such data should not be included in forms, messages or order notes unless absolutely necessary.

Purposes and legal bases for processing

Purpose	Legal basis
Handling an enquiry, preparing a quotation, concluding and performing a sales contract	Article 6(1)(b) GDPR and, for persons representing a contractor, also Article 6(1)(f) GDPR
Maintaining a customer account and providing functions available after login	Article 6(1)(b) GDPR
Issuing and retaining accounting documents and complying with tax obligations	Article 6(1)(c) GDPR
Handling complaints, warranties and returns, and establishing, pursuing or defending claims	Article 6(1)(b), (c) or (f) GDPR — depending on the circumstances
Ensuring Store security, preventing abuse, diagnosing errors and maintaining logs	Article 6(1)(f) GDPR — the Controller’s legitimate interest in protecting the service, data and continuity of operations
Statistical measurement, analytics and marketing using non-essential cookies or similar identifiers	Article 6(1)(a) GDPR — consent, in conjunction with Article 399 of the Polish Electronic Communications Law

Orders and user account

When placing an order, providing data marked as required is necessary for the order to be accepted and fulfilled. The Store operates in a B2B model and therefore also requires details identifying the business, including its Tax ID (NIP).
Order data is used to identify the parties to the transaction, communicate about fulfilment, issue sales documents, process payment, prepare shipment and provide subsequent after-sales service.
If an account is created, data necessary to maintain the account, authenticate the user, display order history and facilitate subsequent purchases is processed.
Deleting an account does not automatically delete order documentation where further retention is required by law or necessary to establish, pursue or defend claims.

Contact, forms and technical support

Data provided through the contact form, by e-mail or by phone is processed in order to respond and continue correspondence. If the contact is aimed at concluding or performing a contract, the legal basis is Article 6(1)(b) GDPR; in other cases it is Article 6(1)(f) GDPR.
Forms may use technical mechanisms to reduce spam and abuse, including form-protection mechanisms and limits on the number of requests sent.
The content of correspondence may be linked to a specific order, complaint, warranty or other case where this is necessary for proper handling and documentation.

Payments and delivery

For bank-transfer payments, payment-related data is processed by the banks participating in the transaction and by the Controller to the extent visible on the account statement and necessary to settle the order.
If electronic payment via Przelewy24 is selected, the data necessary to initiate and settle the payment is transferred to the operator of that service. The payment operator processes data within the scope and under the rules resulting from its own legal obligations and terms.
Where delivery is carried out by InPost, the Controller provides the data necessary to dispatch, deliver and track the parcel, in particular recipient details, address, phone number or e-mail address — depending on the selected service and the data required by the carrier.
The Controller provides payment providers and carriers only with the data necessary to perform the selected service.

Security, logs and abuse prevention

The service keeps technical logs necessary to maintain the website, diagnose errors, protect against attacks and detect unusual activity. Logs may include, among other things, the IP address, timestamp, requested URL, browser information and server response.
When a PDF quotation is generated on a self-service basis, the Store records the generated quotation data and a pseudonymous identifier created from the IP address using HMAC. The full IP address is not stored in the quotation record. The identifier is used to limit abuse and for aggregate analysis of the number of generated quotations and is not used to determine the user's identity.
If the user voluntarily enters recipient details in the PDF quotation generator, those details will be placed in the document and stored together with the quotation. These fields are optional and are not required to generate a quotation.
The Store uses WordPress security solutions, including protective tools such as Wordfence where active at the relevant time. Security tools may analyse technical data necessary to detect intrusion attempts, spam and other abuse.
Access to data is restricted to persons and entities that need it to perform their tasks. The Controller applies appropriate technical and organisational measures, including encrypted HTTPS connections and access control.

Cookies, analytics and advertising

The Store uses cookies and similar technologies. Cookies may be stored by 6es7.pl or — where the applicable conditions are met — by external providers.
Necessary and functional cookies are used, among other things, to maintain sessions, operate the cart, enable login, provide security and remember settings required to provide the service. To the extent that they are necessary for transmission or delivery of a service requested by the user, they do not require consent under Article 399(3) of the Polish Electronic Communications Law.
Statistical/analytics cookies are used to measure traffic and how the website is used. For this purpose, the Store may use in particular Google Analytics 4 and traffic-source attribution tools such as Sourcebuster. Non-essential analytics identifiers are activated in accordance with the user’s choice in the consent-management mechanism.
Marketing cookies may be used by advertising tools, in particular Google Ads, to measure campaign effectiveness and — where the user has given the appropriate consent — for advertising functions and audience creation.
Consent status is stored by the store's consent management mechanism. The user can refuse non-essential categories, accept them or choose each category separately, and later change the choice using the privacy settings available on the website.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Cookies can additionally be deleted in the browser settings.

External services and content

The Store may use Google services, in particular Google Analytics, Google Ads, Google Tag Manager, Google reCAPTCHA and an embedded Google Maps map. When these services are used, the provider may receive technical data such as IP address, device and browser information and data relating to interaction with the relevant service.
The operation of analytics and advertising services depends on the user’s consent settings and the configuration of Google tools. Google Consent Mode itself does not replace the consent banner — it communicates the user’s choice to Google services.
If external content, such as a map, is loaded directly from a provider’s server, a connection to that provider may be established as soon as such content is displayed. The consent mechanism should restrict the loading of content requiring consent in accordance with the user’s selected settings.
Google reCAPTCHA or an equivalent anti-spam solution may be used to protect forms against automated spam where enabled for a particular form.

Data recipients

Data may be disclosed or entrusted to entities supporting the Controller in operating the Store, solely to the extent necessary to perform the relevant task.
Categories of recipients include in particular: the hosting and IT infrastructure provider, e-mail providers, entities maintaining or securing the service, the Przelewy24 payment operator, banks, the InPost carrier, analytics and advertising system providers — in particular Google — and entities providing accounting, tax, legal or technical services.
Data may be disclosed to public authorities where the obligation to provide it results from law or a legally effective request of a competent authority.
The Controller does not sell personal-data databases to third parties.

Transfers of data outside the European Economic Area

Some technology providers, in particular global Google services, may process data using infrastructure located outside the European Economic Area.
Where data is transferred to a third country, the transfer is made using a mechanism provided for in Chapter V GDPR, in particular on the basis of an adequacy decision of the European Commission or appropriate safeguards such as Standard Contractual Clauses.
The scope and legal basis of a transfer depend on the specific provider and the current configuration of the service.

How long we retain data

Order data and accounting documents are retained for the period required by tax and accounting law and — where necessary — until the expiry of limitation periods connected with pursuing or defending claims.
Account data is processed for as long as the account is maintained and, after deletion, to the extent required by law or necessary to protect against claims.
Correspondence and enquiries are retained for the period required to handle the matter and thereafter for as long as retention is justified by the possibility of continuing the matter, documenting arrangements or defending against claims. If correspondence becomes part of transaction documentation, it is retained for the period applicable to that documentation.
Complaint and warranty data is retained for the duration of the case and, after its completion, for the period necessary to demonstrate that it was handled correctly and until the relevant claim periods expire.
Technical logs and security data are retained for a period justified by diagnostics, service protection and incident analysis; if an incident is detected, relevant data may be retained longer until it is resolved.
Consent and cookie data is retained for the lifetime of the relevant file or until consent is withdrawn, while information enabling proof that consent was given or refused may be retained for the period necessary to demonstrate legal compliance.

Rights of data subjects

Under the conditions set out in the GDPR, a data subject may have the right to access and obtain a copy of their data, rectify data, erase data, restrict processing and — where provided by law — data portability.
Where processing is based on the Controller’s legitimate interest (Article 6(1)(f) GDPR), the data subject may object to processing on grounds relating to their particular situation. In the case of processing for direct marketing, the right to object is unconditional.
Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of earlier processing.
Requests concerning these rights may be sent to kontakt@6es7.pl. The Controller may request information necessary to confirm the identity of the person making the request where this is justified by the need to protect personal data.
A person who considers that their data is being processed unlawfully has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

Profiling and automated decisions

POLRAD does not make decisions concerning customers based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them within the meaning of Article 22 GDPR.
After the appropriate consents have been given, analytics or advertising tools may use information about user activity to measure campaigns, segment audiences or tailor advertisements. Such activities do not determine whether an order can be placed or the individual terms of sale in the Store.

Voluntary provision of data and changes to the Policy

Providing data is generally voluntary, but some data is necessary to conclude and perform a contract, issue an accounting document, make a payment, deliver goods or handle a user request. Without that data, the relevant action may be impossible.
The Store does not use order data to send a newsletter solely because a customer has made a purchase. If a separate marketing service requiring consent is introduced in the future, consent will be obtained separately in accordance with applicable law.
The Policy may be updated in the event of changes in law, technology, service providers or the operation of the Store. The current version is published on this page together with the version date.
The rules of sale are described separately in the Store Terms & Conditions.