Privacy Policy

Who is the controller of your personal data

The controller of your personal data is GROPAK Sp. z o.o., with its registered office at ul. Kaletnicza 30, 43-300 Bielsko-Biała, Poland, NIP (tax identification number) 5472208816, the owner of the GRIZO brand.

For any matters concerning your personal data, please write to kontakt@grizo.pl. We have not appointed a data protection officer, so please send all questions and requests to this address.

Other company addresses: our office and sales department are located at ul. Katowicka 103, 43-300 Bielsko-Biała, and our production facility at ul. Warszawska 62, 32-830 Wojnicz.

The “Dobierzmy rozwiązanie” (Let’s find the right solution) enquiry form

On many pages of the website you can open a form in which you describe what you need. We use the data from the form only to respond to your enquiry and, if you wish, to hold further discussions about working together.

When you submit the form, you provide us with:

• your first name,
• your e-mail address,
• the selected topic of the enquiry,
• the description in the “Co planujesz?” (What are you planning?) field,
• optionally, the context of the enquiry: the selected application, project stage, structural element or product,
• the address of the page from which the form was sent (added automatically).

How the form is sent

A script on the website’s server sends the content of the form as an e-mail message through the Google Workspace mail server from the kontakt@grizo.pl account to the GRIZO team’s mailbox. We set the e-mail address you provide in the form as the reply-to address so that we can reply to you.

The website’s server does not store the content of the form in a database or in files. Your enquiry goes only to our mailbox.

If automatic sending fails, the form will offer to copy the content so that you can send it from your own e-mail program. In that case, the message is sent from your mailbox directly to the GRIZO team’s address, and its transmission is governed by the terms of your e-mail provider.

The form does not include any marketing consents. We do not sign you up for a newsletter and we do not send you advertising materials you have not asked for. We prepare an offer only in response to your enquiry.

Protecting the form against spam

To prevent the form from being used by bots, we apply three safeguards: a hidden field that a human does not fill in, a minimum time for completing the form, and a limit of 5 submissions per hour from a single IP address.

We check the time taken to complete the form only at the moment of submission and we do not store it.

To enforce the submission limit, the server stores a hash (SHA-256) of your IP address together with the time of submission. For the purposes of the limit, we do not store the IP address itself, only its hash, which is deleted after one hour. Your IP address is, however, recorded in the standard server logs described below.

Contact by e-mail and telephone

On the website we provide the e-mail addresses and telephone numbers of our employees, including the domestic sales department, the export sales department and the President of the Management Board. If you write to us or call us, we process the data you provide to us at that time: usually your first name and surname, e-mail address or telephone number, the name of the company you represent, and the content of the correspondence or conversation.

We use this data to respond to your message, prepare an offer and hold discussions about working together.

Server logs

Like almost every website, the grizo.pl server keeps standard logs. They record: the IP address, the date and time of the visit, the address of the page visited and information about the browser.

The logs are used to ensure the security of the website and to diagnose errors.

Legal bases for processing

We process your personal data on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR):

• enquiries submitted through the form, as well as correspondence and telephone conversations, where you enquire on your own behalf (e.g. as a sole trader): Article 6(1)(b) GDPR, i.e. steps taken at your request prior to entering into a contract,
• enquiries submitted through the form, as well as correspondence and telephone conversations, where you contact us on behalf of a company you represent: Article 6(1)(f) GDPR, i.e. our legitimate interest in responding to the enquiry and holding discussions with that company,
• the establishment, exercise or defence of legal claims: Article 6(1)(f) GDPR, i.e. our legitimate interest,
• server logs and protection of the form against spam: Article 6(1)(f) GDPR, i.e. our legitimate interest in ensuring the security of the website and e-mail,
• website visit statistics (Google Analytics 4): Article 6(1)(a) GDPR, i.e. your consent given in the banner. Storing and reading information on your device (cookies) also requires consent under electronic communications law, which you give with the same click. You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Who we share your personal data with

Your personal data may be shared with providers who operate the website, e-mail and visit statistics for us. They act on our behalf:

• OVHcloud: the hosting provider on whose server in the European Union the website runs and the logs are stored,
• Google Ireland Limited: the provider of company e-mail in the grizo.pl domain (Google Workspace), through which we send and receive messages from the form and correspondence,
• Google Ireland Limited: the provider of Google Analytics 4, a service for website visit statistics. Data reaches it only if you give your consent in the banner.

Transfers of personal data outside the European Economic Area

The website’s server is located in the European Union. Google, as the provider of our e-mail and of Google Analytics, may also process data outside the European Economic Area, including in the United States. Statistics data reaches Google only after you give your consent. Such transfers take place on the basis of mechanisms provided for in the GDPR: the European Commission’s decision on the EU-US Data Privacy Framework and standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to kontakt@grizo.pl.

How long we keep personal data

• enquiries submitted through the form and correspondence: for as long as necessary to respond and hold discussions, and thereafter until the limitation period for any claims expires, but no longer than 3 years from the end of the correspondence,
• the hash of the IP address stored for spam protection: 1 hour,
• server logs: for the period set by the hosting provider (OVHcloud) for security and diagnostic purposes,
• detailed visit data in Google Analytics: 14 months,
• Google Analytics cookies (_ga and _ga_WQZTFK660X) in your browser: up to 2 years, or until you withdraw your consent or delete them in your browser,
• the record of your cookie choice in your browser’s storage: 12 months.

Your rights

To exercise any of the rights listed below, write to kontakt@grizo.pl. We will respond without undue delay and in any event within one month.

In connection with the processing of your personal data, you have the right to:

• access your personal data and obtain a copy of it,
• rectification of data that is inaccurate or incomplete,
• erasure of your data,
• restriction of processing,
• portability of data that we process on the basis of Article 6(1)(a) or (b) GDPR,
• withdraw your consent to Google Analytics statistics at any time: click “Cookie settings” in the website footer and choose “Decline”,
• object, as described in a separate section below.

Right to object

You may at any time object, on grounds relating to your particular situation, to the processing of your personal data on the basis of our legitimate interest (Article 6(1)(f) GDPR). Write to kontakt@grizo.pl.

Complaint to the supervisory authority

If you believe that we are processing your personal data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland.

Do you have to provide your personal data

Providing your personal data is voluntary. Without your first name, e-mail address and a description in the “Co planujesz?” (What are you planning?) field, the form cannot be sent and we will not be able to reply to you. You choose the topic of the enquiry from a list. You may leave the enquiry context fields blank. Consent to Google Analytics statistics is voluntary. If you do not give it, you can use the website without restriction.

Profiling and automated decision-making

We do not profile you and we do not make decisions about you by automated means. We do not use Google Analytics statistics to make decisions about any individual person.

Cookies and tracking

On your first visit, a banner appears at the bottom of the screen asking for your consent to visit statistics. It has two buttons of equal weight: “Decline” and “Accept”.

Without your consent, the Google Analytics script is not loaded at all, no cookies are created in your browser and no data is sent to Google.

When you click “Accept”, the website loads Google Analytics 4 (service ID G-WQZTFK660X), a tool provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it for visit statistics: we see which pages are viewed, where visitors come from (e.g. a search engine or a link), their approximate location (country or city), the type of device and browser, and how much time they spend on the website. Google Analytics 4 does not store IP addresses.

Advertising features are switched off. In Google Consent Mode, ad_storage, ad_user_data and ad_personalization are always set to “denied”, so we do not use remarketing or ad personalisation.

After you consent, Google Analytics stores two cookies in your browser in the grizo.pl domain: _ga, which distinguishes visitors from one another, and _ga_WQZTFK660X, which keeps the session state. Both are valid for up to 2 years. Apart from these, the website does not set any cookies.

We save your choice in your browser’s storage (localStorage, key “grizo-zgoda-cookies”) so that the banner does not appear on every visit. The record is valid for 12 months. After that, the banner appears again.

You can change your decision at any time using the “Cookie settings” link in the footer of every page. If you decline consent, including later on, the website deletes the Google Analytics cookies (_ga and _ga_WQZTFK660X) from the grizo.pl domain.

We do not use any other analytics or tracking tools, such as Meta Pixel. The website contains no embedded maps, YouTube videos or fonts loaded from external servers. Fonts and videos are served directly from the website’s server, so if you do not consent to statistics, opening grizo.pl does not connect you to the servers of any other companies apart from our hosting provider.

Links to other websites

On the website you will find links to other websites, including gropak.eu, medos.pl (distributor of GRIZO straps for roller blind manufacturers), leanto.pl (the website developer), Google Maps (the “Wyznacz trasę” (Get directions) link) and bsesc.energy.gov (a source cited in an article). Once you go to such a website, its owner’s privacy policy applies. We are not responsible for how those websites process personal data.

Changes to this policy

If we change the way the website works or the way we process personal data, we will update this policy and change the date of the last update below. The current version is always available on this page.