Privacy Policy and Cookies

State as of: 2026-08-03

1. Data Controller

The data controller is INBRAS Sarbinowscy sp. j. with its registered office in Inowrocław

Transportowca 13, NIP: 5562753552, REGON 341406063 (hereinafter: the Controller).

Contact concerning personal data: biuro@inbras.com.pl.

The Controller has not appointed a Data Protection Officer.

2. Basic Concepts

GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (OJ EU L 119 of 04.05.2016).

Personal data - information relating to an identified or identifiable natural person.

Service - the website at https://inbras.com.pl.

3. Purposes and Legal Basis of Processing

The Controller processes personal data for the following purposes:

3.1. Handling inquiries from the contact form

Scope of data: name, email address, phone number, and message content.

Legal basis: Article 6(1)(b) GDPR (taking action at the request of the person before entering into a contract) and Article 6(1)(f) GDPR (legitimate interest of the Controller in responding and maintaining correspondence).

Data from the form is processed solely within the Controller's infrastructure. After submitting the form, the message goes directly to the Controller's email inbox. Data is not forwarded to an external form service provider nor stored with such an entity.

3.2. Analytics and statistics (Google Analytics)

Scope of data: cookie identifiers, IP address in truncated form, device and browser data, activity data on the Service.

Purpose: viewership statistics and analysis of how the Service is used for its improvement.

Legal basis: Article 6(1)(a) GDPR (consent expressed through cookie consent settings).

Consent is voluntary. It can be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

3.3. Ensuring the operation and security of the Service

Scope of data: IP address, connection technical data, server logs.

Purpose: to ensure the correct and secure operation of the Service, including protection against misuse.

Legal basis: Article 6(1)(f) GDPR (legitimate interest of the Controller).

4. Data Recipients

Personal data may be disclosed to the following categories of recipients:

● Google Ireland Limited / Google LLC – provider of Google Analytics (analytical purpose).

● Cloudflare, Inc. – provider of hosting, CDN, and Service protection services (technical support).

● Entities providing IT and legal services for the Controller, based on data processing agreements.

The Controller enters into personal data processing agreements with processors in accordance with Article 28 GDPR.

5. Data Transfer Outside the European Economic Area (EEA)

Using Google Analytics and Cloudflare infrastructure may involve transferring data to the United States.

Transfer is based on the European Commission's implementing decision of 10 July 2023, recognizing an adequate level of personal data protection within the EU-US Data Privacy Framework (DPF). This applies to recipients certified under the DPF program.

Both Google LLC and Cloudflare, Inc. are certified under the EU-US Data Privacy Framework (status active on the date this policy was drafted). The Controller periodically verifies the current status of their certification on the list maintained at dataprivacyframework.gov. If the recipient loses certification, the basis for transfer will be standard contractual clauses (SCC) as per Article 46 GDPR.

6. Data Storage Period

● Data from correspondence and contact forms: for the time necessary to handle the inquiry, and then for the period of limitation of any claims.

● Analytical data in Google Analytics: for the retention period set in the tool's panel, i.e., 12 months.

● Server logs: for the period resulting from technical configuration, no longer than necessary for security.

7. Data Subject's Rights

The data subject has the right to:

● access to data and obtain a copy,

● rectification (correction) of data,

● data erasure,

● restriction of processing,

● object to processing based on legitimate interest,

● data portability,

● withdraw consent at any time regarding data processed based on consent.

To exercise your rights, please contact the Controller at the address indicated in point 1.

8. Right to Lodge a Complaint

The data subject has the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

9. Voluntariness of Data Provision

Providing data in the Service is voluntary. Providing data in the contact form is a condition for responding to an inquiry. Consent to analytical cookies is voluntary and does not condition the use of the Service.

10. Automated Decision-Making and Profiling

Data processed in Google Analytics is used to create aggregated statistics. The Controller does not make decisions solely based on automated processing that would have legal effects or similarly affect users.

11. Cookies

11.1. What are Cookies

Cookies are small text files stored on the user's terminal device when using the Service. Their use is governed by the GDPR and the Act of 12 July 2024 – Electronic Communications Law (Journal of Laws 2024, item 1221).

11.2. Types of Cookies Used in the Service

Essential (technical) cookies. Necessary for the proper and secure functioning of the Service. Used, among others, by Cloudflare for protection and maintaining sessions. No consent required. Analytical cookies. Used by Google Analytics for statistics. Require user consent and are activated after obtaining it.

11.3. Which Cookies We Use

Name Provider Purpose Category Lifespan

11.4. Consent and Cookie Management

Upon first visiting the Service, the user can accept or reject cookies other than essential ones using the consent mechanism (cookie banner). Consent can be changed or withdrawn at any time.

The user can also manage cookies through browser settings, including blocking or deleting them. Restricting cookies may affect the functionality of some features of the Service.

12. Policy Changes

The Controller may update this policy. The current version is published on the Service along with the effective date.