Privacy Policy

Effective date: 05.12.2025
Website: distrix.pl
Data Controller: distriX sp. z o.o., z siedzibą w Mroczy, ul. Cicha 26, 89-115 Mrocza, REGON: 543459703, NIP: 5581889399, VAT UE: PL5581889399, contact email: office@distrix.pl, contact phone: +48791562662

This Privacy Policy explains how distriX sp. z o.o. (“distriX”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you visit and interact with our website distrix.pl (“Website”). We process personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable local laws.

1. Who We Are and How to Contact Us

• Controller: distriX sp. z o.o.
• Address: 89-115 Mrocza, u. Cicha 26, Poland
• Email: office@distrix.pl
• Phone: +48791562662

2. Scope

This Policy covers personal data processed when:

• You visit or browse distrix.pl;
• You contact us via forms, email, phone, or chat;
• You subscribe to newsletters or marketing communications;
• You create or manage an account (if available);
• You engage with our social media or participate in events/webinars we host or promote.

3. Categories of Personal Data We Collect

Depending on your interaction with the Website, we may collect:

• Identification & contact data: name, email address, phone number, company/role, postal address.
• Account data (if applicable): username, login identifiers, profile details.
• Communications: content of messages sent via forms or email, support requests.
• Marketing preferences: newsletter subscriptions, consent states.
• Transactional data (if applicable): services purchased, billing details (processed via secure payment providers).
• Technical & usage data: IP address, device and browser info, operating system, referrer URLs, pages viewed, time spent, clickstream data.
• Cookies and similar technologies: necessary, preference, analytics, and (if used) advertising/retargeting cookies. See Section 9 (Cookies).

We do not intentionally collect special categories of data (e.g., health, biometric, or data revealing racial/ethnic origin) via the Website. Please avoid submitting such data.

4. Sources of Data

• Directly from you: forms, emails, chat, phone, registrations, account creation.
• Automatically: via cookies, pixels, and server logs when you use the Website.
• Third parties: analytics providers, advertising networks (if used), social media platforms, payment processors, event partners—always in line with applicable law and based on appropriate safeguards.

5. Purposes and Legal Bases for Processing

We process personal data for the following purposes under GDPR Articles 6(1)(a–f):

1. Providing and operating the Website (including security and performance). Legal basis: Legitimate interests (Art. 6(1)(f))—to operate a secure, functional service.
2. Responding to inquiries and providing support. Legal basis: Performance of a contract or pre-contractual steps (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f))—to address user requests.
3. Account creation and management (if available). Legal basis: Performance of a contract (Art. 6(1)(b)).
4. Newsletter and marketing communications. Legal basis: Consent (Art. 6(1)(a)) or Legitimate interests (Art. 6(1)(f)) for B2B communications in compliance with e-privacy rules. You can withdraw consent at any time.
5. Analytics and site improvement (e.g., measuring traffic, usability). Legal basis: Consent (Art. 6(1)(a)) for non-essential cookies/analytics; Legitimate interests (Art. 6(1)(f)) where permitted and strictly necessary.
6. Compliance and legal obligations (e.g., taxation, accounting, regulatory requests). Legal basis: Legal obligation (Art. 6(1)(c)).
7. Fraud prevention and security monitoring. Legal basis: Legitimate interests (Art. 6(1)(f))—to protect our services and users.

6. Retention Periods

We retain personal data only as long as necessary for the purposes described above:

• Contact/Inquiry data: up to 24 months after last interaction, unless longer retention is needed to manage claims.
• Account data: for the life of the account and for up to 36 months after closure (or as required by law).
• Marketing/subscription data: until consent is withdrawn or the subscription is terminated; we keep minimal records of consent withdrawal for compliance.
• Transactional and invoicing data: typically 5–10 years to meet tax/accounting requirements, depending on local law.
• Technical logs: typically 12–24 months, unless needed longer for security or legal purposes.

We may pseudonymise or anonymise data for analytics and keep aggregated statistics indefinitely.

7. Sharing of Personal Data

We may share personal data with:

• Service providers / processors: hosting, cloud infrastructure, email delivery, CRM, analytics, payment processing, customer support tools—bound by contracts and GDPR Article 28 obligations.
• Professional advisors: legal, tax, compliance, auditors, when necessary.
• Affiliates (if any): within the distriX group, under appropriate safeguards.
• Authorities: when required to comply with law or valid legal process.
• Business transfers: in connection with mergers, acquisitions, or asset transfers, subject to appropriate safeguards.

We do not sell personal data.

8. International Transfers

If we transfer personal data outside the EEA/UK, we use appropriate safeguards, such as:

• Adequacy decisions (e.g., the EU–US Data Privacy Framework, where applicable);
• Standard Contractual Clauses (SCCs) and, if necessary, supplementary measures;
• Additional assessments to ensure essentially equivalent protection.

You can request details of specific transfer safeguards via office@distrix.pl.

9. Cookies and Similar Technologies

We use cookies to ensure the Website functions properly, remember preferences, analyse usage, and (if implemented) deliver relevant advertising. Categories:

• Strictly necessary cookies: essential for navigation, security, and core features.
• Preference cookies: remember choices (e.g., language).
• Analytics cookies: help us understand how the site is used to improve performance.
• Advertising/retargeting cookies (if used): deliver tailored ads on and off our site.

Consent: Non-essential cookies (analytics/advertising) are set only with your consent via our cookie banner or settings tool. You can withdraw consent at any time and manage preferences via the banner or your browser settings.

Managing cookies: Most browsers let you block or delete cookies. Disabling certain cookies may affect site functionality.

Cookie List: See our Cookie Notice or cookie banner for an up-to-date list of cookies, their providers, and retention periods.

10. Your Rights (EEA/UK)

Subject to legal limitations, you have the following rights:

• Access: obtain a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): request deletion in certain cases.
• Restriction: limit processing in certain circumstances.
• Data portability: receive data in a structured, machine-readable format and transmit it to another controller where technically feasible.
• Objection: object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
• Withdraw consent: where processing relies on consent, you may withdraw it at any time (this will not affect prior lawful processing).

To exercise these rights, contact us at office@distrix.pl. We may need to verify your identity. We aim to respond within one month (GDPR Art. 12–15), extendable by two months for complex requests with notice.

Complaints: You have the right to lodge a complaint with your local data protection authority (e.g., Polish Data Protection Authority – Urząd Ochrony Danych Osobowych, UODO) or the authority in your country of residence or work.

11. Children’s Privacy

Our Website is not directed to children, and we do not knowingly collect personal data from individuals under 16 (or a higher age where local law requires). If you believe a child provided personal data, please contact us so we can delete it.

12. Security

We implement technical and organizational measures appropriate to the risk, including encryption in transit (TLS), access controls, least-privilege principles, logging/monitoring, regular updates, and staff training. No online system is entirely secure; please use the Website responsibly and contact us if you suspect a security issue.

13. Social Media and Third-Party Links

Our Website may include links to third-party sites or social platforms. We are not responsible for their privacy practices. Please review their policies before providing personal data.

14. Automated Decision-Making / Profiling

We do not use automated decision-making that produces legal or similarly significant effects on you. If we implement profiling for analytics or marketing, it will be limited, consent-based where required, and you may object or withdraw consent.

15. Changes to This Policy

We may update this Policy from time to time. The “Effective date” above reflects the latest version. Material changes will be highlighted on the Website and, where appropriate, notified to you.