§1. General provisions
This Privacy Policy sets out how personal data is processed for Users of www.fmt-tarnow.pl (the “Site”), persons contacting FMT Tarnów (forms, email, phone) and customers of the spare-parts online shop - both Consumers (B2C) and Businesses (B2B).
We process data in line with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and applicable data-protection law.
Shop sales terms are set out in the Shop Terms. This Policy covers the FMT Tarnów Site. External links (maps, social media, payment gateways) are governed by third-party policies.
§2. Controller and Data Protection Officer
Personal-data controller:
FMT-Tarnów Sp. z o.o.
33-122 Wierzchosławice 42
NIP: 8733252397 · REGON: 123042291 · KRS: 0001214156
Phone: +48 14 307 05 41
E-mail: sprzedaz@fmt-tarnow.pl
Data Protection Officer (DPO):
Grzegorz Polak
E-mail: biuro@gpkp.pl
Requests concerning GDPR rights (access, rectification, erasure, etc.) should be sent to the DPO or to the Controller at the address above.
§3. Scope and sources of data
Data comes directly from the User (forms, registration, checkout, email, phone), from technical Site logs and - for B2B purchases - from public registers (GUS / CEIDG / KRS) and the VIES system when the Buyer uses tax-ID lookup or VAT-EU verification.
Contact / enquiry forms:
- first and last name
- email address and phone number
- company name, tax number (optional)
- subject and message body, plus selected department / enquiry type
- machine model (for product enquiries)
- file attachments, if provided
Technical and security data:
- IP address, browser type, request timestamp
- information on accepted or rejected cookie consent
- security logs (e.g. abuse attempts, IP blocks) - as needed for Site security
We do not require special-category data. Please do not include unnecessary personal data of third parties in forms.
§4. Online shop - B2C and B2B
The spare-parts shop (paths /sklep/ and /en/shop/, account /konto/) processes data to create an account, place an order or quote request (RFQ), take payment, deliver, invoice, handle complaints and provide after-sales contact.
A B2C (individual) account may include:
- email, password (stored as a cryptographic hash), first name, last name, phone
- delivery / correspondence address
- order history, statuses, in-account communication
A B2B (company) account additionally includes:
- company name, tax ID / VAT-EU, REGON (if provided), registered / delivery address
- contact-person details representing the company
- link to a contractor card (e.g. tax-ID mapping) used for B2B settlement
- VIES check result / GUS-fetched data - only on the Buyer’s request in checkout or profile
Order / quote:
- cart lines (SKU, quantities, net/gross prices, VAT)
- shipping and payment method, shipping cost, order notes
- payment status, bank-transfer proofs (if uploaded), PDF documents / invoices
- acceptance of shop terms and privacy policy (timestamp)
Passwords are not stored in plain text. Password-reset tokens expire. Login sessions use server-side security controls (including CSRF).
§5. Purposes and legal bases
| Purpose |
Legal basis (GDPR) |
| Handling sales, service or product enquiries |
Art. 6(1)(b) - pre-contractual steps; (f) - legitimate interest in responding |
| Registering and running a shop account (B2C / B2B) |
Art. 6(1)(b) - contract / pre-contractual steps |
| Order fulfilment, payment, delivery, invoice, complaint |
Art. 6(1)(b) and (c) - tax / accounting duties |
| Tax ID / VAT-EU checks (GUS, VIES) for B2B purchases |
Art. 6(1)(b)/(c) - correct VAT settlement; (f) - preventing invoice errors |
| Commercial contact / financing / leasing on request |
Art. 6(1)(a) - consent, or (b)/(f) depending on the enquiry |
| Site and shop security, abuse prevention |
Art. 6(1)(f) - Controller’s legitimate interest |
| Traffic statistics (Google Analytics) - optional |
Art. 6(1)(a) - consent via the cookie banner |
| Establishing or defending legal claims |
Art. 6(1)(f) |
| Legal obligations (tax, B2B KSeF, accounting) |
Art. 6(1)(c) |
Providing contact-form data is voluntary but necessary to reply. In the shop, fields marked as required are needed to conclude and perform the sales contract - without them the order cannot be fulfilled.
§6. Recipients
Form data is routed to the selected department mailbox (sales, production, warehouse, service, accounting). Shop data is available to authorised sales and admin staff. We do not sell personal data.
Recipients (including processors) may include:
- hosting and Site-maintenance provider
- email / transactional notification provider
- electronic payment operators (gateways) - as needed to collect payment
- carriers and pickup-point / parcel-locker operators - for delivery
- accounting / ERP / KSeF software providers - invoices and B2B records
- GUS register and the VIES system (European Commission) - for tax ID / VAT-EU checks on request
- analytics tools - only after cookie consent
- bodies authorised by law (courts, law enforcement, tax authorities)
Where we use processors, we enter into data-processing agreements and require appropriate security measures. Transfers outside the EEA occur only with appropriate safeguards (e.g. standard contractual clauses) or where the recipient is in a country with an adequacy decision.
§7. Retention
- Enquiries and correspondence - for the time needed to handle the matter and up to 3 years for potential claims, unless a contract or law requires longer.
- Shop account - for the life of the account; after account deletion, billing data may be retained as required by law.
- Orders, invoices, payment proofs and intra-EU / export documents - as required by tax and accounting law (typically up to 5 years from the end of the tax year, longer if a dispute is pending).
- Technical logs, abuse-prevention records and cookie consent - for as long as needed for Site security or until consent is withdrawn / expires.
§8. Rights of the data subject
You have the right to:
- access your data and receive a copy
- rectify (correct) your data - including in the shop account panel
- erasure (“right to be forgotten”) - where GDPR allows; accounting data may be retained
- restrict processing
- data portability - where based on consent or contract and processing is automated
- object to processing based on Art. 6(1)(f) GDPR
- withdraw consent at any time (without affecting prior lawful processing)
- lodge a complaint with the Polish DPA (UODO, Stawki 2, 00-193 Warsaw)
We do not take automated decisions producing legal effects solely on the basis of profiling. B2B commercial terms (e.g. payment term) may follow contractor data but are not solely automated profiling under Art. 22 GDPR.
§9. Cookies and analytics
The Site and shop use necessary cookies (session, CSRF, cart, login) and - after consent - analytics tools. Details, the cookie table and how to manage consent are described in the Cookie Policy.
§10. Policy changes
The Controller may update this Privacy Policy (e.g. when the B2C/B2B shop expands or recipients change). The version published on the Site with the stated update date applies.
For privacy matters: biuro@gpkp.pl
(DPO) or sprzedaz@fmt-tarnow.pl.
