Privacy policy

Version 1.0 — effective from 7 November 2026

This Privacy Policy explains how we process personal data on https://polandarabic.com ("Invest in Poland"). See also the Terms and the Cookie Policy.

1. Controller and contact

The controller of your personal data is Sendormeco Holding sp. z o.o., ul. Złota 75a/7, 00-819 Warsaw, Poland, NIP 5252866457, REGON 389194801, KRS 0000906110.

For all matters concerning personal data, contact us by e-mail: office@sendormeco.com. We have not appointed a data protection officer.

2. Summary

• We process data to answer your inquiries, to run the Catalogue of Polish exporters, to handle applications for promotional Packages, and to keep the Website secure.
• We do not sell personal data.
• Analytics and advertising cookies are used only with your consent.
• Fonts are hosted on our own server; we do not connect to Google Fonts.

3. Enquiry and contact forms

When you send an inquiry we collect: name, e-mail address, telephone number (optional), company, country and your message. You also tick a checkbox consenting to the processing of this data in order to reply.

• Purpose: answering your inquiry and steps before a contract.
• Legal basis: Article 6(1)(b) GDPR (steps at your request before entering into a contract) and, for the checkbox, your consent; this consent can be withdrawn at any time.
• Retention: up to 24 months from the last contact, unless a contract is concluded (see section 9).

Providing the data is voluntary, but without name, e-mail and message we cannot reply.

4. Applications for a promotional Package

For applications on the Promote your company page we collect: company name, NIP (optional), contact person, e-mail address, telephone number (optional), website, category, Package and period, and the consent checkbox.

• Purpose: reviewing the application, concluding and performing the contract, publishing the paid listing.
• Legal basis: Article 6(1)(b) GDPR; for verification and protection against abuse, Article 6(1)(f); for accounting obligations, Article 6(1)(c).
• Confirmation e-mail: we send a link to confirm your e-mail address, valid for 72 hours. Unconfirmed applications are deleted after 30 days.
• Verification: we check the NIP in the public VAT payers register of the Polish Ministry of Finance (a query to its API), compare the e-mail domain with the website domain, check against a list of disposable mailboxes, and assess risk from visible signals. This is not automated individual decision-making within the meaning of Article 22 GDPR, because the decision is taken by a person (a moderator).
• Notifications about applications are sent by e-mail to our team.

5. Technical data collected with the forms

With each form we also collect: campaign parameters (UTM), the landing page and the referring page, the time taken to fill in the form, the country taken from the network header, and a cryptographic hash (HMAC) of the IP address — not the address itself — used to protect against abuse. Forms are protected by Cloudflare Turnstile (see section 8).

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in protecting the Website and forms against abuse.

6. Catalogue of companies — information under Article 14 GDPR

We create free Basic Listings of Polish businesses from publicly available sources: company websites, trade-fair catalogues and public registers. We have not collected this data from you directly.

• Whose data: mainly company data. Where a company publishes it, a listing may also include the name and business contact details of a contact person.
• Purpose and basis: running the Catalogue and presenting Polish exporters to foreign buyers — Article 6(1)(f) GDPR (legitimate interest of Sendormeco, of the listed companies and of foreign importers).
• Source: publicly available websites, catalogues and registers.
• Recipients: Website visitors and the processors in section 8.
• Retention: as long as the listing is published or until you object or the company asks for removal.
• Right to object: you may object at any time to the processing based on our legitimate interest. A company may also ask us to correct or remove its listing. We remove the data of a contact person on request without undue delay. Write to office@sendormeco.com.

Paid listings contain data supplied by the company and published after the company's approval.

7. Server logs, statistics and the admin panel

• Server logs (IP address, time, requested address, browser): security and diagnostics, Article 6(1)(f) GDPR. We keep them for up to 12 months: 30 days for current analysis, then in a log archive protected against deletion for 360 days and deleted after 365 days.
• View and click statistics: views of listings and clicks on contact details are counted on our server in aggregate, per company per day, without cookies and without personal data.
• Admin panel: accounts of our staff and editors (name, e-mail, password stored as a hash, two-factor authentication) and an audit log of actions in the panel (user identifier, action, time, IP address). Basis: Article 6(1)(f) GDPR, security and accountability.
• Cookies: see the Cookie Policy. Analytics and advertising only with your consent (Article 6(1)(a) GDPR).

8. Recipients and processors

• Hetzner Online GmbH (Germany, EU) — hosting of the server, backups and Hetzner Object Storage for files (logos, photographs).
• Cloudflare, Inc. (USA) — DNS and Cloudflare Turnstile, which protects forms against bots (script from challenges.cloudflare.com; processes IP address and browser data). Transfer to the USA: EU-US Data Privacy Framework or standard contractual clauses.
• Sendinblue SAS (Brevo) (France, EU) — sending of transactional e-mails.
• Google Ireland Limited / Google LLC — Google Tag Manager and analytics and advertising tools (Google Analytics 4, Google Ads), only after your consent, with Google Consent Mode v2. Transfer to the USA under the EU-US Data Privacy Framework.
• Anthropic, PBC (USA) — automatic translation of the descriptions of companies in listings. We do not send data from contact forms. Standard contractual clauses.
• Ministry of Finance of Poland — a query about VAT status by NIP in the public register.

Links to company websites and to social media (Instagram, LinkedIn and others) are ordinary links; we do not embed social plugins. If you follow a link, the other site acts as an independent controller. We may disclose data to authorities where the law requires and to advisers bound by confidentiality. We do not sell data.

9. Retention periods

• Inquiries and applications: up to 24 months from the last contact.
• If a contract is concluded: for the term of the contract and until claims become time-barred; accounting documents for 5 years from the end of the tax year.
• Unconfirmed applications: up to 30 days.
• Server logs: up to 12 months (section 7).
• Cookie consent record: 12 months.
• Catalogue listings: see section 6.

10. Your rights

You have the right to: access your data, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. Write to office@sendormeco.com; we reply within one month.

You may lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

Persons outside the European Union, including in the Gulf states, may exercise these rights on the same terms.

Changes to this Policy

We may change this Policy, in particular when the law, the Website or our processors change. The new version is published with its date and version number. For Companies with a paid Package we notify the change by e-mail at least 14 days before it takes effect, unless the change results from a legal requirement. We will update this Policy before enabling any new analytics or advertising tool.