Privacy policy

What data we collect and why

You can browse this website without giving us any data. We process personal data only in the situations described below.

Contact form

When you send a demo request from the Contact page, we store your full name, company name, work e-mail address, phone number (if you give one), your message, your confirmation that you want to be contacted, the language of the page and the address of the page the form was sent from. We use this data only to answer your request: to set a date, to prepare and hold the demo and to correspond with you about it.

Giving us the data is voluntary, but without your name, company name and e-mail address we cannot answer. Requests are read by authorised CONTMAN staff only: in the site panel, on a company channel in the Slack messaging service and in an e-mail the site sends to a CONTMAN company address through the MailerSend service. What you type into the form is never written to the server logs.

To protect the form from abuse, the server accepts at most five requests from one IP address within 10 minutes. For this it keeps the IP address in memory only: it is not written to the database or stored with the request.

The chat on this site

When you write to us through the chat, we store the conversation in the site's database: your messages and our staff's replies, its language, the address of the page where it started and the dates of the messages. The site passes each of your messages to authorised CONTMAN staff through the Slack messaging service, where they answer it; the reply comes back to the chat window. We use this data only to answer your questions. You do not have to give us any data to write in the chat; what you tell us about yourself is up to you. What you write in the chat is never written to the server logs.

A conversation opens only in the browser where it was started: the necessary __Host-contman_chat cookie, stored with your first message, links it to that browser (see the cookie policy). To protect the chat from abuse, the server limits the number of conversations and messages from one IP address; for this it keeps the address in memory only and never writes it to the database. When the chat is unavailable, you can leave a message with your contact details in its window; we handle it exactly like a request from the contact form.

Downloading materials

Some product brochures are available after you fill in a short form. We then store your full name, e-mail address, company name (if you give one), the material you downloaded, the language of the page and the date, so that we know who downloaded which of our materials. Giving us the data is voluntary, but without your name and e-mail address the form does not release the file. The file downloads right after you send the form, and the site sends no message to the address you give. The data is read in the site panel by authorised CONTMAN staff only. The server accepts at most five such requests from one IP address within 10 minutes and keeps the address in memory only for this.

Visit statistics, only with your consent

If you accept analytics cookies, we use Google Analytics 4 to learn aggregate statistics: how many people visit the site and which pages they read. Google Analytics stores the cookies _ga and _ga_<ID> in your browser and collects information about the pages you visit and your approximate location (city, region, country), derived from your IP address. According to Google, the IP addresses of users in the European Union are discarded before the data is logged.

Without your consent the Google script does not load at all. We show no ads on this site, and Google's advertising consents are always denied: we use no Google Analytics data for advertising. You can withdraw your consent at any time with the "Cookie settings" button in the site footer.

Our ads on Meta's services, only with consent

If you accept marketing cookies, the Meta Pixel runs on the site so that we can measure how well our ads on Facebook and Instagram work and show them to people who visited the site. The pixel sends Meta the data in your browser's HTTP headers (including your IP address and information about your browser), the pixel ID, identifiers from Meta's cookies and the page you visited. The automatic sending of clicks and page metadata is switched off. Without your consent no Meta code loads at all.

We and Meta Platforms Ireland Limited (Block J, Serpentine Avenue, Dublin 4, Ireland) are joint controllers (Article 26 GDPR) for collecting this data on the site and transmitting it to Meta, under the Meta Business Tools Terms. What Meta does with the data once received, including using it for advertising, is Meta's responsibility as a separate controller; it is described in Meta's Privacy Policy.

Technical data

When you open the site, your browser sends technical data: your IP address, the date and time, the address of the page and information about your browser and system (user agent). The site's server and the Cloudflare network that carries traffic to the site may record it in logs to keep the site running and secure, including to detect and fend off attacks and automated traffic. We do not combine this data with form data or use it to find out who you are.

Accounts in the content panel

The site's content panel is for CONTMAN staff only. It processes a work e-mail address, name, role and the data needed to sign in, including the second authentication factor, so that only authorised people publish content.

What we do not do

We run no newsletter, have no comments or visitor accounts, do not sell data, do no profiling ourselves and make no decisions based solely on automated processing (how Meta uses the pixel data is described above). The site is not directed at children.

Legal bases

We rely on Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and on the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej).

• Contact form: Article 6(1)(f) GDPR, our legitimate interest in answering your request and discussing cooperation with the company you represent. If you write on your own behalf about a contract with us, the basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract). The checkbox in the form confirms that you ask to be contacted.
• Chat: Article 6(1)(f) GDPR, our legitimate interest in answering your questions. If the matter concerns your own contract with us, the basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract, or its performance).
• Downloading materials: Article 6(1)(f) GDPR, our legitimate interest in making material about our products available and in knowing who downloaded it. The checkbox in the form confirms that you ask for the material.
• Google Analytics statistics: your consent, Article 6(1)(a) GDPR; analytics cookies are stored and read only with consent (Article 399(1) of the Electronic Communications Law).
• Meta Pixel: your consent, Article 6(1)(a) GDPR; marketing cookies are stored and read only with consent (Article 399(1) of the Electronic Communications Law).
• Technical data: Article 6(1)(f) GDPR, our legitimate interest in running the site and keeping it secure.
• Panel accounts: Article 6(1)(f) GDPR, secure management of the site content by staff.
• Establishing, exercising or defending legal claims: Article 6(1)(f) GDPR.

How long we keep data

• Form requests: 12 months after the last contact on the matter. If the conversation leads to a contract, the data becomes part of the records of our cooperation and follows their retention rules. We keep it longer only when it is needed to establish, exercise or defend legal claims - until those claims are time-barred.
• Chat conversations: 12 months after the last message of the conversation; the site then deletes the conversation from its database by itself. Copies of chat messages and form requests in Slack and in e-mail are kept for as long as they are needed to handle your matter and our cooperation, and longer only when they are needed to establish, exercise or defend legal claims, until those claims are time-barred.
• Material downloads: 12 months after the download; the site then deletes the data by itself.
• Google Analytics: user-level and event-level data for 14 months (a setting of the service). The _ga cookies expire after 2 years unless you withdraw your consent earlier - the site then removes them.
• Server and edge logs of the site: 30 days, unless they are needed to investigate a specific security incident - then until it is resolved.
• Meta Pixel: this site's _fbp and _fbc cookies are removed when you withdraw your consent; how long Meta keeps the data it received is described in Meta's Privacy Policy.
• The contman_consent cookie that remembers your choice: 180 days.
• The __Host-contman_chat cookie: 30 days after your first chat message.
• Panel accounts: for as long as the staff member uses the panel.

Who receives data

We do not sell data. It is accessible only to authorised CONTMAN staff and to companies that help us run the site and process data on our behalf under data processing agreements:

• the provider of the servers that run the site and its database (hosting);
• Cloudflare, Inc. - the network that carries traffic to the site and protects it from attacks and abuse;
• Google Ireland Limited - Google Analytics, only if you accept statistics;
• Slack - the messaging service where our staff receive chat messages and contact-form requests and answer the chat;
• MailerSend - the service through which the site e-mails contact-form requests to us;
• the providers of e-mail and other IT services we use when answering your request.

If you accept marketing cookies, the pixel data also goes to Meta Platforms Ireland Limited - as a joint controller of collecting and transmitting it, and after that as a separate controller (see above).

We may also disclose data to public authorities where the law requires it.

Transfers outside the EEA

Google and Cloudflare may also process data outside the European Economic Area, including in the United States. Google LLC and Cloudflare, Inc. state that they comply with the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision (Article 45 GDPR). Where a transfer is not covered by it, the standard contractual clauses adopted by the European Commission apply (Article 46(2)(c) GDPR). You can obtain a copy of the safeguards by writing to us.

More: Google's data transfer frameworks and Cloudflare's data processing addendum.

Meta Pixel data may also be processed in the United States. Meta Platforms, Inc. participates in the EU-U.S. Data Privacy Framework (U.S. Department of Commerce list), for which the European Commission adopted an adequacy decision (Article 45 GDPR).

Slack and MailerSend may also process data outside the European Economic Area; such a transfer relies on an adequacy decision of the European Commission (Article 45 GDPR) or on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can obtain a copy of the safeguards by writing to us.

Your rights

Within the limits set by the GDPR, you have the right to:

• access your data and obtain a copy (Article 15);
• rectification (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• portability of data processed on the basis of consent or a contract (Article 20);
• object to processing based on our legitimate interest (Article 21);
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Article 7(3)) - you withdraw consent to statistics and to marketing with the "Cookie settings" button in the site footer;
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl) if you believe we process your data unlawfully (Article 77).

To exercise your rights, write to privacy@contman.pl or to the postal address given under "Who is the controller". We will answer without undue delay and within one month at the latest (Article 12(3) GDPR). We may ask for information needed to confirm your identity.

For Meta Pixel data you can exercise your rights against us and against Meta Platforms Ireland Limited (Article 26(3) GDPR).

Cookies

Without your consent the site stores only necessary cookies: contman_consent, which remembers your choice, and - when you write to us through the chat - __Host-contman_chat, which links your browser to your conversation; the Cloudflare network may store necessary cookies that protect the site from abuse. Google Analytics and Meta Pixel cookies are stored only with your consent. The details are in the cookie policy.

Security

We use technical and organisational measures suited to the risk: an encrypted connection to the site (HTTPS), access to form requests for authorised staff only, sign-in to the panel with a second authentication factor and a 10-minute account lock after five failed attempts, and a limit on requests sent from one address.

Changes to this policy

We update this policy when the way the site works or the law changes. The date from which the current version applies is shown at the top of this page.