4 min read
Last updated: 26 September 2026
This policy explains what personal data Mervia Group collects through merviagroup.com, why, and what you can do about it. It is written to be read rather than to be defensible, which means it is shorter than most.
Who is responsible
The controller of your personal data is:
Mervia Group os. Górali, 31-961 Kraków, Poland info@merviagroup.com
We have not appointed a data protection officer, because we are not required to. Data protection questions go to the address above and are answered by a person, not a form.
What we collect, and why
When you request a quote or send an enquiry
| Data | Why | Lawful basis |
|---|---|---|
| Company name | to have a manufacturer quote, and to contract | Art. 6(1)(b) — steps before a contract |
| Contact name | to reply to a person | Art. 6(1)(b) |
| Work e-mail, telephone | to reply | Art. 6(1)(b) |
| Country, postcode | to price the freight | Art. 6(1)(b) |
| Your role, estimated volume | to quote correctly | Art. 6(1)(b) |
| Your message and attachments | to answer it | Art. 6(1)(b) |
| Time and IP of submission | spam prevention, proof of consent | Art. 6(1)(f) — legitimate interest |
We ask for a work e-mail because this is a business-to-business site. We do not knowingly collect personal data of consumers, and nothing on this site is directed at children.
When you download a calculator report
If you ask us to e-mail a PDF of a calculator result, we store the e-mail address and what you asked for. The calculator result itself is always shown in full on the page first — the e-mail is for the PDF, not a condition of seeing the number.
When you simply visit
Our server keeps standard access logs: IP address, time, page requested, browser string. They exist to keep the site running and secure, are kept for 30 days and are not used to build a profile of you.
We do not run Google Analytics or any third-party analytics that identifies visitors. See the cookie policy.
Who else sees it
| Recipient | What they see | Where |
|---|---|---|
| Our hosting provider | everything stored on the server | Poland / EU |
| Our e-mail provider | enquiry e-mails | EU |
| Cloudflare | IP address, for bot protection on forms | EU endpoints |
| The manufacturer quoting your specification | your company, contact name, work e-mail, delivery country and the specification — they quote you and, if you order, they contract with and invoice you | Poland |
| Our accountants | our commission invoices to the manufacturer, which name the order | Poland |
Why the manufacturer sees your details. We are an agent: the supply contract is between you and the plant, so the plant has to know who you are in order to quote, confirm and invoice. We pass what is needed for that and nothing else, and we tell you which plant before you commit rather than after.
We do not sell personal data, and we do not share it for anyone else’s marketing.
Transfers outside the EU: we do not routinely transfer personal data outside the European Economic Area. Cloudflare is configured to use EU endpoints. If a transfer becomes necessary, it will be on the basis of an adequacy decision or standard contractual clauses, and this policy will say so.
How long we keep it
| Data | Retention |
|---|---|
| Enquiry that did not become a contract | 24 months, then deleted |
| Enquiry that became a contract | as long as the commercial relationship, then 6 years for accounting |
| Consent records | for as long as the underlying data, plus 12 months |
| Server access logs | 30 days |
| Marketing subscriptions | until you unsubscribe |
Twenty-four months on unsuccessful enquiries is deliberate: packaging contracts are often re-tendered on a two-year cycle, and an enquiry we cannot win this year is one we may be able to answer properly next time. If you would rather we did not, say so and we will delete it.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the data we hold about you (Art. 15)
- correct anything wrong (Art. 16)
- delete it (Art. 17)
- restrict what we do with it (Art. 18)
- hand it over in a portable format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
To withdraw an enquiry, use the link at the foot of the acknowledgement we sent when you submitted it. It needs no account and no reply from us: it records the withdrawal against that enquiry and we stop contacting you about it. The enquiry itself is kept until its retention period ends, so we can show what was agreed and when — ask and we will erase it sooner.
Write to info@merviagroup.com for anything else. We answer within one month, free of charge, and we do not require a specific form of words.
If you are not satisfied, you can complain to the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa — or to the authority in the EU country where you live or work.
Automated decision-making
There is none. Quotations are prepared by people, and nothing on this site profiles you or makes a decision about you automatically.
Security
Data is held on servers in the EU with encrypted transport (TLS), access limited to the people who need it, and offsite backups. No system is perfect; if a breach occurs that is likely to put your rights at risk, we will tell you and the supervisory authority within the time the GDPR requires.
Changes
We will update this page when what we do changes, and the date at the top will change with it. Material changes affecting existing customers are notified by e-mail rather than only posted here.