4 min read
Last updated: 18 August 2026
This policy explains what personal data Mervia Group collects through merviagroup.com, why, and what you can do about it. It is written to be read rather than to be defensible, which means it is shorter than most.
Who is responsible
The controller of your personal data is:
Mervia Group Sp. z o.o. ul. Przykładowa 12, 61-001 Poznań, Poland KRS 0000000000 · NIP 0000000000 info@merviagroup.com · +48 61 000 00 00
We have not appointed a data protection officer, because we are not required to. Data protection questions go to the address above and are answered by a person, not a form.
What we collect, and why
When you request a quote or send an enquiry
| Data | Why | Lawful basis |
|---|---|---|
| Company name | to quote and to invoice | Art. 6(1)(b) — steps before a contract |
| Contact name | to reply to a person | Art. 6(1)(b) |
| Work e-mail, telephone | to reply | Art. 6(1)(b) |
| Country, postcode | to price the freight | Art. 6(1)(b) |
| Your role, estimated volume | to quote correctly | Art. 6(1)(b) |
| Your message and attachments | to answer it | Art. 6(1)(b) |
| Time and IP of submission | spam prevention, proof of consent | Art. 6(1)(f) — legitimate interest |
We ask for a work e-mail because this is a business-to-business site. We do not knowingly collect personal data of consumers, and nothing on this site is directed at children.
When you download a calculator report
If you ask us to e-mail a PDF of a calculator result, we store the e-mail address and what you asked for. The calculator result itself is always shown in full on the page first — the e-mail is for the PDF, not a condition of seeing the number.
When you simply visit
Our server keeps standard access logs: IP address, time, page requested, browser string. They exist to keep the site running and secure, are kept for 30 days and are not used to build a profile of you.
We do not run Google Analytics or any third-party analytics that identifies visitors. See the cookie policy.
Who else sees it
| Recipient | What they see | Where |
|---|---|---|
| Our hosting provider | everything stored on the server | Poland / EU |
| Our e-mail provider | enquiry e-mails | EU |
| Cloudflare | IP address, for bot protection on forms | EU endpoints |
| Our manufacturers | only the specification and quantity needed to produce your order | Poland |
| Our accountants | invoice data, where a contract results | Poland |
We do not sell personal data, and we do not share it for anyone else’s marketing.
Transfers outside the EU: we do not routinely transfer personal data outside the European Economic Area. Cloudflare is configured to use EU endpoints. If a transfer becomes necessary, it will be on the basis of an adequacy decision or standard contractual clauses, and this policy will say so.
How long we keep it
| Data | Retention |
|---|---|
| Enquiry that did not become a contract | 24 months, then deleted |
| Enquiry that became a contract | as long as the commercial relationship, then 6 years for accounting |
| Consent records | for as long as the underlying data, plus 12 months |
| Server access logs | 30 days |
| Marketing subscriptions | until you unsubscribe |
Twenty-four months on unsuccessful enquiries is deliberate: packaging contracts are often re-tendered on a two-year cycle, and an enquiry we cannot win this year is one we may be able to answer properly next time. If you would rather we did not, say so and we will delete it.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the data we hold about you (Art. 15)
- correct anything wrong (Art. 16)
- delete it (Art. 17)
- restrict what we do with it (Art. 18)
- hand it over in a portable format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
Write to info@merviagroup.com. We answer within one month, free of charge, and we do not require a specific form of words.
If you are not satisfied, you can complain to the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa — or to the authority in the EU country where you live or work.
Automated decision-making
There is none. Quotations are prepared by people, and nothing on this site profiles you or makes a decision about you automatically.
Security
Data is held on servers in the EU with encrypted transport (TLS), access limited to the people who need it, and offsite backups. No system is perfect; if a breach occurs that is likely to put your rights at risk, we will tell you and the supervisory authority within the time the GDPR requires.
Changes
We will update this page when what we do changes, and the date at the top will change with it. Material changes affecting existing customers are notified by e-mail rather than only posted here.
Note for review: this policy is a working draft prepared alongside the site. It reflects what the site actually does, but it should be reviewed by a Polish legal adviser before launch, together with the registration details above.