# Privacy and Cookies Policy

Source: https://ordergroup.co/privacy-policy-cookies/
Last updated: 2026-10-10

> Order Group privacy and cookies policy: what personal data the website collects, which cookies it uses and how you can manage them.

# PRIVACY AND COOKIES POLICY

I. **INTRODUCTORY INFORMATION**

1. We care about information security and the privacy of Users visiting our website available at [https://ordergroup.co/](https://ordergroup.co/)  (the Website). That is why we have implemented organisational and technical measures to properly protect your data. In this Privacy Policy we explain what data we collect through the Website, on what legal basis we process them and how we protect them.
2. The administrator of the Website and the controller of personal data is Order Group sp. z o.o. with its registered office in Warsaw, ul. Chmielna 25 00-021 Warszawa, entered in the Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw in Warsaw under KRS number 0000489590, NIP: 5223011641, REGON: 147025032
3. Having carried out an analysis, we have concluded that in our situation the conditions set out in Article 37(1) GDPR for designating a data protection officer are not met; therefore, we have not appointed a DPO.
In all matters relating to the protection of personal data, you can contact us:
4. in writing: correspondence address: ul. Chmielna 25 00-021 Warszawa
5. electronically: rodo@ordergroup.pl,
6. by telephone: phone number: +48 790-291-813.
7. We process only the information necessary to ensure the proper operation and security of the Website, its maintenance and the ability to contact Users (in particular those using the forms available on the Website). Providing personal data is not required to browse the content available on the Website. In some situations, providing data is necessary to use selected functions (e.g. sending an enquiry via a form) or to take steps at your request prior to entering into a contract. While you use the Website, our systems and servers may automatically record basic information such as, among other things: the IP address and technical device identifiers recorded in server logs; we process these data to ensure the security and maintenance of the Website.
8. We do not make decisions about you based solely on automated processing (including profiling) which would produce legal effects concerning you or similarly significantly affect your situation.
9. Our domain uses an SSL/TLS certificate, so the data transmitted are encrypted.
10. Personal data are collected and processed in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). The full text of the Regulation is available at: [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679).

**II. DEFINITIONS**

1. The terms used in this Policy have the following meanings:
2. **Controller - Order Group sp. z o.o.**with its registered office in Warsaw, ul. Chmielna 25 00-021 Warszawa, entered in the Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw in Warsaw under KRS number 0000489590, NIP: 5223011641, REGON: 147025032, (hereinafter also referred to as: "**the Company"**or**"Order Group"**),
3. **GDPR** - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 2016, p. 1, as amended),
4. **Personal data** - means information relating to an identified or identifiable natural person (data subject), by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person, including image, voice recording, contact details, location data, information contained in correspondence, and information collected by means of recording equipment or other similar technology,
5. **Website -**the website operated by the Controller, available at [https://ordergroup.co/](https://ordergroup.co/).
6. **User -** any natural person visiting the website at [https://ordergroup.co/](https://ordergroup.co/) who uses the services provided by the Controller electronically through the Website (e.g. forms).

**III. WHAT PERSONAL DATA DO WE PROCESS?**

1. Depending on the purpose and the Website function you use, we may process:
2. contact form: first name (and possibly surname), e-mail address, telephone number (if provided), content of the message,
3. business data (B2B - if applicable): company name, NIP (tax identification number), address of the registered office/place of business, only where needed to prepare an offer or perform the cooperation,
4. technical data: IP address, timestamps, URLs visited, server responses, basic information about the browser and operating system, as well as strictly necessary cookies (e.g. session identifier, record of cookie preferences),
5. analytical (statistical) data: traffic source, approximate location derived from the IP address (city/region, without the exact address), browser and system type/version, screen resolution, device model, language, time spent on individual subpages, events.
6. The data indicated above are collected in particular as a result of:
7. use of the contact form,
8. a message sent directly to our e-mail address,
9. data provided to us during a telephone conversation,
10. the collection of technical and statistical data during use of the Website by the Website software (server logs, strictly necessary cookies) and, after consent has been given, by the analytics tools described in this Policy.
11. Detailed information on cookies and other tools we use on the Website can be found later in this Privacy Policy.

**IV. PURPOSES AND LEGAL BASES OF DATA PROCESSING**

1. We process data only to the extent necessary for the operation of the Website
and for handling contact with Users, and for the period required by law or necessary to protect our rights. In particular, we process data for the purposes indicated in points 2-6 below.
2. Responding to an enquiry (contact form, e-mail, telephone):
3. **Purpose of processing:** communicating with the User, responding to the enquiry, providing information (including an offer)
4. **Scope**: first name/surname, e-mail, telephone (if provided), content of the message and other data provided voluntarily in connection with the enquiry,
5. **Legal basis**: Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract - if the enquiry concerns an offer/contract) or point (f) (legitimate interest - responding in connection with contact initiated by the User, ongoing communication),
6. **Processing period:** we process the data for the duration of the correspondence/handling of the matter, and then store them until the limitation periods for claims related to the correspondence have expired), and in the case of enquiries not related to a contract - no longer than 6 months from the last contact on the matter.
7. Security and maintenance of the Website (logs, strictly necessary cookies):
8. **Purpose of processing**: ensuring the security and stable operation of the Website, detecting abuse, diagnosing errors,
9. **Scope**: IP address, timestamps, technical URLs visited, browser/system information, technical identifiers, strictly necessary cookies (e.g. session, cookie preferences),
10. **Legal basis**: Article 6(1)(f) GDPR (legitimate interest of the Controller),
11. **Processing period:** we store technical logs for up to 6 months and logs related to system security for up to 12 months, with longer retention permitted only to the extent justified by security requirements, the need to analyse incidents or the potential pursuit of claims; strictly necessary cookies - for the duration of the session or for up to 12 months (depending on the purpose and configuration).
12. Analytics and statistics (subject to consent):
13. **Purpose of processing**: measuring and improving the usability of the Website, visit statistics,
14. **Scope:** device and session data (e.g. browser type/version, system, resolution), events on the Website (e.g. clicks, visit duration, navigation paths), traffic source,
15. **Legal basis:** Article 6(1)(a) GDPR (consent given in the cookie banner). Not giving consent does not affect basic use of the Website,
16. **Processing period**: we store analytical data in accordance with the configuration of the given tool, for the period needed to achieve the purpose for which they were collected, and in any event no longer than until you withdraw your consent. Consent may be withdrawn at any time; withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before it.
17. Establishment, exercise or defence of legal claims, settlements and archiving:
18. **Purpose of processing:** protection against claims, exercising and defending rights, demonstrating compliance with the law, fulfilling legal obligations (if any), as well as correct settlements and archiving of documents,
19. **Scope:** identification and contact data, transaction/contract data, content of correspondence and requests, documents and evidence related to the matter (including internal notes and system logs),
20. **Legal basis:** Article 6(1)(f) GDPR (legitimate interest of the Controller - establishment, exercise or defence of legal claims) and - where applicable - Article 6(1)(c) GDPR (compliance with a legal obligation, in particular in the field of accounting),
21. **Processing period:** until the limitation periods for claims have expired and for the periods required by law (in particular accounting and tax regulations).

**V. RECIPIENTS OF PERSONAL DATA**

1. We share personal data with other entities only: where the data subject has consented to it, where it is necessary for the performance of a contract, or where it results from our legitimate interests.
2. We entrust data only to trusted providers, in compliance with the requirements of the GDPR, including:
3. the hosting and server maintenance provider,
4. the IT services/maintenance provider (administration, security, support),
5. the e-mail/SMTP provider (handling of correspondence and forms),
6. the analytics tool provider (only after consent to analytics cookies has been given).
7. Data may be disclosed to entities authorised under the law (e.g. courts, public authorities), as well as to legal advisers, statutory auditors and insurers, where this is necessary to protect our rights.
8. Some processing operations may involve the transfer of data to third countries (outside the European Economic Area) or to international organisations where we use solutions from providers whose infrastructure is located outside the EEA, in particular in the USA. This applies in particular to analytics services activated after consent is given in the cookie banner. In such cases, we ensure the transfer safeguards required by the GDPR, in particular: using providers certified under the EU-US Data Privacy Framework (DPF) or applying the European Commission's standard contractual clauses (SCC), supplemented - where necessary - by additional technical and organisational measures (e.g. encryption, pseudonymisation). Google services are, as a rule, provided by Google Ireland Limited (an entity in the EEA). However, if a given function involves a transfer to Google LLC (USA), the transfer takes place using one of the above mechanisms (DPF/SCC) and with privacy features enabled (e.g. IP anonymisation/truncation, pseudonymisation of identifiers). You have the right to obtain information about the safeguards applied and (on request) a copy of the standard contractual clauses. We limit data transferred outside the EEA to the necessary minimum and only to the extent of the purposes described in this Policy.

**VI. RIGHTS RELATED TO DATA PROCESSING**

1. In connection with the processing of personal data by the Company, you have the right to:
2. **access to data** (information about processing) - you have the right to obtain from us confirmation as to whether we process your data and, if so, information on, among other things, the purposes, legal bases, categories of data, recipients, envisaged storage periods and your rights,
3. **obtain a copy of the data** - you have the right to obtain a copy of your personal data that we process,
4. **rectification of data** - you may request the rectification of inaccurate data and the completion of incomplete data,
5. **restriction of processing -** you may request restriction of processing, e.g. when you contest the accuracy of the data (for the period of verification), when the processing is unlawful but you oppose the erasure of the data, when the data are no longer needed for our purposes but are needed for the establishment/exercise of claims, or when you have objected - until the objection is resolved,
6. **erasure of data** ("right to be forgotten") - you may request erasure of data, among other things, when they are no longer necessary for the purposes for which they were collected, consent has been withdrawn (and there is no other legal basis) or an objection has been effectively lodged. This right does not apply to the extent that processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims. If we have disclosed the data to recipients, we will inform them of the erasure where possible,
7. **data portability** - applies to data you have provided to us that are processed on the basis of consent or a contract and by automated means. You may receive the data in a structured, commonly used and machine-readable format or - where technically feasible and secure - request that they be transmitted directly to another controller,
8. **withdraw consent** - if we process data on the basis of consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before its withdrawal,
9. **lodge a complaint** - if you consider that the processing infringes the law, you may lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl),
10. **object**- you may object to processing based on our legitimate interest (Article 6(1)(f) GDPR). In such a case, we will stop processing the data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims,
11. **the right not to be subject to decisions based solely on automated processing, including profiling** - we do not make such decisions about you that produce legal effects or similarly significantly affect your situation.
12. You may exercise the above rights in accordance with the rules set out in Articles 16-21 GDPR by contacting us:
13. by post: ul. Chmielna 25 00-021 Warszawa,
14. by e-mail: rodo@ordergroup.pl.
15. The request should indicate as precisely as possible what your request concerns, in particular:
16. which right you wish to exercise (e.g. the right to obtain a copy of the data),
17. which processing operation the request concerns (e.g. correspondence conducted via the contact form),
18. which processing purpose the request relates to (e.g. communication).
19. When handling your requests, we may ask you to provide additional information
in order to verify the identity of the person submitting the request. If we are unable to determine the content of the request or identify the person submitting it on the basis of the data provided, we will ask for clarification (additional information).
20. The Company will respond to you without undue delay and in any event within 1 month of receipt of the request. In particularly complex cases, this period may be extended; we will inform you of the reasons and the expected date of the response.

**VII. COOKIES AND SIMILAR TECHNOLOGIES**

1. When you use our Website, cookies, i.e. small text files, may be stored on your device (e.g. computer, smartphone, tablet). Cookies are commonly used to improve the operation of websites and to increase their performance. The information stored in cookies makes it possible to recognise the User automatically on their next visit to our Website, which makes the Website easier to use.
2. Our Website uses the following types of cookies:
3. strictly necessary: required for the proper functioning of the Website,
4. statistical: they allow us to study traffic on the Website, learn about Users' preferences, analyse their behaviour on the Website and enable interaction with external networks and platforms (e.g. Google analytics tools, Hotjar),
5. marketing: they allow the advertisements and content displayed to be tailored to Users' preferences - these files are processed on the basis of the User's voluntary consent.
6. In particular, cookies enable us to:
7. maintain the functionality and security of the Website,
8. optimise Users' use of the Website, e.g. cookies allow us to recognise your device and display the Website tailored to your individual needs,
9. use analytics and marketing tools,
10. compile statistics that help us understand how you use the Website, which allows us to improve its structure and content.
11. When you use the Website for the first time, information about the use of cookies is displayed (the cookie consent banner). Accepting and closing this information means that you consent to the use of cookies in accordance with the provisions of this Privacy Policy. You may change or withdraw the consent given for non-functional cookies (analytics/marketing) at any time via the cookie banner available on the Website.
12. You can also block cookies from being stored or delete existing cookies in your browser settings (instructions are usually available in the "Privacy" or "Security" section). How to change cookie settings may differ depending on the web browser you use. Blocking certain categories of cookies may limit certain functions of the Website (e.g. remembering preferences, content personalisation). With regard to personalised advertising, you can additionally manage the settings in your Google account (e.g. in My Ad Center).
13. Consent to the use of analytics and marketing cookies constitutes the legal basis for processing data for these purposes (Article 6(1)(a) GDPR) and may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal. Cookies necessary for the proper functioning of the Website and for ensuring its security are processed on the basis of the legitimate interest of the controller (Article 6(1)(f) GDPR) and do not require the User's consent.
14. Like most modern websites, our Website uses functions provided by third parties, which involves the use of cookies originating from those parties. We use third-party cookies to collect general and anonymous statistical data through analytics tools such as:
15. Google tools (in particular Google Analytics and Google Ads) provided by Google Ireland Ltd.,
16. the Meta Pixel tool provided by Meta Platforms Ireland Ltd.,
17. the Hotjar tool provided by Hotjar Ltd. (Malta).
18. We use Google Analytics for analytical and statistical purposes, in order to improve the operation of the Website and adapt its functionality to Users' needs. Data collected through this tool are aggregated and processed in a way that limits the possibility of identifying a person and, where possible, anonymised. They include, among other things, information on the operating system, browser type, pages and subpages visited, time spent on the Website and the source of the visit.
19. In connection with the use of Google Ads and related advertising tools, remarketing cookies may be stored on your device, collecting information about your activity on our Website. These data are used to display advertisements in the Google network that match your interests and previous interactions with the Website. If you have given the relevant consent to Google, these data may also be processed by that company to create audiences and personalise advertising. If you do not wish to receive personalised advertisements, you can change your ad settings at: myadcenter.google.com.  Detailed information on how Google tools work is available in the Google Privacy Policy at [https://policies.google.com/](https://policies.google.com/)
20. As part of our marketing activities, we use the Meta Pixel tool provided by Meta Platforms Ireland Ltd. Meta Pixel allows us to measure the effectiveness of campaigns, analyse events on the Website and target personalised advertisements on Facebook and Instagram. Detailed information on how Meta Pixel works is available at: [https://www.facebook.com/business/help/742478679120153?helpref=page_content](https://www.facebook.com/business/help/742478679120153?helpref=page_content). You can manage Meta Pixel through the ad settings in your account on Facebook.com: [https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen](https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen).
21. The Hotjar tool helps us better understand how Users use the Website (e.g. by means of heatmaps, recordings of selected sessions and surveys). Data collected by Hotjar are pseudonymised or anonymised where possible and are not used to identify specific Users. Detailed information on the processing of data by Hotjar is available in that provider's privacy policy: [https://www.hotjar.com/legal/policies/privacy/](https://www.hotjar.com/legal/policies/privacy/).

**VIII. PERSONAL DATA PROCESSED THROUGH SOCIAL MEDIA**

1. Order Group runs official profiles on social media platforms (e.g. Facebook, Instagram, LinkedIn, Medium, Clutch) in order to promote its business, provide information about its services, communicate with Users and build and maintain relationships with people who follow the profiles. Each of these platforms is a separate controller of its users' data and processes data in accordance with its own rules. As a rule, with regard to statistics and profile management, the Company and the given platform may be joint controllers of data concerning visits to and interactions with the profile. The scope of joint controllership and basic information can be found in the documentation of the given platform. Using our profiles is voluntary. Not following a profile or not interacting with it does not affect the use of our services, in particular the use of the Website outside social media.
2. In connection with running the profiles, the Company may process personal data of persons visiting the profiles, including in particular: first name and surname (profile name), profile picture, other information made publicly available on the given platform, as well as the content of messages sent via these platforms. We see only the data that are available to us as a result of your privacy settings and activity on the given platform. The legal basis for our processing of the data is our legitimate interest (Article 6(1)(f) GDPR), consisting in communicating on social media. The data come directly from you (activity on the profiles) and from the systems of the given platform (statistics, reach).
3. Personal data processed through social media are processed for as long as the Company's official profile exists or until the data subject stops following the profile, deletes a comment or message, or submits a request for erasure of the data - provided that such a request can be fulfilled in accordance with the terms of the given platform.
4. Data processed in connection with the profiles are available to the social media providers as independent controllers. Social media platforms may process data outside the European Economic Area (e.g. in the USA). This takes place on the basis of appropriate legal mechanisms applied by these platforms (e.g. adequacy decisions, standard contractual clauses). Details can be found in the privacy policies of the individual platforms.

**IX. SERVER LOGS**

1. Using the Website involves sending requests to the server on which the Website is hosted. Each request sent to the server is automatically recorded in the server logs (log files).
2. Server logs are only auxiliary material used by us to administer the Website and for statistical purposes. They contain, among other things, information on the User's IP address, the date and time of the request, the browser and the operating system. We use server logs to ensure security, in particular to defend against attempted attacks on our server and to detect faults. Server logs are stored for up to 6 months, only to the extent necessary to ensure the security of the Website, detect and analyse security incidents, prevent abuse and pursue or defend against claims. In the event of a security incident or an investigation, the data may be stored for the period necessary to complete those activities and then deleted or anonymised.
3. As a rule, the Company does not identify specific persons on the basis of data recorded in server logs, and these data are not used to identify users of the Website. Server logs are recorded and stored on the server. Only persons authorised to administer the server and maintain the security of the infrastructure have access to the logs. The data are not disclosed to unauthorised persons or transferred to other entities, except where such an obligation arises from the law.
4. Data recorded in the logs are processed on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest of the controller, consisting in ensuring the security, stability and proper functioning of the Website.

**X. CHANGES TO THE PRIVACY POLICY**

1. We reserve the right to amend this Privacy Policy, in particular in the event of:
2. the need to adapt it to changes in the services we offer,
3. changes in the law, including the law on personal data protection,
4. the issuing of new guidelines, recommendations or decisions by the competent supervisory authorities.
5. We will inform you of any changes by publishing the updated Privacy Policy on our Website. In the case of material changes (affecting the scope or purposes of data processing, users' rights or the legal bases), we will additionally inform you in a prominent place on the Website.
6. The new version of the Privacy Policy applies from the date of its publication on the Website, unless a different effective date is expressly indicated.
7. This version of the Privacy Policy is effective as of 16.02.2026.