# Privacy Policy - Contact Form Source: https://ordergroup.co/privacy-policy/ Last updated: 2026-10-09 > How Order Group processes personal data sent through the contact form: purpose, legal basis, retention period and your rights under the GDPR. # INFORMATION ON THE PROCESSING OF PERSONAL DATA BY ORDER GROUP SP. Z O.O. WITH ITS REGISTERED OFFICE IN WARSAW (regarding the contact form available on the website https://ordergroup.co/) Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, (OJ L 119, p. 1) (hereinafter "GDPR"), we inform you that: 1. **Data controller** The controller of your personal data is Order Group sp. z o.o. with its registered office in Warsaw, ul. Chmielna 25 00-021 Warszawa, entered in the Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw in Warsaw under KRS number 0000489590, NIP: 5223011641, REGON: 147025032. You can contact the data controller as follows: 1. by post, sending correspondence to: ul. Chmielna 25 00-021 Warszawa, 2. by sending an e-mail to: rodo@ordergroup.pl. We have not appointed a Data Protection Officer (DPO); therefore, in all matters concerning the protection of your personal data and the exercise of your rights, please contact the controller directly. 1. **Source of personal data** Your personal data are obtained directly from you through the contact form made available on the website operated at: https://ordergroup.co/. 1. **Categories and scope of personal data processing** In connection with your use of the contact form, the controller obtains and processes the following data: your e-mail address. The controller may also collect and process personal data of persons using the website available at https://ordergroup.co/ and its subpages, including IP addresses or other identifiers and information collected through cookies or other similar technologies) - in the situations described in detail in the Privacy Policy. 1. **Purpose, legal basis and period of processing of your data** We use your data in order to **respond to the contact you have initiated with the controller / the message you have sent via the contact form available on the controller's website** - legal basis: Article 6(1)(b) GDPR - processing is necessary in order to take steps at the request of the data subject prior to entering into a contract (if the content of the message sent to the controller concerns such requests), or Article 6(1)(f) GDPR - processing is necessary for the purposes of the legitimate interest pursued by the controller, namely ensuring proper handling of communications and responding to enquiries addressed to the controller that do not concern the conclusion of a contract with the controller. Data retention period: the controller processes personal data for the period necessary to respond to the enquiry or provide information, but no longer than 12 months from the end of the correspondence. After the retention period has expired, the data will be deleted or anonymised in a manner that prevents identification of the data subject. 1. **Categories of data recipients** In order to comply with the controller's legal obligations and to ensure the proper functioning of the controller's organisation, your personal data may be disclosed to the following categories of recipients: service providers supplying the controller with technical and organisational solutions that enable us to manage our organisation (in particular providers of e-mail, hosting and cloud services, courier companies and service technicians), entities providing advisory, legal, tax or accounting services to the controller, to the extent necessary to provide those services, and entities authorised under applicable law, in particular courts and public authorities - where required by the relevant provisions of law. Your data will always be shared only to the extent necessary - both in terms of the scope of the data shared and the duration of sharing. 1. **Transfer of data to third countries or international organisations** As a rule, we do not transfer your personal data outside the European Economic Area (EEA) or to international organisations. However, data may be transferred outside the EEA where the controller uses the services of IT tool providers (e.g. e-mail services, communication support systems or hosting) that may store or process data on servers located outside the EEA, in particular in the United States of America. In such cases, data are transferred only where one of the safeguards provided for in the GDPR is in place, in particular: where the provider participates in the EU-US Data Privacy Framework (DPF), which confirms its compliance with the principles of adequate protection of personal data, or on the basis of standard contractual clauses (SCC) adopted by the European Commission together with supplementary security measures applied by the provider. The list of entities certified under the DPF is available at: [https://www.dataprivacyframework.gov/](https://www.dataprivacyframework.gov/). 1. **Your rights in relation to data processing** The controller guarantees you the right to: 1. access your data, 2. rectification of your data, 3. request erasure of your data ("right to be forgotten"), 4. restriction of data processing, 5. data portability (to the extent that processing is based on consent or a contract and is carried out by automated means). 6. **Right to object** In particular situations, you may object to the processing of your data if the processing is based on the legitimate interest of the controller or on the public interest. In such a case, after considering your request, we will no longer be able to process your data covered by the objection, unless we demonstrate that there are: 1. compelling legitimate grounds for the processing which override your rights and freedoms, or 2. grounds for the establishment, exercise or defence of legal claims. 3. **Right to withdraw consent** If your data are processed on the basis of your consent, you have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent will not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal. You can withdraw your consent by sending a request by post or by sending an e-mail (the number and addresses are given in point I above). 1. **How to exercise your rights** You can exercise the rights referred to in points VII-IX by sending a request by post or by e-mail (the addresses are given in point I above). To make sure that you are entitled to submit the request, the controller may ask you to provide additional information enabling your identity to be verified. The scope of each of the above rights and the situations in which they can be exercised are set out in the law, and whether you can exercise a given right will depend, for example, on the legal basis for using the data and on the purpose of their processing. 1. **Complaint** You have the right to lodge a complaint with the supervisory authority competent for personal data protection (currently the President of the Personal Data Protection Office, ul. Stawki 2 00-193 Warszawa) if you believe that the processing of your personal data infringes the law. 1. **Automated decision-making** In the course of processing your data, there will be no automated decision-making that could produce legal effects concerning you or similarly significantly affect you. 1. **Information on whether providing data is required or voluntary** Using the contact form is entirely voluntary. However, failure to provide the data required in the form, i.e. your e-mail address, will prevent us from responding to your enquiry. In such a case, it will not be possible to use the service of sending an enquiry to the controller or to receive a response from us.