Privacy policy

Last updated: 9 October 2026

This policy explains what personal data we collect on zorachem.pl, why, how long we keep it and what your rights are. It also describes cookies and similar technologies.

1. Who the controller is

The controller of your personal data is ZORA-CHEM Spółka z ograniczoną odpowiedzialnością, registered office in Warsaw, ul. Kłobucka 25A/1, 02-699 Warszawa, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000544136, NIP (tax ID) 6282263586, REGON 360836219 (“we”).

For any matter concerning personal data, write to us at biuro@zorachem.pl or by post to our registered office.

Wholesale enquiry

In the wholesale enquiry form you provide: company name, NIP (optional), full name, email address, phone number, delivery location and, if you wish, the products you are interested in, an estimated number of pallets, delivery frequency and a message. We use them to prepare a quote and to correspond with you about this enquiry.

  • Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) or, when you act on behalf of a company, Article 6(1)(f) GDPR (our legitimate interest: answering the enquiry of the company you represent and contacting you about the quote).

Contact form

In the contact form you provide your full name, email address, message and, optionally, a phone number. We use them to reply to your message and to correspond with you about it.

  • Legal basis: Article 6(1)(f) GDPR (our legitimate interest: replying to your message) or, if the message concerns entering into a contract, Article 6(1)(b) GDPR.

Emails

If you write to us directly at biuro@zorachem.pl, we use your data in the same way as data from the contact form. If you write about your rights described in section 7, we use it to handle your request (Article 6(1)(c) GDPR in conjunction with Articles 12–22 GDPR).

Marketing consent

In both forms you can, optionally, tick consent to marketing contact through the channels you choose (email, phone). You can send your enquiry without this consent.

  • Legal basis: your consent (Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law).
  • Together with the consent we record its wording, the channels chosen, the date and time and your IP address, so that we can demonstrate that consent was given (Article 6(1)(c) in conjunction with Article 7(1) GDPR).

Consent withdrawal form

In the consent withdrawal form you provide the email address or phone number the consent applies to and choose the channels. We use this data only to withdraw the consent and record that we have done so.

  • Legal basis: Article 6(1)(c) GDPR in conjunction with Article 7(3) GDPR (the obligation to allow consent to be withdrawn and to demonstrate compliance).

Technical data of submissions

Each form submission includes the date and time it was sent, your IP address, information about your browser and the address of the page the form was sent from. We use them to handle the submission, to protect the site against abuse and spam and as proof of when and from where the submission arrived (Article 6(1)(f) GDPR). The forms are protected by a hidden field and a simple arithmetic question; these safeguards do not use your personal data.

Server logs

The server that runs the website records technical information about connections in its logs, including IP address, date and time, the address of the page visited and the browser type. We also record the IP addresses of failed login attempts to the admin panel to block break-in attempts. We use this data only to keep the website secure and working properly (Article 6(1)(f) GDPR).

Claims and legal obligations

After our correspondence ends, we may keep submissions and messages in case of a dispute, to establish, exercise or defend legal claims (Article 6(1)(f) GDPR, our legitimate interest). For the same reason, and to be able to demonstrate that consent was given or withdrawn, we keep the record of marketing consent and its withdrawal (Article 6(1)(c) in conjunction with Article 7(1) GDPR and Article 6(1)(f) GDPR). If we conclude a contract, we keep the data needed for invoicing and accounting because tax and accounting laws require it (Article 6(1)(c) GDPR).

3. Do you have to provide data

Providing data is voluntary. Without the fields marked with an asterisk, however, we cannot answer your enquiry or message. Marketing consent is always optional.

4. How long we keep data

  • We automatically delete form submissions stored on the website 12 months after receiving them.
  • We keep enquiry emails and business correspondence for as long as needed to handle the enquiry and any further cooperation. After that, we keep them until any claims become time-barred and, if a contract is concluded, for as long as the law requires, for example tax and accounting rules.
  • We process data based on marketing consent until you withdraw it. We keep the record of giving and withdrawing consent for the period in which we may have to demonstrate consent, no longer than until any claims become time-barred.
  • We keep the record of cookie decisions (section 8) for 36 months from the decision.
  • Server logs are kept by the hosting provider for as long as needed to keep the website secure, according to its settings, and then deleted.
  • Website backups, which may contain submissions, are kept according to the hosting provider’s backup schedule and then overwritten.
  • If you consent to analytics tools, data in Google Analytics and Microsoft Clarity is kept for the period set in these services and, for Google Analytics, no longer than 14 months.

5. Who we share data with

Data may be received by companies that provide services to us and process data on our behalf under data processing agreements: the hosting provider whose servers run the website and store submissions, the email service provider and companies supporting us in maintaining the website. If you consent to analytics cookies, data is also received by the providers of the tools described in section 8 (Google, Microsoft); Microsoft also processes Clarity data for its own purposes. We may also disclose data to public authorities where the law requires it.

We do not sell your data or pass it to other companies for their own marketing.

6. Transfers outside the European Economic Area

As a rule, we process form data within the European Economic Area. If you consent to analytics tools, Google and Microsoft may also process data in the USA; our IT service providers, for example for email, may also process it outside the EEA. Such transfers take place only under Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US Data Privacy Framework) or standard contractual clauses adopted by the European Commission. To get a copy of these clauses, write to biuro@zorachem.pl.

7. Your rights

You have the right to:

  • access your data and obtain a copy of it (Article 15 GDPR),
  • rectify your data (Article 16 GDPR),
  • have your data erased (Article 17 GDPR),
  • restrict processing (Article 18 GDPR),
  • data portability for data processed on the basis of consent or a contract (Article 20 GDPR),
  • withdraw your consent at any time; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR),
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland (Article 77 GDPR).

Right to object. On grounds relating to your particular situation, you can object at any time to processing based on our legitimate interest (Article 21(1) GDPR). We always respect an objection to direct marketing (Article 21(2) GDPR).

To exercise your rights, write to biuro@zorachem.pl. You can also withdraw marketing consent using the form at the bottom of this page.

We do not make decisions about you based solely on automated processing, including profiling.

8. Cookies and similar technologies

Cookies are small text files stored in your browser. Browser storage (for example sessionStorage) works in a similar way.

Without your consent

Without consent, the website stores in your browser only information needed to display it:

  • in the browser’s session storage, a note that the website’s intro animation has already been shown; it disappears when you close the tab;
  • if the cookie banner is shown on the website, the zc_consent cookie with your choice (for 6 months; then we ask again).

The legal basis is Article 399(3)(2) of the Polish Electronic Communications Law (storage necessary to provide the service you request).

With your consent: analytics tools

We may use the following analytics tools on the website:

  • Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): visit statistics, such as the number of visits and the most read pages; we do not link it to Google’s advertising services;
  • Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): analysis of how the website is used, such as clicks, scrolling and session recordings. Microsoft also processes this data as a separate controller, under the Microsoft Privacy Statement.

We only start them after you give consent in the cookie banner (Article 399(1) of the Polish Electronic Communications Law, Article 6(1)(a) GDPR). If the banner is not shown, these tools are not used. You will find the full list of cookies with providers, purposes and retention periods in the “Cookie settings” window.

Consent record

When you make a choice in the banner, we store on the server: a random consent identifier (the same as in the zc_consent cookie, shared by later decisions made in this browser), the date and time, the banner version and a hash of its wording, the language, the categories accepted and rejected, the type of decision and the address of the page. The record does not include your IP address. It allows us to demonstrate that we obtained consent (Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR).

How to change or withdraw consent

You can change your choice at any time using the “Cookie settings” link in the website footer. After you withdraw consent, we delete the Google Analytics and Microsoft Clarity cookies stored under our website’s domain (_ga, _ga_*, _clck, _clsk), and the website stops loading these tools. We cannot delete the cookies Microsoft stores under its own domains (such as MUID or CLID); you can delete them in your browser settings. You can also delete and block cookies in your browser settings; blocking essential cookies may make the website harder to use.

9. Data security

The connection to the website is encrypted (HTTPS). Logging in to the admin panel is protected by a limit on failed attempts, passwords are stored as hashes and we update the website software regularly. We automatically delete form submissions stored on the website after 12 months (for copies in our mailbox, see section 4).

10. Changes to this policy

If the way we process data changes, for example when we start using a new tool, we will update this policy and, where necessary, ask for your consent again.

If you no longer want us to contact you for marketing purposes, withdraw your consent using the form below. Enter the email address or phone number the consent applies to and choose the channels. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

    I withdraw my consent to contact by

    Spam check: enter the result

    The controller of your personal data is ZORA-CHEM Sp. z o.o., ul. Kłobucka 25A/1, 02-699 Warszawa. We use the data from this form only to act on and record the withdrawal of your consent. To learn how we process data and what your rights are, read our privacy policy.