Privacy Policy

1. Controller

The controller of personal data collected through ee-en.saunacraft.pl is Denys Nechipai — sole trader, operator of the Saunacraft website.

For privacy matters you can reach us at nechipay2@gmail.com or by telephone: +48 724 157 520.

We have not appointed a Data Protection Officer — none of the conditions of Article 37(1) of the GDPR is met.

2. What data we collect

From the enquiry form and the configurator: your name, telephone number and — if you enter them — the text of your message, the place where the sauna is to be installed, and the model and configuration you chose (stove, options).

When a form is sent we also record the date and time, the version of the Terms and of this Policy in force, your IP address and your browser identifier (user agent) — as evidence that you made the declaration under the form.

Source of the visit: campaign tags in the link (utm parameters) and the referring page, so that we know which channel the enquiry came from.

If you contact us on WhatsApp, by telephone or by email, we process the content of the conversation and the number or address used.

We do not ask for identity documents or payment card details and do not collect special categories of data (Article 9 GDPR). Your delivery address is needed only if you place an order.

Technical data that the server stores automatically on every visit: IP address, browser type, pages viewed and time of the visit — in server logs, solely for security and to detect abuse.

3. Purposes and legal bases

Handling your enquiry, preparing a quote, saving your configuration under a short link (the “Quote” page) and performing an order. Basis: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract, and performance of the contract.

Replying to messages sent by WhatsApp or email, protecting the website and forms against abuse and automated submissions, keeping evidence of your declaration, and establishing, exercising or defending legal claims. Basis: Article 6(1)(f) GDPR — our legitimate interest.

Recording the source of the visit (utm tags, referring page) so that we know which advertising and channels bring enquiries. Basis: Article 6(1)(f) GDPR — our legitimate interest in assessing our marketing.

Visitor statistics (Google Analytics 4) and measuring the effect of advertising (Google Ads conversions) — only after you click “Accept” in the cookie window. Basis: Article 6(1)(a) GDPR — your consent.

Issuing invoices and keeping accounting records if a contract is concluded. Basis: Article 6(1)(c) GDPR — legal obligation.

4. Recipients of data

We do not sell data and do not pass it to anyone for their own marketing purposes.

Hosting: Fly.io — the website and the enquiry database run on servers in the European Union (Frankfurt region).

Notification of a new enquiry: the enquiry is forwarded to our sales adviser in an internal Telegram chat (Telegram Messenger Inc.).

Email: our mailbox is provided by Google (Gmail, Google Ireland Ltd). WhatsApp: Meta Platforms Ireland Ltd — only if you choose to contact us through WhatsApp.

Google Ireland Ltd: fonts loaded from Google Fonts (your IP address reaches Google when the page opens), and — after your consent — Google Analytics 4 and Google Ads conversion measurement.

Haulier and assembly crew — only if you place an order, and only the data needed for delivery or assembly (name, telephone, address). Our accountant — for invoices.

Data may be passed to public authorities where the law requires it.

5. Transfers outside the EEA and the UK

Google, Meta and Telegram may process data in the United States or other countries outside the European Economic Area and the United Kingdom. The basis is the adequacy decision on the EU–U.S. Data Privacy Framework (for the UK, the UK Extension to it) and/or the European Commission’s standard contractual clauses (for the UK, together with the UK Addendum). You can obtain a copy of the safeguards on request at nechipay2@gmail.com.

Transfers from the European Union to the United Kingdom are based on the adequacy decision of the European Commission for the UK.

6. Retention

Enquiries and configurations that do not lead to an order — up to 12 months after the last contact, after which we delete them.

Order data — for as long as the warranty lasts and the periods required by tax and accounting law (accounting records 5 years from the end of the tax year).

Evidence of your declaration under the form (date, version, IP, user agent) — for as long as claims relating to it may be brought.

Server logs — up to 90 days.

7. Cookies

Legal basis: the rules implementing the ePrivacy Directive (in Ireland S.I. No. 336/2011, in the United Kingdom the Privacy and Electronic Communications Regulations — PECR) and Article 6(1)(a) GDPR. Strictly necessary storage needs no consent; everything else does.

Necessary: your choice in the cookie window, stored in your browser for 12 months.

Only after you click “Accept”: Google Analytics 4 (cookies _ga and _ga_*, up to 2 years) and Google Ads conversion measurement (cookie _gcl_au, 90 days).

Until you click “Accept”, Google Consent Mode applies: no analytics or advertising cookies are set and no identifiers are stored on your device. We use no other tracking tools (no Meta Pixel, TikTok or Clarity).

On your first visit you see a window with two equal buttons, “Reject” and “Accept”. You can change your decision at any time with the “Cookie settings” link in the footer.

8. Your rights

You have the right of access and to a copy of your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and to object to processing based on our legitimate interest (Article 21) — and at any time, without giving reasons, to object to direct marketing.

You may withdraw your consent to cookies at any time (“Cookie settings” link in the footer). Withdrawal does not affect the lawfulness of processing before it.

To exercise any of these rights, write to nechipay2@gmail.com. We reply without undue delay and at the latest within one month.

9. Supervisory authorities

You may lodge a complaint with the supervisory authority of the country where you live or work, or with the Polish authority competent for us as a Polish seller:

Poland — Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl.

United Kingdom — Information Commissioner’s Office (ICO), ico.org.uk.

Ireland — Data Protection Commission, www.dataprotection.ie.

Estonia — Andmekaitse Inspektsioon (Data Protection Inspectorate), www.aki.ee.

Latvia — Datu valsts inspekcija (Data State Inspectorate), www.dvi.gov.lv.

Lithuania — Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate), vdai.lrv.lt.

10. Is providing data mandatory?

Giving your name and telephone number is voluntary; without a number, however, we cannot get back to you or prepare a quote. Instead of the form you can call us or write on WhatsApp: +48 724 157 520.

11. Automated decisions

We take no decisions based solely on automated processing and do not build profiles (Article 22 GDPR). The price in the configurator is calculated from a simple price list, and every enquiry is handled by a person.

12. Security and changes

The website runs only over an encrypted HTTPS connection. Only authorised persons have access to the enquiry database.

If we change the scope of the data collected or the list of service providers, we will update this document and the date at the top.