Privacy Policy

General Provisions

1. The Controller of personal data collected via the website https://alquora.com/ (hereinafter referred to as: the Website) is Andrzej Paszota, conducting a sole proprietorship under the name GORZELNIA ROLNICZA – Andrzej Paszota, with a permanent place of business at Podole Wielkie nr 22, 76-220 Główczyce, entered into the Central Register and Information on Economic Activity under NIP number: 8391010359, REGON: 770755972, email address: letstalk@alquora.com, tel. +48 730 884 999 (hereinafter referred to as: the Controller).
2. Personal data collected by the Controller via the Website are processed in accordance with the provisions resulting from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as GDPR).
3. The Website is informational and business-oriented, and serves, in particular, to establish commercial contact regarding the supply of ethyl alcohol. The Website is not intended for the sale of alcoholic beverages.
4. This Privacy Policy is a document that specifies what personal data of Users visiting the Website are collected and processed by the Controller, and its purpose is to inform potential recipients how, by whom, and for what period their data are processed, and for what purpose and on what basis they are used.

Types of Data Processed, Scope, and Purpose of Collection

1. The Controller processes the personal data of the Website Users in the event of:
   1. using the contact form available on the Website to establish business contact, obtain information about the offer, or order a product sample – based on Art. 6(1)(b) and (f) of the GDPR,
   2. taking steps aimed at concluding a contract for the delivery of products offered by the Controller, including determining the terms of cooperation and handling commercial inquiries – based on Art. 6(1)(b) of the GDPR,
   3. carrying out the shipment of a product sample and related logistics activities – based on Art. 6(1)(b) of the GDPR,
   4. contacting the User, including responding to inquiries, providing information regarding the offer, cooperation, and further stages of inquiry handling – based on Art. 6(1)(b) and (f) of the GDPR,
   5. receiving marketing information from the Controller, including email messages, SMS, and communications regarding the offer, products, promotions, and discounts – after expressing separate consent, based on Art. 6(1)(a) of the GDPR,
   6. conducting marketing and remarketing activities, including displaying tailored advertisements on the Website and on third-party websites – based on Art. 6(1)(a) and Art. 6(1)(f) of the GDPR,
   7. ensuring the security of using the Website, preventing abuse, conducting statistical analyses, and developing the Website’s functionality – based on Art. 6(1)(f) of the GDPR,
   8. establishing, pursuing, or defending claims – based on Art. 6(1)(f) of the GDPR.
2. The Controller processes the following types of personal data:
   1. when the User uses the contact form – first name, last name, email address, phone number, IP address, content of the message, and in the case of acting on behalf of a business entity, also company identification data, in particular, the name, NIP (tax identification number), and address of the registered office or place of business,
   2. when consent for the newsletter is granted – email address, phone number,
   3. in the case of push notifications – email address,
   4. in the case of ordering a product sample related to business activity – data necessary for the shipment and possible preparation of an offer or commercial documents, in particular: company name, NIP, delivery address, registered office address, contact person’s name and surname, phone number, email address, and also – in justified cases – data for issuing settlement documents, such as bank account number.
3. Personal data are stored for the period:
   1. in the case of processing for the performance of a contract – for the duration of the contract, and then for the period of limitation of claims arising from the contract (as a rule, 6 years, and for claims related to conducting business activity – 3 years),
   2. in the case of processing based on consent – until its withdrawal, and after its withdrawal for the period of limitation of claims related to processing (as a rule, 6 years, and for claims related to business activity – 3 years),
   3. in the case of processing for the purpose of fulfilling legal obligations (accounting, taxes) – for the period required by law (currently 5 years from the end of the tax year),
   4. in the case of processing based on the legitimate interest of the Controller (including marketing) – for the time necessary to achieve this interest or until the User effectively objects.
4. Technical data may also be collected during the use of the Website, in particular: the User’s IP address, the IP address of the Internet provider, browser type, operating system type, time of access to the Website, and activity within the Website. These data are processed to ensure the security of the IT system, adapt functionalities to the User’s device, and conduct statistical analyses – based on Art. 6(1)(f) of the GDPR.
5. Personal data will also be processed automatically in the form of so-called profiling, provided that the User gives consent – Art. 6(1)(a) of the GDPR. Through profiling, the Controller will obtain information enabling them to assign a profile to a given User in order to make decisions regarding the User in terms of predicting their preferences and the functionality of these services.
6. The Controller exercises the utmost diligence to protect the rights and interests of the data subjects. In particular, it ensures that the data are:
   1. used lawfully,
   2. collected only for clearly defined and legitimate purposes, and subsequently not processed in a manner incompatible with those purposes,
   3. accurate, up-to-date, and adequate for the needs arising from the purpose of their processing,
   4. stored in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
7. The Controller informs that, in connection with the development of the Website, additional functionalities requiring the processing of personal data may be introduced, in particular:
   1. extension of functionalities related to handling quote inquiries and sample orders, including the automation of the contact form process, management of communication with the User, archiving of contact history, and customer relationship management (CRM) – for the purposes of service provision, improving the quality of service, and data security (Art. 6(1)(b) and (f) of the GDPR),
   2. integration of systems supporting sales processes and customer service, including tools enabling the preparation of commercial offers, handling orders placed outside the Website, and potential settlements between the Controller and the contractor – in order to enable the execution of commercial cooperation (Art. 6(1)(b) of the GDPR, Art. 6(1)(c) of the GDPR, and Art. 6(1)(f) of the GDPR),
   3. development of tools based on artificial intelligence and communication automation – in order to support inquiry handling, analysis of User needs, and offer matching (Art. 6(1)(a) of the GDPR and Art. 6(1)(f) of the GDPR),
   4. integration with external partner systems (in particular, providers of logistics services, IT services, and marketing tools) to the extent necessary to handle inquiries, sample shipments, conduct marketing activities, and manage commercial cooperation (Art. 6(1)(b) and (f) of the GDPR).
8. The introduction of new functionalities referred to in paragraph 7 will always be preceded by an update of this Privacy Policy and informing Users about the scope of new purposes and legal bases for data processing with at least 7 days’ notice by sending information about the planned introduction of changes to the Users’ email addresses.
9. Data may also be processed in connection with the organization of contests and promotional campaigns, based on separate regulations and the legal bases for personal data processing indicated therein.

Transfer of Personal Data of Users between the Controller and Cooperating Entities

1. The Controller informs that if the User uses the contact form on the Website, particularly to order a free product sample, the User’s personal data may be transferred to entities cooperating with the Controller to the extent necessary for the shipment of the sample and handling the inquiry.
2. The transfer referred to in paragraph 1 includes, in particular, data such as: first name and last name, email address, phone number, data necessary for the shipment of the sample (including delivery address), and in the case of acting on behalf of a business entity – also company identification data (including name, NIP, and address).
3. The purposes of data transfer are:
   1. enabling the User to order the product sample – based on Art. 6(1)(b) of the GDPR,
   2. enabling contact between the User and the Controller or the cooperating entity in matters related to the inquiry or sample – based on Art. 6(1)(b) and (f) of the GDPR,
   3. enabling the establishment and execution of commercial cooperation, including the transfer of data to entities affiliated with the Controller if the User is interested in placing an order or concluding a permanent contract – based on Art. 6(1)(b) and (f) of the GDPR,
   4. handling potential complaints and resolving disputes related to the shipment of the sample or cooperation – based on Art. 6(1)(f) of the GDPR.
4. The Controller indicates that entities to whom the Users’ personal data are transferred, including affiliated entities and business partners, may act as:
   1. separate data controllers – in the scope of commercial cooperation, product sales, or concluding contracts, in accordance with their own privacy policies,
   2. processors – in the scope of handling inquiries, sample shipments, logistical, and technical support performed on behalf of the Controller.
5. To the extent that cooperating entities process personal data on the Controller’s instruction, the Controller concludes data processing agreements with them, in accordance with Art. 28 of the GDPR, covering the processing of data to the extent necessary for handling inquiries, sample shipments, and activities related to potential future commercial cooperation.
6. The data referred to in this paragraph may be stored for the period necessary to achieve the purposes indicated in paragraph 3, including in the IT systems of the Controller and affiliated entities, in order to ensure the continuity of business relationship management (in particular, information about a previous sample order), but no longer than for the period resulting from applicable legal provisions or until the claims become time-barred.

Sharing Personal Data

1. The Users’ personal data may be shared with entities cooperating with the Controller in operating the Website. This applies in particular to:
   1. hosting companies,
   2. providers of software supporting business operations (e.g., CRM),
   3. entities servicing mailing systems and marketing communication (email, SMS),
   4. providers of tools and software necessary for the functioning of the Website, including analytical tools and cookie management,
   5. entities conducting marketing activities, including remarketing and personalized advertisements.
2. The entities listed in paragraph 1(a–e), depending on the concluded agreements and the nature of cooperation, may act on the Controller’s instruction (as processors) or independently decide on the purposes and means of data processing (as controllers).
3. For entities handling inquiries, sample shipments, and commercial cooperation, §3 of this privacy policy applies.
4. The Controller informs that, as part of using the Website, some personal data, including technical data (such as IP address, browser information, and the User’s end device), may be transferred to entities located outside the European Economic Area (EEA), particularly in connection with the use of the following services and tools:
   1. Google – including analytical and advertising tools, such as Google Analytics and Google Ads,
   2. Meta Platforms Ireland Limited (Facebook, Instagram) – including marketing tools such as Facebook Pixel, personalized advertisements, and remarketing,
   3. Microsoft – including services supporting IT infrastructure, analytics, or communication.
5. The transfer of data outside the EEA is carried out in accordance with the applicable provisions of the GDPR, with the use of appropriate legal mechanisms guaranteeing an adequate level of personal data protection, including in particular through Standard Contractual Clauses (SCC) adopted by the European Commission.
6. Standard Contractual Clauses (SCC) ensure that the entity located outside the EEA to whom personal data is transferred applies appropriate technical and organizational measures and complies with data protection principles consistent with the GDPR.
7. In cases of data transfer to countries outside the EEA where the law allows public authorities access to personal data (e.g., in the USA), the Controller applies additional protective measures provided for in the GDPR, including appropriate contractual clauses, adequacy assessments, and technical and organizational measures to ensure data security.
8. Detailed information on the transfer of data outside the EEA, including the tools used, security rules, and applied data protection measures, are available in the privacy policies of the respective entities (Google, Meta, Microsoft).

Right of Access to Data and Data Subjects

1. The data subject has the rights resulting from the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), including in particular:
   1. the right of access to personal data (Art. 15 GDPR),
   2. the right to rectification of data (Art. 16 GDPR),
   3. the right to erasure of data – the so-called “right to be forgotten” (Art. 17 GDPR),
   4. the right to restriction of processing (Art. 18 GDPR),
   5. the right to data portability (Art. 20 GDPR),
   6. the right to object to data processing (Art. 21 GDPR),
   7. the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).
2. To exercise the rights referred to in paragraph 1(a–g) above, the User may send a relevant request via email to the Controller’s address: letstalk@alquora.com.
3. In the case of marketing consent, the User expresses it voluntarily, knowingly, and unequivocally, and these consents are separate from the acceptance of other provisions (e.g., the Website regulations), and granting them may be subject to a double opt-in mechanism. The User has the right to withdraw consent at any time, in particular by clicking the unsubscribe link contained in an email message, contacting the Controller via email, or changing cookie settings.
4. The Controller is obliged to comply with the request of the data subject without undue delay, but no later than within one month of its receipt. In justified cases, particularly due to the complexity of the matter or the number of requests, this period may be extended by another two months. The Controller will inform the data subject about the extension of the period and its reasons within one month of receiving the request.
5. The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warszawa, tel. 22 531-03-00, kancelaria@uodo.gov.pl) if they consider that the data processing violates the provisions of the GDPR.
6. The Controller declares that they have not appointed a Data Protection Officer.

Use of Cookies

1. The Controller uses a Cookies mechanism within the Website. The installation of Cookies is necessary for the proper provision of services by electronic means and to ensure the full functionality of the Website regarding essential Cookies.
2. Cookies on the website may be used by the website itself or by third parties, e.g., by social media platforms. Cookies are small text files, sent by websites and stored on the end device (e.g., computer) used by the User while browsing websites. Cookies enable, among other things, language adaptation, remembering settings regarding expressed consents, remembering preferences, and personalizing websites in terms of displayed content.
3. Cookies may be used for the following purposes:
   1. ensuring the proper operation and security of the Website (essential cookies) – based on Art. 6(1)(f) of the GDPR,
   2. remembering User preferences and adapting Website settings (e.g., language, interface settings) (preference cookies) – based on Art. 6(1)(a) of the GDPR,
   3. conducting statistical analyses regarding User activity (analytical cookies) – based on Art. 6(1)(a) of the GDPR,
   4. improving the functioning and adapting the Website to the individual needs of Users (functional cookies) – based on Art. 6(1)(a) of the GDPR,
   5. carrying out marketing activities, including delivering personalized content (marketing cookies – used only with the User’s consent) – based on Art. 6(1)(a) of the GDPR.
4. The Website may use the Controller’s own Cookies and third-party Cookies, particularly from providers of analytical, advertising, or payment services (such as Google, Meta (Facebook), Microsoft, or IT infrastructure providers).
5. Depending on the storage time, the following types of Cookies are used within the Website:
   1. session cookies – stored on the User’s end device until leaving the Website or logging out,
   2. persistent cookies – stored on the User’s end device for the period specified in the Cookie parameters or until they are deleted by the User.
6. As a rule, Cookies do not contain personal data that allows for the direct identification of the User. To the extent that data from Cookies can be linked to a natural person, their processing takes place in accordance with the Privacy Policy and based on Art. 6(1)(a), (b), or (f) of the GDPR.
7. The User has the ability to independently determine the conditions for storing or accessing Cookies through the internet browser settings, and can also withdraw consent at any time for the use of non-essential Cookies from the Website level (Cookie banner).

Final Provisions

1. Providing personal data by the User is voluntary.
2. The Controller declares that, within the Website, it uses entities providing services on behalf of the Controller (Art. 28 GDPR):
   1. Google (Google Analytics) – used for analyzing traffic on the Website and how its functionalities are used,
   2. Google (Google Ads) and Meta Platforms Ireland Limited (Facebook, Instagram) – used for conducting marketing activities, remarketing, and displaying personalized advertisements, in accordance with the User’s consent settings,
   3. Microsoft – used in the scope of services supporting IT infrastructure, communication, and analytical or business tools used by the Controller,
   4. other technological tools supporting the functioning of the Website, i.e., entities providing IT services, system maintenance, and security – to the extent necessary to ensure the proper operation of the Website.
3. The Controller applies appropriate technical and organizational measures ensuring the protection of personal data against unauthorized access, loss, destruction, unauthorized modification, and processing inconsistent with applicable law, such as data transmission encryption using the HTTPS protocol (Let’s Encrypt SSL certificate), access control to data (access only for authorized system and server administrators), security of IT systems, and regular data backups stored for a period of up to 30 days.
4. The Controller implements technical solutions preventing the interception and modification of personal data transmitted electronically by unauthorized persons. Data are stored on servers located within the European Economic Area (EEA).
5. Matters not regulated by this Privacy Policy are governed by the provisions of the GDPR and the generally applicable laws in the territory of the Republic of Poland.
6. This Privacy Policy is effective from 07.05.2026.