Privacy Policy
This policy explains what data we collect about you, why, how long we keep it and what rights you have. We have tried to write it in plain language, without legal jargon.
1. Who is responsible for your data
The controller of personal data collected through fulfillment-polska.pl is:
Grupa Lewandowski Sp. z o.o.
ul. Stanisława Murzynowskiego 18, 10-684 Olsztyn, Poland
Tax ID (NIP): PL 739 393 78 58
E-mail: kontakt@fulfillment-polska.pl
Phone / WhatsApp: +48 791 521 115
For any matter concerning personal data, write to the address above — we answer every request. We have not appointed a Data Protection Officer, as we are not required to do so.
2. Contact form
What we collect: first name, last name, e-mail address, phone number, company name, website address and your message. Only the e-mail address and the message are required; the rest is optional.
Why: to answer your enquiry and, if you ask for it, prepare a fulfillment services quote.
Legal basis: Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract; and, for further business correspondence, Art. 6(1)(f) GDPR (our legitimate interest in handling enquiries).
Where it goes: the message is sent by e-mail to kontakt@fulfillment-polska.pl, hosted on our own server, and then loaded into our CRM system running on the same server. We do not use third-party form or mailbox services for this.
How long: up to 3 years from the last contact. If a contract is concluded — for the period required by accounting law, i.e. 5 years counted from the end of the tax year in which the last document was issued.
3. Live chat
What we collect: the content of your messages, any files or images you send, and technical session data (conversation ID, time, IP address).
Why: to answer a question asked in real time.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in serving visitors. You start the conversation on your own initiative.
Where it goes: to our CRM system, on our server. Please do not send sensitive data through the chat — document numbers, health data or passwords.
How long: up to 12 months after the conversation ends.
4. Newsletter
What we collect: e-mail address, language, sign-up source, sign-up date and confirmation date.
Why: to send you information about new articles and about our services.
Legal basis: Art. 6(1)(a) GDPR — your consent, given in two steps: you provide the address and then click the confirmation link in the message we send. Without that click we send nothing.
How to opt out: every message contains an unsubscribe link. Clicking it opens a page with a button — only pressing that button removes you from the list. You can also write to kontakt@fulfillment-polska.pl. Withdrawing consent does not affect the lawfulness of mailings sent earlier.
How long: until you unsubscribe or withdraw consent.
5. Comments under articles
What we collect: your signature (name or nickname), e-mail address, the comment itself, IP address and browser data.
Why: to publish the comment and allow discussion, and to prevent spam and abuse.
Legal basis: Art. 6(1)(a) GDPR (consent given by submitting the comment) and Art. 6(1)(f) GDPR (moderation and site security).
Important: comments are moderated and appear only after our approval. Your signature and the comment text are publicly visible; the e-mail address is not published.
How long: as long as the comment remains published. You may ask us to remove it at any time.
6. Contact via WhatsApp
If you click the WhatsApp icon you move to a service operated by Meta Platforms Ireland Ltd., which then acts as controller for data related to the use of that messenger, under WhatsApp's own privacy policy. We receive your phone number and the messages you send us, and process them in order to reply (Art. 6(1)(f) GDPR).
7. Server logs
Like any website, our server records technical information about visits: IP address, date and time, the page requested, browser and operating system, and the referring page. This is used solely to keep the service secure and to diagnose faults (Art. 6(1)(f) GDPR). We keep these logs for 12 months.
8. Artificial intelligence in handling enquiries
We want to be straightforward with you: we use artificial-intelligence tools when handling enquiries, to prepare answers faster. This means the content of your message — from the form, the chat or an e-mail — may be passed to a language-model provider that generates a suggested reply.
- A human always approves the final answer. No message reaches you automatically. We therefore do not take decisions about you based solely on automated processing and we do not profile you — Art. 22 GDPR does not apply.
- We use tools from the following providers: Anthropic, Google and Groq. All of them are established outside the European Economic Area — see section 10.
- What reaches the AI tools is the content of your message. We do not separately pass on your contact details — name, e-mail address or phone number — unless you include them in the text.
9. Who we share data with
- Hostinger International Limited (Lithuania) — hosting the server that runs the website, the mailbox and the CRM. The data centre is located in Vilnius, within the European Union. The data processing agreement was concluded by Grupa Lewandowski Sp. z o.o.
- Google — visit statistics and embedded videos, only after you give cookie consent.
- Providers of artificial-intelligence tools — drafting suggested replies (see section 8).
- Meta (WhatsApp) — only if you choose that contact channel yourself.
- Authorised employees and associates — day-to-day handling of enquiries, under written authorisations.
We do not sell your data and do not share it with third parties for their marketing purposes.
10. Transfers outside the European Union
Let us start with what is not such a transfer: the hosting itself. Our server — and with it the website, the company mailbox, the database and the CRM — is located in Vilnius, Lithuania, that is within the European Union. The data you send us is stored there. The web fonts used on the site are also hosted on our own server, so merely opening a page causes no connection to any company outside the Union.
Data goes outside the European Economic Area in two situations:
- Services of Google LLC (USA) — visit statistics (Google Analytics) and embedded YouTube videos. They start only after you give consent in the cookie window. What is transferred is, among other things, your IP address and browser information.
- Providers of artificial-intelligence tools described in section 8 — they receive the content of the message you sent us.
Such transfers rely on the mechanisms provided for in the GDPR: Standard Contractual Clauses approved by the European Commission, or a Commission adequacy decision (the Data Privacy Framework), depending on the provider.
In other words: unless you click "Allow all", ordinary browsing of this site sends no data outside our server in Vilnius.
11. Your rights
At any time you have the right to:
- access your data and receive a copy of it,
- rectify inaccurate or incomplete data,
- erase your data (the "right to be forgotten"),
- restrict processing,
- port your data to another controller,
- object to processing based on our legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal,
- lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
To exercise any of these rights, write to kontakt@fulfillment-polska.pl. We respond without undue delay and no later than within one month.
Providing data is voluntary, but without an e-mail address we cannot reply to an enquiry, and without confirming your sign-up we cannot send the newsletter.
12. Cookies and consent
On your first visit we show a window with three choices: "Allow all", "Necessary only" or "Reject all". Your choice is stored in your browser and you can change it at any time using the cookie icon in the bottom-left corner of every page.
Until you give consent, we run no analytics and no videos.
- Necessary — remembering your consent choice, powering the chat and the contact form. Always active.
- Analytics (Google Analytics 4) — anonymous visit statistics. Only after consent.
- Embedded video (YouTube) — playing videos on the page; YouTube then sets its own cookies. Only after consent.
You can also delete and block cookies in your browser settings, under "Privacy".
13. Security
The site works only over an encrypted HTTPS connection. Access to the administration panel and to the CRM is limited to authorised persons after logging in. The company mailbox and the database run on our own server, protected by cryptographic keys. Backups are made daily.
14. Changes to this policy
We may update this policy — for example when we add a new feature to the site. The current version is always available at fulfillment-polska.pl/en/privacy-policy-en.
Last updated: 25 July 2026.
This policy is also published in Polish. In case of any discrepancy between the language versions, the Polish version prevails.