1. Who is the controller?
The controller of personal data processed through this website is Ogólnopolskie Stowarzyszenie Przetwórców i Producentów Produktów Ekologicznych „Polska Ekologia”, ul. Rakowiecka 36, lok. 38, 02-532 Warszawa, Poland, KRS 0000264616.
Contact: euorganic@polskaekologia.org.
No Data Protection Officer has been appointed. Privacy requests are handled by the Management Board or an authorised person.
Asociația Operatorilor din Agricultura Ecologică Bio Romania is the project partner. It is not automatically a joint controller of website data.
2. What data may be processed and why?
Contact and business enquiries
When you contact us, we may process your name, email address, organisation, country, enquiry category, subject, message and any information you choose to provide. We use these data to answer the enquiry, manage project cooperation and document project activities.
The legal basis may be our legitimate interest in communicating about and implementing the project (Article 6(1)(f) GDPR), steps requested before entering into a relationship (Article 6(1)(b)), or compliance with a legal obligation (Article 6(1)(c)), depending on the request.
Optional analytics
Google Analytics 4 is planned only after consent (Article 6(1)(a) GDPR). Google Signals, remarketing and advertising personalisation are to remain disabled. The review website does not currently load GA4.
Technical security data
Hosting and security providers may process IP address, request time, requested resource, device or browser information and security events to deliver and protect the website. The exact production logging configuration and supplier retention must be confirmed before launch.
External media
YouTube content may be made available only after a visitor chooses to load it. Facebook, Instagram and map services are provided as ordinary external links, not embedded tracking widgets.
Event registration is not enabled at launch. This notice must be updated before an event registration function is activated.
4. How long is information kept?
- Contact correspondence: normally 12 months after the end of correspondence, with justified extensions for legal obligations, project documentation or legal claims.
- Optional GA4 event-level and user-level data: planned maximum of 14 months, subject to verified configuration.
- Technical logs: target maximum of 90 days, subject to the actual hosting and security configuration.
- Consent evidence: proposed retention of 12 months after expiry or withdrawal, subject to confirmation of necessity and the selected CMP.
The actual deletion mechanisms for the production form, mailbox, backups and suppliers remain to be verified before launch.
5. Your data protection rights
Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, portability or object to processing. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.
Send a request to euorganic@polskaekologia.org. We may need to verify your identity. We respond without undue delay and in principle within one month under Article 12 GDPR. This may be extended by two further months where necessary because of complexity or number of requests; if so, we will explain the extension within the first month.
You may lodge a complaint with the competent supervisory authority, including the President of the Personal Data Protection Office in Poland.
No solely automated decision-making or profiling producing legal or similarly significant effects is planned.
6. Suppliers and international transfers
The intended production infrastructure is dhosting for domain and DNS, Netlify for hosting, Google Analytics 4 for consent-based analytics and potentially Cloudflare Turnstile for anti-spam. The form-processing and email-delivery providers have not yet been selected or verified.
The public review build is hosted separately from eu-organic.eu. Before production launch, Polska Ekologia must confirm each supplier’s role, DPA, storage locations, international transfers, safeguards, access controls, retention and deletion procedures. We do not claim that all data remain in the European Union.
7. Changes to this notice
We will update this policy when processing, suppliers or website functions change. The approved publication and last-review dates will be shown here.