Privacy policy

This policy describes how we process the personal data of people who use the Biossphere Source website (source.biossphere.eu) and who contact us through the form or by email.

1. Data controller

The data controller is Biossphere P.S.A., with its registered office in Warsaw, Przyczółkowa 350, 02-962 Warsaw, NIP 9512578037, KRS 0001058564. For data protection matters, contact: source@biossphere.eu.

2. What data we process

• Data from the form or correspondence: full name, company name, email address, the content of your inquiry, and, if you provide it, a phone number.
• Technical data collected automatically during your visit: IP address, browser data and server logs.

3. Purposes and legal bases

• Handling your inquiry and preparing an offer: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Article 6(1)(f) (our legitimate interest in responding).
• Marketing of our offer, if you give consent: Article 6(1)(a) GDPR.
• Phone contact regarding your inquiry, if you give consent: Article 6(1)(a) GDPR.
• Sending requested materials, such as our purchase list template: Article 6(1)(b) GDPR (steps taken at your request).
• Fulfilling and settling an order, if a contract is concluded: Article 6(1)(b) and (c) GDPR (tax and accounting obligations).
• Security and correct operation of the site: Article 6(1)(f) GDPR.

4. Data recipients

Data may be entrusted to entities that process it on our behalf: IT and hosting providers and Google Ireland Limited for email (Google Workspace). When an order is fulfilled, the necessary data is shared with hardware suppliers and distributors and with transport companies. We may also disclose data to authorities entitled to it under the law.

5. Transfers outside the EEA

As a rule, we do not transfer data outside the European Economic Area. If one of our service providers processes data outside the EEA, it does so on the basis of standard contractual clauses approved by the European Commission.

6. Retention period

• Inquiries that did not result in a contract: until the matter is closed and any potential claims become time barred.
• Data related to a concluded contract and accounting documents: for the period required by tax law, that is 5 years counted from the end of the year in which the tax obligation arose.
• Data processed on the basis of consent (marketing, phone contact): until consent is withdrawn.

7. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, port your data and object to processing based on legitimate interest. You can withdraw consent at any time, which does not affect the lawfulness of processing before withdrawal. To exercise your rights, write to source@biossphere.eu. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, Stawki 2, 00-193 Warsaw).

8. Voluntary provision of data

Providing data in the form is voluntary but necessary to handle your inquiry and prepare an offer. Giving consent for marketing and phone contact is entirely voluntary and does not affect the handling of your inquiry.

9. Automated decisions

We do not make decisions based solely on automated processing, including profiling.

10. Cookies

The site uses only essential cookies necessary for it to work, so a consent banner is not required. You can manage cookie settings in your browser.

11. Changes to this policy

We may update this policy. The current version is always available on this page, with the date of the last update at the top.