Legal
Privacy Policy
This policy explains how AREKA FOODS processes personal data when you visit this website or contact us. It is written to meet the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Polish Act of 10 May 2018 on the Protection of Personal Data.
1. Data controller
The controller of your personal data is Areka Foods PSA (prosta spółka akcyjna), ul. Gliwicka 39a, 43-190 Mikołów, Poland, entered in the National Court Register (KRS) under number 0001128576, VAT ID: PL6351872496 (“we”, “us”).
For any question about your personal data, write to [email protected] or to our postal address above. We have not appointed a Data Protection Officer, as this is not required for our activities.
2. What data we process and why
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| You email or call us | Name, email address, phone number, company name, position, content of the message | Answering your inquiry, preparing offers and samples | Art. 6(1)(b), steps taken at your request before entering into a contract; Art. 6(1)(f), our legitimate interest in replying to business correspondence |
| We do business together | Contact details of your company's representatives, order and delivery details | Performing the contract, invoicing, quality and compliance documentation | Art. 6(1)(b) and (c), contract performance and legal obligations (tax and accounting law); Art. 6(1)(f) for contact persons of a business partner |
| You visit this website | IP address, date and time, requested page, browser type (server logs) | Delivering the website, security and preventing abuse | Art. 6(1)(f), our legitimate interest in running a secure website |
| Possible claims | Data from the situations above | Establishing, pursuing or defending legal claims | Art. 6(1)(f) |
Providing data is voluntary, but without contact details we cannot reply to you. We do not use your data for automated decision-making or profiling.
3. Cookies and similar technologies
This website does not use cookies, local storage or any similar technology to store or read information on your device. We do not use analytics, advertising pixels, social media plugins or embedded third-party content. All fonts and images are served from our own website, so visiting the site does not send your data to Google or other third parties.
The site is delivered through Cloudflare, our hosting and security provider. To protect the site against bots and attacks, Cloudflare may in some cases set a strictly necessary security cookie (for example __cf_bm or cf_clearance). These cookies do not identify you, are not used for analytics or advertising, and are exempt from consent because they are essential to provide the service you request (Art. 399 of the Polish Electronic Communications Law and Art. 5(3) of the ePrivacy Directive).
For this reason no cookie consent banner is shown. If we ever add cookies or tracking tools that require consent, we will ask for your consent before using them and update this policy.
4. Who receives your data
We share personal data only as far as necessary with:
- Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which hosts the website, delivers it through its network and protects it against attacks;
- our email and IT service providers;
- accounting, legal and logistics service providers when we work together;
- manufacturers and suppliers we cooperate with, when this is needed to process your inquiry or order (business contact details only);
- public authorities, when the law requires it.
Our service providers process data on our behalf under data processing agreements (Art. 28 GDPR).
5. Transfers outside the EEA
Cloudflare, Inc. is based in the United States, so technical data of website visitors (such as IP address and request details) may be processed outside the European Economic Area. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection (Art. 45 GDPR), and its Data Processing Addendum also includes Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of these safeguards by contacting us.
We do not otherwise transfer personal data outside the EEA. If another provider ever does so, we will make sure an adequate safeguard is in place.
6. How long we keep data
- Inquiries that do not lead to cooperation: up to 12 months after our last contact.
- Contract and accounting records: for the duration of the contract and then for the period required by tax and accounting law (generally 5 years from the end of the calendar year).
- Technical request logs: processed by Cloudflare only for as long as needed for delivery and security, in line with its Data Processing Addendum; we do not keep separate server logs.
- Data kept for legal claims: until the limitation period expires.
7. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- data portability (Art. 20);
- object at any time to processing based on our legitimate interest (Art. 21);
- withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal.
To exercise your rights, contact us using the details in section 1. We will reply within one month.
You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
8. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS) and access limited to authorised staff.
9. Changes to this policy
We may update this policy when our services or the law change. The current version is always available on this page, with its effective date at the top.