PRIVACY POLICY

Last updated: July 13, 2026

1. General information

This Privacy Policy explains how personal data is processed in connection with the website: https://sumplast.com/

The data controller is:

Sum-Plast Eugeniusz Solski
ul. Miedziana 15
40-321 Katowice
Poland

Email: sumplastpl@hotmail.com

The controller is referred to in this Policy as “Sum-Plast,” “we,” “us,” or the “Controller.”

We process personal data in accordance with applicable law, including:

• Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”);
• the Polish Act of May 10, 2018 on the Protection of Personal Data;
• applicable rules governing electronic communications, online services, and cookies.

2. Scope of this Policy

This Policy applies to personal data processed when a person:

• visits the website;
• submits a contact form;
• sends an email or product-related enquiry;
• uses the map or store locator;
• interacts with cookie settings;
• is included in website analytics;
• interacts with marketing technologies after providing consent.

The website currently operates as a product catalog. It does not offer online purchasing, payment processing, customer accounts, or online order management.

3. Data Protection Officer

Sum-Plast has not appointed a Data Protection Officer.

Questions regarding personal data may be sent directly to:

sumplastpl@hotmail.com

4. Personal data we may process

Depending on how a person uses the website, we may process:

• name and surname;
• email address;
• message content;
• information voluntarily included in correspondence;
• IP address;
• browser and device information;
• operating system;
• approximate location derived from an IP address;
• pages visited;
• referring page;
• date and time of access;
• cookie identifiers;
• server logs;
• security and diagnostic information;
• interactions with maps, forms, and website features.

Please do not submit sensitive personal data through the contact form unless it is strictly necessary and an appropriate legal basis exists.

5. Purposes and legal bases

5.1. Responding to enquiries

We process contact information to:

• respond to messages;
• provide product information;
• prepare quotations;
• conduct business correspondence;
• take steps requested before entering into a contract.

The legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

5.2. Legal obligations

We may process data to comply with tax, accounting, consumer-protection, data-protection, or other legal obligations.

The legal basis is Article 6(1)(c) GDPR.

5.3. Legal claims

We may retain information where necessary to establish, pursue, or defend legal claims.

The legal basis is Article 6(1)(f) GDPR.

5.4. Website security

Technical data may be processed to secure the website, prevent abuse, diagnose errors, maintain backups, and protect our systems.

The legal basis is Article 6(1)(f) GDPR.

5.5. Analytics

Subject to consent, analytics technologies may be used to understand website traffic and improve the website.

The legal basis is Article 6(1)(a) GDPR.

5.6. Advertising measurement

Subject to consent, Meta Pixel and similar technologies may be used to measure advertising performance, create audiences, and personalize advertising where those features are enabled.

The legal basis is Article 6(1)(a) GDPR.

Sum-Plast does not currently operate an email newsletter, and submitting the contact form does not subscribe the sender to a newsletter.

6. Contact forms

The website uses Gravity Forms.

Information submitted through a Gravity Form:

• is stored in the WordPress database;
• may be sent to Sum-Plast by email;
• may be accessed by authorized website administrators;
• may be processed by hosting, email, security, and technical-support providers.

Providing information is voluntary, but failure to provide required fields may prevent the form from being submitted or prevent us from responding.

7. Google reCAPTCHA

Google reCAPTCHA is used to protect forms against spam and automated submissions.

It may process:

• IP address;
• device and browser information;
• user interactions;
• timing and behavioral signals;
• cookies or identifiers used to assess risk.

We use reCAPTCHA based on our legitimate interest in protecting the website and forms against spam, abuse, and attacks under Article 6(1)(f) GDPR.

8. Cookies

The website uses cookies and similar technologies.

Necessary cookies

Necessary cookies support:

• website operation;
• security;
• session management;
• language selection;
• consent preferences;
• WordPress administration.

They may include:

• PHPSESSID;
• wpconsent_preferences;
• wordpress_*;
• wp-settings-*;
• wp-wpml_*;
• __cf_bm.

Analytics cookies

Subject to consent, Google Analytics may use cookies such as:

• _ga;
• _ga_*;
• _gid;
• _gat.

Marketing cookies

Subject to consent, Meta Pixel and similar technologies may use cookies or other identifiers to measure campaigns and interactions with advertising.

Consent management

WPConsent is used to present the cookie banner, record preferences, categorize cookies, and block optional technologies until the visitor has made a choice.

Visitors may accept, reject, customize, or later withdraw their consent.

9. Google Analytics

The website uses Google Analytics 4, subject to consent.

Google Analytics may process:

• IP-related information;
• device and browser identifiers;
• approximate location;
• pages visited;
• visit duration;
• traffic source;
• campaign and interaction data.

Google Analytics should not load until the visitor consents to analytics cookies.

10. Google Maps

The website may display maps using Google Maps or the Google Maps API.

Google may process:

• IP address;
• browser and device details;
• map interactions;
• approximate location;
• Google service identifiers.

Where required, Google Maps and related technologies will be activated only after appropriate consent.

11. Meta Pixel

Subject to consent, Meta Pixel may collect or receive:

• website visits;
• pages viewed;
• IP address;
• device and browser information;
• cookie identifiers;
• referring source;
• advertising interactions.

Meta may combine this information with other information processed through its services according to its own privacy terms and user settings.

12. Search engine tools

Sum-Plast uses Google Search Console and Bing Webmaster Tools to monitor indexing, search visibility, technical errors, website security, and search-performance reports.

These services may provide aggregated or technical reports concerning the website.

13. Hosting and security infrastructure

The website is hosted by Kinsta.

Kinsta may process:

• website databases;
• form entries;
• IP addresses;
• server logs;
• backups;
• diagnostic and security data.

Kinsta uses Cloudflare infrastructure for network delivery, website security, malicious-traffic filtering, and performance.

Cloudflare may process IP addresses, network-request information, device information, and security events.

14. Email services

Emails may be processed through Microsoft services, including Hotmail or Outlook.

Microsoft may process:

• sender and recipient addresses;
• message content;
• attachments;
• message metadata;
• IP addresses;
• delivery information.

15. WordPress technologies

The website uses WordPress and plugins supporting content, forms, SEO, performance, product display, translations, maps, cookie management, and administration.

These include:

• All in One SEO Pro;
• Gravity Forms;
• Imagify;
• WooCommerce used only as a catalog;
• WP Store Locator;
• WPConsent;
• WPML;
• WPBakery Page Builder;
• Essential Grid;
• theme and administrative components.

The website does not currently provide a shopping cart, checkout, online payment system, customer account, or online order processing.

16. Recipients of personal data

Personal data may be disclosed to:

• authorized Sum-Plast personnel;
• hosting and infrastructure providers;
• website-security providers;
• email providers;
• analytics, mapping, and advertising providers, subject to consent where required;
• IT, legal, accounting, and professional advisers;
• courts, regulators, and public authorities where disclosure is legally required;
• parties involved in establishing, pursuing, or defending legal claims.

17. International data transfers

Some providers, including Google, Meta, Microsoft, Kinsta, and Cloudflare, may process information outside the European Economic Area, including in the United States.

Where personal data is transferred outside the EEA, appropriate safeguards may include:

• a European Commission adequacy decision;
• a recognized data-protection framework where applicable;
• European Commission Standard Contractual Clauses;
• supplementary contractual, technical, or organizational safeguards.

18. Retention

We retain personal data only for as long as reasonably necessary for the relevant purpose.

In particular:

• contact messages are retained while the enquiry is handled and for an appropriate period afterward;
• potential-business correspondence may be retained during discussions and for a reasonable period following them;
• legally required records are retained for the statutory period;
• information relevant to claims may be retained until applicable limitation periods expire;
• technical logs are retained for security and diagnostic needs;
• consent-based data is retained until consent is withdrawn or the purpose otherwise ends;
• backups may retain data temporarily according to the backup cycle.

19. Individual rights

Subject to the GDPR and applicable conditions, a person may have the right to:

• receive information about processing;
• access their data;
• obtain a copy;
• correct inaccurate data;
• complete incomplete data;
• request deletion;
• restrict processing;
• receive portable data;
• object to legitimate-interest processing;
• withdraw consent;
• object to direct marketing;
• avoid certain decisions based solely on automated processing;
• lodge a complaint with a supervisory authority.

Requests may be sent to:

sumplastpl@hotmail.com

We may request information needed to verify the requester’s identity.

20. Right to object

Where processing is based on Article 6(1)(f) GDPR, a person may object for reasons connected with their particular situation.

We will stop the processing unless we demonstrate compelling legitimate grounds that override the person’s interests, rights, and freedoms, or the processing is required for legal claims.

An objection to direct marketing is absolute.

21. Withdrawal of consent

Consent may be withdrawn at any time through:

• the cookie-preference panel;
• applicable browser settings;
• direct contact with Sum-Plast.

Withdrawal does not affect the lawfulness of processing performed before consent was withdrawn.

22. Complaints

A person who believes their data has been processed unlawfully may complain to the:

President of the Personal Data Protection Office
Prezes Urzędu Ochrony Danych Osobowych

We encourage contacting Sum-Plast first so that we have an opportunity to address the issue.

23. Automated decision-making

Sum-Plast does not use contact-form data to make decisions based solely on automated processing that produce legal or similarly significant effects.

Analytics and advertising providers may create statistical audience classifications subject to consent and user settings.

24. Children

The website is not intended to collect personal data directly from young children.

Minors should not submit personal information without the knowledge or authorization of a parent or legal guardian.

25. Security

We use reasonable technical and organizational safeguards, which may include:

• access controls;
• administrative-account security;
• software updates;
• HTTPS encryption;
• network protection;
• spam prevention;
• backups;
• security and diagnostic monitoring;
• limitation of access to authorized persons.

No transmission or storage method is completely secure, but we take measures appropriate to the nature of the information and the risks involved.

26. External links

The website may link to third-party websites, social-media services, distributors, or other organizations.

Those third parties process information under their own privacy practices. Sum-Plast is not responsible for independent third-party websites.

27. Changes to this Policy

We may update this Policy when:

• laws change;
• website functions change;
• new forms or services are introduced;
• service providers change;
• analytics or marketing technologies change;
• retention practices are revised.

The current version will be posted on the website with the latest revision date.

28. Language

This Policy may be available in Polish and English.

The English version is provided for the convenience of international visitors. In the event of an inconsistency, the Polish version shall prevail, subject to mandatory applicable law.

29. Contact

Sum-Plast Eugeniusz Solski
ul. Miedziana 15
40-321 Katowice
Poland

Email: sumplastpl@hotmail.com