The controller of personal data is CHEMAXA Adrian Matusiak, ul. Promienna 14, 71-218 Bezrzecze, Poland, VAT ID (NIP) 8512981442 (“CHEMAXA”, “we”).
Data protection contact:
We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Polish data protection and e-services law, following the data minimisation principle.
This policy describes the processing of personal data of: users of the www.chemaxa.com website (the “Website”); users of the “Chemaxa” iOS mobile application (the “App”); customers, contractors and their representatives; persons contacting us by e-mail, phone, SMS or WhatsApp; and job applicants.
When you contact us (including sending a quotation request or an order — also from the App), we process the data provided in the correspondence: name, company name, VAT ID, delivery address, phone number, e-mail address and message content.
| Purpose | Legal basis (GDPR) |
|---|---|
| handling the enquiry, preparing a quotation, accepting and performing an order (pre-contractual steps and contract performance) | Art. 6(1)(b) |
| contractor verification (including in public registers), invoicing, tax and accounting obligations | Art. 6(1)(c) |
| ongoing business communication; establishing, pursuing or defending claims; system security (legitimate interest) | Art. 6(1)(f) |
| direct marketing of our own products and services — where you give separate consent | Art. 6(1)(a) / (f) |
Providing the data is voluntary but necessary to receive a quotation or have an order fulfilled.
In connection with concluding and performing contracts we process data of contractor representatives and contact persons: name, position, business e-mail and phone number, together with company details. The legal basis is our legitimate interest in maintaining business contacts (Art. 6(1)(f) GDPR) and, for contracting parties’ data, Art. 6(1)(b) and (c) GDPR.
From job applicants we process the data required by labour law (name, date of birth, contact details, education, qualifications, employment history) under Art. 6(1)(b) and (c) GDPR. Additional data included in a CV (e.g. photo, interests) is processed on the basis of consent (Art. 6(1)(a) GDPR), and special-category data (e.g. disability status) solely on the basis of explicit consent (Art. 9(2)(a) GDPR). Consent may be withdrawn at any time.
When you use the Website, technical data is processed automatically: IP address, date and time of the request, browser and system type, pages visited. This data serves the proper functioning and security of the Website (Art. 6(1)(f) GDPR) and — with consent — the measurement purposes described in section 5.
The App is used to order bulk AdBlue® deliveries and to send quotation requests. It is a business-to-business tool and is not directed at persons under 16. The App works in two modes: (1) without signing in — an enquiry/order form for new customers; and (2) signed in — a returning-customer account with an individual price list, unloading points and order history.
For part of its functionality the App uses the CHEMAXA server (api.chemaxa.com), on which we process the data described below as the controller. We do not share this data with third parties for marketing purposes.
Data entered in the form (VAT ID, company name, delivery address, phone, e-mail, order parameters) is also stored locally on your device so you do not have to re-enter it. You can delete it by overwriting the fields or uninstalling the App. Local data is protected by iOS security mechanisms.
When you fill in the form and tap “Send quotation request” or “Send order”, the form data (company name, VAT ID, delivery address/location, phone, e-mail, approximate quantity, delivery dates and unloading hours) is saved on our server as an enquiry so that we can prepare a quotation and contact you. This happens when you tap the button, even if you ultimately do not complete sending the message via WhatsApp, e-mail or SMS (we do not want to lose contact with interested prospects). We also record limited technical data (IP address, device/app information) to ensure security and prevent abuse. Separately, if you choose a channel (WhatsApp, e-mail or SMS), the message content is handed to the app you choose and sending requires your confirmation.
| Purpose | Legal basis (GDPR) |
|---|---|
| handling the enquiry, preparing a quotation and contacting you back; pre-contractual steps | Art. 6(1)(b) and (f) (legitimate interest: responding to the enquiry and keeping in touch with a prospect) |
| system security and abuse prevention (technical data) | Art. 6(1)(f) |
Providing the data is voluntary, but without contact details we cannot send a quotation. Enquiries are deleted automatically after the retention period (section 8) and at your request.
You can sign in in two ways, and both can be linked to the same account:
…@privaterelay.appleid.com), and, at first sign-in, your name if you share it. Sign in with Apple does not disclose your password to us.You can have both methods linked to the same account at the same time (e.g. add a password to an account created via Apple in the "My Profile" screen) and choose which one to use the next time you sign in.
Within the account we process on our server: company data (name, VAT ID, phone, address, contact e-mail, invoice e-mail), your individual price list, saved unloading points (address, contact person, phone, hours, notes) and order details and history.
| Purpose | Legal basis (GDPR) |
|---|---|
| operating the account, presenting your individual price list, accepting and performing orders | Art. 6(1)(b) |
| invoicing, tax and accounting obligations | Art. 6(1)(c) |
| support and contact, establishing/pursuing/defending claims, security | Art. 6(1)(f) |
Account deletion: you can delete your account at any time directly in the App — we then permanently erase the account data (company profile, price list, unloading points, order history), except for data we must retain for tax and accounting purposes (section 8).
If you consent to notifications, we store your device’s notification token to send you notifications about orders and pricing via the Apple Push Notification service (APNs). You can withdraw consent at any time in iOS settings. Legal basis: Art. 6(1)(b) and (f) GDPR (informing you about order status and our offer).
When you enter a VAT ID, the App sends that number to our server, which queries public registers to suggest the company name and address: the Polish Ministry of Finance VAT register and CEIDG (dane.biznes.gov.pl). Only the VAT ID is sent to those registers.
While you type the delivery address, text fragments are sent to Apple’s mapping service to display suggestions (Apple privacy policy). The App does not use device location.
If you choose to send via WhatsApp (Meta Platforms), your mail client or Messages (SMS), processing within those services is governed by their own privacy policies.
The Website uses:
_gcl_au) and similar identifiers used to attribute a visit or call to an ad click. Provider: Google Ireland Ltd. (Google privacy policy). We use these technologies on the basis of consent (Art. 6(1)(a) GDPR and the Polish e-communications law implementing the ePrivacy rules).You may withdraw or change your consent to non-essential cookies at any time — via the consent settings on the Website or your browser settings (blocking/deleting cookies). Withdrawal does not affect the lawfulness of prior processing. You may also use Google My Ad Center.
We may disclose personal data to: authorised CHEMAXA staff; processors acting on our behalf (the hosting/server provider that runs the App back-end and stores account and enquiry data, accounting offices, IT and e-mail providers, transport and courier companies); Apple (for Sign in with Apple account authentication and Apple Push Notification service delivery); providers of communication services chosen by the user (Meta Platforms — WhatsApp; telecom operators — SMS/phone); Google (for the measurement tools described in section 5, subject to consent); and public authorities and courts where required by law.
As a rule we process data within the EEA. However, the use of certain services may involve transfers to third countries (in particular the USA): Google (Website measurement tools), Meta Platforms (WhatsApp communication) and Apple (Sign in with Apple, APNs push notifications and address autocomplete in the App). These providers participate in the EU–US Data Privacy Framework or rely on Standard Contractual Clauses approved by the European Commission, ensuring the level of protection required by the GDPR.
| Data category | Retention period |
|---|---|
| enquiries and correspondence not resulting in a contract | up to 3 years after the correspondence ends (defence against claims) |
| enquiries saved from the App form (leads) | deleted automatically after the retention period (2 years by default) or earlier on request |
| returning-customer account in the App (company profile, price list, unloading points, order history) | until the customer deletes the account or the relationship ends; order- and invoice-related data as in the row below |
| data related to contracts, orders and invoices | the term of the contract and thereafter the period required by accounting and tax law — as a rule 5 years from the end of the year in which the tax obligation arose |
| push notification token | until notifications are disabled, the App is uninstalled, or the account is deleted |
| job applicants’ data | the duration of the recruitment and, with the candidate’s consent, up to 12 months afterwards |
| data processed on the basis of consent (e.g. marketing) | until consent is withdrawn |
| measurement cookies on the Website | the lifetime of the given cookie or until consent is withdrawn |
| data stored locally in the App | until overwritten by the user or the App is uninstalled (device-only) |
You have the right to: access your data and obtain a copy; rectification; erasure (“right to be forgotten”); restriction of processing; data portability; objection to processing based on legitimate interest (including direct marketing); withdrawal of consent at any time (without affecting prior processing); and to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).
We respond to requests without undue delay, at the latest within one month. Requests may be sent to info@chemaxa.com.
We do not make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you. Ad-measurement (section 5) serves statistical and billing purposes only.
We apply appropriate technical and organisational measures, including: encryption of data in transit (SSL/TLS — on the Website, in the App and in communication with the CHEMAXA server and external services), access control to systems and the admin panel (authentication, login-attempt limiting), the least-privilege principle (a database account with restricted permissions), protection of database queries against SQL injection, storing session tokens only as a hash, protection of configuration files and secrets, regular backups and staff training. Data stored locally in the App is protected by iOS security mechanisms, including device encryption and the Keychain.
This policy may be updated, e.g. when Website or App features or legal requirements change. The current version, with its effective date, is always available at this address.