Privacy policy

2.1. Contact form

Using the contact form, the user may provide:

• first name and surname or company name — required field,
• email address — mandatory field,
• telephone number — optional field,
• the service the enquiry concerns — optional field,
• message content — mandatory field.

Where a company name is provided instead of a first name and surname, the company name alone does not always constitute personal data. Personal data may, however, be contained in the e-mail address, telephone number, content of the message or other information provided by the person contacting us.

2.2. Request for quotation

Through the request for quotation form, the user may provide:

• first name and surname or the name of the company or institution — mandatory field,
• email address — required field,
• phone number — optional field,
• information about what the enquiry concerns — where the form was not opened from a specific item in the range,
• quantity, delivery date and height of the Christmas tree — optional fields,
• message content — mandatory field.

If the form has been opened from a specific item in the range, information about the product may be automatically attached to the enquiry, e.g. the name, code, category and the address of the product page. This is information concerning the range, not the person, unless in a specific case it were combined with other data allowing a person to be identified.

2.3. Catalogue download form

The catalogue download form may contain the following fields:

• first name and surname or the name of the company or institution,
• email address,
• telephone number.

The data entered in this form is not sent to CR Iluminacje Sp. z o.o. or to Web3Forms and is not stored by us. It is handled locally in the user’s browser solely in order to reveal the link enabling the catalogue to be downloaded.

Downloading the file itself involves a standard connection to the infrastructure from which the file is made available. In connection with that connection, the ordinary technical data described in point 2.4 may be generated.

If the operation of the catalogue download form is changed in the future and data begins to be transmitted to the controller, this policy will be updated accordingly.

2.4. Technical data related to the use of the website

The website uses Cloudflare infrastructure. In connection with the display of the website and the transmission of its resources, technical data may be processed, in particular:

• IP address,
• date and time of the request,
• the requested URL,
• routing and connection data,
• information about the browser, device and system configuration,
• HTTP headers and referrer information, if transmitted by the browser,
• information used to ensure security, detect abuse and maintain the proper functioning of the infrastructure.

The website does not use this data to create its own marketing profiles of users. We do not send data entered by the user into form fields to Google Analytics 4 or Google Ads. We also do not use it in Enhanced Conversions or Customer Match.

2.5. Data stored in the page address

Some functions of the website store their state in the URL.

This applies in particular to:

• filter settings in the section presenting the range,
• the phrase entered into the site’s internal search engine.

Searching and filtering are carried out on the browser side. The controller does not create a user profile on this basis. It should nevertheless be noted that the URL may appear in the browser history and in the technical data associated with the handling of the request by the website’s infrastructure.

Personal data and confidential information should not be entered into the site’s search function.

2.6. Data related to analytics and advertising measurement

If the user consents to analytics, we may process data related to use of the website, in particular online identifiers used by Google Analytics, information about page views and events on the website, the address of the page visited and the referring page, information about the device, operating system and browser, approximate location, and information about the user’s interactions with the website.

If detailed location and device data collection is enabled in Google Analytics, this information may include approximate city-level location and more detailed technical parameters relating to the device, operating system and browser.

If the user consents to advertising measurement, Google Ads may process online and technical identifiers, information related to arriving from an ad and attributing conversions to campaigns, conversion events, and technical information necessary for the measurement to operate. The purpose of this processing is to measure conversions, attribute them to advertising campaigns and assess campaign effectiveness. This scope does not include remarketing or ad personalisation.

We do not send data entered by the user into form fields or data that directly identifies the user, such as their first and last name, email address or telephone number, to Google Analytics 4 or Google Ads. We do not use Enhanced Conversions or Customer Match in Google Ads.

A detailed description of how Google Analytics 4 and Google Ads measurement work, including information about the use of device storage and the scope of measurement, is provided in the section on cookies, browser storage, analytics and advertising measurement.

3.1. Responding to messages and handling enquiries

We process data provided through the contact form or otherwise in the course of correspondence for the purpose of:

• providing a reply,
• conducting correspondence concerning the user’s matter,
• clarifying the enquiry,
• preparing information or a proposal.

If a person contacts us as a representative, employee or person acting on behalf of a company, local authority, shopping centre, institution or other organisation, the basis for processing is Article 6(1)(f) GDPR, that is our legitimate interest consisting in conducting business communication, handling enquiries and establishing and maintaining commercial or institutional relationships.

3.2. Steps prior to entering into a contract

If a natural person contacts us on their own behalf and their enquiry is directly aimed at concluding a contract with them, the data may also be processed on the basis of Article 6(1)(b) GDPR, that is, in order to take steps at the request of that person prior to entering into a contract.

This basis is not applied automatically to an employee or representative of an organisation where the party to any prospective contract is to be the organisation they represent, and not that person.

3.3. Handling a request for quotation

We use the data provided in a request for quotation for:

• determining requirements relating to decorations or projects,
• preparing a response or proposal,
• contacting you in connection with the enquiry,
• conducting further discussions regarding possible cooperation.

The legal basis is, as applicable, Article 6(1)(f) GDPR or, where the conditions described in point 3.2 are met, Article 6(1)(b) GDPR.

3.4. Ensuring the security and correct operation of the website

Technical data may be processed for the purpose of:

• delivering the content of the website,
• ensuring the continuous operation of the website,
• protecting the website against misuse and attacks,
• detecting and diagnosing errors,
• ensuring the security of the infrastructure.

The legal basis is Article 6(1)(f) GDPR, that is the controller’s legitimate interest in ensuring the secure and correct operation of the website.

3.5. Establishment, exercise or defence of claims

Where necessary, data relating to correspondence, an enquiry or cooperation may be further stored and used for the purpose of establishing, exercising or defending legal claims.

The legal basis is Article 6(1)(f) GDPR.

3.6. Legal obligations

If contact leads to the conclusion of a contract or the performance of a transaction, some of the data may also be further processed in order to fulfil obligations arising from legal provisions, in particular tax, accounting or other obligations relating to the documentation of business activity.

The legal basis for such processing is Article 6(1)(c) GDPR in conjunction with the relevant legal provisions.

3.7. Analytics based on consent

If the user gives consent in the privacy banner, we process data related to the use of the website in order to compile visit statistics and assess how the website is used.

Information is stored on, and accessed from, the user’s device for this purpose only after the consent required by Article 399(1), read in conjunction with Article 400 of the Act of 12 July 2024 – Prawo komunikacji elektronicznej, has been obtained. If this information constitutes personal data, the legal basis for its processing is Article 6(1)(a) GDPR, namely the user’s consent.

Storing the choice made in the privacy banner is a technically necessary mechanism for saving and respecting the privacy settings selected by the user and does not require separate consent, in accordance with Article 399(3)(2) of Prawo komunikacji elektronicznej. We describe the details in point 11.

Consent is voluntary, and refusing it does not limit the ability to use the website or to send enquiries. Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing carried out before its withdrawal.

3.8. Campaign effectiveness measurement — Google Ads

If the user consents to advertising measurement in the privacy banner, we use Google Ads solely to measure conversions, attribute them to advertising campaigns and assess campaign effectiveness.

Storing information in the user’s terminal equipment or accessing information already stored on it for the purpose of this measurement takes place after obtaining the user’s consent under Article 399(1) in conjunction with Article 400 of the Polish Act of 12 July 2024 — Prawo komunikacji elektronicznej.

To the extent that CR Iluminacje Sp. z o.o. processes the user’s personal data in connection with the use of Google Ads, the legal basis for this processing is Article 6(1)(a) GDPR, i.e. the user’s consent.

Consent to advertising measurement is independent of consent to analytics. Not giving or withdrawing consent to Google Ads does not withdraw consent separately given to Google Analytics 4. Likewise, not giving or withdrawing consent to analytics does not withdraw consent to advertising measurement.

5.1. Web3Forms

Messages from the contact form and the request for quotation form are technically handled using the Web3Forms service, operated by Web3Creative.

With respect to personal data submitted through our forms, CR Iluminacje Sp. z o.o. remains the controller, and Web3Creative acts as a processor and processes those personal data only on our documented instructions.

Web3Forms may process:

• data entered into the form fields,
• the content of the message,
• technical metadata relating to the submission of the form, such as the IP address, the time of submission and information about the referring page.

Web3Forms uses its own infrastructure and the sub-processors indicated in its current data processing agreement (DPA), including providers of cloud infrastructure, security and anti-spam mechanisms.

According to the current information from Web3Forms, submission data may be physically stored for a maximum of three years from submission, unless it is deleted earlier or a shorter period follows from the plan used.

5.2. Email

Messages sent through the forms may also be delivered to the controller’s company email inbox.

The controller’s mailbox is operated by OVH. The e-mail service provider may process data as an entity providing the infrastructure necessary to receive, store and transmit messages.

5.3. Cloudflare

The website and its associated infrastructure use the services of Cloudflare, Inc. for, among other things, content delivery, hosting or edge services, security, routing and traffic protection.

Cloudflare may process end users’ data, such as IP address, routing data, system configuration information and other data relating to traffic between the user’s device and the website.

We do not use Cloudflare to conduct our own marketing analytics of the users of the service.

5.4. Authorised persons

Access to the data may be granted only to persons authorised by the controller who need such data to handle enquiries, conduct correspondence, prepare proposals, carry out cooperation or maintain systems.

5.5. Google

If the user gives the relevant consent in the privacy banner, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, may process data related to use of the website in connection with the provision of Google Analytics 4, Google Tag Manager and Google Ads services. Data related to analytics is processed in accordance with the analytics choice, while data related to advertising measurement is processed in accordance with the separate Google Ads choice.

For Google Analytics 4 and Google Tag Manager, Google Ireland Limited acts as a processor on behalf of CR Iluminacje Sp. z o.o. under the applicable Google data processing terms.

For personal data processed in connection with the standard Google Ads services used by CR Iluminacje to measure conversions and campaign effectiveness, CR Iluminacje Sp. z o.o. and Google Ireland Limited act as separate, independent controllers. Each of these entities is independently responsible for the processing it carries out for its own purposes and in accordance with the data protection obligations applicable to it.

For the standard Google Ads services used in Ads v1, Google Ireland Limited does not act solely as a processor acting on CR Iluminacje’s instructions.

We do not send data entered by the user into form fields or data that directly identifies the user, such as their first and last name, email address or telephone number, to Google Analytics 4 or Google Ads. In Google Ads, we do not use Enhanced Conversions, Customer Match, remarketing or ad personalisation.

A detailed description of the scope of data and the mechanisms related to analytics and advertising measurement is provided in the section on cookies, browser storage, analytics and advertising measurement.

6.1. Web3Forms

The operator of Web3Forms — Web3Creative — operates from India, and Web3Forms also uses subprocessors located in various regions of the world.

In accordance with the current Web3Forms DPA, where data is transferred from the European Economic Area to a country in respect of which an appropriate transfer mechanism is required, the European Commission’s standard contractual clauses (SCC) are applied in particular.

Web3Forms also indicates that, as part of its protection against spam, the IP address and e-mail address of the person submitting the form may be transferred to providers of anti-spam systems.

6.2. Cloudflare

Cloudflare operates a global infrastructure and data may also be processed outside the EEA. In accordance with the current Cloudflare DPA, Cloudflare applies mechanisms provided for by data protection law, including — depending on the circumstances of the transfer — the European Commission’s standard contractual clauses and other recognised transfer mechanisms.

Information on the safeguards applied can be found in the relevant provider’s data protection documentation or obtained by contacting the controller.

6.3. Google

In connection with the use of Google services, including Google Analytics 4, Google Tag Manager and Google Ads, data may subsequently also be processed by entities belonging to the Google group outside the European Economic Area, including in the United States.

For users in the European Economic Area, the relevant Google entity responsible for processing data in connection with standard Google Ads services is Google Ireland Limited, established in Ireland.

Where data is subsequently transferred to the United States, Google states that for transfers to entities certified under the EU–U.S. Data Privacy Framework it relies on the European Commission’s adequacy decision. Where that mechanism does not apply to a particular transfer, Google may use other mechanisms provided for by the GDPR, in particular Standard Contractual Clauses approved by the European Commission.

7.1. Enquiries that do not lead to cooperation

As a rule, we retain correspondence and data relating to an enquiry which did not lead to the conclusion of a contract or the commencement of cooperation for up to 3 years from the end of the correspondence, unless earlier erasure of the data is possible and justified, or further retention is necessary in connection with a specific claim or legal obligation. We consider correspondence to be concluded after 180 days without activity, and, in matters concluded by the completion of a project, at the moment the last agreed service is performed. A complaint, warranty claim, dispute or a further stage of the matter reopens it and moves the start of that period.

7.2. Enquiries leading to cooperation

If an enquiry leads to the conclusion of a contract or the start of cooperation, data relating to the matter may be stored for the duration of the cooperation and subsequently for the period necessary to:

• settling accounts for the cooperation,
• complying with legal obligations,
• retaining the documentation required by law,
• establishing, exercising or defending legal claims.

This period is determined taking into account the provisions on the limitation of claims and on accounting and tax obligations.

7.3. Web3Forms

Submission data may be retained within Web3Forms for up to three years from submission, subject to earlier deletion or a shorter retention period under the applicable plan.

7.4. Catalogue download form data

Data entered into the catalogue download form is neither received nor stored by us.

7.5. Cloudflare technical data

The retention period for technical data depends on the type of service, the configuration and the rules applied by Cloudflare. The controller retains its own technical data only to the extent and for the period necessary to ensure the security, diagnostics and proper functioning of the website.

12.1. OpenStreetMap map

The contact page may display a local map preview or an image which does not itself require a connection to OpenStreetMap.

Only after the user selects the “Show map” button is the interactive map loaded from the external OpenStreetMap service.

When the map is launched, the user’s browser establishes a connection with the infrastructure of OpenStreetMap or of entities involved in the provision of this service. Consequently, the following data may be transmitted, among others:

• IP address,
• browser and device type,
• operating system,
• information about the referring page,
• date and time of the connection,
• information about the requested content.

The OpenStreetMap Foundation describes such data in its privacy policy.

Before the “Show map” button is clicked, the interactive map is not loaded in the background.

12.2. Route planning in Google Maps

The “Get directions” button takes the user to the external Google Maps service.

After clicking, the user leaves the CR Iluminacje website and connects directly to the Google service. From that moment on, data is processed in accordance with Google’s privacy rules.

The link to Google Maps itself does not cause Google services to be loaded in the background beforehand.

12.3. YouTube videos

Video thumbnails are stored on our servers. The external YouTube player is not loaded before the user takes any action.

Only after the user clicks the button that starts the video is the YouTube player embedded in the page, operating in privacy-enhanced mode using the youtube-nocookie.com domain.

Once the video has been started, the browser may establish connections with Google and YouTube infrastructure, including with domains necessary for the operation of the player and the transmission of video content.

Google indicates that privacy-enhanced mode limits the use of views of an embedded video for personalisation, but the use of the embedded player remains subject to Google/YouTube terms and policies.

Before the play button is clicked, no YouTube element is loaded — a local thumbnail is displayed on the page and the browser does not connect to the provider’s servers. Clicking deliberately activates the player and a connection to YouTube, in the course of which the provider receives the technical data necessary to establish the connection, in particular the IP address. We do not store this choice — on a subsequent visit to the page, the player is again inactive. Once activated, the external player may use its own device storage mechanisms or other technical solutions.