§1 General Provisions

1. This document sets out the rules for the processing of personal data and the use of cookies and similar technologies in connection with the use of websites operating under the domains www.guma.pl and www.gumotiv.pl (together with their subdomains), hereinafter collectively referred to as the “Services”.
The gumotiv.pl domain serves solely as a technical server-side redirect to the guma.pl domain. The processing of personal data, the use of cookies, and consent mechanisms are carried out exclusively within the guma.pl service.

2. The Services are of an informational and business (B2B) nature – they present information about the company, its products and services, and enable contact and the submission of requests for quotations.

3. The controller of personal data is:
GUMOTIV Sp. z o.o.
ul. Inwestorów 11, 39-300 Mielec, Poland
tel. +48 17 749 20 00
e-mail: sekretariat@gumotiv.pl

VAT ID: PL8172175072, REGON: 181057560, KRS: 0001212334,
District Court in Rzeszów, 12th Commercial Division of the National Court Register,
Share capital: PLN 22,800,100

4. Contact regarding matters related to personal data protection is carried out using the contact details indicated in point 3 above.

5. This document takes into account applicable provisions of law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), as well as regulations concerning privacy and cookies in electronic communications services.

6. Recruitment forms contain separate information clauses available directly next to the recruitment forms, which constitute the primary source of information for candidates.

7. To the extent that the same mechanisms (e.g. Google tools, cookies, consent mechanisms) are used within the Services, this Privacy Policy shall apply accordingly to data processing carried out within the guma.pl service.

PRIVACY POLICY (GDPR)

§3 Types of Personal Data Processed

1. Data provided in contact and quotation request forms, in particular: first and last name, company name, e-mail address, telephone number, the content of the enquiry, and attachments. The scope of the processed data varies depending on the type of form and the purpose of processing and is described in detail in the further sections of this policy.

2. Technical data: IP address, cookie identifiers, information about the device and browser – to the extent resulting from the granted consents.

3. As part of Google Ads enhanced conversions, only the e-mail address and telephone number provided by the user in forms are processed.

§4 Purposes and Legal Bases for Processing

1. Handling quotation requests and correspondence – Article 6(1)(b) and (f) GDPR.

2. Ensuring the security and proper functioning of the Services – Article 6(1)(f) GDPR.

3. Analytics and statistics (GA4) – Article 6(1)(a) GDPR (consent).

4. Marketing, remarketing, and measurement of advertising effectiveness (Google Ads) – Article 6(1)(a) GDPR (consent).

5. Google Ads enhanced conversions – Article 6(1)(a) GDPR (consent).

§5 Forms Available on the Website – Purposes, Legal Bases, and Scope of Data

1. Request for Quotation (RFQ) – data are processed for the purpose of handling the enquiry, contacting the sender, and preparing a response or offer.
Legal basis:

• Article 6(1)(b) GDPR – actions taken prior to entering into a contract
• Article 6(1)(f) GDPR – legitimate interest of the controller (archiving correspondence, defence against claims)

2. Contact Form – data are processed for the purpose of responding to the enquiry and conducting correspondence.
Legal basis:

• Article 6(1)(f) GDPR
• Article 6(1)(b) GDPR – if the contact concerns cooperation or an offer

3. Recruitment Forms – data are processed for the purpose of conducting current and – upon obtaining separate consent – future recruitment processes.
Legal basis:

• Article 6(1)(a) GDPR – candidate’s consent

§6 Confidentiality of Enquiries (NDA)

1. Requests for quotation and attachments submitted via forms are subject to a confidentiality clause (NDA) presented alongside the form.

2. Such data are used exclusively for the purpose of handling the enquiry and commercial contact.

§7 Recruitment

1. Detailed rules for the processing of candidates’ data, including the scope of data, retention period, and candidate rights, are set out in the information clauses available directly next to the recruitment forms.

§8 Google Analytics 4

1. The Service uses Google Analytics 4 to analyse statistics and traffic.

2. GA4 is activated only after consent to analytical cookies has been granted.

3. The service provider is Google Ireland Limited:
https://policies.google.com/privacy

§9 Google Ads

1. The Service uses Google Ads for advertising activities, including remarketing and conversion measurement.

2. Marketing mechanisms are activated only after marketing consent has been obtained.

3. Information about Google advertising:
https://policies.google.com/technologies/ads

§10 Enhanced Conversions

1. Only the e-mail address and telephone number are transferred to Google in hashed form (e.g. SHA-256).

2. These data are used solely to measure advertising effectiveness.

3. This feature operates exclusively after marketing consent has been granted.

§11 Data Recipients

1. Entities processing data on behalf of the Controller (e.g. hosting providers, IT service providers).

2. Google – with regard to GA4 and Google Ads.

3. Public authorities – where required by law.

§12 Transfer of Data Outside the EEA

Personal data may be transferred outside the EEA in connection with the use of Google services, in accordance with applicable legal mechanisms.

§13 Data Retention Period

1. Requests for quotation and contact form data – for the duration of correspondence and thereafter for the period necessary to secure or pursue claims.

2. Recruitment data – for the period indicated in the content of the candidate’s consent, no longer than 6 months from the date it is granted or until it is withdrawn.

3. Marketing and analytical data – until consent is withdrawn.

4. Technical logs – for the period necessary to ensure the security of IT systems.

§14 User Rights

The User has the right to access their data, rectify them, erase them, restrict processing, transfer data, withdraw consent, and lodge a complaint with the President of the Personal Data Protection Office (UODO).

§15 Automated Decision-Making

The Controller does not make decisions based solely on automated processing within the meaning of Article 22 GDPR.

COOKIE POLICY

§16 Cookies – Purposes

1. Necessary cookies – proper functioning of the Service.
2. Analytical cookies – statistics (GA4).
3. Marketing cookies – Google Ads, remarketing, conversion measurement.

§17 Cookie Consents

1. Consent management is carried out via the Cookiebot CMP platform.

2. Consents are assigned to the domain used by the User.

3. The User may change or withdraw consent at any time via the Cookiebot consent management panel.

FINAL PROVISIONS

§18 Amendments to the Document

The Controller may update this document in the event of legal or technological changes.

§19 Effective Date

This document is effective as of 01 January 2026.

CONSENT MANAGEMENT

The tool provided and integrated with the Cookiebot CMP.