Your data.
Clear information.

1. Controller and contact

The controller is Iron Workers Sp. z o.o., ul. Batalionów Chłopskich 38/38, 70-764 Szczecin, Poland; KRS 0000913735, NIP 9552558466.

Privacy contact: p.tokarek@ironworkers.pl — Paulina Tokarek, administration. You may also write to our registered address. We have not appointed a data protection officer.

2. Contact and quotation enquiries

We process details you provide in correspondence or a conversation: your name, company details, email address, any phone number you give us, and your enquiry and attachments. Please provide only information needed to deal with your request.

• Preparing a quotation or performing a contract where you are a party: Article 6(1)(b) GDPR.
• Contact with company representatives and other correspondence: Article 6(1)(f) GDPR. Our legitimate interest is handling enquiries and business relationships.
• Legal obligations arising from a contract, such as accounting: Article 6(1)(c) GDPR.
• Establishing, exercising or defending legal claims where necessary: Article 6(1)(f) GDPR.

Providing data in an enquiry is voluntary. Without details of your request and a way to contact you, we may be unable to reply or prepare a quotation. Ordinary contact does not require marketing consent.

3. How the enquiry tool works

The configurator creates a browser preview and sends part parameters to the server for pricing. When you select a DXF for import, we upload and store its original and analysis result in protected hosting storage. Subsequent calculations use the import reference. Importing or calculating a price alone does not create an enquiry or order.

A working import remains accessible for 7 days. It then expires, and its files are removed during cleanup triggered by subsequent imports. Originals attached to submitted enquiries and orders are saved separately and follow the retention periods described in this notice. The cart, including parameters and a DXF copy, is also stored locally in the browser on your device.

Submitting the enquiry stores your name and email, optional contact/company/delivery details and comments, the specification, quantity, indicative price, one-part DXF and preview. Imported original DXF files are retained with the enquiry. Records and files use the hosting provider described below; access is restricted to authorised staff. Customer files are not published.

Provide only details needed for your enquiry. Downloading a DXF saves a file on your device. Existing email links and the short homepage form may still open your email app, where you send the message yourself. An enquiry is not a purchase or payment. A person verifies the final quotation; we do not perform marketing profiling.

4. Website operation and recipients

Serving and protecting the website involves technical data such as your IP address, request time, requested address and browser details. Keeping the website available and secure is our legitimate interest under Article 6(1)(f) GDPR. Separate rules apply to storing and reading cookies, as described below.

Recipients may include authorised members of our company, hosting and security providers (OpenAI / ChatGPT Sites and Cloudflare infrastructure), our business email provider (Microsoft 365), and, where needed, IT support, legal advisers and competent authorities. Data is shared to the extent needed for the relevant service or obligation.

5. Processing outside the EEA

Providers use global infrastructure, so data may be processed outside the European Economic Area, including in the USA. ChatGPT Sites does not guarantee storage exclusively within the EEA.

The Sites data processing terms provide for Standard Contractual Clauses or a European Commission adequacy decision for transfers from the EEA. Provider information: Sites data processing terms and Microsoft data protection terms. Contact our administration team for information about the safeguards applying to your data and how to obtain a copy.

6. Retention

We retain correspondence for as long as needed to handle an enquiry and related discussions. If it leads to a business relationship, the data becomes part of its documentation. Documents subject to legal retention requirements are kept for the period required by applicable law.

Where data is needed for legal claims, we take into account the relevant limitation period and any proceedings. Once the purpose and obligations end, the data should be deleted or anonymised. Cookie durations are described below; specific platform log retention periods require confirmation from the hosting provider.

7. Your rights

You may request access, rectification, erasure or restriction of processing under the conditions set out in the GDPR. Data portability applies to automated processing based on consent or a contract.

You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

Send requests to our administration team. You may also complain to the President of the Polish Personal Data Protection Office (UODO) or a competent supervisory authority in the country of your habitual residence, workplace or the alleged infringement.

8. Cookies and browser storage

Cookies and similar storage support sign-in, your basket and secure shop operation. Storage necessary for the service you request works independently of analytics consent. Optional shop analytics is off by default. You can enable or disable it in “Privacy settings” at the bottom of the page; refusal does not restrict ordering.

Hosting platform cookie

OpenAI lists __Host-appgarden-visitor as an analytics cookie with a 90-day lifetime. We do not classify it as strictly necessary. In HTTP checks on 25 October 2026, it was not set on the homepage, configurator, account page, DE/EN pages or the chatgpt.site address. These checks do not guarantee the same behaviour in every region or condition. Our application does not create it; when it receives an older copy from a browser, it responds with an instruction to delete it. This does not erase earlier provider records or replace control over any future setting by the host. This website’s settings control Iron Workers analytics; the available hosting tools do not expose a confirmed switch for this cookie.

Closing the first notice without making a choice saves refusal. Closing reopened settings preserves your existing choice. Your choice applies to this browser and domain. We have not added Google Analytics or advertising pixels. Google sign-in is described in section 11. Cookie lifetime is not the retention period for orders or provider logs. You can clear site data in your browser; removing your basket or sign-in session may interrupt those functions.

Sources: OpenAI Cookie Policy (22 October 2026) and Cloudflare cookie documentation. OpenAI · Cloudflare

9. Maps and social media

Links to Google Maps, TikTok and Instagram open external services. We do not load their embedded maps or videos. After you follow a link, the service processes data under its own rules: Google, TikTok, Instagram.

This notice describes the current website. Changes to enquiry handling, payment providers or measurement tools will require updated information and appropriate privacy settings.

10. Orders, payments and confirmations

For purchases, we store contact and billing details, company name and Polish tax ID where applicable, part specification, DXF, quantity, price, finishing, collection, the accepted terms and acknowledgements, and payment and fulfilment statuses. Processing is necessary to conclude and perform the contract (Article 6(1)(b) GDPR), comply with accounting obligations (c), and handle business contacts, security and claims (f). Acknowledging the privacy notice is not marketing consent or a consent required to perform the contract.

For payments, Przelewy24 / PayPro SA receives the order reference, amount, currency, email and required payer details. The store does not retain bank credentials or BLIK codes. PayPro also acts as an independent controller under its payer privacy information.

Transactional confirmations are delivered through Resend. It receives the email address and confirmation content including order details; this channel is not used for marketing. Appropriate processor terms and safeguards for transfers outside the EEA are required. Microsoft 365 continues to handle business correspondence. Orders and files remain in the protected database and file storage described in the hosting section.

Order data is retained for fulfilment and after-sales support, followed by applicable tax/accounting retention periods or periods necessary for legal claims. Unpaid order data is used to reconcile payments and handle incomplete purchases, and is deleted or anonymised once these purposes and legal requirements cease. Accepted specifications and terms are retained as evidence of the contract.

The private status link grants access to the order and its documents. Do not share it. Payment credentials are stored server-side only. Test payments do not create production jobs.

When quoting and fulfilling a selected delivery, we share the recipient’s name, company, address, email and phone, sender details and shipment details with Furgonetka and the relevant carrier. This enables pricing, dispatch and delivery of the order. Selecting collection alone does not share these details with a carrier.

11. Customer account, sign-in and newsletter

The optional free account stores buyer details, order history, documents and saved parts. We process the verified email, customer number, supplied profile/company details, saved configurations and linked Google account identifier. Account services rely on Article 6(1)(b) GDPR; security, voucher abuse prevention and claims on legitimate interests (f). Guest purchases remain available. Company details never grant other users access.

Resend sends sign-in codes and subscription confirmations. The account page loads Google Identity Services for the sign-in button: Google receives technical connection data and, after you choose and authorise sign-in, shares basic profile information, email and account identifier. We do not request Gmail or Drive access. See Google privacy and Resend processing terms. Transfers outside the EEA are subject to the safeguards described above.

The HttpOnly, Secure, SameSite=Lax cookie __Host-iw_customer keeps you signed in for up to 30 days. iw_google protects a Google sign-in attempt for up to 10 minutes. Sign-out revokes the current session. Profile and library data remain for the duration of the account service; request account deletion from our administration. Required accounting, contract and claims records are retained separately.

The newsletter requires separate consent (Article 6(1)(a) GDPR) and email confirmation. We retain the consent text/version and dates of request, confirmation and withdrawal. Mailing stops on withdrawal; necessary consent and withdrawal evidence may remain for compliance and claims. Unsubscribe in your account or through the email link, without losing your account or a granted voucher. See account, newsletter and voucher terms. Your data rights and contact details appear above.