This Privacy Policy explains what personal data we collect on the stellartreestand.com website (hereinafter: the “Website”) and in connection with B2B trade cooperation, for what purposes and on what legal bases we process it, to whom we transfer it (including outside the European Economic Area) and what rights you have. It fulfils the information obligations under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: the “GDPR”).
The Website is intended for businesses. Even in B2B relationships, data relating to natural persons (e.g. the first name and surname, business email address or telephone number of a buyer or business owner) is personal data, and we protect it in accordance with the GDPR.
1. Controller
The controller of your personal data is KAMAI.PL Spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Wola Batorska, address: Wola Batorska 461, 32-007 Zabierzów Bocheński (województwo małopolskie), Poland, entered in the register of entrepreneurs of the KRS (National Court Register) kept by the District Court for Kraków-Śródmieście in Kraków, XII Commercial Division of the National Court Register, under number 0000361320, NIP (tax identification number) 6832056712, REGON (statistical identification number) 121297532, share capital 5 000,00 zł (hereinafter: “KAMAI”, the “Controller”, “we”).
Contact in matters relating to personal data:
- email: biuro@kamai.pl (subject line: “Personal data”),
- telephone: +48 12 307 28 21,
- in writing: to the address of the registered office.
The Controller has not appointed a data protection officer, as it is not required to do so. You may contact us directly in all matters relating to personal data.
2. Whose data we process
- persons visiting the Website;
- persons who submit the quote request form or the contact form;
- persons subscribed to the offer mailing list (commercial information);
- persons using the AI Assistant on the Website;
- representatives and contact persons of our current and potential trade partners (owners, management board members, buyers, staff of purchasing, logistics, accounting and marketing departments);
- entrepreneurs who are natural persons (sole proprietorships, partners in civil-law partnerships);
- persons whose data we have obtained from publicly available sources for the purpose of establishing B2B cooperation (point 6).
3. What data we collect
We collect the data needed to establish and conduct trade cooperation, to protect the Website and to demonstrate compliance with the law. We do not collect special categories of data (Article 9 GDPR) and ask you not to provide them.
| Category | Examples of data | Source |
|---|---|---|
| Identification and contact data | first name and surname, job title, business email address, telephone number, language of correspondence | from you, from your employer or principal, from public sources |
| Company data | company name, NIP, address, country, type of business (shop, garden centre, chain, wholesaler, distributor), website, number of points of sale, sales channels | from you, from public registers (KRS, CEIDG, VIES), from websites |
| Content of enquiries and correspondence | content of the form, email messages, notes from telephone calls and meetings, expected quantities, season, expectations regarding the offer | from you |
| Conversations with the AI Assistant | full content of messages and replies, language of the conversation, data provided in the conversation (e.g. email address, company name), date and time, IP address | from you, automatically |
| Data on consents and declarations (event log) | date and time (timestamp with time zone), IP address, user agent, subpage address and language version, content of consents and declarations as displayed, version of the Terms of Use and of the Privacy Policy, date and method of withdrawal of consent | automatically, at the time a form is submitted, a subscription is made or a conversation takes place |
| Data on the use of commercial information | date of sending, opening of messages, clicks on links, unsubscribing, bounced messages | automatically, via email sending tools |
| Technical data and server logs | IP address, date and time of the request, subpage address, referring page address, browser and operating system type, server response code | automatically |
| Data from cookies and similar technologies | identifiers, settings (e.g. language choice, cookie consents), statistical data on the use of the Website | automatically (point 13) |
| Location data entered in the map search | city or postcode entered | from you |
| Trade cooperation data | orders, offers, terms, settlements, complaints, invoicing data | from you or your company |
4. Purposes, legal bases and retention periods
| Purpose | Legal basis | How long |
|---|---|---|
| Responding to an enquiry, preparing and presenting an offer, contact regarding cooperation | Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract, where you are yourself an entrepreneur); Article 6(1)(f) GDPR (our legitimate interest: establishing cooperation with the company you represent) | until the end of the discussions and, if no contract is concluded, for up to 3 years from the last contact, unless you lodge an effective objection earlier |
| Concluding and performing a trade contract, handling orders, deliveries, complaints and warranty | Article 6(1)(b) GDPR (where you are a party to the contract); Article 6(1)(f) GDPR (contact with representatives and employees of the counterparty) | for the term of the contract and until the limitation period for claims expires |
| Accounting and tax obligations | Article 6(1)(c) GDPR in conjunction with the Accounting Act (ustawa o rachunkowości) and tax legislation | 5 years from the end of the calendar year in which the tax payment deadline expired, or longer if required by law |
| Sending commercial information by electronic means (offer mailing list) and telephone marketing | Article 6(1)(a) GDPR (consent) in conjunction with Article 398 of the Electronic Communications Law (ustawa – Prawo komunikacji elektronicznej) | until consent is withdrawn |
| Direct marketing of our own products and services (e.g. offers, new products, invitations) through channels for which separate consent is not required, and in the course of ongoing cooperation | Article 6(1)(f) GDPR (legitimate interest: direct marketing) | until an objection is lodged or for up to 3 years from the last contact |
| Obtaining and verifying contacts of potential B2B partners from public sources, building a partner database, first contact regarding cooperation | Article 6(1)(f) GDPR (legitimate interest: developing wholesale sales); contact by electronic means for marketing purposes – after the required consent has been obtained | until an objection is lodged or for up to 2 years from obtaining the data if no contact is established |
| Operating the AI Assistant: answering questions, receiving enquiries, passing matters to a sales representative, quality control and development of the knowledge base | Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); Article 6(1)(f) GDPR (handling enquiries, improving the quality of answers, security) | up to 24 months from the last message; if the conversation contains a quote request – as for enquiries |
| Event log: demonstrating that consents were given or withdrawn, and who made declarations and when | Article 6(1)(c) GDPR in conjunction with Article 5(2) and Article 7(1) GDPR (accountability principle); Article 6(1)(f) GDPR (protection against claims and defence in proceedings) | for the period in which the consent or declaration is relied on, and then until the limitation period for claims expires and any proceedings are concluded |
| Security of the Website, prevention of abuse, spam and attacks, server logs | Article 6(1)(f) GDPR (legitimate interest: security and continuity of operation) | up to 12 months, unless the data is needed as evidence in connection with an incident |
| Website statistics and analytics using cookies other than strictly necessary ones | Article 6(1)(a) GDPR (consent) in conjunction with Article 399 of the Electronic Communications Law | until consent is withdrawn or the cookie expires |
| Ensuring the operation of the Website (strictly necessary cookies, remembering the language and consent choices) | Article 6(1)(f) GDPR | in accordance with the lifetime of the cookie concerned |
| Market analyses, partner segmentation and sales planning (on aggregated data or data relating to companies) | Article 6(1)(f) GDPR | as for the purpose for which the data was collected |
| Establishing, pursuing and defending claims | Article 6(1)(f) GDPR | until the limitation period for claims expires and proceedings are concluded |
| Responding to requests from data subjects, handling complaints about the services | Article 6(1)(c) GDPR; Article 6(1)(f) GDPR | up to 3 years from the conclusion of the matter |
After the retention periods expire, we delete or anonymise the data. The periods may be extended if required by law or if the data is necessary in pending proceedings.
5. Event log (timestamp)
When a form is submitted, a subscription to the offer mailing list is made, consent is given or withdrawn, and when a conversation with the AI Assistant takes place, we automatically record: the date and time with time zone, the IP address, the user agent, the subpage address and language version, the content of consents and declarations as displayed, and the version of the Terms of Use and of the Privacy Policy.
We do this because the GDPR requires us to be able to demonstrate that consent was given (Article 7(1) GDPR) and that we process data lawfully (Article 5(2) GDPR). The log may serve as evidence in the event of an inspection by the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), a dispute or a complaint. Only authorised persons have access to the log. We do not use data from the log for marketing or to track your activity.
6. Data not obtained from you (Article 14 GDPR)
If you did not provide us with your data yourself, we may have obtained it:
- from the company you represent or work for (e.g. as a contact person for orders);
- from public registers: KRS, CEIDG (Central Register and Information on Economic Activity), VIES and foreign registers;
- from company websites, online shops, company and professional profiles on social media (e.g. LinkedIn), trade directories and trade fair exhibitor lists;
- from commercial business contact databases (including those operated by providers based in the USA);
- from our partners, sales representatives and distributors.
In such cases we process identification and contact data, job title and company data. We inform you of this at the latest at the first contact, and no later than within one month of obtaining the data. You may object at any time – we will then stop contacting you and delete your data, except for the information necessary to respect your objection in the future (e.g. your email address on a suppression list).
7. Do you have to provide data
Providing data is voluntary. Without the data marked as mandatory in the form, we cannot respond to an enquiry or prepare an offer. Without an email address and consent, we cannot subscribe you to the offer mailing list. Providing data is necessary to conclude and perform a trade contract and – to the extent required by law – to issue an invoice.
8. To whom we transfer data
Data may be received only by entities that need it to achieve the purposes described above:
- IT service providers acting on our behalf (processors): hosting of the Website and the server with the AI Assistant conversation database (Hostinger), email and cloud office suite, file and spreadsheet storage, CRM system, email sending tools, tools for searching and verifying business contacts, analytics tools, providers of artificial intelligence models (including OpenAI – AI Assistant) and AI tools supporting the team’s work on correspondence and documents;
- providers of embedded services: YouTube (Google) – video playback; OpenFreeMap and the OpenStreetMap Foundation (Nominatim service) – map and location search;
- our employees, associates, sales representatives and distributors – to the extent needed to handle an enquiry or cooperation;
- courier, forwarding and logistics companies – when making deliveries;
- accounting firm, law firms, advisers, auditors, insurers;
- banks and payment operators – for settlements;
- public authorities and courts – where required by law.
We conclude data processing agreements with processors (Article 28 GDPR) or apply their standard data processing terms. We will provide a full, up-to-date list of providers on request. We do not sell personal data.
9. Transfers of data outside the European Economic Area
We knowingly use the services of providers based in the United States of America (e.g. for artificial intelligence, cloud email and teamwork, CRM, email sending, business contact search and analytics). In the Controller’s assessment, their solutions provide functionality, reliability and a level of security that comparable European solutions do not currently offer. Consequently, your personal data may be transferred outside the European Economic Area, in particular to the USA, and may also be processed by sub-processors of these providers in other countries.
Transfers take place only using one of the mechanisms provided for in Chapter V of the GDPR:
- EU-US Data Privacy Framework – for providers certified under this programme, on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection (Article 45 GDPR);
- standard contractual clauses adopted by the European Commission by Implementing Decision (EU) 2021/914 (Article 46(2)(c) GDPR), applied together with supplementary safeguards (e.g. encryption of data in transit and at rest, access control);
- Commission adequacy decision – for other countries, e.g. the United Kingdom (OpenStreetMap Foundation).
We want you to be aware of the risk: in third countries, public authorities may have different powers to access data than in the EU, and legal remedies may be limited. For this reason we transfer only the data necessary for the purpose concerned. You may request a copy of the safeguards applied to the transfer by writing to biuro@kamai.pl.
10. AI Assistant
The AI Assistant on the Website is an artificial intelligence system, not a human. When you talk to it:
- the content of your messages is sent to the language model provider OpenAI (USA), which generates the reply; the transfer to the USA takes place on the terms set out in point 9;
- we store the full conversation (messages and replies), the language, the date and time and the IP address on our server; this data may be transferred to the CRM system if the conversation concerns a quote request;
- conversations may be reviewed by authorised KAMAI personnel in order to handle the enquiry, for quality control and to improve the Assistant’s knowledge base;
- the content of messages may be automatically checked for abuse (moderation);
- in accordance with the provider’s API terms of use in force on the date this Policy was drawn up, the provider does not by default use data sent via the API to train its models and may retain it for a limited time for the purpose of detecting abuse.
The Assistant does not make decisions about you that produce legal effects. Please do not provide sensitive data, passwords, payment data or data of other persons in the conversation.
11. Your rights
You have the right to:
- access your data and receive a copy of it (Article 15 GDPR);
- rectification of your data (Article 16 GDPR);
- erasure of your data (Article 17 GDPR);
- restriction of processing (Article 18 GDPR);
- data portability for data processed by automated means on the basis of consent or a contract (Article 20 GDPR);
- object to processing based on legitimate interest (Article 21 GDPR); we always comply with an objection to direct marketing, without the need for justification;
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal;
- lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in the country where you reside or work.
To exercise your rights, write to biuro@kamai.pl. We will respond without undue delay and no later than within one month (in justified cases this period may be extended by two months, of which we will inform you). We may ask for information needed to confirm your identity. These rights are not absolute – e.g. we will not delete data that we must retain under the law or in order to defend against claims.
12. Profiling and automated decisions
We do not make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). We may group companies by type of business, country, size or interest in the offer (segmentation) in order to tailor offers and commercial information. Decisions on cooperation are made by people.
13. Cookies and similar technologies
The Website uses cookies and similar technologies (e.g. the browser’s local storage).
- Strictly necessary – they ensure the operation and security of the Website and remember the language version and your cookie choices. They do not require consent.
- Functional – they remember settings and make the Website easier to use (e.g. the state of the AI Assistant window).
- Analytics and marketing – we use them only after you have given consent in the cookie banner.
You may change or withdraw your consent at any time in the cookie settings on the Website (link in the footer) or in your browser settings. Restricting strictly necessary cookies may make it more difficult to use the Website.
External content. We load YouTube videos only after you click on the player; Google may then store its own cookies on your device and process data in accordance with its privacy policy. The map uses OpenFreeMap tiles (OpenStreetMap data), which do not set cookies; however, the provider’s server receives your IP address. We send the city or postcode entered in the search box to the Nominatim service (OpenStreetMap Foundation) only after the search is submitted.
The current list of cookies is available in the cookie settings on the Website.
14. Server logs
The hosting server automatically records technical data on each request (IP address, date and time, subpage address, browser data). We use it to ensure security, diagnose errors and produce aggregated statistics. We do not combine it with other data in order to identify individuals, unless this is necessary to investigate a security incident or to defend against claims.
15. Correspondence and telephone contact
When you write to us or call us, we process the data provided in the correspondence and the call (Article 6(1)(f) GDPR and, where the contact concerns an offer or a contract, also Article 6(1)(b) GDPR). We retain correspondence for as long as needed to deal with the matter, and then until the limitation period for any claims to which it may relate expires.
16. Data security
We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), in particular: an encrypted HTTPS connection, multi-factor authentication for accounts and tools, granting access only to authorised persons and only to the extent needed, storing access keys outside the Website code, backups, protection against spam and abuse, budget and permission limits for AI services, and regular reviews of providers. However, no transmission over the internet is completely secure. We notify the President of the UODO and data subjects of personal data breaches where required by law.
17. Links to other websites
The Website may contain links to other websites (e.g. partners’ shops, social media, an online shop for retail customers). We are not responsible for the privacy practices of those websites. Please read their privacy policies.
18. Changes to the Privacy Policy
We may update the Privacy Policy, in particular when there are changes to legislation, providers, Website functions or processing purposes. The current version, together with its date, is always available on the Website. We will inform persons subscribed to the offer mailing list of material changes by email. If a change requires your consent, we will ask you for it.
This Privacy Policy has been drawn up in Polish. Versions in other languages are for reference only; in the event of any discrepancy, the Polish version prevails.
19. Contact
KAMAI.PL Sp. z o.o., Wola Batorska 461, 32-007 Zabierzów Bocheński, Poland, email: biuro@kamai.pl, tel. +48 12 307 28 21