Privacy policy
Effective from 5 October 2026. This document fulfils the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and applies to everyone whose data we receive through the website, by email, by phone or from your company.
1. Who is responsible for your data
The controller of personal data is Flormont sp. z o.o., ul. Hoża 29/31, 00-521 Warszawa, Polska, KRS 0001264972, NIP 7011330495. Full registration details are on the Company details page.
For questions about data processing, write to kontakt@flormont.com or by post to the company’s address. The company has not appointed a data protection officer (DPO), as it is not subject to the obligation under Article 37 of the GDPR.
2. Whose data we process
- sole traders (jednoosobowa działalność gospodarcza) who submit an application or place orders;
- representatives and contact persons of customer companies: directors, buyers, accountants and persons who receive the goods;
- persons who write to us through the contact form or by email, or who phone us;
- visitors to the website, to the extent of technical connection data.
The website is not intended for consumers or for persons under 18.
3. What data
- Identification and contact data: first name, surname, position, business name, phone number, email address.
- Business registration data: tax or registration number (NIP, EU VAT number, EORI, EDRPOU, RNOKPP), shop address, website or social media page.
- Order data: content and value of orders, delivery addresses, payer, payment history, deferred payment, claims with photos of the goods.
- Correspondence: the content of enquiries and of our replies.
- Technical data: IP address, date and time of the request, browser and device type, page address. These are recorded in server logs.
We do not collect special categories of data (Article 9 of the GDPR). Do not send them in forms or attachments.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|
| Reviewing a trade application, checking business status in public registers | Art. 6(1)(b): steps taken at your request before entering into a contract; for contact persons of companies Art. 6(1)(f): our legitimate interest in checking a counterparty | Until the application is approved; rejected applications for 6 months |
| Managing cooperation, accepting and fulfilling orders, delivery, settlements | Art. 6(1)(b): performance of a contract; for contact persons Art. 6(1)(f): performance of the contract with your company | For the whole term of the contract |
| VAT invoices, accounting and tax records | Art. 6(1)(c): obligations under the Polish Accounting Act (ustawa o rachunkowości), VAT Act (ustawa o podatku od towarów i usług) and Tax Ordinance (Ordynacja podatkowa) | 5 years from the end of the calendar year in which the tax payment deadline passed |
| Handling quality claims | Art. 6(1)(b) and Art. 6(1)(f): protection of the parties’ rights | Until the claim is resolved and then until the limitation period expires |
| Replying to enquiries from the contact form, email and phone | Art. 6(1)(f): our legitimate interest in replying to an enquiry | 12 months after the correspondence ends |
| Sending the price list, news of new lots and deadline reminders by email or phone | Art. 6(1)(a): your consent; also consent under Art. 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) | Until consent is withdrawn |
| Establishing, exercising and defending legal claims | Art. 6(1)(f): our legitimate interest | Until the limitation period expires: usually 2–3 years from the date the claim falls due, in some cases up to 6 years |
| Security and stability of the website, server logs | Art. 6(1)(f): our legitimate interest in protection against abuse | Up to 90 days |
Where the basis is legitimate interest, you may object to the processing (section 8).
5. Where the data comes from
You provide most of the data yourself in forms, emails and by phone. If you are a contact person of a company, your name, position and work contact details may have been passed to us by your company. We check business registration data against public registers: CEIDG and KRS in Poland, VIES in the EU, and the Unified State Register in Ukraine.
Providing data is voluntary. Without the data marked as required in the forms we cannot review an application, start cooperation or fulfil an order.
6. Who receives the data
Data is received only by those who need it for the purposes listed:
- the provider of website hosting and form processing (servers in the EU);
- the email provider: Infomaniak Network SA, Switzerland;
- the growers where your order is loaded and the carriers who deliver it: they receive the consignee’s name and address and a contact for unloading;
- customs representatives, when goods travel to Ukraine;
- banks and payment operators;
- the accounting office, legal advisers, and IT contractors who maintain the website and the order system;
- BunnyWay d.o.o., Slovenia: the website fonts are loaded from their servers, which involves transmitting your IP address; no cookies are set;
- public authorities, where the law requires it.
We have concluded data processing agreements under Article 28 of the GDPR with contractors who process data on our behalf. We do not sell data or pass it on for third-party marketing.
7. Transfers outside the European Economic Area
- Switzerland (email): a European Commission adequacy decision is in force.
- Ukraine: only when you order delivery to Ukraine. The carrier and the customs representative receive the consignee’s data needed for delivery and clearance. Basis: Article 49(1)(b) of the GDPR, the transfer is necessary for the performance of the contract with you.
- If a transfer to another third country is needed for a particular contractor, we apply the European Commission’s standard contractual clauses. A copy is available on request.
8. Your rights
- to obtain access to your data and a copy of it;
- to have inaccurate data corrected or incomplete data completed;
- to request erasure of data where there is no basis for keeping it;
- to restrict processing;
- to port data that you provided and that is processed by automated means on the basis of a contract or consent;
- to object to processing based on legitimate interest, on grounds relating to your particular situation;
- to withdraw consent at any time. This does not affect the lawfulness of processing before the withdrawal. You can unsubscribe from mailings through the link in the email, by telling your account manager or by writing to kontakt@flormont.com.
Send your request to kontakt@flormont.com. We reply within one month; in complex cases the period may be extended by a further two months, of which we will inform you. To avoid disclosing data to an unauthorised person, we may ask you to confirm your identity.
You have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa), uodo.gov.pl, or with the data protection authority in the EU country where you live or work.
9. Automated decisions
We do not take decisions that are based solely on automated processing and produce legal effects for you. The customer’s discount is calculated from turnover according to the published scale; trade applications and deferred payment limits are reviewed by an account manager.
10. Security
The website runs over an encrypted HTTPS connection. Access to customer data is limited to employees and contractors who need it for their work and who are bound by a duty of confidentiality. We will inform you without delay of any personal data breach that creates a high risk to your rights.
11. Cookies
The website does not use advertising or analytics cookies. The browser stores only the entries needed to remember the catalogue view and that the cookie notice has been closed. The list and the way to delete them are described on the Cookies and local storage page.
12. Changes to this policy
The current version is always on this page with its effective date. We notify customers of material changes by email at least 14 days in advance.