Privacy Policy for the ekoflam.pl Online Store
Last updated: August 5, 2026
1. General Information
We are committed to protecting the personal data of individuals who use the ekoflam.pl website, contact us, submit requests for quotes, make purchases, and use our installation and maintenance services.
In this Privacy Policy, we explain:
what personal data we collect,
for what purposes and on what legal basis we process it,
how long we store it,
to whom we may disclose it,
what rights data subjects have,
how we use cookies and similar technologies.
This Privacy Policy applies to the website available at https://ekoflam.pl, including the online store, contact forms, product inquiry forms, service forms, and other features available on the site.
2. Personal Data Controller
The controller of personal data is:
EkoFlam Przemysław Kubiak
, ul. Łódzka 67
, 95-050 Konstantynów Łódzki
, NIP: 7282419250
, REGON: 101718676
Phone: +48 790 782 780
Email address: info@ekoflam.pl
For matters related to the protection of personal data, you may contact us:
by email at: info@ekoflam.pl,
by phone at: +48 790 782 780,
by mail at: EkoFlam Przemysław Kubiak, ul. Łódzka 67, 95-050 Konstantynów Łódzki.
The Data Controller has not appointed a Data Protection Officer. All questions and requests regarding personal data should be directed to the Data Controller.
3. Basic Principles of Data Processing
We process personal data in accordance with applicable regulations, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter referred to as the “GDPR.”
We process data:
lawfully, fairly, and transparently,
exclusively for specified and legitimate purposes,
to the extent necessary to achieve those purposes,
for no longer than is necessary,
using appropriate technical and organizational measures to protect the data against loss, destruction, unauthorized access, or disclosure.
4. What Data We May Process
Depending on how you use the website and the type of contact, we may process the following data:
4.1. Identification data
first and last name,
company name,
Tax ID (NIP),
REGON,
details of the person representing the company.
4.2. Contact Information
email address,
phone number,
residential address, registered office address, shipping address, installation address, or service location.
4.3. Data related to the order or inquiry
information about the selected product,
content of the inquiry,
information regarding the building, room, heating system, chimney, or installation site,
expected scope of installation,
selected delivery and payment methods,
order and contact history,
information regarding service provision, warranty, complaints, or maintenance.
4.4. Billing Information
data required to issue an invoice,
payment details,
bank account number—if needed to process a refund.
We do not receive full payment card details or online banking login credentials. This data is processed directly by the bank or payment processor.
4.5. Technical Data
While using the website, the following data may be collected automatically:
your device’s IP address,
device and browser type,
operating system,
screen resolution,
browser language,
approximate location based on the IP address,
date and time of visiting the website,
subpages visited,
source of the visit,
identifiers for cookies and similar technologies,
information about how the website is used.
4.6. Content Submitted by the User
We may process documents, photos, floor plans, designs, photographs of the installation site, technical documentation, and other materials submitted in connection with the preparation of a quote, installation, or maintenance service.
Please do not submit information that is not necessary for preparing a response, quote, or providing a service.
5. Purposes, Legal Bases, and Data Processing Period
5.1. Handling contact forms and inquiries
We process the data provided in contact forms, product inquiry forms, emails, phone calls, or through other communication channels for the following purposes:
respond to your question,
contact the person interested in the offer,
provide information about the product,
schedule a meeting, consultation, or site visit,
prepare a preliminary equipment recommendation,
handling further correspondence.
The basis for processing is:
taking action at the request of an individual prior to entering into a contract—Article 6(1)(b) of the GDPR,
the Controller’s legitimate interest in communicating, handling inquiries, and documenting arrangements—Article 6(1)(f) of the GDPR.
We store the data for the time necessary to handle the inquiry and conduct discussions, and then for a maximum of 3 years from the end of contact, unless a contract is concluded earlier or further storage of the data is necessary to establish, pursue, or defend claims.
5.2. Preparing a Quote and Selecting Equipment
If you contact us to request a quote, selection of a stove, fireplace, boiler, chimney, accessories, installation, or other services, we may process data regarding:
the building and its parameters,
the floor area and volume of the rooms,
the existing heating system,
the chimney system,
the planned installation site,
expectations regarding the unit,
the scope of work required.
The basis for processing is taking steps prior to entering into a contract—Article 6(1)(b) of the GDPR—and the Controller’s legitimate interest in preparing an appropriate and safe offer—Article 6(1)(f) of the GDPR.
We retain the data for the duration of the negotiations and for a maximum of 3 years from the submission of the last offer or the conclusion of the negotiations, unless the offer is accepted and a contract is concluded.
5.3. Conclusion and Execution of an Order or Contract
We process customer data for the following purposes:
accepting and confirming an order,
preparing sales documents,
executing the sale,
ensuring delivery,
set a completion date,
performing installation or other requested work,
communicating regarding the order,
providing product documentation,
processing payments,
fulfilling obligations under the contract.
The legal basis for processing is the performance of the contract or taking steps to enter into a contract—Article 6(1)(b) of the GDPR.
We retain contract-related data for the duration of the contract and thereafter until the statute of limitations for claims expires. We retain accounting documents for the period required by tax and accounting regulations, generally for 5 years from the end of the year in which the tax payment deadline expired.
5.4. Product Delivery
If an order requires delivery, we process the recipient’s data, delivery address, phone number, email address, and information necessary for the proper delivery of the product.
The legal basis for processing is the performance of a contract—Article 6(1)(b) of the GDPR.
The data may be transferred to a selected courier company, carrier, logistics operator, manufacturer, or distributor handling delivery directly to the customer.
5.5. Payments and Billing
We process data for the purpose of:
accepting and identifying payments,
issuing invoices, advance invoices, receipts, and other documents,
maintaining accounting records,
process refunds,
fulfilling tax obligations.
The legal basis for processing is:
performance of a contract—Article 6(1)(b) of the GDPR,
compliance with legal obligations incumbent upon the Controller—Article 6(1)(c) of the GDPR in connection with tax and accounting regulations.
We retain accounting and tax records for the period required by applicable regulations.
5.6. Installation, Commissioning, and Technical Support
In the event of an order for installation, commissioning of equipment, a site visit, or other technical work, we process data for the following purposes:
determine the location and date of the work,
assessing technical conditions,
prepare the scope of work and materials,
provide the installation team with access to the work site,
perform and document the service,
maintaining contact during the project,
ensuring the safety and proper execution of the installation.
The legal basis for processing is the performance of the contract—Article 6(1)(b) of the GDPR – and the Controller’s legitimate interest in documenting the proper performance of the work and safeguarding against potential claims – Article 6(1)(f) of the GDPR.
Data may be transferred to installers, service technicians, subcontractors, and technical partners involved in the execution of a specific order.
5.7. Complaints, Warranty, and Service
We process data for the purpose of:
receiving and resolving complaints,
exercising rights arising from the warranty or consumer protection laws,
diagnosing the device,
organize a service visit,
order replacement parts,
contacting the manufacturer, distributor, or authorized service center,
maintaining repair records,
defending against potential claims.
The basis for processing is:
performance of the contract or exercise of rights related thereto—Article 6(1)(b) of the GDPR,
compliance with the Controller’s legal obligations—Article 6(1)(c) of the GDPR,
the Controller’s legitimate interest related to handling the request, documenting the repair, and protecting against claims – Article 6(1)(f) of the GDPR.
We retain the data for the duration of the service request, the warranty period, or the seller’s liability period, and thereafter until the statute of limitations for claims expires.
5.8. Customer Account
If the store offers the option to create an account, we process the data for the following purposes:
creating and maintaining the account,
enabling login,
providing access to your order history,
facilitate placing future orders,
manage customer data,
ensuring account security.
The legal basis for processing is the performance of the account agreement—Article 6(1)(b) of the GDPR.
We store the data until the account is deleted, and data regarding completed orders is also stored for the period required by law and until the statute of limitations for claims expires.
5.9. Newsletter and Marketing Communications
If you subscribe to the newsletter or consent to receiving commercial communications, we will process your email address, and if communication takes place by phone or via text message, we will also process your phone number.
This data may be used to send:
product information,
promotions and special offers,
advice on selecting, using, and maintaining devices,
information about new devices and services,
invitations to events and presentations.
The legal basis for processing is:
consent—Article 6(1)(a) of the GDPR,
regulations regarding the transmission of commercial information and the use of telecommunications terminal equipment for marketing purposes.
Consent may be withdrawn at any time, without affecting the lawfulness of actions taken prior to its withdrawal.
We retain the data until consent is withdrawn or an objection is raised. After consent is withdrawn, we may retain information regarding its prior granting and withdrawal for the purpose of demonstrating compliance with the law.
5.10. Marketing of Our Own Products and Services
We may process the data of current customers for the purpose of marketing our own products and services, in particular to present offers related to the purchased device, parts, accessories, inspections, or service.
The basis for processing is the Controller’s legitimate interest—Article 6(1)(f) of the GDPR.
If regulations require additional consent for the use of a specific communication channel—such as email, text messages, or phone calls—communication will only take place after such consent has been obtained.
You may object to the processing of your data for direct marketing purposes at any time.
5.11. Customer Reviews and Ratings
If you post a review of a product or service, we may process the content of the review, your signature or username, information about the purchased product, and technical data related to posting the review.
The legal basis for processing is:
consent—if the review is published on this basis—Article 6(1)(a) of the GDPR,
the Controller’s legitimate interest in presenting customer reviews, developing our offerings, and preventing false reviews—Article 6(1)(f) of the GDPR.
The review may be publicly visible. Do not include any information in the review that should not be published.
We retain the data for the duration of the review’s publication or until a valid request for its removal is made, unless further retention is justified by the need to defend against claims.
5.12. Social Media
If you contact us through social media platforms or follow our profiles, we may process:
username,
first and last name,
profile picture,
the content of messages and comments,
data made publicly available on your profile,
information about reactions and activity related to our profile.
We process this data to manage the profile, respond to messages and comments, provide information about our offerings, and build relationships with users.
The legal basis for processing is the Controller’s legitimate interest—Article 6(1)(f) of the GDPR.
The operator of a given social media platform may also act as an independent data controller, processing data in accordance with its own privacy policy.
5.13. Analytics, Statistics, and Website Development
We may process technical data and information regarding website usage for the following purposes:
compiling visitor statistics,
determining which content is most useful,
improve the performance of the website and online store,
detect errors,
measuring the effectiveness of advertising campaigns,
customizing content and ads.
If data is collected using cookies or similar technologies that are not necessary for the website to function, the basis for their use is the user’s consent—Article 6(1)(a) of the GDPR.
In the case of data necessary to ensure the proper and secure operation of the website, the legal basis for processing is the Controller’s legitimate interest—Article 6(1)(f) of the GDPR.
5.14. Website Security and Fraud Prevention
We may process technical data for the purpose of:
ensuring website security,
protecting forms and user accounts,
detect attempts at unauthorized access,
preventing spam, fraud, and other abuses,
create backups,
maintaining technical event logs.
The basis for processing is the Controller’s legitimate interest in protecting the website, data, users, and the Controller’s operations—Article 6(1)(f) of the GDPR.
Technical logs are retained for the period necessary to ensure security, analyze incidents, and defend against claims.
5.15. Establishing, Pursuing, and Defending Claims
Data may be processed for the purpose of establishing, pursuing, or defending claims related to the use of the website, a concluded contract, a sale, installation, a complaint, service, or other cooperation.
The basis for processing is the Controller’s legitimate interest—Article 6(1)(f) of the GDPR.
We retain the data until the expiration of the applicable statute of limitations for claims or until the proceedings are finally concluded.
5.16. Compliance with Legal Obligations
We may process data to comply with legal obligations arising from applicable laws, in particular:
tax,
accounting,
consumer protection,
regarding product safety,
regarding complaint procedures,
requiring the disclosure of data to authorized authorities.
The legal basis for processing is Article 6(1)(c) of the GDPR.
6. Is providing data mandatory?
Providing personal data is voluntary; however, in many cases it is necessary to:
receiving a response to an inquiry,
preparing a quote,
placing and fulfilling an order,
issuing a sales document,
delivering a product,
performing installation,
handling complaints, warranties, or service requests,
creating a customer account,
receiving the newsletter.
Failure to provide the required information may prevent us from completing the relevant action.
Data marked as required in the forms is necessary to process the form. The remaining data may be provided voluntarily.
7. Sources of Data
We most often receive data directly from the data subject.
In some cases, data may be provided by:
a person placing an order on behalf of another recipient,
a family member or co-owner of the property,
an employer or a person representing a company,
an installer, business partner, or service technician,
a manufacturer or distributor handling the request,
a payment processor,
a carrier,
publicly available business registries.
If you provide us with another person’s data, you should have a valid basis for doing so and inform that person about the processing of their data in accordance with this Privacy Policy.
8. Recipients of Data
Personal data may be transferred to entities that support us in conducting our business, in particular:
hosting, server, and email providers,
website administrators and developers,
IT, CRM, sales, and accounting system providers,
accounting firms and tax advisors,
payment processors, banks, and financial institutions,
courier companies, carriers, and logistics operators,
manufacturers, importers, and distributors of products,
installers, service technicians, assembly teams, and technical partners,
providers of tools for sending newsletters and messages,
providers of analytics, advertising, and marketing tools—if the user has given the appropriate consent,
law firms, consultants, and debt collection agencies,
insurance companies,
entities providing archiving, security, and backup services,
public authorities, courts, the police, tax offices, and other authorized entities—if the obligation to transfer data arises from legal provisions.
We provide data processors acting on our behalf only with the data necessary to perform a specific service. These entities are required to maintain confidentiality and implement appropriate security measures.
9. Transfer of Data Outside the European Economic Area
Some tools used on the website—in particular analytics, advertising, communication, hosting, or social media services—may be provided by companies based outside the European Economic Area or using infrastructure located outside that area.
In such cases, data may be transferred outside the European Economic Area only if there is an appropriate legal basis and the required level of protection is ensured, in particular on the basis of:
a European Commission decision recognizing an adequate level of protection,
standard contractual clauses approved by the European Commission,
another mechanism provided for by the provisions of the GDPR.
If a specific service requires consent for the use of cookies or similar technologies, the transfer of data in connection with that service will take place only after the appropriate consent has been given.
Information regarding specific tools and providers may be available in the cookie consent management panel.
10. Automated Decision-Making and Profiling
We may use tools that allow us to analyze how the website is used and to tailor advertising content to the user’s interests. Such activities may constitute profiling.
Profiling may involve, among other things, analyzing:
subpages visited,
products viewed,
the source of the visit to the website,
responses to ads,
approximate location,
device type.
These activities are conducted based on the user’s consent to analytical or marketing cookies.
We do not make decisions regarding users that produce legal effects or similarly significantly affect them solely through automated means.
11. Rights of Data Subjects
In connection with the processing of personal data, you have the following rights:
11.1. Right of access to data
You may request information on whether we are processing your data, access your data, and obtain a copy of it.
11.2. Right to rectification
You may request that incorrect data be corrected or that incomplete data be supplemented.
11.3. Right to erasure
You may request the erasure of your data if, among other reasons:
the data is no longer necessary for the purposes for which it was collected,
you withdraw your consent and there is no other legal basis for processing,
you have successfully objected,
the data was processed unlawfully.
The right to erasure is not absolute. We may continue to process the data if required by law or if the data is necessary to establish, exercise, or defend legal claims.
11.4. Right to Restriction of Processing
You may request that we restrict the processing of your data in the cases specified in the GDPR, including while we verify the accuracy of the data or consider your objection.
11.5. Right to Data Portability
If data is processed on the basis of consent or a contract and by automated means, you may receive the data in a structured, commonly used format and—if technically feasible—request that it be transmitted to another controller.
11.6. Right to Object
You may object at any time to the processing of your data based on the Controller’s legitimate interests.
Upon receiving your objection, we will cease processing the data unless we demonstrate compelling legitimate grounds for further processing that override your interests, rights, and freedoms, or the data is necessary for the establishment, assert, pursue, or defend legal claims.
If the data is processed for direct marketing purposes, the objection is effective without the need to provide a reason. Upon receiving it, we will cease using the data for this purpose.
11.7. Right to Withdraw Consent
If your data is processed based on consent, you may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
11.8. Right to File a Complaint
If you believe that your data is being processed unlawfully, you may file a complaint with:
The President of the Personal
Data Protection Office, ul. Stanisława Moniuszki 1A
, 00-014 Warsaw
Before filing a complaint, we encourage you to contact us. We will try to clarify the matter and address your concerns.
12. How to Exercise Your Rights
Requests regarding personal data can be sent:
by email to: info@ekoflam.pl,
by mail to: EkoFlam Przemysław Kubiak, 67 Łódzka St., 95-050 Konstantynów Łódzki.
In the message, please specify which right your request concerns and provide information that allows us to identify you.
We may ask for additional information needed to verify your identity. We do this to ensure that your data is not disclosed to an unauthorized person.
We respond to requests without undue delay, generally within one month. In the case of particularly complex matters or a large number of requests, the deadline may be extended by an additional two months. We will notify you of such an extension and the reasons for it.
Exercising these rights is generally free of charge. If a request is manifestly unfounded or excessive, particularly due to its repetitive nature, we may charge a reasonable fee or refuse to take action.
13. Cookies and Similar Technologies
13.1. What Are Cookies
Cookies are small text files stored on a user’s device when using a website.
Cookies may contain, among other things, an identifier, information about website settings, selected consents, the user’s session, and how the website is used.
In addition to cookies, similar technologies may be used, such as browser local storage, pixels, tags, and device identifiers.
13.2. Types of Cookies Used
The following categories of cookies may be used on the website:
Essential cookies
These are necessary for the website to function properly, ensure its security, process forms, remember privacy settings, and enable the shopping cart or customer account to work.
They do not require consent, as without them the website or a service selected by the user would not function properly.
Functional cookies
They allow the website to remember selected settings and provide additional features, such as playing content from external sites, maps, or communication tools.
They are used after consent is given, provided their use is not essential for providing the service selected by the user.
Analytical cookies
These cookies allow us to measure the number of visits, how users navigate the website, the popularity of individual pages, and the effectiveness of published content.
They help us improve the website’s performance and better meet users’ needs.
They are used after you give your consent.
Marketing cookies
These cookies allow us to measure the effectiveness of ads, create audience segments, limit the number of times the same ad is displayed, and tailor ads to users’ interests.
They may be placed by us or by third-party advertising and social media service providers.
They are used after you give your consent.
13.3. Consent to Cookies
During your first visit to the site, a panel appears that allows you to:
accept all cookies,
reject cookies other than essential ones,
select specific categories of cookies.
Not consenting to analytical, functional, or marketing cookies should not prevent you from using the website’s basic functions.
You may withdraw or change your consent at any time using the settings available on the website. Withdrawing consent does not affect the lawfulness of the use of cookies prior to withdrawal.
13.4. Third-Party Cookies
The website may use third-party tools, in particular those related to:
web analytics,
online advertising,
social media,
maps,
video content,
form spam protection,
payment processing,
customer communication.
The providers of these services may set their own cookies and process data in accordance with their own privacy policies.
An up-to-date list of the tools used, cookies, their providers, purposes, and durations should be available in the cookie consent management panel.
13.5. Managing Cookies in Your Browser
Users can also change their cookie settings directly in their browser, specifically:
block the storage of cookies,
delete stored cookies,
allow cookies only for selected websites,
enable notifications when cookies are attempted to be stored.
Restricting the use of essential cookies may affect the proper functioning of the website, forms, shopping cart, or customer account.
14. Links to Other Websites
The website may contain links to the websites of manufacturers, suppliers, social media platforms, video services, payment processors, or other third parties.
Once you navigate to another website, your data is processed in accordance with the policies set by that website’s operator. We recommend that you review the privacy policy of each external website you visit.
We are not responsible for the privacy practices of independent operators of other websites.
15. Data Security
We implement appropriate technical and organizational measures to protect personal data against:
unauthorized access,
accidental loss,
destruction,
alteration,
disclosure,
or misuse.
Depending on the type of data and the risks involved, the security measures used may include, among others:
an encrypted connection to the website,
server and email security measures,
system access controls,
backups,
software updates,
protection against malware,
restricting access to data to authorized individuals only,
requiring employees and suppliers to maintain confidentiality.
No method of data transmission or storage is completely secure. If a data breach is detected, we will take the actions required by law.
16. Children’s Data
EkoFlam’s services are not directed specifically at children. We do not knowingly collect data from individuals under the age of 16 for marketing purposes or in connection with account creation.
If we learn that a child’s data has been provided without a valid basis, we will take steps to delete it.
17. Data Retention Period
The data retention period depends on the purpose and legal basis for processing. We retain data:
for the time necessary to handle an inquiry or prepare an offer,
for the duration of the contract,
for the duration of the warranty and the seller’s liability,
for the period required by tax and accounting regulations,
until the statute of limitations for claims expires,
until consent is withdrawn—when processing is based on consent,
until an objection is effectively filed—when processing is based on a legitimate interest,
for the period specified in the settings of a given cookie,
for the time necessary to ensure website security and analyze incidents.
Once the applicable period has ended, the data is deleted, anonymized, or retained only to the extent required by law.
18. Changes to the Privacy Policy
The Privacy Policy may be updated in the event of:
changes in the law,
changes in how the website or online store operates,
the launch of new forms, services, or communication channels,
the implementation of new analytics, marketing, or payment tools,
changes in how data is processed.
The current version of the Privacy Policy is always published on the ekoflam.pl website along with the date of the last update.
Changes take effect on the date the new version is published, unless a different date is specified in the text.
19. Contact
If you have any questions regarding this Privacy Policy or the processing of personal data, please contact:
EkoFlam Przemysław Kubiak
67
Łódzka St. 95-050 Konstantynów Łódzki
Phone: +48 790 782 780
Email: info@ekoflam.pl