DM GROUP sp. z o.o. sp.k. · ul. Dworcowa 1C, 64-731 Drawski Młyn · KRS 0000497884 · NIP 7632127721 · REGON 302649072.Last updated: 21 October 2026This document applies to persons who use the dmgroup.be website: customers and business contractors, their employees and designated contact persons, persons submitting requests for quotations, persons contacting us, and website visitors. The rules for using the website are set out in the separate Terms and Conditions of the dmgroup.be Website.

1. Data Controller

The controller of your personal data is DM GROUP spółka z ograniczoną odpowiedzialnością spółka komandytowa, with its registered office in Drawski Młyn, ul. Dworcowa 1C, 64-731 Drawski Młyn, entered in the register of entrepreneurs of the National Court Register maintained by the District Court Poznań — Nowe Miasto i Wilda in Poznań, IX Commercial Division of the National Court Register, under KRS number 0000497884, NIP 7632127721, REGON 302649072. Contact regarding personal data: sekretariat@dmgroup.be, tel. +48 509 685 047, or by post to the registered office address. We have not appointed a Data Protection Officer — all matters are handled by the controller at the address indicated above.

2. Who this information applies to

• Customers and contractors — persons and companies submitting requests for quotations and entering into agreements with us.
• Employees and associates of our contractors — persons designated for business contact, receipt of goods or settlements.
• Suppliers and their representatives.
• Persons contacting us via the form, e-mail or telephone.
• Visitors to the dmgroup.be website.
• Persons entering our premises who are covered by video surveillance.

3. Purposes of processing, legal bases and retention periods

Handling a request for quotation submitted through the form or the “My Enquiry” list Data scope: name and surname, company name, e-mail, telephone, content of the enquiry, list of selected products. Legal basis: Art. 6(1)(b) GDPR (steps at the data subject’s request prior to entering into a contract). Retention period: until completion of the quotation process + limitation period for claims.Entering into and performing a sales or supply agreement Data scope: contractor’s data, data of persons designated for contact and receipt of goods, delivery data. Legal basis: Art. 6(1)(b) GDPR (contractor); Art. 6(1)(f) GDPR (contact persons on the contractor’s side). Retention period: duration of the agreement + limitation period for claims.Settlements, invoices, accounting Data scope: settlement and tax data. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 74(2) of the Accounting Act and tax regulations. Retention period: 5 full tax years.Handling correspondence and enquiries (e-mail, telephone) Data scope: contact details and message content. Legal basis: Art. 6(1)(f) GDPR (responding to an enquiry). Retention period: until the matter is closed + limitation period for claims.Marketing of our own products and maintaining business contacts Data scope: contact details, history of contacts and enquiries. Legal basis: Art. 6(1)(f) GDPR; sending through a given channel (e-mail, telephone) — with consent, in accordance with Art. 398 of the Electronic Communications Law. Retention period: until objection is made or consent is withdrawn.Website security and traffic statistics and measurement Data scope: access logs, IP address, website events, cookie identifiers; in Microsoft Clarity also a record of interactions with the website (cursor movements, clicks, scrolling) and heatmaps. Legal basis: Art. 6(1)(f) GDPR (security); analytical cookies and Google Analytics 4 and Microsoft Clarity data — Art. 6(1)(a) GDPR (consent). Retention period: logs up to 12 months; Google Analytics 4 data up to 14 months; Microsoft Clarity session recordings up to 30 days, heatmaps and click data up to 9 months.Displaying the location map (Google Maps) on the Contact page Data scope: IP address, device and browser information, data on use of the map. Legal basis: Art. 6(1)(a) GDPR (consent). Retention period: we do not store these data; Google processes them under its own privacy policy.Establishing, pursuing and defending claims Data scope: case, agreement and correspondence data. Legal basis: Art. 6(1)(f) GDPR. Retention period: until expiry of limitation periods.Safety of persons and property — video surveillance on the premises Data scope: image of persons entering the premises. Legal basis: Art. 6(1)(f) GDPR. Retention period: up to 3 months from recording, unless the recording constitutes evidence in proceedings. Submitting a request for quotation is not an order or an offer within the meaning of Art. 66 of the Civil Code; presentation of products on the website constitutes an invitation to enter into a contract (Art. 71 of the Civil Code).

4. Where we obtain data

We obtain data primarily from you — from the quotation request form, contact form, correspondence and telephone conversations. Before entering into an agreement, we may verify the contractor’s data in public registers (CEIDG, KRS, REGON, the VAT Taxpayers Register, VIES); this verification takes place outside the website, which is not integrated with any register. We receive data of a person designated for contact, receipt of goods or settlements from their employer or principal who is our contractor — in such case, this information constitutes fulfilment of the obligation under Art. 14 GDPR, and the source of the data is your employer or principal. Such data usually include name and surname, position or function, business e-mail address and telephone number. Where we initiate the first business contact, we may obtain the business contact details of the contact person (name and surname, position, business e-mail address and telephone number) from publicly available sources, in particular company websites, public registers, trade directories and business networking services; in such case, this information constitutes fulfilment of the obligation under Art. 14 GDPR.

5. Data recipients

Data may be disclosed only to entities necessary for us to conduct our business: hosting and domain providers, e-mail providers, the entity operating the website, providers of analytics and consent-management tools used on the website (Google Ireland Limited and Google LLC — in connection with Google Analytics; Microsoft Corporation — in connection with Microsoft Clarity), invoicing-system provider, accounting office, carriers and forwarding companies, postal operators, legal and tax advisers, insurers, and authorities entitled to receive data under applicable law. Each provider acting on our behalf processes data under a data processing agreement compliant with Art. 28 GDPR. With respect to the Google Maps map displayed on the Contact page, Google acts as a separate controller. We do not sell data. At your request, we will identify the specific recipients to whom we have disclosed your data.

6. Transfers of data outside the European Economic Area

Our systems, e-mail and backups are located in the European Union. Data are transferred outside the European Economic Area in connection with the use of Google Analytics 4 and Google Maps on the website — the recipient is Google Ireland Limited and, insofar as data are transferred to its parent company, Google LLC, based in the United States. Data collected by Microsoft Clarity are processed by Microsoft Corporation, based in the United States. The basis for the transfer is the European Commission Implementing Decision of 10 July 2023 establishing an adequate level of protection for personal data provided by the EU–US Data Privacy Framework (Art. 45 GDPR); Google LLC and Microsoft Corporation are certified under that Framework. In addition, standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR), forming part of the service terms, apply. A copy of the safeguards applied will be provided upon request. The transfer takes place only if you have consented to analytical cookies (Google Analytics 4, Microsoft Clarity) or to the display of the Google Maps map. If you do not consent, the data are not transferred.

7. Automated processing and profiling

We do not make decisions concerning you based solely on automated processing that would produce legal effects or similarly significantly affect your situation (Art. 22 GDPR). We do not profile your data to assess creditworthiness or payment capacity. Some activities are performed automatically — for example, compiling products selected for a quotation request or aggregated website traffic statistics. We do not use Microsoft Clarity session recordings or heatmaps to identify individuals or for profiling.

8. Cookies and traffic measurement

We use cookies necessary for the operation and security of the website — supporting the user session, the “My Enquiry” list, language selection and remembering your decision made in the consent panel. These cookies cannot be disabled because the website would not function without them; their use does not require your consent. With your consent, we use analytical cookies associated with Google Analytics 4, which allows us to measure website traffic and improve the website. We also use Microsoft Clarity, provided by Microsoft Corporation. Clarity records how the website is used, in particular cursor movements, clicks and scrolling, and on that basis creates session recordings and heatmaps that help us assess whether the website is easy to use. Text entered in form fields is masked and is not recorded. Session recordings are stored for up to 30 days, and heatmaps and click data for up to 9 months. We do not use Clarity data for advertising purposes. Before consent is given, Microsoft Clarity operates in a limited mode without storing cookies. After consent to analytical cookies is given, Clarity may use cookies and enable its full analytical functionality. On the Contact page we display a Google Maps map that allows you to check the location of our registered office and plan a route. The map is loaded only after you give consent in the consent panel. Once it is loaded, Google receives in particular your IP address and information about your device and browser, and may store cookies on your device. Google processes these data as a separate controller, in accordance with the Google Privacy Policy available at policies.google.com/privacy. We manage consents using Complianz together with Google Consent Mode and Microsoft Clarity consent mode. Google Analytics 4 and the remaining optional analytical mechanisms are activated in accordance with the user’s choice in the consent panel. You give consent in the panel displayed on your first visit; you can change or withdraw it at any time via the “Cookie settings” link in the footer. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. The legal basis for the use of cookies is Art. 399 and Art. 400 of the Electronic Communications Law of 12 July 2024 and, insofar as cookie data constitute personal data, also the GDPR. A detailed list of cookies used, including their name, provider and retention period, is available in the Cookie Policy on the website and in the cookie settings panel.

9. Video surveillance

The premises are covered by video surveillance for the purpose of ensuring the safety of persons and protecting property. The monitored area is visibly marked. Recordings are stored for no longer than 3 months, unless a recording constitutes evidence in proceedings — in that case, until the proceedings have been finally concluded. We do not use facial recognition or other biometric techniques. Detailed information is provided in the notice displayed at the entrance to the premises.

10. Your rights

You have the right to: access your data and obtain a copy; rectification; erasure; restriction of processing; data portability for data processed on the basis of consent or a contract by automated means; object to processing based on legitimate interests (Art. 21(1) GDPR) — including, in all cases and without the need to provide reasons, in relation to direct marketing (Art. 21(2) GDPR) — and withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Requests should be sent to sekretariat@dmgroup.be or by post to the registered office address. We respond without undue delay, no later than within one month; in complex cases, the period may be extended by two months, of which we will inform you during the first month. Exercising your rights is free of charge.

11. Complaint to the supervisory authority

If you believe that we process data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

12. Is providing data mandatory?

Providing data is voluntary, but constitutes a condition for entering into and performing an agreement — without it, we will not prepare an offer, carry out a delivery or issue an invoice. Providing data in the contact form is voluntary and is used solely to respond. We are required to process some data under tax and accounting regulations. Giving marketing consents is entirely voluntary and does not affect your ability to receive an offer or the terms of cooperation.

13. Data security

We apply technical and organisational measures appropriate to the risk: encryption of transmissions (HTTPS protocol), role-based access control, two-factor authentication for persons operating the website, website software updates, regular backups stored in the European Union, authorisations for employees to process data, and data processing agreements with every provider having access to data.

14. Changes to the Policy

We update the Policy when regulations or the scope of our activities change. The date of the latest update is stated at the beginning of the document. In foreign-language versions of the website, the Polish version is legally binding.DM GROUP sp. z o.o. sp.k. · ul. Dworcowa 1C, 64-731 Drawski Młyn · KRS 0000497884 · NIP 7632127721 · sekretariat@dmgroup.be · tel. +48 509 685 047