Last updated: 9 October 2026
We respect the privacy of people using the website https://bshaus.eu (the “Website”). This document explains what personal data we process, for what purposes and on what legal bases, to whom it may be disclosed, how long we keep it and what rights data subjects have. This policy takes into account the GDPR, the Polish Personal Data Protection Act of 10 May 2018 and the Polish Electronic Communications Law of 12 July 2024 (“ECL”).
This is an English translation. In case of any discrepancies, the Polish version prevails.
1. Data controller
The controller of personal data is Erwin Urbaniak, running a business under the name BSHaus Erwin Urbaniak, VAT ID (NIP): 8531384888 (the “Controller”, “BSHaus”, “we”).
Correspondence address: ul. Juliusza Słowackiego 4B, 74-200 Pyrzyce, Poland
Office: ul. Uczniowska 5, 70-893 Szczecin, Poland
Email: biuro@bshaus.eu
Phone: +48 506 378 494 or +48 501 305 750
The Controller has not appointed a data protection officer. In matters concerning personal data you can contact the Controller directly using the details above.
2. What data we process, for what purposes and on what legal basis
2.1. Contact form and requests for quotation
If you use the contact form or send a request for quotation, we may process the data you provide, in particular: name and surname, company name, email address, phone number, the content of the message and data contained in attachments. We may also record technical information related to sending the form, e.g. the date and time it was sent and the address of the page from which it was sent.
We process the data in order to:
- reply, prepare a quote or offer and take steps at your request prior to entering into a contract – on the basis of Article 6(1)(b) GDPR;
- conduct correspondence on matters not directly related to concluding a contract – on the basis of Article 6(1)(f) GDPR, i.e. our legitimate interest in communicating and handling inquiries;
- establish, pursue or defend possible claims – on the basis of Article 6(1)(f) GDPR.
Providing data is voluntary, but data marked as required is necessary to send the form and handle the inquiry. We do not require separate consent to the processing of personal data merely to reply to an inquiry or prepare an offer.
2.2. Contact by email and phone
If you contact us directly by email or phone, we process the data you provide, usually your name, contact details, company information and the content of the correspondence. We use the data to communicate, prepare an offer, fulfil your request or secure claims – on legal bases appropriate to the nature of the matter, in particular Article 6(1)(b) or (f) GDPR.
2.3. Contact persons, representatives and employees of business partners
In business relations we may process data of persons acting on behalf of or for our customers, suppliers, subcontractors and other business partners, in particular: name and surname, position or function, company name, business email address, phone number and data contained in correspondence. The data may come directly from that person, from the entity they represent, from our business partner or from publicly available sources, e.g. a company website or public registers.
We process this data on the basis of Article 6(1)(f) GDPR – in our legitimate interest in cooperating, communicating and performing contracts with the entities these persons represent, and in order to establish, pursue or defend claims.
2.4. Concluding and performing a contract
If you conclude a contract with us as a natural person, we process the data necessary to conclude and perform it on the basis of Article 6(1)(b) GDPR. Independently, we process data in order to comply with legal obligations, in particular tax and accounting obligations – Article 6(1)(c) GDPR – and to establish, pursue or defend claims – Article 6(1)(f) GDPR. For persons representing businesses or other entities, the legal basis for processing contact data related to the performance of a contract is, as a rule, Article 6(1)(f) GDPR.
2.5. Commercial information and direct marketing
If you give your prior, voluntary consent, we may send you commercial information or direct marketing by email, phone or other means of electronic communication. The legal basis for processing personal data is Article 6(1)(a) GDPR, and the use of these means of communication complies with Article 398 ECL. Marketing consent is voluntary, is not a condition for sending an inquiry or concluding a contract and may be withdrawn at any time.
2.6. Cookies, statistics and marketing activities on the Website
The Website uses cookies and similar technologies. Cookies necessary for the proper operation of the Website are used to the extent permitted by Article 399(3) ECL. Statistics, preference or marketing cookies and technologies that are not necessary are activated after the required consent has been obtained, in accordance with Article 399 ECL and – where they involve the processing of personal data – Article 6(1)(a) GDPR. Users can manage their consent using the consent management mechanism available on the Website. Details on cookie categories, providers and retention periods can be found in the Cookie policy and in the current consent management panel, if it provides such a list.
2.7. Social media
We run profiles on Facebook, Instagram and YouTube. If you visit our profiles or interact with them, we may process data made available to us by the given service in order to run the profile, communicate with users and promote our business – on the basis of Article 6(1)(f) GDPR. For certain profile statistics we may act as a joint controller with the operator of the given service. The operators of these services also process data in accordance with their own privacy policies.
2.8. Server logs and security
When you use the Website, technical data may be recorded automatically, such as the IP address, date and time of the request, the address of the requested resource and information about the browser and operating system. We use this data to ensure the security, stability and diagnostics of the Website – on the basis of Article 6(1)(f) GDPR. We do not use logs to identify users for other purposes.
3. Recipients of data
Data may be disclosed only to the extent necessary for the purposes described, in particular to:
- providers of hosting, servers, email and IT services;
- providers of analytics, advertising and tag management tools – to the extent resulting from the Website configuration and the consents given;
- operators of social media services, if you use our profiles or features related to these services;
- our accounting office, law firm, designers, contractors and subcontractors – where necessary to handle an inquiry, perform a contract or comply with legal obligations;
- payment operators, courier, transport or other service providers, where necessary to perform a specific contract;
- public authorities – where the obligation to disclose data arises from the law.
We entrust data to entities processing it on our behalf on the basis of appropriate agreements or other instruments required by the GDPR. We do not sell personal data.
4. Transfers of data outside the European Economic Area
Some technology providers may process data outside the European Economic Area, in particular in the United States. In such cases an appropriate legal basis for the transfer is applied, e.g. a European Commission decision establishing an adequate level of protection for entities participating in the EU-U.S. Data Privacy Framework or standard contractual clauses approved by the European Commission, together with supplementary safeguards where required. You can obtain information about the safeguards applied or a copy of them – to the extent it can be made available – by contacting us at biuro@bshaus.eu.
5. How long we keep data
- Data from the form, inquiries and correspondence – for as long as necessary to handle the matter, and then for the period needed to secure possible claims or until an effective objection is raised, where the legal basis is legitimate interest.
- Contract-related data – for the duration of the contract and then until the relevant limitation periods for claims expire.
- Accounting and tax records – as a rule for 5 years from the end of the calendar year in which the tax payment deadline expired, unless the law requires longer retention.
- Data processed on the basis of consent – until consent is withdrawn, unless there is another legal basis for further processing. Information on the granting or withdrawal of consent may be kept for as long as necessary to demonstrate compliance with the law.
- Technical logs – for as long as necessary to ensure security and diagnostics, in accordance with the configuration of hosting services and our security needs.
- Cookie-related data – for the periods specified in the Cookie policy or the consent management mechanism.
6. Your rights
In the cases provided for by the GDPR, you have the right to:
- access your data and receive a copy of it (Article 15 GDPR);
- rectify your data (Article 16 GDPR);
- erasure of your data (Article 17 GDPR);
- restriction of processing (Article 18 GDPR);
- data portability, if the conditions of Article 20 GDPR are met;
- object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR);
- withdraw consent at any time, where processing is based on consent; withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal;
- lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe your data is processed unlawfully.
Requests concerning your rights can be sent to biuro@bshaus.eu or to the Controller’s correspondence address. We will reply without undue delay, as a rule no later than one month after receiving the request.
7. Automated decision-making
We do not make decisions about users based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect them. Analytics and advertising tools may create statistics or audience groups if the user has given the required consent, but this is not used to make such decisions about them.
8. Data security
We apply appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or disclosure. The connection to the Website is encrypted using HTTPS, and access to data is limited to persons and entities who need it to perform their tasks.
9. Links and external content
The Website may contain links to external websites and services, including Google Maps, Facebook, Instagram and YouTube. Once you go to an external service, its operator’s privacy rules also apply. If external content or tools requiring consent are embedded on the Website, their activation should depend on the user’s consent settings.
10. Changes to this Privacy policy
This Privacy policy may be updated in particular in the event of changes to the law, Website functionality, providers or the way data is processed. The current version is published on the Website together with the date of the last update.