Privacy policy
This policy explains what personal data we collect on the Fallwood website and in the ppwr.fallwood.com.pl portal, for what purposes, and what rights data subjects have. Effective from 21 September 2026.
1. Data controller
The controller of personal data is FALLWOOD Stanisław Fal i Wspólnicy Spółka Jawna, registered office Zahutyń 55, 38-500 Sanok, Poland, VAT PL6871968044, REGON 382593142, KRS 0000771883 (“Fallwood”, “we”).
Contact regarding personal data: [email protected], tel. +48 13 46 44 164, or by post to the registered office.
2. What data we process
Contact form and correspondence: name, company name, e-mail address, phone number, content of the enquiry and technical parameters provided (e.g. drum diameter).
Orders and business cooperation: contact details of persons representing the customer, data needed to perform the contract, issue invoices and deliver goods.
ppwr.fallwood.com.pl portal: login, e-mail address, company name, document download history and technical data required by PPWR and EUDR.
Technical data: IP address, browser type and basic server logs, collected automatically to keep the site secure and working.
3. Purposes and legal bases
Answering enquiries and correspondence – Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) (our legitimate interest in communicating with customers).
Concluding and performing the contract, including delivery and complaints – Art. 6(1)(b) GDPR.
Invoicing, accounting and archiving – Art. 6(1)(c) GDPR (legal obligations).
Providing PPWR and EUDR documentation in the portal – Art. 6(1)(b) and (c) GDPR (contract and obligations under Regulations (EU) 2025/40 and 2023/1115).
Establishing and defending claims and system security – Art. 6(1)(f) GDPR.
We do not make decisions based solely on automated processing and we do not profile users.
4. Recipients of data
Data may be transferred to processors acting on our behalf: hosting and e-mail providers, the documentation portal provider, our accounting office, transport and courier companies to the extent necessary for delivery, and IT system providers. All act under data processing agreements.
Data may be disclosed to public authorities where required by law, including supervisory authorities for PPWR and EUDR.
We do not transfer data outside the European Economic Area. Should this become necessary, we will apply the safeguards provided for in Chapter V GDPR.
5. Retention periods
Correspondence and enquiries: up to 3 years from the last contact.
Contract and accounting data: for the period required by tax and accounting law (as a rule 5 years from the end of the financial year).
PPWR and EUDR documentation: for the period required by the regulations (at least 5 years from placing the product on the market).
Portal accounts: for the duration of cooperation and up to 12 months after it ends.
Server logs: up to 12 months.
6. Rights of data subjects
You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest.
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
To exercise your rights, write to [email protected]. We reply within 30 days.
You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in your country of residence.
7. Voluntary provision of data
Providing data is voluntary but necessary to answer an enquiry, conclude a contract or use the portal. Without it we cannot provide the given service.
8. Cookies, analytics and marketing
Necessary: we store the selected site language and your cookie choice in the browser (localStorage). These are technical settings without which the site does not work properly; they do not identify the user. The ppwr.fallwood.com.pl portal uses strictly necessary session cookies to keep you logged in.
Analytics (with consent): Google Analytics 4 (Google Ireland Ltd.) – visit statistics, traffic sources, page popularity. IP addresses are truncated and the data is used only to improve the site. Cookies _ga and _ga_* are stored for up to 2 years.
Marketing (with consent): advertising pixels (e.g. Google Ads, Meta, LinkedIn) that measure campaign performance and show relevant ads. These providers are independent controllers for their own services; see their privacy policies for details.
Consent is given in the banner on the first visit and can be changed at any time via the “Cookie settings” link in the footer. Until consent is given, analytics and marketing scripts are not loaded (Google Consent Mode v2). Fonts are loaded from Google Fonts; that provider may log IP addresses in technical logs. The 3D library is served from our own server.
9. Security
We use encrypted connections (HTTPS), access control, individual portal logins, backups and processing agreements with providers. Only authorised staff have access to data.
10. Changes to this policy
This policy may be updated when the law or the way the site works changes. The current version is always available at this address, with the effective date shown at the top.