Back to homepage

    Privacy Policy

    Last updated: June 2026

    1. Data Controller

    The controller of your personal data is EcoCore (formerly Eco-Corn) Sp. z o.o., registered at ul. Mysia Góra 18A, 44-144 Nieborowice, Poland, entered in the National Court Register under KRS 0000389864, VAT PL969-159-38-80, REGON 241945484, share capital 510,000 PLN.

    All matters concerning personal data: info@ecocore.pl.

    2. Data Protection Officer

    The controller has not appointed a Data Protection Officer. For any data-protection matter please contact info@ecocore.pl.

    3. Sources of Data

    We process data you provide to us directly — through the contact form, the recruitment form, email or phone — as well as data collected automatically when you use the site (IP address, device and browser identifiers, traffic data). Some data may come from publicly available sources (such as company registers or LinkedIn) to the extent necessary for business contact.

    4. Purposes, Legal Bases and Retention

    We process your personal data for the following purposes:

    • Handling contact-form enquiries and email/phone correspondence — basis: Art. 6(1)(b) GDPR (steps prior to entering a contract) and Art. 6(1)(f) GDPR (legitimate interest in business communication). Retention: up to 12 months from end of correspondence.
    • Conducting a specific recruitment process — basis: Art. 6(1)(c) GDPR in conjunction with Art. 22¹ of the Polish Labour Code and Art. 6(1)(a) GDPR (consent for data provided voluntarily, e.g. photo in a CV). Retention: until the end of the recruitment, no longer than 12 months.
    • Participation in future recruitments — basis: Art. 6(1)(a) GDPR (your explicit consent). Retention: up to 24 months from consent or until withdrawal.
    • Conclusion and performance of commercial contracts, B2B cooperation and partnerships — basis: Art. 6(1)(b) GDPR. Retention: for the duration of the contract and until expiry of limitation periods.
    • Issuing and storing invoices and accounting / tax documentation — basis: Art. 6(1)(c) GDPR in conjunction with the Polish Accounting Act and Tax Ordinance. Retention: 5 years from the end of the accounting year.
    • Marketing communication (commercial information, newsletter, offers) — basis: Art. 6(1)(a) GDPR (consent), Art. 10 of the Act on Provision of Electronic Services and Art. 172 of the Telecommunications Law. Retention: until consent is withdrawn.
    • Establishing, exercising and defending legal claims — basis: Art. 6(1)(f) GDPR. Retention: until limitation periods expire.
    • Ensuring site security, fraud prevention and access logs — basis: Art. 6(1)(f) GDPR. Retention: up to 12 months.
    • Cookies and analytics — see the separate Cookies Policy. Basis: Art. 6(1)(a) GDPR (analytics and marketing cookies) or Art. 6(1)(f) GDPR (essential cookies).

    5. Scope of Processed Data

    Depending on the purpose, we process in particular:

    • identification and contact data (name, email, phone, job title, company name, VAT ID),
    • correspondence content and attachments,
    • recruitment data (CV, cover letter, employment history, qualifications, test / case-study results),
    • transactional and billing data (order numbers, invoice and payment data),
    • technical data (IP address, browser and device identifiers, logs, cookie data).

    6. Recipients and Processors

    Data may be disclosed to entities authorised by law and entrusted to trusted service providers acting on our behalf, in particular:

    • hosting, cloud infrastructure and database providers (incl. Supabase, Lovable / Vercel),
    • email and SMTP gateway providers (incl. Resend),
    • analytics providers (Google Ireland Ltd. — Google Analytics 4),
    • recruitment, communication and e-signature tools,
    • accounting, legal and audit firms,
    • postal and courier operators,
    • banks and payment operators for settlements.

    7. Transfers Outside the EEA

    Some of our providers (e.g. Google) may process data in third countries, in particular in the United States. Such transfers are based on a European Commission adequacy decision (EU–US Data Privacy Framework) or on Standard Contractual Clauses (SCC) approved by the European Commission, supplemented with additional technical and organisational safeguards.

    8. Your Rights

    You have the right to:

    • access your data and receive a copy,
    • rectify (correct) your data,
    • erase data (right to be forgotten),
    • restrict processing,
    • data portability,
    • object to processing based on legitimate interest,
    • withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal,
    • lodge a complaint with the supervisory authority — President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

    9. Voluntary Provision of Data

    Providing data is voluntary, but in certain cases necessary — to respond to your enquiry, take part in a recruitment, conclude and perform a contract, or issue an invoice. Without this data we cannot fulfil the relevant purpose.

    10. Profiling and Automated Decisions

    We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.

    11. Cookies

    The site uses cookies and similar technologies. Detailed information — scope of cookies used, legal bases, third-party providers and consent management — is provided in a separate document: the Cookies Policy available in the site footer.

    12. Data Security

    We apply appropriate technical and organisational measures to ensure the security of processed data, including transmission encryption (SSL/TLS), role-based access control, backups, event logging and periodic review of access rights at our providers.

    13. Changes to this Policy

    This Privacy Policy may be updated due to changes in law or our processes. The current version, with its publication date, is always available at ecocore.pl.