Privacy Policy
This policy explains how MATANGEL sp. z o.o. processes personal data of people who use this website, submit inquiries or requirements, or register as suppliers. It is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data controller
The controller of your personal data is MATANGEL sp. z o.o., ul. Garbary 6/7, 80-827 Gdańsk, Poland, entered in the National Court Register (KRS) under number 0000652715, NIP 5833223695, REGON 366079162 (“MATANGEL”, “we”).
Contact in data-protection matters: kg.regenevia@gmail.com, phone +48 453 108 326, or by post to the address above.
2. What data we process
- Contact and company data you provide: name, company, business email, phone, country, website and role.
- Content of your inquiry, requirement or supplier registration, including attached documents.
- Consent records: what you acknowledged or consented to, when, and in which language version.
- Security data: a pseudonymised hash of your IP address (salted and rotated daily), used for rate limiting and abuse prevention. We do not store raw IP addresses.
- Usage statistics: pages visited, clicks on calls to action, form steps, the referring website (host only), campaign (UTM) parameters, time zone, browser language and device class (mobile/tablet/desktop).
- Only if you allow it in the consent banner: a random visitor identifier and a session identifier stored in your browser.
3. Purposes and legal bases
| Handling your inquiry or requirement (RFQ), communicating with you and taking steps prior to entering into a contract | Art. 6(1)(b) GDPR; for persons acting on behalf of a company — Art. 6(1)(f) GDPR (our legitimate interest in handling business communication) |
|---|---|
| Sourcing: searching supply channels and obtaining quotations from potential suppliers (without disclosing your identity unless you agree) | Art. 6(1)(f) GDPR — legitimate interest in performing the intermediary service you requested |
| AI-assisted processing of inquiry content (structuring, summarising, identifying missing information, preparing internal drafts reviewed by staff) | Art. 6(1)(f) GDPR — legitimate interest in efficient and accurate handling of requests |
| Supplier registration, qualification and verification | Art. 6(1)(b) and (f) GDPR |
| Security of the website and forms, prevention of spam and abuse | Art. 6(1)(f) GDPR |
| Cookieless, aggregated usage statistics | Art. 6(1)(f) GDPR — legitimate interest in understanding and improving the website |
| Storing a random identifier in your browser to recognise returning visits (optional) | Art. 6(1)(a) GDPR — your consent, in line with the rules on storing information on terminal equipment (Art. 5(3) of Directive 2002/58/EC as implemented in Polish law) |
| Commercial information by email (optional) | Art. 6(1)(a) GDPR — your consent, which also serves as consent to electronic commercial communication under applicable law |
| Compliance with legal obligations (e.g. accounting and tax) if a transaction follows | Art. 6(1)(c) GDPR |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) GDPR |
No decisions producing legal effects or similarly significantly affecting you are made solely by automated means (Art. 22 GDPR). AI tools support our staff; decisions are made by people.
4. Recipients and processors
We use the following service providers, who process data on our behalf under data processing agreements:
- Supabase — database, private file storage and server functions; project hosted in the EU (Frankfurt, Germany).
- Resend — delivery of transactional emails (e.g. acknowledgements with your reference number).
- OpenAI and Anthropic — AI-assisted processing of inquiry content via their business APIs. According to their API terms, data submitted via the API is not used to train their models by default.
- Google (Gemini API) — backup AI provider, used only when the primary AI providers are unavailable, limited to the inquiry content needed for the analysis or draft (contact details are minimised).
- Cloudflare — website hosting and content delivery; processes technical connection data needed to deliver the website.
Potential suppliers or buyers receive only the information necessary to prepare a quotation or continue a negotiation. Your identity is not disclosed to the other party without your agreement.
Data may also be disclosed to public authorities where we are legally obliged to do so, and to our IT, legal and accounting advisers bound by confidentiality.
5. Transfers outside the EEA
Some providers (in particular Resend, OpenAI, Anthropic, Google and Cloudflare) are based in, or may process data in, the United States. Such transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) where the recipient is certified, or on standard contractual clauses approved by the European Commission. You may request information about these safeguards using the contact details above.
6. Retention
- Inquiries, requirements and supplier data: for as long as necessary to handle the matter and maintain the business relationship, and afterwards for the period in which claims may arise under applicable law.
- Accounting documents (if a transaction follows): for the period required by tax and accounting law.
- Usage statistics: up to 13 months, after which they are deleted.
- Security records (pseudonymised IP hashes used for rate limiting): up to 2 days.
- Consent records: for as long as needed to demonstrate that consent was given or acknowledged.
- Data stored in your browser: until you withdraw consent, change your privacy settings or clear your browser storage.
7. Your rights
You have the right to access your data, to rectification, erasure and restriction of processing, to data portability, and to object to processing based on legitimate interest (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
To exercise your rights, contact us at kg.regenevia@gmail.com. You also have the right to lodge a complaint with the supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.
Providing data is voluntary, but the fields marked as required are necessary to handle your request.
8. Statistics, cookies and browser storage
This website does not set cookies. By default, we collect usage statistics without cookies and without identifiers stored on your device: the server derives a pseudonymised identifier from technical data that changes every day, so visits cannot be linked over time.
If you click “Allow” in the statistics banner, we store a random identifier in your browser’s local storage to recognise returning visits. You can change your choice at any time using “Privacy settings” in the footer.
The website uses the following browser storage entries:
| matangel_consent (local storage) | Your statistics choice (granted/denied) |
|---|---|
| matangel_lang (local storage) | Your language preference |
| matangel_attr (session storage) | Campaign parameters, referring site and landing page of the current visit — attached to statistics and form submissions |
| matangel_vid, matangel_seen (local storage) — only with consent | Random visitor identifier and returning-visit marker |
| matangel_sid, matangel_ret (session storage) — only with consent | Session identifier and returning-visit flag for the current visit |
9. Security
Data is transmitted over encrypted connections (TLS). Documents are kept in private storage that is not publicly accessible and can be downloaded only by authorised staff through short-lived links. Access to the administration panel is limited to authorised persons and logged.
10. Changes to this policy
We may update this policy when our services or legal requirements change. The current version is always available on this page.