The controller of personal data is CHEMAXA Adrian Matusiak, ul. Promienna 14, 71-218 Bezrzecze, Poland, VAT ID (NIP) 8512981442 (“CHEMAXA”, “we”).
Data protection contact:
We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Polish data protection and e-services law, following the data minimisation principle.
This policy describes the processing of personal data of: users of the www.chemaxa.com website (the “Website”); users of the “Chemaxa” mobile application for iOS and Android (the “App”); customers, contractors and their representatives; persons contacting us by e-mail, phone, SMS or WhatsApp; and job applicants.
When you contact us (including sending a quotation request or an order — also from the App), we process the data provided in the correspondence: name, company name, VAT ID, delivery address, phone number, e-mail address and message content.
| Purpose | Legal basis (GDPR) |
|---|---|
| handling the enquiry, preparing a quotation, accepting and performing an order (pre-contractual steps and contract performance) | Art. 6(1)(b) |
| contractor verification (including in public registers), invoicing, tax and accounting obligations | Art. 6(1)(c) |
| ongoing business communication; establishing, pursuing or defending claims; system security (legitimate interest) | Art. 6(1)(f) |
| direct marketing of our own products and services — where you give separate consent | Art. 6(1)(a) / (f) |
| assessing the effectiveness of Google ads (which keywords and devices bring enquiries and customers) — legitimate interest | Art. 6(1)(f) |
When you send a quotation request from a page you reached through a Google ad, we store information about that ad together with the request: the keyword that triggered it, the keyword match type, the device type (phone, tablet or computer) and the ad group and ad numbers. We use it only to assess which ads bring enquiries and customers and to set ad bids. We do not store the click identifier and we do not pass this information to Google. We keep it with the enquiry and in the e-mail notifying us of it, for the periods given in section 8 for enquiries and correspondence.
Providing the data is voluntary but necessary to receive a quotation or have an order fulfilled.
Consent to contact by SMS and e-mail — Electronic Communications Law. Beyond the GDPR, sending messages to your phone number and e-mail address is governed by the Polish Electronic Communications Law of 12 July 2024 (in force since 10 November 2024; it replaced the Telecommunications Law). Under its Article 398, sending commercial information and direct marketing requires your prior consent. We therefore separate two kinds of messages:
You may withdraw consent at any time — an e-mail to info@chemaxa.com or a reply to the message received is enough. Withdrawal does not affect the lawfulness of messages sent beforehand and does not stop messages concerning orders to which you are a party.
AI-assisted draft replies. We may prepare a reply to a quotation request or an order with the help of the Claude artificial intelligence model (provider: Anthropic). This happens only when an authorised person at CHEMAXA clicks the button for a specific enquiry — never automatically. The provider then receives the text of the remarks entered in the enquiry — with phone numbers, e-mail addresses, VAT IDs and bank account numbers removed before sending — together with the quantity and town of delivery (without the street or postcode) and the type of enquiry (quotation or order). We do not pass on the company name or the name of any person given in the enquiry or recorded on the company’s account in our panel; however, if you enter other information about yourself or about other people in the remarks, it reaches the provider together with the rest of the text. The model only prepares a draft: an authorised person at CHEMAXA reads it, edits it and sends it, and the model sends nothing itself. We do not keep the draft — the panel keeps only the reply that person sends (as correspondence) and a technical record without content (date and service usage), needed to account for its cost. The legal basis is Art. 6(1)(b) GDPR (replying to your enquiry before a contract is concluded) and Art. 6(1)(f) GDPR (legitimate interest: a prompt and accurate reply to the enquiry). Sections 6, 7 and 8 describe the recipient, the transfer outside the EEA and the retention period.
Correspondence pasted into the panel. An authorised person at CHEMAXA may paste an e-mail from a customer or contractor into our administration panel to save it as a note on the company’s record or — where it concerns a delivery date — as a short note on the order. At that person’s request, never automatically, the text of the message may be sent to the Claude artificial intelligence model (provider: Anthropic) to prepare a short summary and to read the dates in it (e.g. a proposed delivery date). Before sending, we remove quoted earlier correspondence, phone numbers, bank account numbers and VAT IDs from the text; together with the text we send the date of the message, so that expressions such as “next Thursday” can be turned into a date. The rest of the text — including the sender’s signature with their name, if it contains one — reaches the provider as written. A person checks the summary and the dates read; the panel stores only the note that person approves, and we do not keep the model’s result (only a technical record without content remains, as with draft replies). The legal basis is Art. 6(1)(b) GDPR (performing the order, including agreeing the delivery date) and Art. 6(1)(f) GDPR (legitimate interest: an accurate record of what was agreed in correspondence). Sections 6, 7 and 8 describe the recipient, the transfer outside the EEA and the retention period.
With your consent we may submit to the National Debt Register (Krajowy Rejestr Długów Biuro Informacji Gospodarczej S.A., ul. Danuty Siedzikówny 12, 51-214 Wrocław, Poland, KRS 0000169851) positive information — that is, confirmation that you paid us on time.
Legal basis: Article 6(1)(a) GDPR (consent) in conjunction with Article 18 of the Polish Act of 9 April 2010 on the disclosure of business information and the exchange of business data. Without your consent we submit nothing about you to the register — unless you yourself request such an entry, which the Act treats as equivalent to consent.
What we submit: company name, address, tax identification number (NIP) and, for each obligation, the amount, currency, due date and payment date. We do not submit your phone number or e-mail address.
Why: a positive entry builds a documented payment history for your company, visible to counterparties, banks and leasing providers who check the register.
How to give and how to withdraw consent — any of these, as you prefer:
Withdrawing consent is as easy as giving it (Article 7(3) GDPR) and takes effect for the future: from the moment of withdrawal we submit nothing new to the register. ⚠️ Withdrawal does not delete entries already submitted — these remain in the register under the Act and the register's own rules. You may ask us separately to have an existing entry removed; we will then apply to the register on your behalf.
Consent log. So that we can demonstrate consent, as Article 7(1) GDPR requires, we keep a record of it. For every grant and every withdrawal of consent — both to the National Debt Register entry and to SMS messages — we note:
An IP address is personal data and is covered by this policy. We store it solely so that the consent record has evidential value, and we use it for nothing else — we do not build a profile from it, we do not derive location from it, and we do not combine it with the Website technical data described in section 3.4.
An unticked box when creating an account. If you leave a consent box unticked when creating an account in the App, we record in the log the date and the identifier of the clause wording we showed you — so that your profile in the App does not claim we never asked for that consent. Such a record is neither consent nor refusal, contains no IP address and is deleted together with the account. Legal basis: Article 6(1)(f) GDPR (legitimate interest: an accurate record of what we asked you).
⚠️ We keep the consent log for longer than the account itself. If you delete your account and we had previously, with your consent, submitted a positive entry to the National Debt Register, that entry remains in the register — and the proof that consent existed must remain with it. Deleting the log would leave an entry in the register with nothing behind it. Legal basis: Article 17(3)(b) GDPR (legal obligation) and Article 17(3)(e) GDPR (establishment, exercise or defence of legal claims). Only the record of consent to the register entry (together with any withdrawal of it) is kept. The record of consent to SMS messages, and a record of consent to the register entry after which NO entry was submitted, are deleted together with the account.
Contact noted during a conversation (prospective customers). If we discuss AdBlue® deliveries over the phone — because you call us or respond to our contact — we record a note of that conversation in our admin panel: company name, VAT ID, phone number, e-mail address, the postcode of the delivery location, your current supplier and the price you pay today, the volume you are interested in and the price level discussed, together with a short note on what you need. This data comes from you alone — we do not buy contact lists and do not obtain it from external databases. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest: keeping a record of what was agreed and preparing an offer).
Periodic price-offer updates. The price of AdBlue® changes over time and an offer is valid for a defined period. To people and companies we have spoken to about deliveries — both established contractors and people whose contact details we noted during a conversation — we send a price-offer update to the e-mail address provided: the price level for each volume band and the period for which that offer applies. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: direct marketing of our own products, carried out towards businesses with whom we are in commercial contact) and, to the extent that the rules on providing services by electronic means require consent for sending commercial information, consent given by providing us with an e-mail address for the purpose of receiving an offer (Art. 6(1)(a) GDPR).
You may object at any time — simply reply to any of our messages or write to info@chemaxa.com. An objection takes effect immediately and needs no justification; once raised we stop sending offer updates and, if you wish, delete the conversation note in full. Sending offer updates is not an automated decision and not profiling (section 10): the content and price level are set by a human on the basis of the earlier conversation, and the send is triggered manually.
In connection with concluding and performing contracts we process data of contractor representatives and contact persons: name, position, business e-mail and phone number, together with company details. The legal basis is our legitimate interest in maintaining business contacts (Art. 6(1)(f) GDPR) and, for contracting parties’ data, Art. 6(1)(b) and (c) GDPR.
After a completed delivery we may send you an e-mail asking for a review of our cooperation on our Rzetelna Firma business card. Leaving a review is entirely voluntary and happens on that service’s own website under its own privacy policy — we receive no additional data as a result. On your account we store only the date such a request was sent, so that we do not ask repeatedly. Legal basis: Art. 6(1)(f) GDPR (legitimate interest: building the company’s credibility). You may object at any time — simply reply to the message.
On the contractor’s record in our admin panel we store the details of contact persons on their side: name, role (e.g. owner, driver, accounts, logistics), business phone number, business e-mail address and a short note that makes contact easier (e.g. the hours at which it is best to call). This data is given to us by the contractor — we do not obtain it from any other source. It is used solely to arrange and complete deliveries and for day-to-day business contact. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: maintaining contact with the contractor).
We also record the history of business contact: the date and type of the conversation (phone, e-mail, SMS, WhatsApp, meeting), a short note on what was discussed, any reminder date for the next contact, and the CHEMAXA person who wrote the note. These records are strictly internal — only authorised CHEMAXA staff can see them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: serving the contractor and keeping track of what was agreed).
Payment-reliability assessment. Before we offer a contractor deferred payment (trade credit), we check their payment reliability. For that purpose we obtain a business report from Krajowy Rejestr Długów Biuro Informacji Gospodarczej S.A. (the Polish National Debt Register, “KRD BIG S.A.”) and store it — the report file together with a copy of the reading: the score, the report date and number, and the suggested trade-credit limit. These two things have different retention periods and section 8 lists them separately: the archived report (the file and the copy of the reading attached to it) is deleted after 24 months, whereas the current reliability assessment held on the contractor’s record stays for as long as the cooperation lasts — it is what we base the deferred-payment decision on with every further order, and the date of the reading shown next to it makes clear when the assessment has aged and is worth refreshing. We also keep our own internal assessment of how punctually the contractor pays, and we record the agreed commercial terms (payment term, credit limit, current supplier and their price, status and how the contact was acquired). The legal basis is Art. 6(1)(f) GDPR (legitimate interest: assessing commercial risk before granting deferred payment and protecting against financial loss).
Where the contractor is a sole trader, this data concerns a natural person and is fully covered by this policy — you then have the right to access, rectify and erase it, and to object to the processing (section 9). The assessment is not an automated decision: the terms of cooperation are decided by a human being (section 10). The data described in the three paragraphs above is processed solely in the CHEMAXA admin panel — it is not visible in the App and is not included in the copy of your data that you can download yourself from your account in the App. This does not limit your right of access: on a request sent to info@chemaxa.com we will provide this data as well.
Additional e-mail addresses. At the contractor’s request we also store on their record in our admin panel additional business e-mail addresses of people who handle orders on their side. We send them the messages we send to the contact e-mail — including order and delivery-date confirmations, payment reminders and demands, information about our offer and prices, the invitation to the App and the request for a review. We do not send them invoices or messages about consent to an entry in the National Debt Register. Additional addresses are not used for signing in. They are provided by the contractor; we delete an address at the contractor’s request or at the request of the person it belongs to — including when that person does not wish to receive information about our offer (info@chemaxa.com). A record of messages sent before deletion remains in our log of sent messages. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: contact with the people who handle orders on the contractor’s side). These addresses are included in the copy of your data that you can download from your account in the App.
Carriers. When we order transport, we record the carrier’s details — name, address and country, also where the carrier is a sole trader — and include them in the transport order. The legal basis is Art. 6(1)(b) GDPR (concluding and performing the contract of carriage) and, for keeping the list of carriers, Art. 6(1)(f) GDPR (legitimate interest: organising deliveries). We keep the data for the duration of the cooperation, and in transport documents for the periods set out in section 8.
AI-assisted reading of invoices. In our administration panel we may read purchase and sales invoices, as well as carriers’ invoices for transport, with the help of the Claude artificial intelligence model (provider: Anthropic). We may read cost invoices and receipts (e.g. for fuel, telephone or services) in the same way, including those issued by sole traders. This happens only when an authorised person at CHEMAXA clicks the reading button for a specific invoice — never automatically. The provider then receives the invoice file with the data shown on it: names, VAT IDs and addresses of the seller and the buyer (and of the delivery recipient and place of delivery where shown), document numbers, quantities, prices and amounts, the name of the person who issued the invoice where shown, and — on a carrier’s invoice — also the vehicle registration number where the carrier has included it. On a cost invoice or a receipt this may also include the name of a seller who is a sole trader, their bank account number and the cashier’s identifier, where printed. That person checks the values read and records them on the order only after approving them — the model decides nothing; values from a cost invoice or a receipt are recorded in the same way with the company’s costs. We keep the result of the reading in the panel so that the same file is not sent again. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: transcribing invoice data efficiently and without errors) and, for recording the cost in the accounts, Art. 6(1)(c) GDPR (tax and accounting obligations). Sections 6, 7 and 8 describe the recipient, the transfer outside the EEA and the retention period.
From job applicants we process the data required by labour law (name, date of birth, contact details, education, qualifications, employment history) under Art. 6(1)(b) and (c) GDPR. Additional data included in a CV (e.g. photo, interests) is processed on the basis of consent (Art. 6(1)(a) GDPR), and special-category data (e.g. disability status) solely on the basis of explicit consent (Art. 9(2)(a) GDPR). Consent may be withdrawn at any time.
When you use the Website, technical data is processed automatically: IP address, date and time of the request, browser and system type, pages visited. This data serves the proper functioning and security of the Website (Art. 6(1)(f) GDPR) and — with consent — the measurement purposes described in section 5.
The App is used to order bulk AdBlue® deliveries and to send quotation requests. It is a business-to-business tool and is not directed at persons under 16. The App works in two modes: (1) without signing in — an enquiry/order form for new customers; and (2) signed in — a returning-customer account with an individual price list, unloading points and order history.
For part of its functionality the App uses the CHEMAXA server (api.chemaxa.com), on which we process the data described below as the controller. We do not share this data with third parties for marketing purposes.
The iOS and Android versions provide the same functionality and use the same server. The differences follow from the platform: Sign in with Apple, address autocomplete (Apple Maps, section 4.6) and crash reports (MetricKit, section 4.9) exist only in the iOS version. In the Android version you sign in with an e-mail address and password, and push notifications are delivered by Firebase Cloud Messaging (Google) — see section 4.4.
Data entered in the form (VAT ID, company name, delivery address, phone, e-mail, order parameters) is also stored locally on your device so you do not have to re-enter it. You can delete it by overwriting the fields or uninstalling the App. Local data is protected by operating-system security mechanisms — the Keychain on iOS and encrypted preference storage (EncryptedSharedPreferences) on Android; in the Android version backup of App data is disabled.
When you fill in the form and tap “Send quotation request” or “Send order”, the form data (company name, VAT ID, delivery address/location, phone, e-mail, approximate quantity, delivery dates and unloading hours) is saved on our server as an enquiry so that we can prepare a quotation and contact you. This happens when you tap the button, even if you ultimately do not complete sending the message via WhatsApp, e-mail or SMS (we do not want to lose contact with interested prospects). We also record limited technical data (IP address, device/app information) to ensure security and prevent abuse. Separately, if you choose a channel (WhatsApp, e-mail or SMS), the message content is handed to the app you choose and sending requires your confirmation.
| Purpose | Legal basis (GDPR) |
|---|---|
| handling the enquiry, preparing a quotation and contacting you back; pre-contractual steps | Art. 6(1)(b) and (f) (legitimate interest: responding to the enquiry and keeping in touch with a prospect) |
| system security and abuse prevention (technical data) | Art. 6(1)(f) |
Providing the data is voluntary, but without contact details we cannot send a quotation. Enquiries are deleted automatically after the retention period (section 8) and at your request.
An authorised person at CHEMAXA may use the quantity and town of delivery (without the street or postcode) from such an enquiry to prepare an AI-assisted draft reply — without the company name, VAT ID, phone number or e-mail address; section 3.1 (“AI-assisted draft replies”) sets out the rules.
You can sign in in two ways, and both can be linked to the same account:
…@privaterelay.appleid.com), and, at first sign-in, your name if you share it. Sign in with Apple does not disclose your password to us.You can have both methods linked to the same account at the same time (e.g. add a password to an account created via Apple in the "My Profile" screen) and choose which one to use the next time you sign in.
Within the account we process on our server: company data (name, VAT ID, phone, address, contact e-mail, invoice e-mail, additional e-mail addresses of people handling orders — section 3.2 “Contractors and their representatives”), your individual price list, saved unloading points (address, contact person, phone, hours, notes) and order details and history.
| Purpose | Legal basis (GDPR) |
|---|---|
| operating the account, presenting your individual price list, accepting and performing orders | Art. 6(1)(b) |
| invoicing, tax and accounting obligations | Art. 6(1)(c) |
| support and contact, establishing/pursuing/defending claims, security | Art. 6(1)(f) |
| limiting bulk account creation (IP address and e-mail domain recorded at registration) | Art. 6(1)(f) (legitimate interest: system security and protecting contractors against accounts being created against their data) |
Creating an account — limiting abuse. At the moment of registration we record on our server the IP address the request came from and the domain of the e-mail address provided (the part after the @ sign, e.g. company.com — without the part before it). This serves solely to count how many accounts are created from a single IP address and a single domain within a short period, and to stop bulk creation of accounts against other companies' VAT IDs. We do not build a profile from this and we do not link these records to your account once registration is complete. The records are deleted automatically after 2 days (section 8).
Account deletion: you can delete your account at any time directly in the App — we then permanently erase the account data (company profile, price list, unloading points, order history), except for data we must retain for tax and accounting purposes (section 8). The consent log (section 3.2) is deleted together with the account as well — except for the record of consent to the National Debt Register entry where, on the basis of that consent, we submitted a positive entry to the register.
If you consent to notifications, we store your device’s notification token to send you notifications about orders and pricing. Delivery relies on the service of the operating system you use:
The push service receives the device token and the notification text (order status or a pricing notice). We do not send company data, order contents or prices through this channel. We also record whether and when a given notification was opened and on which platform (iOS or Android) — once for each message sent. This serves solely to confirm that the information about your order status or about pricing reached you; apart from that single event we do not record how you use the App. You can withdraw consent at any time in your system settings (iOS or Android). Legal basis: Art. 6(1)(b) and (f) GDPR (informing you about order status and our offer).
The message list in the App. The messages we send you are also available in the App itself — under the bell icon next to “My profile”. There you will find pricing and order information as well as current announcements (for example about a production stoppage). The list works independently of your consent to notifications: if you never enabled notifications, or turned them off, the message will still be waiting for you there. We record a read marker alongside it — whether and when you read that message in the App. It serves solely to stop marking the message as new; it is separate from the confirmation that a push notification was opened described above and it is likewise not a statistic of how you use the App. The retention periods for both markers are given in the table in section 8.
Deleting messages from the list. You can delete a message from the list — one at a time or all at once. It then disappears from the App, and we record the date of its deletion. The message itself is not erased: its content, the date it was sent and the date of deletion remain in the CHEMAXA panel so that we can handle your enquiries and demonstrate what information we sent you and when (accountability). Legal basis: Art. 6(1)(f) GDPR. We keep the date of deletion for as long as the message itself — until your account is deleted (table in section 8).
When you enter a VAT ID, the App sends that number to our server, which queries public registers to suggest the company name and address: the Polish Ministry of Finance VAT register and CEIDG (dane.biznes.gov.pl). Only the VAT ID is sent to those registers.
Applies to the iOS version only. While you type the delivery address, text fragments are sent to Apple’s mapping service to display suggestions (Apple privacy policy). The App does not use device location.
If you choose to send via WhatsApp (Meta Platforms), your mail client or Messages (SMS), processing within those services is governed by their own privacy policies.
iOS only. If the App crashes or stops responding, iOS prepares a technical diagnostic report (MetricKit, a mechanism built into Apple’s operating system). The App sends that report to our server (CHEMAXA) so that we can fix the fault. The Android version does not send such reports.
The report contains technical data only: the type of event (crash or hang), a record of the program state at the moment of failure (a call stack), the App version, the iOS version and the device model. It contains no company data, no order contents and no identifier of your account, and it is not linked to them. Together with the report we store the IP address of the connection, solely to limit abuse of this mechanism; an IP address is personal data and is covered by this policy (retention: 90 days, same as the report). We use no third-party tools for this purpose — the data does not leave the CHEMAXA server. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: keeping the App working correctly).
If you order regularly, you can save a schedule in the App: quantity, unloading point, the interval between deliveries and the date of the next one. We process this data to remind you by notification before the date and to pre-fill the order form.
A schedule never places an order automatically — every delivery requires your confirmation in the App. You can pause or delete a schedule at any time; deleting it does not affect orders already placed. The legal basis is Art. 6(1)(b) GDPR (performance of a contract at your request).
As a signed-in customer you can obtain an individual referral code and pass it to another company. If that company enters the code when creating an account, we record the link between your accounts (who referred whom, the code and the date) in order to settle the discount on both sides.
This means that both companies will know that the link exists — it is visible to us and is the basis for granting the discount. We do not disclose the referred company's contact details to the referrer or vice versa, and we do not share this information with anyone outside CHEMAXA. Passing the code to another company is your decision and happens outside the App (e.g. by e-mail or phone). The legal basis is Art. 6(1)(f) GDPR (legitimate interest: settling the referral programme and preventing abuse).
After a completed delivery you can rate it in the App on a scale of 1–5 and add an optional comment. The rating is internal: it is visible only to CHEMAXA and serves our quality control (after a low rating we may contact you to resolve the issue). Ratings are not published and are not shared with anyone outside CHEMAXA — this is not an App Store review or a public opinion.
Rating is voluntary and tied to a specific order; you can change it at any time by submitting a new one. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: quality control and maintaining customer relationships). Ratings are deleted together with the account.
The Website uses:
_gcl_au) and similar identifiers used to attribute a visit or call to an ad click. Provider: Google Ireland Ltd. (Google privacy policy). We use these technologies on the basis of consent (Art. 6(1)(a) GDPR and the Polish e-communications law implementing the ePrivacy rules).You may withdraw or change your consent to non-essential cookies at any time — via the consent settings on the Website or your browser settings (blocking/deleting cookies). Withdrawal does not affect the lawfulness of prior processing. You may also use Google My Ad Center.
The Website does not display third-party advertising and does not carry out profiling producing legal effects.
We may disclose personal data to: authorised CHEMAXA staff; processors acting on our behalf (the hosting/server provider that runs the App back-end and stores account and enquiry data, accounting offices, IT and e-mail providers, transport and courier companies); Krajowy Rejestr Długów Biuro Informacji Gospodarczej S.A. (when we check a contractor’s payment reliability we pass the company’s identifying data — VAT ID and name — to that register and receive a business report in return, see section 3.2 “Contractors and their representatives”; that register is also the source of the payment-reliability data we did not receive from you); Apple (for Sign in with Apple account authentication and Apple Push Notification service delivery in the iOS version); Google Ireland Limited (Firebase Cloud Messaging — push notification delivery in the Android version); the SMS gateway operator — PROMOHUB sp. z o.o., ul. Bagatela 10/39, 00-585 Warsaw, Poland, KRS 0001077455, VAT ID (NIP) 7011181115, REGON 527265555, operator of the SMS-fly service (sms-fly.pl), to which we entrust your phone number when we send you an SMS invitation to the App, an order notice or a notice that your account has been activated; Anthropic Ireland, Limited (the provider of the Claude artificial intelligence model, acting as our processor under a data processing agreement — we send it an invoice file only when an authorised person at CHEMAXA requests that invoice to be read, see section 3.2 “Contractors and their representatives” — including a cost invoice or a receipt — and the text of the remarks in an enquiry or of pasted correspondence (after removing the data listed in section 3.1) only when that person requests a draft reply or a summary, see section 3.1; under the provider’s terms this data is not used to train models); providers of communication services chosen by the user (Meta Platforms — WhatsApp; telecom operators — SMS/phone); Google (for the measurement tools described in section 5, subject to consent); and public authorities and courts where required by law.
As a rule we process data within the EEA. However, the use of certain services may involve transfers to third countries (in particular the USA): Google (Website measurement tools and Firebase Cloud Messaging push notifications in the Android version), Meta Platforms (WhatsApp communication), Apple (Sign in with Apple, APNs push notifications and address autocomplete in the App) and Anthropic (AI-assisted reading of invoices, section 3.2 “Contractors and their representatives”, and AI-assisted draft replies to enquiries and summaries of correspondence pasted into the panel, section 3.1 — the provider stores data in the USA and may also process it in other countries, including outside Europe — in Asia and Australia; the transfer relies on standard contractual clauses incorporated into the data processing agreement). These providers participate in the EU–US Data Privacy Framework or rely on Standard Contractual Clauses approved by the European Commission, ensuring the level of protection required by the GDPR.
| Data category | Retention period |
|---|---|
| enquiries and correspondence not resulting in a contract | up to 3 years after the correspondence ends (defence against claims) |
| enquiries saved from the App form (leads) | deleted automatically after the retention period (2 years by default) or earlier on request |
| note of a conversation with a prospective customer (company contact details, current supplier and price, the price level discussed, note on needs) — section 3.1 | up to 2 years from the last contact and, where an objection or a deletion request is raised, without undue delay |
| e-mail address used to send periodic price-offer updates — section 3.1 | until an objection to such sending is raised, or until the note/account is deleted |
| returning-customer account in the App (company profile, price list, unloading points, order history) | until the customer deletes the account or the relationship ends; order- and invoice-related data as in the row below |
| data related to contracts, orders and invoices | the term of the contract and thereafter the period required by accounting and tax law — as a rule 5 years from the end of the year in which the tax obligation arose |
| result of AI-assisted reading of an invoice — section 3.2 “Contractors and their representatives” | in the CHEMAXA panel — together with the data of the order the invoice relates to (as in the row above); at the provider (Anthropic) the invoice file and the model’s response are deleted automatically within 30 days, longer only in the cases set out in the provider’s terms (breach of its usage rules, legal obligation) |
| result of AI-assisted reading of a cost invoice or a receipt — section 3.2 “Contractors and their representatives” | in the CHEMAXA panel — together with the cost entry it relates to, i.e. 5 years from the end of the tax year in which the cost was recorded; a reading result from which no cost entry was created — no longer than 90 days from the reading; at the provider (Anthropic) the file and the model’s response — as in the row above |
| draft reply to an enquiry and summary of correspondence pasted into the panel, prepared with the help of AI — section 3.1 | not kept — the CHEMAXA panel keeps only the reply sent by the authorised person (as enquiries and correspondence) or the note that person approved (as business contact history or order data), plus a technical record without content; at the provider (Anthropic) the text sent and the model’s response are deleted automatically within 30 days, longer only in the cases set out in the provider’s terms (breach of its usage rules, legal obligation) |
| push notification token | until notifications are disabled, the App is uninstalled, or the account is deleted |
| confirmation that a notification was opened (section 4.4) | up to 12 months from the confirmation being recorded |
| marker recording that a message on the list in the App has been read (section 4.4) | up to 12 months from the marker being recorded |
| history of notifications sent (date, content, delivery result, date the message was deleted from the list in the App — section 4.4) | until the customer’s account is deleted — as evidence that information about an order or a change of pricing was sent |
| job applicants’ data | the duration of the recruitment and, with the candidate’s consent, up to 12 months afterwards (for future recruitment) |
| data processed on the basis of consent (e.g. marketing) | until consent is withdrawn |
| measurement cookies on the Website | the lifetime of the given cookie or until consent is withdrawn |
| delivery schedules and referral links | until deleted by the customer or until the account is deleted (deleting the account removes both) |
| delivery ratings (1–5 scale with optional comment) | until the account is deleted (deleting the account removes the ratings) |
| date a review request was sent (Rzetelna Firma) | until the account is deleted |
| contact persons at a contractor (name, role, phone, e-mail, note) | until the customer’s account is deleted or the relationship ends |
| additional e-mail addresses of people handling orders at a contractor | until the address is deleted at the request of the contractor or that person, the customer’s account is deleted, or the relationship ends |
| business contact history (call notes, reminder dates) | until the customer’s account is deleted |
| archive of payment-reliability reports (KRD) — the report file together with the copy of the reading attached to that file (score, date, report number, suggested trade-credit limit) | 24 months from the report being uploaded to the system (deleted automatically together with the report file), or earlier — when the customer’s account is deleted |
| current reliability assessment on the contractor’s record (KRD score, date of the reading, report number, suggested trade-credit limit, remark), the internal payment-discipline assessment and the commercial data (payment term, credit limit, current supplier and their price, status and how the contact was acquired) | until the customer’s account is deleted or the relationship ends |
| technical data from the Website (IP address, date and time of the request, browser and operating system, pages visited — including opens of a quotation page shared by link) | up to 12 months from being recorded |
| consent log (date and time, route, identifier of the clause wording, IP address or the person who made the entry) — for consent to the National Debt Register entry and to SMS messages | together with the customer account; and where an entry was submitted to the register on the basis of that consent — for as long as the entry remains in the register and for the limitation period for claims |
| record of an unticked consent box when creating an account (date, identifier of the clause wording, no IP address) — section 3.2 | together with the customer account |
| records from account registration used to limit abuse (IP address, e-mail domain) | 2 days from being recorded (deleted automatically) |
| App crash and hang reports | 90 days from receipt (deleted automatically) |
| data stored locally in the App | until overwritten by the user or the App is uninstalled (device-only) |
You have the right to: access your data and obtain a copy; rectification; erasure (“right to be forgotten”); restriction of processing; data portability; objection to processing based on legitimate interest (including direct marketing); withdrawal of consent at any time (without affecting prior processing); and to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).
We respond to requests without undue delay, at the latest within one month. Requests may be sent to info@chemaxa.com.
We do not make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you. Ad-measurement (section 5) serves statistical and billing purposes only. AI-assisted reading of invoices (section 3.2 “Contractors and their representatives”) is not such a decision either — a person checks and approves the values read. Nor are AI-assisted draft replies to enquiries or summaries of pasted correspondence (section 3.1) — a person reads, edits and sends the draft, and records a note only after approving it.
We apply appropriate technical and organisational measures, including: encryption of data in transit (SSL/TLS — on the Website, in the App and in communication with the CHEMAXA server and external services), access control to systems and the admin panel (authentication, login-attempt limiting), the least-privilege principle (a database account with restricted permissions), protection of database queries against SQL injection, storing session tokens only as a hash, protection of configuration files and secrets, regular backups and staff training. Data stored locally in the App is protected by operating-system security mechanisms: on iOS — device encryption and the Keychain (which holds the session token); on Android — EncryptedSharedPreferences (AES-256), with backup of App data disabled.
This policy may be updated, e.g. when Website or App features or legal requirements change. The current version, with its effective date, is always available at this address.