Privacy Policy

This Privacy Policy defines the principles of processing and protecting personal data provided by Users in connection with using the website Robert Białas Fruit Tree and Bush Nursery (bialas.pol-agro.pl) as well as placing orders and inquiries regarding fruit trees, bushes, and nursery material.

1. Personal Data Controller

The Controller of your personal data is Robert Białas Fruit Tree and Bush Nursery, based in Brzustówek 10, 26-300 Opoczno, Poland. Contact regarding personal data protection is possible via:

2. Security Architecture – No invasive tracking

Site traffic is monitored only through internal, anonymous server logs to ensure stability, infrastructure security, and protection against attacks (technical logs). We do not use analytical tools based on marketing cookies or remarketing systems.

3. Scope of collected data

As part of our business activity, we may process the following categories of personal data:

Data category	Data scope	Processing purpose
Identification data	Name, surname, company name, VAT number (NIP)	Customer identification, issuing invoices
Contact data	Email address, phone number, delivery address	Contact and order fulfillment
Order data	Purchase history, variety preferences	Contract performance, after-sales service
Technical data	IP address, browser type, operating system	Traffic analysis, website security

4. Purpose and legal basis for data processing

Personal data provided by Users in contact forms, inquiry forms, or orders are processed exclusively for the following purposes:

• Handling inquiries and conducting business correspondence – the legal basis is Art. 6(1)(f) GDPR (legitimate interest of the Controller consisting of responding to customer inquiries).
• Order fulfillment, issuing invoices and sales documentation – the legal basis is Art. 6(1)(b) GDPR (necessary for contract performance) and Art. 6(1)(c) GDPR (fulfillment of tax and accounting obligations).
• Potential assertion of claims or defense against claims – the legal basis is Art. 6(1)(f) GDPR.
• Direct marketing of own products – only after you give separate consent (Art. 6(1)(a) GDPR).

We do not process personal data for marketing purposes without the explicit consent of the User.

5. Data retention period

Personal data will be processed for the period necessary to achieve the purpose for which it was collected:

• For inquiries – until the end of correspondence, no longer than 12 months from the last contact.
• For completed orders – for the period required by tax law (5 years from the end of the calendar year in which the tax obligation arose) and until the statute of limitations for claims expires (usually 6 years).
• Marketing data (with consent) – until consent is withdrawn, no longer than 3 years.

6. Data recipients

User data is not sold, rented, or shared with third parties for marketing purposes. Data recipients may only include:

• Entities providing hosting and server services to the Controller (based on data processing entrustment agreements).
• Courier and shipping companies – to deliver ordered trees and bushes.
• Providers of accounting and legal services.
• Entities authorized by law (e.g., tax authorities, courts).

7. User rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access to your data – you may obtain information about what data we process and receive a copy.
• Right to rectification – you may request correction of inaccurate data or completion of incomplete data.
• Right to erasure (right to be forgotten) – in certain circumstances, you may request deletion of your data.
• Right to restriction of processing – when you contest the accuracy of data or object to processing.
• Right to data portability – you may receive your data in a machine-readable format.
• Right to object – to processing based on the legitimate interest of the Controller.
• Right to withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint – with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) if you believe processing violates legal provisions.

To exercise your rights, contact us via email at bialas@bialas.pl or in writing at our business address.

8. Cookies

The Robert Białas Nursery website uses only necessary (technical) cookies that are essential for the proper functioning of the site, ensuring security, and enabling the use of basic features (e.g., navigation, language switch). We do not use cookies for profiling, behavior analysis, or marketing purposes.

You can change your cookie settings in your browser at any time. Disabling necessary cookies may, however, affect the correct operation of the website.

9. Data security

We apply appropriate technical and organizational measures to ensure the protection of processed personal data against loss, damage, unauthorized access, or disclosure. Only authorized persons who have been properly trained in information protection have access to the data. The site uses an SSL certificate (HTTPS encryption).

10. Data transfer outside the EEA

As a rule, we do not transfer personal data outside the European Economic Area (EEA). When using tools from providers outside the EEA (e.g., hosting servers), we ensure an adequate level of protection through standard contractual clauses approved by the European Commission.

11. Changes to the Privacy Policy

The Controller reserves the right to update this Privacy Policy in the event of changes in legal regulations or the development of offered services. Any material changes will be communicated by posting a notice on the main page of the website. The current version of the document will always be available at this address.

This Privacy Policy is effective from 1 January 2026.