Last updated: 4 August 2026
1. Data controller
The controller of personal data processed in connection with the use of https://stairs-q.com/ is SCHODY-Q E.W. SKROBISZEWSCY S.C., Białkowo 49d, 87-400 Golub-Dobrzyń, Poland, Tax ID (NIP): 5030081371 (the “Controller”).
For privacy and personal data matters, contact the Controller at schodyq@gmail.com or by post at the address above.
2. Scope of this policy
This policy describes the processing of data in connection with browsing the website and using its features; contact by telephone, email and contact forms; requests for a free measurement and quotation; photographs and technical information submitted for measurement; entering into and performing a contract; protection of forms and the website against misuse; and cookies and similar technologies, including localStorage.
3. Data, purposes, legal bases and retention
3.1. Contact form and correspondence
We may process the information included in a message, in particular your name, email address, telephone number, enquiry and technical information associated with submission of the form.
We process it to respond and manage correspondence on the basis of the Controller’s legitimate interest in handling enquiries (Article 6(1)(f) GDPR); to prepare an offer or take steps at your request before entering into a contract (Article 6(1)(b) GDPR), where the enquiry concerns an order; and, where necessary, to establish, exercise or defend legal claims (Article 6(1)(f) GDPR).
We retain the data for as long as necessary to handle the matter. If no contract is concluded, it may then be retained for the period necessary to document the correspondence or defend against claims. If a contract is concluded, the periods in section 3.3 apply.
3.2. “Book a free measurement” form
The form may collect your name, telephone number, email address, measurement address, preferred date, selected staircase type, dimensions and other technical information, additional comments and photographs of the floor opening.
We use this data to handle the request, contact you, prepare the measurement and quotation and take steps at your request before entering into a contract (Article 6(1)(b) GDPR). Management of correspondence, security and the defence of claims may also be based on the Controller’s legitimate interests (Article 6(1)(f) GDPR).
Data and photographs are retained for the time needed to handle the request and perform the measurement. If the project does not proceed, they may subsequently be retained for the period necessary to document the matter or defend against claims. If a contract is concluded, the data becomes part of the contract documentation.
Do not submit photographs containing images of people, documents, identification numbers or other information that is not needed for the technical assessment of the measurement location.
3.3. Contracts, orders and settlements
If a contract is concluded, we process data to enter into and perform it (Article 6(1)(b) GDPR), comply with tax, accounting and other legal obligations (Article 6(1)(c) GDPR), and establish, exercise or defend claims (Article 6(1)(f) GDPR). Documentation is retained for the term of the contract and then for the periods required by tax and accounting law and applicable limitation periods.
3.4. Server logs and security
When you use the website, technical information may be processed automatically, including IP address, date and time of a request, requested URL, browser and device information, referring page and error information.
This data is used to operate and diagnose the website, make backups, prevent misuse and protect the website and forms, on the basis of the Controller’s legitimate interests (Article 6(1)(f) GDPR). Logs are retained according to the hosting configuration and security needs, no longer than necessary for those purposes.
3.5. Statistics, embedded content and preferences
With your consent, the website may use Google Analytics and activate third-party services such as Google Maps or embedded YouTube content. The legal basis for processing personal data is consent (Article 6(1)(a) GDPR). Storing or accessing information on a device is governed by Article 399 of the Polish Electronic Communications Law.
Consent is voluntary and can be changed or withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.
3.6. Cookie consent decision log
WP KRS Cookie maintains a server-side decision log so that the Controller can demonstrate when and to what extent consent was granted, rejected, changed or withdrawn. The log does not contain a name, email address or telephone number.
It records a random consent identifier assigned to the browser, date and time, action, selected categories, consent version, banner language, browser type information and the page address on which the decision was recorded. By default, the IP address is stored only as a non-reversible cryptographic hash, not in plain text.
This pseudonymous data is processed solely to demonstrate consent, ensure accountability and handle potential requests or disputes, on the basis of the Controller’s legal obligation (Article 6(1)(c), in conjunction with Articles 5(2) and 7(1) GDPR) and, additionally, the legitimate interest in defending against claims (Article 6(1)(f) GDPR). Detailed entries are retained for 365 days and then deleted automatically. Aggregated choice statistics cannot be used to reconstruct the decision of a specific browser.
4. Is providing data mandatory?
Providing data is voluntary, but fields marked as necessary must be completed for the Controller to answer a message, prepare a quotation, arrange a measurement or perform a contract. Failure to provide the data may prevent the request from being handled.
The contact and measurement forms are not used to subscribe to a newsletter or give marketing consent. Any marketing activity requires a separate legal basis and, where required, separate voluntary consent.
5. Recipients of data
Data may be disclosed only to the extent necessary for the purposes described above, to:
- authorised persons, employees and contractors of the Controller;
- cyber_Folks S.A., as the hosting and server infrastructure provider;
- the provider of the company email service to which form messages are delivered;
- website maintenance, IT support and backup providers;
- Cloudflare, Inc., in connection with Turnstile protection against bots;
- Google Ireland Limited and other Google group companies in connection with Google Analytics, Google Tag Manager, Google Maps or YouTube, depending on the consent choices and page used;
- accounting, legal, courier or payment service providers where needed to perform a contract or comply with legal obligations; and
- public authorities where disclosure is required by law.
Processors act under contracts or service terms. Recipients that independently determine the purposes of processing are responsible for data under their own privacy rules.
6. Third-party services
6.1. Google Analytics and Consent Mode
The website uses Google Analytics 4 to measure traffic and website use. Analytics cookies such as _ga and _ga_* are stored only after consent to the analytics category.
The website uses advanced Google Consent Mode. If analytics consent has not been given, the Google tag may send cookieless signals to Google. These may include the consent state and technical information supplied by the browser, such as timestamp, browser type, page address and referrer. Google may use these signals to model aggregated statistics.
The retention period for user and event data depends on the Google Analytics settings. Cookie durations are listed in the cookie declaration. See Google Analytics data safeguards and the Google Privacy Policy.
6.2. Google Maps and YouTube
Selected pages may contain maps or media supplied by Google. Once this content is activated, the browser connects to Google servers and Google may receive the IP address, device and visited-page information and use cookies or similar technologies.
These embeds are assigned to the marketing category and should be activated only after the relevant consent. You may refuse consent and continue to use the rest of the website. See the Google Privacy Policy.
6.3. Cloudflare Turnstile
Forms are protected by Cloudflare Turnstile, which helps identify automated submissions and misuse. It may process technical information about the browser, device, connection and verification and may use localStorage or security cookies. Turnstile is a form-security measure based on the Controller’s legitimate interest in protecting the website and correspondence against misuse (Article 6(1)(f) GDPR).
See Cloudflare Turnstile documentation and the Cloudflare Privacy Policy.
7. Cookies and similar technologies
Cookies are small pieces of information stored by a browser. The website also uses similar mechanisms, in particular localStorage, to remember consent decisions, handle file uploads and protect forms.
The website uses the following categories:
- necessary — website operation, security, forms, caching and remembering consent decisions; used to the extent required to provide a service requested by the user;
- analytics — traffic statistics, activated after consent;
- marketing — third-party embeds such as Google Maps or YouTube, activated after consent; and
- preferences — selected settings, such as language, activated according to their nature and consent settings.
Consent is the basis for storing or accessing non-essential information on a user’s device. Exemptions for information necessary for transmission or a service requested by the user arise from Article 399(3) of the Polish Act of 12 July 2024 — Electronic Communications Law.
On the first visit, you can accept all categories, reject them or make a detailed choice. You can change the decision at any time using the floating “Cookie settings” button in the bottom-left corner. Cookies can also be deleted in your browser settings.
The current cookie declaration, including name, provider, purpose, category and duration, appears below:
8. Transfers outside the European Economic Area
Use of Google and Cloudflare may involve processing outside the European Economic Area. The providers describe their transfer mechanisms in their terms and data-protection documents, including, where required, European Commission standard contractual clauses or other safeguards permitted by law.
See the Google Privacy Policy and the Cloudflare Data Processing Addendum.
9. Your rights
Subject to the conditions set out in the GDPR, you may have the right to access and obtain a copy of your data; rectify or erase it; restrict processing; receive data in a portable format where processing is automated and based on consent or a contract; object to processing based on legitimate interests; and withdraw consent at any time without affecting earlier lawful processing.
Send a request to schodyq@gmail.com. The Controller may request information needed to verify the identity of the person making the request.
10. Complaint to a supervisory authority
If you believe your data is processed unlawfully, you may lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Current contact details are available at uodo.gov.pl. You may also have the right to contact the supervisory authority in the EU or EEA country of your habitual residence, place of work or place of the alleged infringement.
11. Automated decisions
The Controller does not make decisions about users based solely on automated processing that produce legal or similarly significant effects. Google Analytics may create aggregated statistics and models according to its settings, but it is not used by the Controller to make automated decisions about a specific person.
12. Data security
The website uses an encrypted HTTPS connection. The Controller applies appropriate organisational and technical measures, including access control, software updates, backups and form protection. Nevertheless, transmitting data over the Internet always involves some risk.
13. Links to other websites
The website may link to external services, including Facebook and YouTube profiles. After you follow such a link, its operator is responsible for processing data under its own privacy policy.
14. Changes to this policy
This policy may be updated when website functions, providers, processing practices or legal requirements change. The last-updated date appears at the beginning. If a change requires consent for cookies or similar technologies to be obtained again, the website will display the choices panel again.