Privacy and cookies policy

The service is also available at naturalzone.pl as the English and Italian version of Strefa Naturalni. Both domains are operated by the same entity and share company accounts, reservations and settlement records.

Strefa Naturalni · version dated 5 November 2026; language preference information added 6 November 2026.

1. Controller and contact

The controller is Aleksander Pitura, trading as DGL Aleksander Pitura, ul. Warszawska 15/1, 59-900 Zgorzelec, Poland, NIP 6151838313, REGON 231088065. For data matters, write to contact@mygelato.eu, call +48 501 320 023 or use the correspondence address.

This policy covers the public website strefanaturalni.pl and contact with the organiser. The facilities at test.strefanaturalni.pl are a separately labelled test environment. The main domain provides company accounts and orders; automated SMS delivery and publication on lodoludki.pl are described in the original policy as not yet active.

2. Data scope and sources

When you browse, the hosting infrastructure processes technical request data such as IP address, date, resource address, request result and browser information. When you write or call, we receive the contact details you provide, your enquiry and information needed for an offer, such as the company, preferred floor area and service scope. We do not require a PESEL number, identity document scan or bank login details.

The company dashboard supports registration, login, profile and photo editing, reservations, individual offers and payments. We process contact details, company name and billing information, NIP, address, offer content, acceptance of terms, orders and payment statuses. For login we process an account identifier, password hash, session state and attempt counters linked to a hash of the IP address. Clicking an email address opens your email program; you send the message yourself. Links to the test environment open a separate service and its functions.

3. Purposes and legal bases

• Replying to your enquiry and preparing an offer at your request: Article 6(1)(b) GDPR where you are a party to the proposed contract; for a company representative, Article 6(1)(f), the legitimate interest in managing cooperation and contact.
• Website security, error handling, abuse prevention and establishing, pursuing or defending claims: Article 6(1)(f), following assessment of necessity and individuals’ rights.
• Legal obligations, such as responding to required requests, complaints or accounting documentation once the obligation arises: Article 6(1)(c).

We do not conduct marketing profiling, operate a newsletter or make automated decisions with significant legal effects on this website. An enquiry or acceptance of the terms is not advertising consent.

4. Recipients and location

Data is accessible to authorised staff supporting the organiser and providers required for contact and website operation: OVHcloud for hosting and logs, providers of the email accounts used and, where appropriate, accounting providers and authorised authorities. We do not pass contact details to other exhibitors or sell the database.

Browsing alone does not send data to Paynow, GUS or SerwerSMS. When a payment is created, we send Paynow / mElements S.A. the amount and currency, service description, transaction identifier and buyer email to perform the contract (Article 6(1)(b) GDPR), and record payment status with the order. You provide banking and authentication data directly to the operator and bank. After login, if GUS lookup is enabled and you choose to retrieve company data, the NIP you enter is sent to Statistics Poland to retrieve REGON register data. The basis is handling the enquiry and preparing an offer (Article 6(1)(b)), or the legitimate interest in business cooperation for a company representative (Article 6(1)(f)). We display the result for review and do not automatically overwrite buyer details. The result is held in the session and an encrypted cache valid for one hour. Outdated cache files are removed no later than the next retrieval after 24 hours; without further retrievals, they remain encrypted and unused until maintenance. Integration connection tests use only the organiser’s public NIP. We do not load embedded advertising or social modules.

The website is hosted in OVHcloud infrastructure in the EEA. Your chosen email provider may use infrastructure outside the EEA. Where the controller arranges a transfer outside the EEA, it ensures a basis under Chapter V GDPR. Ask the controller for information about specific recipients and safeguards.

5. Retention periods

We retain correspondence while handling the enquiry and cooperation, and subsequently only as needed for specific obligations or claims. We do not collect contacts indefinitely for future advertising. Hosting logs follow the provider’s retention and rotation and necessity review; ask the controller about a specific matter. Accounting documents, if created, are retained for the applicable statutory period, considering tax deadlines and events affecting them.

Backups may temporarily contain data until replacement or deletion under the retention cycle. They are not used for ordinary marketing; required deletions are repeated after restoration.

6. Your rights

Subject to GDPR limits, you have rights of access and a copy, rectification, erasure, restriction, portability where applicable and objection to processing based on legitimate interests. Where consent is the basis of a particular activity, you may withdraw it without affecting earlier lawful processing. The right to erasure does not override obligations to retain required records.

Address requests to the controller. We normally respond within one month and inform you in time of any permitted extension and its reason. You may complain to the President of the Polish Personal Data Protection Office: uodo.gov.pl. We require only proportionate information to verify a request.

Providing contact data is voluntary, but without information necessary to answer or prepare an offer we cannot handle your enquiry.

7. Cookies and browser data

The language selector stores your PL/EN/IT preference in the first-party cookie sn_language for up to one year. The company dashboard uses the necessary session cookie sn_live_firms, and the earlier review account uses naturalni_buyer (Secure, HttpOnly, SameSite=Lax), for authentication and form protection. Dashboard sessions expire after 30 minutes of inactivity; the session cookie is not persistent. We do not use localStorage, analytics, advertising pixels or external fonts. Login requires necessary cookies. Dashboard login counters are held in the database to limit abuse, and maintenance removes outdated entries. Review-account data is removed after verification. Necessary server logs are not cookies. We therefore do not display a consent banner for advertising tools that are not present.

You can remove or block cookies in your browser settings. Services opened through links, including the test environment and payment provider, have their own settings and information. Adding optional analytics requires prior updates to information and consent arrangements.

8. Security and changes

We use HTTPS, infrastructure access restrictions and updates. Do not send passwords or banking codes in enquiries to the organiser. Policy updates describe actual functional changes and do not create consent retroactively. You can save and print this document.