DAPAL.EU Privacy and Cookie Policy
Last updated:
This document covers dapal.eu, www.dapal.eu and the quotation form at /contact-form/. It explains data processing and the use of cookies and similar technologies, including localStorage and sessionStorage.
1. Controller and contact
The controller is DAPAL Damian Habdas, ul. Holnówka 14B, 34-322 Rychwałd, Poland, NIP 5532323048, REGON 380533992. For data matters and to exercise your rights, write to Show email or to the controller’s postal address. No data protection officer has been appointed.
2. Data we receive
- Contact and inquiry: First and last name, email, telephone, company details, address and information about the investment, budget, expectations, timing and installation — as supplied in the chosen form path — together with correspondence and attachments such as photographs, plans and inspiration.
- Form draft: Answers, progress and settings may be saved on the device while you complete the form. Adding an attachment may upload it to a server draft before final submission. Saving and resuming use draft identifiers; do not share the link or device with unauthorised persons.
- Technical data: IP address, request time and parameters, browser data and information needed for security, sessions, spam prevention and error diagnostics.
- After consent to the relevant category: Browser identifiers and information about pages visited, interactions and campaign source, used for statistics and advertising measurement and personalisation.
Providing data is voluntary, but fields marked as required are necessary to handle the inquiry you have chosen. Rejecting optional analytics or marketing does not block the form. Do not send health information, identity documents or other data unnecessary for a quotation.
3. Purposes and legal bases
- Preparing a quotation at your request and steps before entering into or performing a contract — Article 6(1)(b) GDPR. General contact or contact with a company representative — Article 6(1)(f) GDPR; the legitimate interest is handling correspondence and business relationships.
- Secure operation of the website, prevention of misuse, diagnostics and the establishment, exercise or defence of legal claims — Article 6(1)(f) GDPR; the interest is security and protection of the controller’s and users’ rights.
- Records required by law, such as tax records after a contract is concluded — Article 6(1)(c) GDPR.
- Optional analytics and marketing, campaign measurement and remarketing — consent, Article 6(1)(a) GDPR. Storing or accessing optional information on your device requires prior consent under Article 399 of the Polish Electronic Communications Law.
Acknowledging the privacy policy in the form is not consent to advertising or a condition requiring consent as the basis for processing an inquiry. Cookie settings and handling an inquiry are separate matters.
4. Recipients and transfers
Access, to the extent necessary, may be provided to authorised DAPAL personnel and providers of hosting, email, infrastructure, security, system maintenance, backups, accounting and legal services. Depending on the service, they act as processors or independent controllers; public authorities may receive data where required by law.
Optional Google Analytics and Google Ads tools are operated by Google Ireland Limited, and Meta Pixel by Meta Platforms Ireland Limited. Google Tag Manager manages tag activation. Using these tools may involve sharing data with their providers and processing outside the European Economic Area, including in the USA.
A transfer requires an appropriate basis under Chapter V GDPR, such as a European Commission adequacy decision (in the USA, only for organisations covered by the relevant certification) or standard contractual clauses and required safeguards. The controller provides information on the safeguards used and how to obtain a copy. Additional provider policies: Google, Meta.
5. Data retention
- Correspondence and submitted inquiries: While the matter is handled and then, as a rule, for up to 3 years after closure to document arrangements and claims. If a contract, statutory recordkeeping obligation or dispute arises, relevant data is retained for the legally required period or until the matter is finally resolved and the decision implemented.
- Local draft and preferences: The local draft expires 60 days after the last activity while completing the form or saving it manually. Local answers and identifiers are removed the next time the form is opened after this period. For older records without an activity date, a 60-day transition period starts when the form is first opened after this feature is introduced. Periodic autosaving alone does not extend the period. The form language remains a preference until changed or browser data is cleared; sessionStorage is associated with the tab’s session.
- Unsubmitted drafts and server attachments: The adopted retention period is 60 days after the last activity on a draft. Submitted inquiries are subject to the separate rules above. Removal requires checking that files do not belong to an accepted inquiry and that no ground for retention exists. Closing the tab or clearing device storage does not confirm deletion from the server. Contact the controller about withdrawal and deletion.
- Cookie choice: A choice is treated as current for up to 180 days after saving; the panel asks again after expiry or a choice-version change. This is not a deadline for deletion from advertising providers’ systems.
- Form application logs: The adopted period is 60 days, with rotation and size limits. This is not a common period for hosting or email logs or Google/Meta data. Records secured for a particular incident may be required to investigate it and handle claims.
Withdrawing consent stops further processing based on that consent and does not affect the lawfulness of earlier processing. We assess erasure requests taking account of legal obligations and grounds for continued retention; a request does not automatically delete documents we must retain.
6. Cookies and similar technologies
Cookies are small files sent to your browser. localStorage and sessionStorage hold information in browser storage. Information and consent requirements do not depend solely on the name of the technology. Mechanisms strictly necessary for transmission or for a service expressly requested by the user may operate without consent to optional categories.
| Mechanism / provider | Purpose and choice | Lifetime on the device |
|---|---|---|
DAPALSESSID and form security / DAPAL | PHP session, form operation and protection against misuse; necessary for the requested service. | Generally the session; browser settings may restore a session. |
dapal_consent_v1 / DAPAL, localStorage | Remembering acceptance or rejection of categories. | Choice valid for up to 180 days; it can be changed earlier in the panel. |
dapal_form_*, form_*, draft identifiers / DAPAL | Progress, resuming the form and the language used. Local data may include answers entered in the form. | Draft and identifiers: 60 days after activity, removed the next time the form is opened; older records have the transition period described above. Language preference: until changed or browser data is cleared. |
| Gallery settings / DAPAL | Photo selection and browsing state within the current page. | Only in the current page’s memory, with no new cookies, localStorage or sessionStorage records. Older gallery records can be removed in your browser settings. |
_ga, _ga_* / Google Analytics | Usage statistics; optional analytics. | Normally up to 2 years; configuration and the browser may shorten this period. |
_gcl_* / Google Ads; _fbp, _fbc / Meta Pixel | Campaign and conversion measurement and remarketing; optional marketing. | Typically up to 90 days for the identifiers listed; this depends on the active tool and settings. |
Cookie names and standard lifetimes given by providers describe the listed mechanisms and do not guarantee that each will appear on every visit. Actual storage depends on consent, active tag configuration and the browser. Return visits may renew cookie lifetimes according to the tool’s settings. More information: Google cookies and Meta cookies.
7. Choosing and withdrawing consent
The panel offers “Reject optional”, “Accept all” and “Settings”. Analytics and marketing can be selected separately; optional switches are not preselected for a new choice. Without a choice, optional tags remain blocked. Click the button , which opens the panel and lets you change or withdraw consent.
Rejecting all optional categories does not prevent access to the main offer or contact options. Withdrawing active consent may reload the page to stop tools that have already loaded. After rejection, the site removes Google Analytics, Google Ads and Meta cookies that it can access in the DAPAL domain, according to the category withdrawn. This does not delete data from providers’ systems or cookies belonging to other domains; you can also manage those in your browser settings. Clearing site data may also remove your draft and preferences and cause the consent panel to appear again.
8. Your rights and profiling
Under the conditions set out in the GDPR, you have rights of access and a copy of your data, rectification, erasure, restriction of processing, data portability and withdrawal of consent. You may object to processing based on legitimate interests on grounds relating to your situation, and to direct marketing at any time. Particular rights depend on the basis and circumstances of processing.
You may lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl. Send requests to DAPAL at the address given above. As a rule, we respond within one month of receipt; any permitted extension and its reasons are communicated in accordance with Article 12 GDPR. Proportionate verification of identity may be necessary for the request.
After marketing consent, advertising providers may tailor ads based on activity and identifiers. DAPAL does not use this to make decisions about users based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.
9. Changes to this document
The current version is available on this page with its update date. Extending purposes that require consent requires appropriate information and fresh consent; publishing this policy does not replace obtaining consent. The rules for using electronic services are set out in the Website Terms of Use.