Privacy Policy

1. Privacy Policy — who processes your data

The data controller for the personal data collected through ecad.com.pl is ECAD A. Wojtczak, R. Zarębski spółka komandytowa located in Łódź:

• registered office (KRS) and invoicing address: ul. 3 Maja 64/66, 93-408 Łódź;
• main office, production facility and mailing address: ul. Elektronowa 6, 94-103 Łódź;
• KRS 0001005609, registering court: District Court for Łódź-Śródmieście in Łódź, XX Commercial Department of the National Court Register;
• Polish tax identification number (NIP) 7292652717, REGON 100585925;
• email: biuro@ecad.com.pl, tel. +48 697 270 000.

In this policy, the data controller appears as “ECAD” or “we”.

We explain what data we collect through the website, quotation form, email, telephone, and social media profiles. We also describe why we collect it, how long we store it, and what rights you have. We process data in accordance with Regulation (EU) 2016/679 (GDPR).

2. Contact regarding personal data

Please direct any inquiries regarding personal data to biuro@ecad.com.pl or by post to: ul. Elektronowa 6, 94-103 Łódź.

We have not appointed a data protection officer — we are not obliged to do so (Article 37 GDPR).

3. What data do we collect

3.1 Data you provide yourself

• Quotation form: full name, company name, tax identification number (Polish NIP or a foreign equivalent; required), email, telephone, order details (type of work, material and thickness, quantity and deadline), message and uploaded drawings, 3D models, photos and archives (e.g. PDF, DXF, DWG, STEP, IGES, JPG, PNG, TIFF, ZIP, 7Z).
• Email correspondence and telephone conversations: data from messages or conversations, as well as telephone number and email address.
• Orders and contracts: The data needed to process your order and issue an invoice.

Technical files typically do not contain personal data. However, they may, for example, include it in a drawing title block (author, reviewer) or in file metadata. We treat such data in the same way as data from a form.

3.2 Automatically Collected Data

• Technical connection data: data recorded by the server and website security systems, including IP address, date and time, page address and browser type.
• Statistical data from Google Analytics 4 (website visitor statistics and measurement of the effectiveness of our Google advertising) — collected only with your consent (point 9).
• Cookie consent register: for each choice, we record an anonymous entry on the server without an IP address or browser data (section 9.6).
• Technical data for the quotation form: the submission date and time, enquiry number and form completion time are recorded with the enquiry. To protect the form from spam and misuse, we also use a hash of the IP address and a hash of the email address (pseudonyms created using our key — the full IP address is not stored; point 5.1).

4. Purposes, Legal Basis and Retention Period

5. Quotation form and uploaded files

5.1 How we handle submissions

Submissions from the quotation form are sent to biuro@ecad.com.pl. We send messages from the quote@ecad.com.pl address via the mail server of our hosting provider (WEBD.pl).

If you provide an email address, we will send you an automated confirmation with a submission number and the number, format, and size of the received files – without their names and without the content of the request. We send no more than 3 confirmations per day to one address. If you received such a confirmation but did not submit a request, please contact biuro@ecad.com.pl – we will delete the submission.

Uploaded files are stored in the email inbox and on the server, outside the public website directory. A copy of the submission on the server (form data and files) is automatically deleted 12 months after its submission; the email inbox is subject to the periods specified in point 4. Access to the copy is restricted to authorized personnel who prepare quotations and execute orders – after logging into the website panel.

To protect our forms from spam and abuse, we monitor submission times and limit the number of requests from each connection and the total number of submissions and confirmations. We use abbreviated IP addresses and email addresses for counting, not the full versions; counters are deleted after 24 hours. Form events (submission, rejection, email failure, retrieval or deletion by an employee) are logged technically without names, email addresses, phone numbers, or message content; abbreviated IP addresses are recorded only for rejected submissions. These logs are deleted after 90 days.

5.2 Confidentiality of technical documentation

We use drawings and models solely for quotation preparation and order fulfilment. We do not share them with third parties without your consent, except for subcontractors when their involvement is required (point 6). We can provide a non-disclosure agreement (NDA) upon request.

5.3 Do you have to provide your data?

Providing data is voluntary. To prepare a quotation or respond to your enquiry, we need your full name, a tax identification number (Polish NIP or a foreign equivalent), and at least one contact method: an email address or telephone number. Other fields are optional.

6. Who we share data with

Your data may be shared with third parties who assist us in running our website and business. They process it under data processing agreements and only to the extent necessary to perform the service:

• website and email hosting provider: Globtel Internet Szymon Hersztek (WEBD.pl), 2/1 Matecznikowa Street, 80-126 Gdańsk; their hosting services include network protection by BitNinja.
• Google Ireland Limited (Google Analytics 4 connected to our Google Ads account) – when you consent to statistics tracking (point 9);
• accountants, legal advisers and IT service providers – to the extent necessary for their services;
• transport and courier companies – when shipping ordered items;
• subcontractors – only when their involvement is required and only with the necessary documentation.

When you click a YouTube video, we and Google Ireland Limited are jointly responsible under Article 26 GDPR for loading the player and transmitting your data (IP address, browser data and the URL of the page). We obtain your consent, and you can direct requests about this stage to us. Google is separately responsible for its further processing of the data (section 10).

We may also disclose data to public authorities if required by law.

7. Transfers of data outside the European Economic Area

We primarily process data within the EEA. When using Google Analytics (including in connection with our Google Ads account), data may be transferred to Google LLC in the USA. This is based on the European Commission’s decision of 10 July 2023 regarding the EU-US Data Privacy Framework (EU-US DPF) – Google LLC has an active DPF certification – and, as a supplementary measure, standard contractual clauses. When a YouTube video is played, Google may transfer data to Google LLC in the USA – based on the same Commission decision (Google LLC has DPF certification) and in accordance with its privacy policy.

8. Automated decisions and profiling

We do not make decisions about you based solely on automated processing, including profiling, which would have legal effects or significantly affect you in a similar way.

9. Cookies and statistics

9.1 What cookies are

Cookies are small text files that a website saves in your browser. We store or retrieve information in your device in accordance with Article 399 of the Electronic Communications Act of 12 July 2024: essential cookies without consent, and all others only with your consent.

9.2 Essential cookies

Until you make a decision on the consent banner, the website does not store cookies in your browser. After you make a decision, we store two essential cookies, both valid for 180 days. The first records your choice using either seopress-user-consent-accept (consent) or seopress-user-consent-close (consent declined). The second, ecad_zgoda_id, stores a random number for that choice and is used by the consent register (section 9.6). Separately, only when you click a YouTube video, the Google player saves data in your browser’s memory (point 10). You can find the list of files and data in cookie policy. When the English version of the page is enabled, a file remembering the selected language may be created.

We load fonts and scripts from our server, not from external providers. Exceptions: the Google Analytics script loads from Google’s servers only with your consent for statistics, and the YouTube player — only after clicking a video.

9.3 Google Analytics 4 and Google Ads (with consent)

If you consent, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This allows us to see which subpages are visited and where users come from. GA4 then collects, among other things: visited subpage addresses and the page from which you came (e.g., a search engine or an advertisement), device type, operating system and browser, approximate location (country, city), time and duration of the visit, and information that a quotation request form has been submitted — without the data entered in the form. GA4 stores the following files:

• _ga: distinguishes users, valid for 2 years from the last visit; we delete it upon the first visit after withdrawing or expiry of consent;
• _ga_<ID>: maintains session state, valid for 2 years from the last visit; we delete it as above.

According to Google, GA4 does not store or retain user IP addresses from the EU. The address is used only for approximate location and is immediately deleted.

Our GA4 statistics are linked to the ECAD advertising account in Google Ads. This allows us to check whether our Google ads are bringing people interested in our offer to the page — for example, how many visits came from ads and how many of those resulted in a quotation request being submitted. We only use data collected with your consent for statistics.

The consent from the banner only covers visit statistics, including the assessment of the effectiveness of our advertisements. It does not include advertising files or ads tailored to you. Therefore, we always pass consent signals for advertising (ad_storage, ad_user_data, ad_personalization) to Google as no consent, and we disable Google Signals and ad personalisation in the page code. The page does not therefore store advertising files. According to Google’s rules, your visit data is then not used for remarketing or to tailor ads to you, and passing information to Google Ads about how your actions on the page connect with a click on a specific ad is limited.

Access to Google Analytics and Google Ads accounts is restricted to individuals authorised by ECAD.

Google describes how Google uses data from websites using its services in its document “How Google uses data from websites and apps that use our services”.

9.4 How to change your decision

Consent is voluntary. Without it, the page functions as normal and you can submit a quotation request. You express or reject consent via the banner on your first visit — both buttons are equally valid. You can change it at any time via the “Cookie Settings” button in the footer of the page or by deleting cookies in your browser. Withdrawing consent does not affect the legality of processing before withdrawal.

9.5 Browser Settings

You can block and delete cookies in your browser settings. Blocking necessary files may cause the consent banner to appear on each visit.

9.6 Consent Register — how we record your decision

To record that consent for statistics has been given, rejected, or withdrawn (Article 7(1) GDPR), we record a single anonymous entry on the page server for each decision on the consent banner — “Accept”, “Reject”, or change or withdrawal of decision via “Cookie Settings”. It contains only:

• decision time (UTC);
• decision type: consent given, refused or withdrawn;
• the SHA-256 hash of the consent text you saw and the date of that version; full versions of the text are stored separately;
• a random number generated by your browser and stored in ecad_zgoda_id, valid for 180 days like the decision itself; it links successive choices from the same browser, such as consent and a later withdrawal;
• the URL of the page where you made the choice, without any query parameters.

The register does not contain your IP address, browser name or version, or any data that would allow us to identify you. As with every page visit, your IP address and browser data are logged on the server (section 3.2), separately from the register. The register data is not shared with Google or other recipients; it is hosted on our hosting provider’s server (section 6).

The legal basis is Article 6(1)(c) in conjunction with Article 7(1) of the GDPR – the obligation to demonstrate that consent was given. An entry is created with each decision, even when consent is refused. We store entries for 3 years from the decision date and automatically delete them.

Because we do not know your identity, we will not link the entry to you without additional information. If you wish to check your entry, please contact us and provide the number from the file. ecad_zgoda_id (Article 11(2) GDPR).

10. Social Media, YouTube Videos and External Links

The page contains links to our profiles on Facebook, LinkedIn and YouTube, as well as to Google Maps. We do not embed maps or widgets from these services. Until you click a link, these services do not receive your data from our page.

YouTube videos on our page. Before you click a video, you only see a thumbnail saved on our server – Google does not receive your data at that time. After clicking, the player loads from Google’s servers (e.g. youtube-nocookie.com) – Google Ireland Limited. From that point, Google processes, among other things, your IP address, browser data and the URL of the page from which you launched the video. Despite the domain name, it may also save or read files and similar data on your device – according to its own rules.

Clicking the video constitutes your consent to load it from YouTube and to save or read that data on your device (Article 6(1)(a) GDPR, Article 399 of the Electronic Communications Act). This consent applies only to the clicked video – the others will not load without clicking. You can delete the data saved by YouTube in your browser settings. If your browser has JavaScript disabled or you open the video in a new tab, the link goes directly to youtube.com. If you do not want to transmit data to Google, do not play the video – viewing it directly on youtube.com also means transmitting data to Google, according to YouTube’s terms.

Data is processed by the operator of the service according to its own rules:

• Meta Platforms Ireland Ltd (Facebook);
• LinkedIn Ireland Unlimited Company;
• Google Ireland Limited (YouTube, Google Maps).

If you interact with our profiles (comments, messages, following), we process your data visible on the service in order to manage the profile and contact you. We are jointly responsible for profile statistics with the service operator, according to the operator’s terms.

The page also contains a link to cubeweld.pl, the CUBEWELD website. The privacy policy of cubeweld.pl applies there.

11. Your Rights

You have the right to:

• access your data and obtain a copy of it;
• correct your data;
• delete your data;
• restrict processing;
• port your data processed on the basis of consent or contract;
• object to processing based on our legitimate interest (Article 6(1)(f) GDPR);
• withdraw your consent at any time; this does not affect the lawfulness of processing carried out before withdrawal;
• You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw.

Right to Object. You may object to processing based on our legitimate interest (Article 6(1)(f) GDPR) – for reasons related to your particular situation (Article 21(1) GDPR). We will then cease processing for that purpose unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims.

To exercise your rights, please email us at biuro@ecad.com.pl or write to: Elektronowa 6 Street, 94-103 Łódź.

12. Security

The website operates exclusively over a secure HTTPS connection and is protected by a hosting provider’s web application firewall. Access to the website’s administration panel and email accounts is restricted to authorised personnel only. We implement technical and organisational measures proportionate to the risk, including backups.

13. Changes to the Policy

Current Privacy Policy

We update this policy when the tools used on the website or our data-processing methods change. The current version is always available at ecad.com.pl/polityka-prywatnosci/.

Version dated 17 October 2026.