MR STEEL privacy policy

Updated: 16 October 2026

1. Data controller and contact

The controller of personal data provided when contacting us through this website is MR STEEL Sp. z o.o., tax identification number (NIP) 779-252-24-61. Contact address: ul. Kierska 8, 62-090 Kiekrz, Poland. For matters concerning personal data and exercising your rights, email biuro@mrsteel.pl or write to the postal address above. Contact phone number: 570 057 752.

2. Data covered by this policy

This policy covers use of the website, enquiries and contact about MR STEEL’s services. When you contact us, we may process your name, email address, phone number, installation town or address, message content and any photos, plans or other attachments you provide voluntarily.

Only provide data needed to handle your enquiry. Do not send identity documents, health information or other particularly sensitive information. Remove unnecessary information about other people from photos and plans before sending them.

The hosting provider may process technical connection data, such as your IP address, request date and time, the page visited and browser information, as part of server logs and website security.

3. Purposes and legal bases

• Responding to project enquiries, preparing quotations and taking steps at your request before entering into a contract: Article 6(1)(b) GDPR.
• Handling other messages, contacting a customer’s representative and maintaining necessary correspondence: Article 6(1)(f) GDPR. MR STEEL’s legitimate interest is communicating with people interested in its services and handling enquiries.
• Ensuring website security and establishing, exercising or defending legal claims: Article 6(1)(f) GDPR. The legitimate interest is protecting the website, data and MR STEEL’s rights.
• Complying with legal obligations where an enquiry leads to a documentation retention requirement, for example for accounting records: Article 6(1)(c) GDPR.

Sending an enquiry does not subscribe you to a newsletter or constitute consent to marketing. In its current configuration, the new website has no newsletter or automated marketing activities.

4. Providing data is voluntary

Providing data is voluntary. Fields marked as required are needed to respond to and handle your enquiry. We cannot reply without contact details. Attachments and additional project information are optional.

5. Recipients of data

Data may be accessed by authorised MR STEEL personnel and service providers needed to operate the website and handle correspondence, particularly hosting, email and IT support providers. Providers acting on behalf of MR STEEL process data under appropriate agreements and the controller’s instructions.

The hosting and email provider is dhosting.pl Sp. z o.o. Data may also be disclosed to authorities entitled to receive it by law. MR STEEL does not sell user data.

6. How long we retain data

We retain correspondence and enquiry data for as long as needed to respond, prepare a quotation and conclude the related discussions. Once contact ends, data is deleted unless it is needed for ongoing customer service, contract performance, compliance with a legal obligation or the protection of legal claims.

Data required to perform a contract is kept during its performance and then for the period required by applicable law or until the relevant limitation period expires. Further retention is limited in scope and duration to what is necessary for the purpose concerned.

The hosting provider retains technical server logs for a period determined by its configuration and security needs. Contact the controller for information about log retention relating to a specific event.

The form sends messages and attachments to biuro@mrsteel.pl through an authenticated, encrypted SMTP connection. The application does not save copies of attachments in a public directory. Private submission rate-limit records contain an IP address hash and timestamps; records older than 48 hours are removed when subsequent submissions are made.

7. Your rights

Depending on the legal basis and conditions set out in the GDPR, you have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing and data portability. You may also object to processing based on the controller’s legitimate interests on grounds relating to your particular situation.

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact biuro@mrsteel.pl. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). Information on making complaints is available at uodo.gov.pl.

8. Cookies and external services

The website does not use analytics, advertising or CRM. The form uses the essential PHPSESSID session cookie to protect against unauthorised submissions (CSRF). The cookie is marked Secure, HttpOnly and SameSite=Strict and lasts for the session.

The form is protected by Cloudflare Turnstile, provided by Cloudflare, Inc. The service analyses technical data, including IP address, browser and connection information, to distinguish people from bots. Processing serves website security (Article 6(1)(f) GDPR). Cloudflare acts on our behalf to protect the website and in its own capacity to improve bot detection. The terms are described in the Turnstile Privacy Addendum. Pre-clearance mode and its cf_clearance cookie are not enabled.

You can manage cookies in your browser settings. Blocking technical cookies may affect functions that rely on them.

Links to Facebook, Instagram, Oferteo and TikTok open external services only when clicked. Those services process data under their own privacy policies. We do not embed their plugins or content that automatically connects to those services.

9. Transfers outside the European Economic Area

Using Cloudflare Turnstile may involve processing technical data outside the EEA, including in the USA. Information on transfer safeguards, including standard contractual clauses, is provided in the Cloudflare privacy policy. For information about processing on behalf of MR STEEL, contact biuro@mrsteel.pl.

10. Automated decisions and policy changes

Form data is not used for decisions producing legal or similarly significant effects based solely on automated processing, or for profiling. If website functionality or the scope of data processing changes, we will update this policy and state the date of the new version.