Privacy policy
- Last updated
- 4 August 2026
- Law as at
- 4 August 2026
This policy explains what personal data we collect through completio.pl, why, on what legal basis, whom we pass it to, and what rights you have. It describes what the site actually does, rather than a generic template.
1. Who is the controller of your data
The controller of personal data is COMPLETIO Sp. z o.o., with its registered office in Warsaw, ul. Nałęczowska 33 lok. 22, 02-922 Warszawa, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register, under KRS number 0000689649, VAT no. PL1251659725, REGON statistical number 367970493, share capital PLN 500,000.00.
Data Protection Officer
The controller has appointed a Data Protection Officer: Marek Pióro (CISA, CISM, CGEIT, CRISC, CDPSE). You can reach him on any matter concerning the processing of your personal data and the exercise of the rights set out in section 9 at iod@completio.pl.
Contact for data protection matters
| Channel | Details |
|---|---|
| Data Protection Officer | iod@completio.pl |
| biuro@completio.pl | |
| Telephone | +48 22 888 51 01 |
| Postal address | COMPLETIO Sp. z o.o., Sales Office, Al. Jana Pawła II 24, 05-250 Radzymin, Poland |
In all matters concerning personal data you may contact us at biuro@completio.pl or by post at the correspondence address given above. At those addresses we receive and handle all requests arising under the GDPR, including requests for access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. The scope of those rights is set out in section 9.
2. What this policy covers
This policy covers data we collect through the completio.pl website: from forms, from newsletter sign-ups, and from analytics tools if you consent to them.
This policy does not cover the processing of data in the performance of fulfillment and logistics contracts. That is governed by separate arrangements in customer contracts, including data processing agreements.
The site has no sales, cart, payments or user accounts. No contract can be concluded through it. The rules for using the site are set out in the Terms of service, and information about cookies and local storage in the Cookie policy.
3. What data we collect, why, and on what basis
3.1. Quote form and contact form
The forms serve to prepare an offer and to answer your enquiry. Through them we collect:
| Data | Purpose |
|---|---|
| first name and surname | identifying the contact person |
| company name | preparing an offer for the right entity |
| e-mail address, telephone number | getting back to you with an offer |
| online store address | matching the quote to the scale of your business |
| estimated monthly parcel volume | pricing the service |
| message content | handling the enquiry |
| the address of the page the form was sent from, and the language version of the site | routing the enquiry to the right team |
| the wording of the consent, its version and a timestamp | demonstrating what you consented to and when (accountability, Article 5(2) GDPR) |
Legal bases:
- Article 6(1)(f) GDPR (legitimate interests) — handling your enquiry and conducting business correspondence. Our legitimate interest is replying to an enquiry you sent us yourself.
- Article 6(1)(b) GDPR — where the enquiry leads to a contract: steps taken at your request prior to entering into a contract, and then its performance.
- Article 6(1)(c) GDPR — tax and accounting obligations, if settlement follows.
- Article 398 of the Polish Electronic Communications Law — the consent collected with the form covers contact by telephone and SMS only, rather than the processing of the data itself, which rests on legitimate interests. Without that consent we will not call you or send you an SMS. Replying by e-mail to an enquiry you addressed to us yourself does not require consent.
Providing your data is voluntary, but without an e-mail address or telephone number we will not be able to reply.
Ticking the consent boxes on the form is not the basis for processing your enquiry. The enquiry is handled under Article 6(1)(f) GDPR, so withdrawing consent for one channel does not interrupt correspondence already under way. The consents govern one thing only: which channel we may use to reach you — telephone, SMS or e-mail. You tick each channel separately and you can withdraw each one independently.
3.2. Newsletter
If you sign up for the newsletter, we process your e-mail address in order to send you information about fulfillment and e-commerce.
Legal bases: Article 6(1)(a) GDPR (your consent) and Article 398 of the Act of 12 July 2024, the Electronic Communications Law, which prohibits sending commercial information without the recipient's prior consent.
You may withdraw your consent at any time, without giving a reason. Withdrawal does not affect the lawfulness of mailings sent earlier.
The prior-consent requirement under Article 398 of the Electronic Communications Law covers business recipients as well, not only natural persons. A work address on a company domain does not remove the need for consent.
3.3. Recruitment
Through the form on the Careers page we accept job applications together with an attached CV. We collect: your first name and surname, e-mail address, telephone number, the position the application relates to, the content of your message and the CV file.
Legal bases: Article 6(1)(b) GDPR (steps taken prior to entering into a contract) for the data listed in Article 22(1) of the Polish Labour Code, and Article 6(1)(a) GDPR (your consent) for the data you provide on your own initiative beyond that list, for example a photograph in your CV.
Where your CV goes. The submission is received by the form handling provider, after which the automation platform moves it together with the attachment to a dedicated folder on Google Drive, accessible only to the people running recruitment at Completio and to the agency that maintains the site. The detail is set out in section 5. Whom we pass data to.
How long we keep applications. We keep application documents for 12 months from the close of the recruitment process to which the application related. If you give separate consent to take part in future recruitment processes, we also keep them for 12 months from the date that consent was given. Once those periods expire, the documents are deleted.
3.4. Site usage statistics
If you consent to the analytics category, we collect data about how the site is used: pages visited, entry source, device type, and approximate location derived from an anonymized IP address.
Legal basis: Article 6(1)(a) GDPR (your consent). The technical detail is set out in the Cookie policy.
3.5. Technical data on the hosting side
The site is hosted on the infrastructure of Vercel Inc. The hosting provider processes standard technical data associated with serving network requests, including IP addresses, in order to deliver the page and maintain security.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in keeping the site running and secure.
A data processing agreement (Article 28 GDPR) is in place with the hosting provider. Technical logs are retained for the period that follows from the configuration of the service at the provider.
4. How long we keep data
We keep data for as long as is necessary for the purpose for which it was collected and, once that purpose has been achieved, for the period that follows from the law or from the limitation of claims. The table below sets out the periods we apply.
| Category of data | Retention period | Where the period comes from |
|---|---|---|
| enquiries that did not lead to a contract | 12 months from the last contact | the time needed to handle the enquiry and to resume the conversation if it is taken up again |
| candidates' application documents | 12 months from the close of the recruitment process and, where consent to future recruitment is given, 12 months from the date it was given | decision of the controller, see section 3.3 |
| data relating to a concluded contract | the term of the contract and, afterwards, until claims become time-barred | performance of the contract and the establishment and pursuit of claims; the limitation period follows from the Polish Civil Code |
| accounting and tax records | 5 years counted from the end of the calendar year in which the tax payment deadline fell | statutory obligation |
| e-mail address signed up to the newsletter | until consent is withdrawn | follows from the basis of processing |
| records of consent (wording, version, timestamp) | for the period of processing based on consent and, afterwards, until claims become time-barred | accountability, Article 5(2) GDPR |
| analytics data | 14 months | the default setting of the measurement tool |
| the record of your cookie consent decision | see the Cookie policy |
Once the periods indicated have expired, we delete or anonymize the data. Where the same set of data is subject to several periods at once, for example contract data and accounting records, we apply the longest of them.
5. Whom we pass data to
Data may reach the following categories of recipient. Those visible from the site's code are named.
5.1. Form handling provider
Forms on the site are sent through the Web3Forms service, which receives the submission and forwards it to our mailbox. The service is a product of Web3Creative, a company registered in India, and its servers are located in the United States. The provider states that it does not store submission content, while its server logs may contain personal data and are deleted every two months.
The key identifying the form (access_key) is public by design in this service and is visible in the page's code. That is how the service works and it is not a leak: the key allows a submission to be sent to a preconfigured address, but grants access to no data. The safeguard against abuse is a hidden bot-trap field.
A data processing agreement (Article 28 GDPR) is in place with the form handling provider. The rules governing transfers of data outside the European Economic Area are set out in section 6.
5.2. Automation platform
Form submissions are collected from the form handling provider by the Make automation platform (Celonis SE, Germany), which passes them on: to Completio's mailbox and, in the case of recruitment applications, also to a dedicated folder on Google Drive. A data processing agreement is in place with the provider.
5.3. Where application documents are stored
CV files submitted through the recruitment form are stored on Google Drive (Google Ireland Limited), in a dedicated folder with restricted access. Access is limited to the people running recruitment at Completio and to the agency that maintains the site, under the data processing agreement in place.
5.4. Hosting provider
The site is hosted by Vercel Inc. (United States).
5.5. Analytics and maps provider
Google Ireland Limited (Ireland) for Google Analytics 4, Google Tag Manager and Google Maps, where the analytics tools run only after you give consent and the map only after consent to third-party content.
5.6. Other recipients
Depending on the matter your data relates to, its recipients may also include the following categories of entity (Article 13(1)(e) GDPR). We list them as categories because their composition changes over time:
- the e-mail service provider,
- the CRM system provider,
- the warehouse management system (WMS) provider,
- carriers and courier companies,
- postal operators,
- providers of telecommunications and telephony systems,
- the accounting office and the tax adviser,
- the law firm,
- providers of IT and technical support services, including the agency that maintains the site,
- providers of document archiving and document destruction services,
- insurers and entities involved in the pursuit of claims,
- public authorities, where they approach us on the basis of the law.
Entities that process data on our behalf do so under a data processing agreement (Article 28 GDPR) and only to the extent necessary to perform the service. Public authorities that approach us on the basis of the law are not recipients within the meaning of Article 4(9) GDPR.
6. Transfers outside the European Economic Area
Some recipients are established, or hold infrastructure, outside the EEA. The basis for the transfer is different for each of them, and we separate them below according to the actual position.
| Recipient | Where to | Basis for the transfer |
|---|---|---|
| Google (Analytics 4, Tag Manager, Maps) | United States, via Google Ireland Limited | Article 45(1) GDPR — Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU-U.S. Data Privacy Framework. Google LLC holds an active certification under that framework. The provider additionally applies standard contractual clauses. |
| Vercel (hosting) | United States | Article 45(1) GDPR — as above; Vercel Inc. holds an active certification under the EU-U.S. Data Privacy Framework. The data processing agreement additionally incorporates the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, that is Article 46(2)(c) GDPR. |
| Make (automation) | Germany, within the EEA | A transfer within the EEA — no transfer tool under Chapter V GDPR is required. |
| Web3Forms (form handling) | India (the provider's seat), United States (servers) | Article 46(2)(c) GDPR — the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, entered into together with the data processing agreement. The basis here is neither the EU-U.S. Data Privacy Framework, because the provider is not an entity under United States law, nor an adequacy decision, because India is not covered by one. |
You may obtain a copy of the safeguards applied to transfers outside the EEA by writing to the address given in section 1.
7. Do we take automated decisions
No. We take no decisions concerning you based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
The site does not build a visitor profile. Statistics, once enabled, are aggregate in nature.
8. Security
The connection to the site is encrypted (HTTPS), and the server enforces encryption on subsequent visits as well. The site applies a content security policy restricting the sources from which scripts and other assets may be loaded, and forbids the site from being embedded in a frame on third-party pages.
Form validation in the browser is a convenience feature. It is not a security control, because submissions are received by an external service.
9. Your rights
In connection with the processing of your data you have the right to:
- access your data and obtain a copy of it (Article 15 GDPR),
- rectification of inaccurate data and completion of incomplete data (Article 16 GDPR),
- erasure of your data (Article 17 GDPR),
- restriction of processing (Article 18 GDPR),
- portability of data processed on the basis of consent or a contract (Article 20 GDPR),
- object to processing based on our legitimate interests, on grounds relating to your particular situation (Article 21(1) GDPR), and to object to processing for direct marketing at any time and without giving reasons (Article 21(2) GDPR),
- withdraw consent at any time where processing is based on it; withdrawal does not affect the lawfulness of processing before it (Article 7(3) GDPR).
You can make a request by writing to biuro@completio.pl or by post to the address in section 1. We reply without undue delay and at the latest within one month; in complex cases that period may be extended by a further two months, of which we will inform you (Article 12(3) GDPR).
Complaint to the supervisory authority
If you consider that we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office:
| Address | ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland |
| Telephone | +48 22 531 03 00 |
| kancelaria@uodo.gov.pl |
10. Changes to this policy
We update this policy when the tools used on the site, the scope of processing, or the law change. The current version is always available at this address, and the date of the last update and the state of the law appear at the top of the document.
We will announce changes material to your rights visibly on the site, and where processing is based on consent and a change goes beyond its scope, we will ask for consent again.