Last updated: 11 September 2026

Privacy Policy

Below we explain how MERXFORMA processes the data of people visiting the website, contacting us, and representing customers, suppliers and business partners.

1. Data controller

The controller of personal data is MERX FORMA Michał Makohon, an entrepreneur registered in Poland, place of business: Prószków, NIP: 9910531880, EU VAT: PL9910531880.

For matters concerning personal data, contact us at kontakt@merxforma.com. The controller has not appointed a Data Protection Officer.

2. What data we process

Depending on the type of contact or cooperation, we may process:

• name and surname, position, company name, NIP and details of the represented organisation;
• email address, telephone number and identifier used in a messaging service;
• correspondence content, subject of the enquiry and attachments submitted voluntarily;
• quotation, contract and billing data, delivery address and payment details;
• driver, recipient or authorised person data when needed for delivery or collection;
• IP address, device and browser type, address of the page visited, time of visit and information stored in server logs;
• image, time and location of presence recorded by warehouse CCTV;
• after consent: online identifiers and information about use of the website collected by Google Analytics 4.

We do not ask you to submit special-category data, such as information about health, beliefs, religion or origin. Do not include such data in the form or attachments.

3. Purposes and legal bases

4. Where we obtain data

We most often receive data directly from you through a form, email, telephone, WhatsApp, a B2B platform, social media, a meeting or in connection with performance of a contract.

In B2B relationships, we may also receive business contact details from your employer, a contracting party, a referrer or public sources such as a company website, CEIDG, KRS, an industry directory or a public professional profile. In that case, we usually process your name and surname, position, company and business contact details. We provide the information required under Article 14 GDPR no later than upon first contact, unless a statutory exception applies.

5. Warehouse CCTV

The MERXFORMA warehouse premises in the Września and Gulczewko area are covered by video surveillance to protect property. Cameras cover the warehouse premises, entrances, yards and loading zones. CCTV does not cover toilets, changing rooms or other rooms where particular privacy is expected, and it does not record sound.

We retain recordings for no longer than 30 days, after which they are automatically overwritten or deleted. If a recording is evidence of an incident or is needed to establish, pursue or defend claims, we may secure the relevant segment until the case is finally concluded or the applicable limitation period expires.

Recordings may be accessed only by authorised persons and, where necessary, the CCTV technical service provider, security provider, insurer, law firm or authorised public authority. The monitored area is marked before entry, and full information is available in this policy.

6. Data recipients

Data may be received only by entities that need it to perform a specific task:

• authorised MERXFORMA employees and associates;
• OVHcloud as the website hosting and server infrastructure provider;
• Google, in particular as part of Google Workspace and Google Analytics 4;
• Meta Platforms when you contact us through WhatsApp, and operators of other communication platforms chosen by you;
• the accounting office, banks and payment service providers;
• transport, courier and forwarding companies and warehouse operators;
• IT, security and technical support service providers;
• law firms, debt collection entities, insurers and public authorities where there is a legal basis.

Entities acting on our behalf process data under an agreement and in accordance with our instructions, unless the law assigns them the role of an independent controller.

7. Transfers outside the EEA

Use of Google and Meta services may involve processing data outside the European Economic Area, particularly in the United States. The providers declare that they use mechanisms required by law, such as adequacy decisions, including the EU–US Data Privacy Framework for certified entities, and the European Commission's standard contractual clauses.

More information is available in the Google Privacy Policy and the WhatsApp Privacy Policy.

8. How long we retain data

• enquiries that did not result in a contract: up to 12 months from the last contact, unless further retention is needed to establish or defend claims;
• data related to a contract and order: for the duration of contract performance and then until expiry of the applicable limitation period for claims;
• accounting and tax documents: for the period required by applicable law;
• data used for marketing: until an objection is made, required consent is withdrawn or the purpose ceases; we may retain minimal data about an objection so that we do not contact you again;
• evidence that consent was given or withdrawn: for the period needed to demonstrate compliance and defend against claims;
• server logs: for the period resulting from the hosting provider's settings and terms, no longer than needed for security, diagnostics and protection against abuse;
• CCTV recordings: up to 30 days, with the option of securing the relevant segment for the duration of investigating an incident or conducting proceedings;
• Google Analytics data: event data for 2 months and user data for 14 months; aggregated reports may remain available for longer;
• the analytics decision stored in the browser: 6 months, unless you change it earlier or we change the scope or version of consent.

9. Your rights

Within the limits provided by the GDPR, you have the right to:

• access your data and receive a copy;
• rectify your data;
• erase your data or restrict its processing;
• data portability where processing is based on consent or a contract and is carried out by automated means;
• object to processing based on a legitimate interest, including an unconditional objection to direct marketing;
• withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise your rights, write to kontakt@merxforma.com. We may ask for information necessary to confirm your identity.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office: ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.

10. Cookies and similar technologies

The website uses the browser's local storage to remember the language and the analytics decision. These mechanisms are necessary to retain selected settings. The language preference remains in the browser until deleted by the user. The analytics decision is valid for 6 months.

After you consent, we launch Google Analytics 4 with measurement ID G-HCV58KM5MP. The service may set cookies, in particular those beginning with _ga, and collect information about the device, approximate location, source of the visit and use of pages. Google Analytics is not loaded before consent.

You can reject analytics as easily as accepting it and change your decision at any time using the “Cookie settings” button. After consent is withdrawn, we stop any further loading of analytics and delete Google Analytics cookies accessible to the website. You can also delete cookies and local storage in your browser settings.

11. Voluntary provision and automated decisions

Providing data is voluntary, but without contact details and information needed for the matter concerned, we may be unable to respond, prepare a quotation or perform a contract. Data required on an invoice or in transport documentation may be necessary by law or to perform a contract.

We do not make decisions about you that produce legal effects or similarly significantly affect you based solely on automated processing. Google Analytics helps us create statistics and analyse use of the website, but we do not use it to make such decisions.

12. Policy changes

We update this policy when processes, providers, tools or laws change. The date of the current version is stated at the beginning of the document. If a change affects the scope of consent given, we will ask for it again.

Back to home page Cookie settings