Privacy policy

The controller of personal data processed in connection with the use of the tigaset.com website is:

TIGASET spółka z ograniczoną odpowiedzialnością
ul. Zawodzie 20, 80-726 Gdańsk, Polska
KRS: 0001245983 · NIP: 5833570770 · REGON: 544954570
email: info@tigaset.com

For matters related to personal data protection, please contact us at the above email address with the subject line "Personal data". The controller has not appointed a Data Protection Officer.

We process personal data for the following purposes:

• Handling contact form and quotation requests — first and last name, email address, phone number (optional), role/company (optional), message content, and language of correspondence.
• Business correspondence — data provided in the course of exchanging messages, including information on the investment, project, schedule, and budget.
• Contract performance and settlement — identification and contact data of persons representing the counterparty, and data required to issue and store accounting documents.
• Documents submitted through the forms — attachments such as BOQs, specifications, technical drawings, project documentation, land information, investment memoranda, financial or project models and execution scope documentation. Please upload only data and documents you are entitled to share. Attachments may contain contact persons’ details or other personal data; we process them solely to handle the enquiry and prepare a proposal.
• Website security — IP address, request headers, and basic technical logs.
• Compliance with legal obligations — in particular tax and accounting obligations.

Data is processed under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR):

• Art. 6(1)(b) GDPR — taking steps at the request of the data subject prior to entering into a contract, and contract performance;
• Art. 6(1)(c) GDPR — compliance with legal obligations to which the controller is subject;
• Art. 6(1)(f) GDPR — legitimate interests of the controller (correspondence, defence and pursuit of claims, direct marketing of the controller's own products and services, website security);
• Art. 6(1)(a) GDPR — the data subject's consent, where consent is required.

• Business correspondence data — for the duration of the correspondence and up to 3 years thereafter.
• Data related to concluded contracts — for the period necessary to establish, pursue or defend claims, taking into account the limitation periods applicable to the specific type of claim.
• Data contained in accounting documents — for the period required by Polish tax and accounting law (as a rule, 5 years).
• Technical logs — no longer than 12 months.

Data may be entrusted to trusted service providers, only to the extent necessary to fulfil the processing purposes. Categories of recipients:

• hosting and website platform provider (Lovable / Cloudflare Workers, EU / EEA and global edge network);
• database backend and authentication provider (Supabase, EU region);
• transactional email provider (handling contact form notifications);
• accounting office, law firms and consulting entities — under separate agreements;
• authorised state authorities — under applicable law.

The website uses a global edge infrastructure (Cloudflare). As a result, data may be transferred to third countries (outside the EEA). Such transfers take place on the basis of Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR) or on the basis of adequacy decisions where applicable. A copy of the safeguards may be obtained by contacting the controller.

In connection with the processing, you have the right to:

• access your data and obtain a copy (Art. 15 GDPR);
• rectification of data (Art. 16 GDPR);
• erasure of data (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR);
• withdraw consent at any time, where processing is based on consent (without affecting the lawfulness of processing carried out before withdrawal);
• lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

Please direct requests to info@tigaset.com.

Providing personal data is voluntary but necessary to respond to an enquiry submitted via the contact form or by email, and to conclude and perform a contract.

Personal data is not processed in a way that leads to automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR.

We apply technical and organisational measures appropriate to the risks associated with processing, including: encryption of connections (HTTPS/TLS), role-based access control, event logging, and data processing agreements with service providers.

This policy may be updated. The current version is always available at /polityka-prywatnosci on tigaset.com. The date of the last update appears at the top of the document.