Privacy policy
We respect your privacy. Below we explain what data we collect on the dothat.pl website, why, how long we keep it and what rights you have.
Last updated: 22 October 2026
§ 1. General information
This Privacy Policy sets out the rules for processing personal data provided via the dothat.pl website (the contact form with a brief and a quote request, email messages, telephone contact). The processing of data in connection with fulfilling orders and concluded commercial contracts is governed separately – by the order placed (which contains a GDPR information clause accepted by the Customer), the cooperation agreement and the Eblis B&L Principles of Cooperation.
The controller of personal data is Eblis B&L Edyta Lisowska, doing business under the dothat brand, with its registered office in Chorzów, ul. Wolności 4, 41-500 Chorzów, Polish tax ID (NIP) 627-223-98-30, REGON 277862994.
For matters relating to the protection of personal data, please contact us at: biuro@dothat.pl. Full contact details are given in § 11.
§ 2. Purposes and legal bases of processing
We process personal data for the following purposes:
- Handling enquiries and preparing quotes (contact form with a brief, email, telephone) – legal basis: Art. 6(1)(b) GDPR (steps taken with a view to entering into a contract) and, where you act on behalf of a company, Art. 6(1)(f) GDPR (our legitimate interest, i.e. contact with a business customer). We work only with businesses, which is why our form asks for your VAT number / company tax ID.
- Sending commercial information and marketing content by electronic means (email) – legal basis: Art. 6(1)(a) GDPR (consent ticked in the form, voluntary). You can withdraw your consent at any time by writing to biuro@dothat.pl – withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
- Performance of contracts and orders and issuing accounting documents – legal basis: Art. 6(1)(b) and (c) GDPR (obligations arising from tax and accounting regulations).
- Establishing, pursuing or defending claims – legal basis: Art. 6(1)(f) GDPR.
- Operation and security of the website (basic server logs: IP address, date of visit, browser type) – legal basis: Art. 6(1)(f) GDPR.
- Analytics, marketing and remarketing (analytics and marketing cookies) and displaying Google Maps – legal basis: Art. 6(1)(a) GDPR (consent given in the cookie banner or by clicking “Show map”). Details are described in the Cookie Policy.
§ 3. Categories of data processed
Depending on the purpose, we may process the following categories of personal data:
- Identification data: first name, surname, company name, VAT number / tax ID,
- Contact data: email address, telephone number, correspondence address,
- Project data: product, quantity, deadline, budget, project description, uploaded files (e.g. a logo or sketch),
- Technical data: IP address, browser type, operating system, cookie identifiers, device parameters,
- Analytics data: behaviour on the website, time spent on subpages, traffic source (collected only after you give consent).
Providing data is voluntary, but without an email address or telephone number we will not be able to respond to your enquiry, and without company details we will not be able to prepare an offer or fulfil orders.
§ 4. Data recipients – processors
Personal data may be entrusted for processing to the following entities, whose activities are based on standard data processing agreements (DPAs) available in their terms of service:
| Entity | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, spam protection for forms (Turnstile), storage of files uploaded via the form, CDN | EU / USA |
| Neon Inc. | Database (form submissions) | EU (Frankfurt) |
| Google Ireland Ltd / Google LLC | Google Analytics 4 – traffic analytics (with consent), Google Maps on the contact page (after clicking) | EU / USA |
| Meta Platforms Ireland Ltd / Meta Platforms, Inc. | Meta Pixel – ad remarketing (with consent) | EU / USA |
| Adobe Systems Software Ireland Ltd | Adobe Fonts – typefaces | EU / USA |
| Accounting office (external) | Accounting services – only in connection with the performance of contracts (invoices) | Poland |
| Courier companies | Deliveries – only when shipping orders and samples | Poland / EU |
Data may also be disclosed to public authorities where required by law. Personal data is not sold or shared with third parties for commercial purposes. Transfers to third countries (USA) take place on the basis of standard contractual clauses approved by the European Commission (SCC) and the EU-U.S. Data Privacy Framework.
§ 5. Data retention period
- Website enquiries (form, briefs, quote requests) – for the period necessary to handle the enquiry, and thereafter for up to 3 years in the archive (possibility of pursuing claims).
- Marketing consent – until it is withdrawn.
- Orders – for the duration of the contract, and accounting documents for 5 years from the end of the year in which the tax payment deadline expired.
- Data processed on the basis of consent – until consent is withdrawn.
- Cookies – retention periods are described in the Cookie Policy.
§ 6. Your rights
Under the GDPR, you have:
- the right of access to your data (Art. 15 GDPR),
- the right to rectification of your data (Art. 16 GDPR),
- the right to erasure of your data – the “right to be forgotten” (Art. 17 GDPR),
- the right to restriction of processing (Art. 18 GDPR),
- the right to data portability (Art. 20 GDPR),
- the right to object to processing (Art. 21 GDPR),
- the right to withdraw consent at any time – without affecting the lawfulness of processing carried out before consent was withdrawn.
To exercise your rights, write to biuro@dothat.pl.
You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
§ 7. Cookies
The website uses cookies. Cookies from third-party providers (analytics, Google Maps) are set only with your consent, which you give in the banner on your first visit (Art. 399 of the Polish Electronic Communications Law – Prawo komunikacji elektronicznej). You can manage your consents at any time using the “Cookie settings” button in the website footer. Detailed rules are described in the Cookie Policy.
When you fill in the contact form, we temporarily save a draft of it in your browser’s storage (sessionStorage) so that nothing is lost when you move between steps. The draft does not reach us until you submit the form, and it disappears when you close the tab.
§ 8. External links
The website contains links to other websites (including our Facebook and Instagram profiles, the PSI exhibitor directory and Google Maps). Until you click them, they do not transmit any data. These websites operate independently of the Controller and have their own privacy policies, which we recommend you read.
§ 9. Profiling and automated decision-making
The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you. Analytics and marketing cookies are used only to improve the website and to personalise advertising.
§ 10. Changes to the Privacy Policy
The Controller reserves the right to amend this Policy in the event of changes in legislation, technology or the scope of services provided. The current version is always available on this page, and the date of the last update is shown at the beginning of the document.
§ 11. Contact
If you have any questions about this Policy or the processing of personal data, please contact us:
- email: biuro@dothat.pl,
- telephone: +48 667 832 547,
- address: ul. Wolności 4, 41-500 Chorzów.