Privacy policy

1. Data controller

The controller of your personal data is D&D Group spółka z ograniczoną odpowiedzialnością, registered office in Ostrów (Ostrów 418A, 37-700 Przemyśl, Poland), entered in the register of entrepreneurs of the National Court Register under KRS number 0000419185 by Sąd Rejonowy w Rzeszowie, XII Wydział Gospodarczy KRS (District Court in Rzeszów, 12th Commercial Division), NIP 7952525245, REGON 180840200 ("we").

For anything about your personal data, write to vitalii@ddtransco.com, call +48 728 603 505 or send a letter to our registered office. We have not appointed a data protection officer.

2. What this website does

The website presents the company and its services. It has no user accounts, does not store form data and uses no cookies, analytics or advertising tools. Fonts, scripts and images load from our hosting provider's server (Vercel), with no other third-party services.

The enquiry form neither sends nor stores anything. When you click the button, your email app opens a ready message to us. The data reaches us only when you send it, and from then on we handle it like any other email.

3. What data, why and on what legal basis

Enquiries and correspondence (email, including a message from the form, and phone):

• data: email address, name, phone number, company and job title if you give them, and the content of the message or call, such as the route, cargo and date;
• purpose: to answer your enquiry and prepare a quote and, once we agree, to conclude and perform the transport or forwarding contract;
• legal basis: Art. 6(1)(b) GDPR when you yourself are the party to the contract or ask us to prepare one; Art. 6(1)(f) GDPR when you write or call on behalf of a company: our legitimate interest is then contact with the client and its staff about the order.

Performing orders: after a contract is concluded, we also process the data of contact persons at loading and unloading and other data needed for the transport and its documents, such as the CMR consignment note; legal basis: Art. 6(1)(b) or (f) GDPR. We usually receive contact persons' data from the client who places the order.

Invoicing and claims: Art. 6(1)(c) GDPR (duties under tax and accounting law) and Art. 6(1)(f) GDPR (establishing, pursuing and defending claims).

Technical data: on every visit, the hosting provider's server logs, among other things, your IP address, the date and time, the page visited and browser details. They serve the website's security and help find errors; legal basis: Art. 6(1)(f) GDPR. We do not combine them with other data.

Giving your data is voluntary, but without contact details we cannot answer your enquiry or prepare a quote.

4. Who receives the data

• Vercel Inc. (USA): website hosting and server logs. Data may go to the USA under the European Commission's decision on the EU-US Data Privacy Framework, under which Vercel is certified, and standard contractual clauses (you can get a copy by writing to us).
• Google (Google Workspace): our email service, including messages with enquiries. Google may also process data outside the European Economic Area, including in the USA, under the European Commission's decision on the EU-US Data Privacy Framework, under which Google LLC is certified, and standard contractual clauses (you can get a copy by writing to us).
• Carriers and partners we commission: only to the extent needed for the transport, such as the address and contact person at loading and unloading. When a transport ends outside the European Economic Area, such data also goes to partners in the destination country, because the transport cannot be performed otherwise (Art. 49(1)(b) and (c) GDPR).
• Our accounting office, legal advisers and public authorities when the law requires it.

We do not sell data or pass it to other companies for advertising.

5. How long we keep the data

• enquiries that did not lead to a contract: up to 12 months after the last message, so that we can pick up the conversation for a later order, unless you ask us to delete them sooner;
• correspondence and documents about contracts: while they are performed, then until the limitation periods for claims expire;
• accounting records: 5 years from the end of the year in which the tax payment deadline passed;
• server logs: briefly, under the hosting provider's rules.

6. Your rights

You have the right to access your data and get a copy, to have it corrected, erased or its processing restricted, and to data portability where we process it by automated means on the basis of a contract. You may also object at any time to processing based on our legitimate interest. Write or call us: we will answer without undue delay and within one month at the latest.

You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in the country where you live or work.

7. Cookies

The website stores no cookies or other data on your device, for example in browser storage. We use no analytics or advertising tools, so there is no cookie banner. If this changes, we will first update this policy and ask for consent where the law requires it.

8. Security

The website works only over an encrypted connection (HTTPS) and sends security headers that make it harder, among other things, to embed it in other sites or to run third-party scripts on it. We never ask for passwords or card details through the website or by email.

9. Automated decisions

We make no automated decisions about you and do not profile you within the meaning of the GDPR.

10. Changes

If we change this policy, we will update the date at the top of the page. The policy is available in Polish, English and German; the Polish version is binding.