Privacy &
cookie policy

Effective from: 15 October 2026

1. General provisions and the Controller

1. This policy is for information purposes and describes how personal data is processed and how cookies are used on the website novofil.pl together with its English version at novofil.eu (the “Website”), dedicated to the NOVOFIL brand. It fulfils the information obligation under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”). This is a translation; in case of any discrepancies the Polish version prevails.
2. The controller of personal data is SPIDWELD SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (a limited liability company) with its registered office in Toruń, Poland (registered office and address for service: ul. Równinna 24/2, 87-100 Toruń), entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001088466; registry court: District Court in Toruń, 7th Commercial Division of the National Court Register; NIP (tax ID) 8792715166; REGON 384126580; share capital PLN 230,000.00 (the “Controller”). The Controller is the authorised distributor of the NOVOFIL brand in Poland.
3. Contact with the Controller: email [email protected], phone +48 530 009 555, or in writing to the registered office address.
4. The Controller has appointed a Data Protection Officer: Michał Wojciechowski, email [email protected], phone +48 530 009 555 ext. 9. You may contact the Data Protection Officer on all matters relating to the processing of your personal data and the exercise of your rights.
5. The Website is informational. It does not sell products, does not contain forms, user accounts or social media plug-ins, and does not load resources (such as fonts) from external servers. NOVOFIL products can be purchased in the online shop centrumspawalnicze.pl (in Polish), which is governed by a separate shop privacy policy.

2. Purposes, legal bases and retention periods

The Controller processes personal data for the following purposes, on the following legal bases and for the following periods:

Where processing is based on the Controller's legitimate interest, the data is processed until an effective objection is raised, but no longer than for the periods indicated above.

3. Recipients and transfers outside the EEA

1. Personal data may be entrusted to processors acting on behalf of the Controller, only to the extent necessary for the given purpose and on the basis of data processing agreements, in particular:
   • the provider of hosting and infrastructure for the Website — EXEA sp. z o.o., registered office in Toruń (ul. Włocławska 167, 87-100 Toruń, Poland), KRS 0000394866; the Website is hosted in a data centre in Poland,
   • the provider of the content delivery network (CDN) and protection of the Website against attacks — Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA); traffic to the Website passes through the Cloudflare network, which processes IP addresses and technical request data (e.g. page address, browser type, connection error reports) in order to deliver the website quickly and securely,
   • providers of email and IT services,
   • entities providing accounting, legal and advisory services to the Controller.
2. Data may be disclosed to public authorities where required by law.
3. The Website's server logs are stored in a data centre in Poland. Cloudflare processes technical request data, as a rule, in the data centre of its network closest to the visitor; the data may, however, be transferred to the United States. Cloudflare, Inc. participates in the EU-US Data Privacy Framework — the transfer is based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection (Art. 45 GDPR) and, additionally, on standard contractual clauses (Art. 46(2)(c) GDPR) included in the data processing agreement. More information: Cloudflare privacy policy.
4. If a service provider processes data outside the European Economic Area, the transfer takes place on the basis of a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission (Art. 46(2)(c) GDPR). You can obtain a copy of these safeguards by contacting the Controller.

4. Voluntary provision of data, profiling

1. Providing data is voluntary. However, without your contact details we will not be able to respond to your enquiry. Server log data is recorded automatically when you use the Website.
2. The Controller does not make decisions about you based solely on automated processing, including profiling, as referred to in Art. 22 GDPR.

5. Your rights

In connection with the processing of your personal data, you have the right to:

• access your data and obtain a copy (Art. 15 GDPR),
• rectification of your data (Art. 16 GDPR),
• erasure of your data — the “right to be forgotten” (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on the Controller's legitimate interest (Art. 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal — for cookies, simply change your choice in the cookie settings,
• lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl — if you consider that the processing infringes the GDPR.

To exercise your rights, write to [email protected] or to the Controller's registered office. We will respond without undue delay and in any event within one month of receiving the request (in specific cases this period may be extended by a further two months, of which we will inform you — Art. 12(3) GDPR).

6. Cookies

1. Cookies are small text files stored on your terminal device (computer, phone) by your web browser.
2. In accordance with Art. 399 of the Polish Electronic Communications Law of 12 July 2024, the Website stores information on your device without consent only where this is strictly necessary to provide the service (necessary cookies). Other categories of cookies are used only with your consent.
3. On your first visit we display a banner in which you can accept all categories, reject the optional ones or choose them in the settings. Until you make a choice, the Website uses only necessary cookies. You can change your choice at any time:Open cookie settings
4. Cookies used on the Website, by category:

5. You can also delete or block cookies in your browser settings. Blocking necessary cookies will cause the consent banner to be shown on every visit. Instructions for popular browsers: Google Chrome, Mozilla Firefox, Microsoft Edge, Safari, Opera.

7. Social media and external links

1. The Website contains only plain links (no plug-ins) to the Controller's profiles on: Facebook, Instagram, YouTube. No data is transferred to the operators of these services unless you click a link.
2. Once you go to an external service (e.g. Facebook and Instagram — Meta Platforms Ireland Ltd.; YouTube — Google Ireland Ltd.; the website of the manufacturer NOVOFIL S.p.A.; the centrumspawalnicze.pl shop), the privacy policies of those services apply. If you contact us via our social media profiles, we process your data in order to handle that communication on the basis of Art. 6(1)(f) GDPR.

8. Data security

The Controller applies technical and organisational measures appropriate to the risk, in particular an encrypted HTTPS connection, a Content Security Policy, limiting the data collected to the necessary minimum and not storing personal data on the Website itself.

9. Final provisions

1. This policy may be updated, in particular in the event of changes in the law or the introduction of new tools on the Website. The current version is always available on this page together with its effective date.
2. Matters not regulated herein are governed by the GDPR, the Polish Act of 10 May 2018 on the Protection of Personal Data and the Polish Electronic Communications Law of 12 July 2024.