Privacy Policy
This Privacy and Cookie Policy (hereinafter: Privacy Policy) explains how we process your personal data and which cookies are used in connection with your use of the website available at https://color-laboratory.com (hereinafter: Website).
1. Personal data controller
The controller of your personal data is COLOR LABORATORY MD SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Warsaw (02-496), ul. Wolności 24, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS No. 0000435741, NIP 5223000057, REGON 14634263500000, hereinafter referred to as the "Controller" or the "Company".
2. Contacting the Controller
For any matter concerning personal data protection or this Privacy Policy, you can reach us:
- by e-mail: biuro@color-laboratory.com
- by phone: +48 228 824 057
- in writing: Color Laboratory MD sp. z o.o., ul. Wolności 24, 02-496 Warsaw, Poland
3. What data we process, why, and on what legal basis
The Website is informational. It does not require an account, does not sell online and has no newsletter. We process personal data only as described below.
| Purpose of processing | Data | Legal basis |
|---|---|---|
| Handling an inquiry sent through the contact form, including a price inquiry about a specific product | full name, e-mail address, message content and, if you provide them, company name and phone number; the product the inquiry concerns; the language you use the Website in | Article 6(1)(a) GDPR – consent given when submitting the form; for quotation requests also Article 6(1)(b) GDPR – steps taken at your request prior to entering into a contract |
| E-mail or telephone contact about the matter you raise with us, including in order to conclude or perform a contract | full name, contact details, position or represented entity – where applicable, correspondence content | Article 6(1)(b) GDPR – performance of a contract or pre-contractual steps; Article 6(1)(f) GDPR – our legitimate interest in replying to you |
| Verifying your authority to represent our client or business partner | full name, contact details, position or function, details of the represented entity | Article 6(1)(b) GDPR; Article 6(1)(f) GDPR – our legitimate interest in properly serving clients and business partners |
| Protecting the contact form against spam and abuse (Cloudflare Turnstile) | IP address and technical data about your browser and device passed to the provider to distinguish a person from a bot | Article 6(1)(f) GDPR – our legitimate interest in keeping the Website and the form secure |
| Security and proper operation of the Website (server logs) | IP address, date and time of the request, address of the page visited, browser identifier | Article 6(1)(f) GDPR – our legitimate interest in maintaining and securing the Website |
| Website visit statistics (Vercel Web Analytics, cookieless) | address of the page visited, referring page, country, device type, operating system and browser; the IP address is not stored – together with the request data it is used only to determine the country and to create an anonymised visit identifier, which is automatically discarded after 24 hours | Article 6(1)(f) GDPR – our legitimate interest in analysing the popularity of our content in aggregate and improving the Website |
| Archival and evidentiary purposes | data provided in correspondence and in the form | Article 6(1)(f) GDPR – our legitimate interest in securing information that may prove facts of legal significance |
| Establishing, pursuing or defending claims | data provided in correspondence and in the form | Article 6(1)(f) GDPR – our legitimate interest in protecting the Company's interests |
| Meeting our obligations under the GDPR (e.g. keeping records, handling your requests) | data needed to handle the request | Article 6(1)(c) GDPR – legal obligation; Article 6(1)(f) GDPR – our legitimate interest in demonstrating compliance |
4. Do you have to provide your data?
Providing data is voluntary; however, without your name, e-mail address and message we will not be able to reply to an inquiry sent through the form. Company name and phone number are optional.
5. Right to withdraw consent
Where we process your data on the basis of consent, you may withdraw it at any time by writing to biuro@color-laboratory.com. Withdrawal does not affect the lawfulness of processing carried out before it.
6. Profiling and automated decision-making
We do not make automated decisions about you and do not profile your data.
7. Recipients of data
To run the Website we use external service providers, who may have access to your data to the extent needed to provide their services:
- Vercel Inc. – hosting of the Website and visit statistics (Vercel Web Analytics);
- Supabase Inc. – the database in which contact-form inquiries are stored (data is held in a data centre in the European Union, in Frankfurt);
- Resend (Plus Five Five, Inc.) – sending e-mails: the inquiry notification to our office and the confirmation to you;
- Cloudflare, Inc. – anti-spam protection of the contact form (Turnstile);
- Google Ireland Limited – YouTube videos and the Google Maps map embedded on the Website;
- providers of IT, legal and accounting services to the Company, bound by professional secrecy or a data processing agreement.
We may also be required to disclose your data to public authorities under applicable law. We review the lawfulness of every such request.
8. Transfers outside the European Economic Area
Some of the providers listed above are based in the United States (Vercel, Supabase, Resend, Cloudflare, Google). Transfers to the USA take place on the basis of the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework – for certified providers – or on the basis of the Standard Contractual Clauses adopted by the European Commission. Contact-form data is stored in a database located in the European Union.
9. How long we keep data
- Contact-form inquiries and correspondence – for the time needed to handle the matter, then until the limitation period for any claims expires;
- Data connected with concluding or performing a contract – for the term of the contract, then until the limitation period for claims and any statutory retention periods (e.g. tax) expire;
- Server logs – for as long as needed to secure the Website, no longer than 12 months;
- Visit statistics – the visit identifier is discarded after 24 hours; we keep only aggregated, anonymous statistics that cannot identify you;
- Data processed on the basis of consent – until consent is withdrawn;
- Data processed on the basis of legitimate interest – until an effective objection is raised or the purpose is achieved;
- Data connected with our GDPR obligations – until the limitation period for our liability as controller expires.
After these periods the data is deleted or anonymised.
10. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy of it;
- rectify your data;
- erase your data;
- restrict processing;
- object to processing based on legitimate interest;
- data portability;
- withdraw consent at any time;
- lodge a complaint with a supervisory authority – in Poland the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw) – if you believe we process your data unlawfully.
To exercise these rights, contact us as described in section 2. These rights are not absolute – in some situations the law may allow us to refuse a request; we do so only after careful review and we explain why.
11. Cookies
The Website itself does not set cookies for analytics, marketing or tracking and does not use such tools (e.g. Google Analytics). We measure visits with Vercel Web Analytics, which works without cookies (see section 3).
On selected pages, however, we embed content from third-party providers, who may store cookies on your device within their own domains once that content loads:
- YouTube (Google) – videos on the home page, the About us page and selected product pages (privacy-enhanced mode: cookies only once playback starts);
- Google Maps (Google) – the directions map on the Contact page.
This content is loaded only after you give your consent in the banner shown on your first visit (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law). Until you consent, the video or map is replaced by a notice with an option to load it. You can withdraw or change your consent at any time by clicking "Cookie settings" in the Website footer; withdrawal does not affect the lawfulness of earlier processing. Your choice is remembered for 6 months in the strictly necessary cookie cl_consent, which does not require consent.
The contact-form protection (Cloudflare Turnstile) is necessary for the form to work and does not require consent. Details are in our Cookie Policy.
12. Changes to this Privacy Policy
We may update this Privacy Policy, in particular when the services we use or the applicable law change. The current version is always available on this page.
This Privacy Policy is effective as of 17 September 2026.