Privacy Policy

1. Controller and contact

The controller is Radosław Wachowski, operating Gospodarstwo Rolne Radosław Wachowski under the Wachowski Herbs brand, Bodzewo 57, 63-820 Piaski, Poland. NIP: 6961897715, REGON: 387984551.

Privacy contact: radoslaw@wachowskiherbs.pl, +48 693 958 465.

2. Data processed

Depending on the contact and business stage, we may process:

• company name, full name, email address, optional phone number and message
• the product or page from which the enquiry was sent and that page's address
• for samples or orders: company details, tax ID, delivery address and contact-person data
• technical data needed to deliver and protect the website: IP address, request time and address, and security events

For rate limiting, the IP address is used transiently to create a pseudonymous HMAC digest. The digest and timestamp are used only to prevent abuse. Please do not submit special-category data, such as health data.

3. Purposes and legal bases

• answering an enquiry, preparing a quotation or taking pre-contractual steps — Article 6(1)(b) GDPR where the contacting person is the prospective contracting party
• correspondence with employees or company representatives, B2B relationship handling and sample arrangements — Article 6(1)(f) GDPR; the legitimate interest is business communication and handling a voluntarily submitted enquiry
• accounting, tax and other legal duties — Article 6(1)(c) GDPR
• form protection, abuse prevention, security and establishing or defending claims — Article 6(1)(f) GDPR

Submitting the form does not subscribe the sender to a newsletter or other direct marketing. Any future direct-marketing channel will require a separate and voluntary opt-in where required.

4. Voluntary provision of data

Providing data is voluntary. Company name, full name and email address are required to identify and answer a B2B enquiry. The message and phone number are optional. Delivery data is needed only after a sample shipment has been agreed.

5. Recipients

Data may be disclosed only where needed for the purposes above:

• Hetzner Online GmbH — server hosting and infrastructure in Germany
• Zoho, relevant Zoho group entities and service-specific subprocessors — email services
• authorised IT administration and maintenance providers
• couriers and logistics providers — only after a sample or goods shipment is agreed
• accounting or legal providers and authorised public authorities where required by law or for claims

Data is not sold or shared for another party's own marketing.

6. Transfers outside the EEA

The website is hosted in Germany and email uses Zoho's EU data centre. Zoho states that, in specific technical-support situations, staff in India may access data, while selected features may involve providers outside the EU. Zoho identifies Standard Contractual Clauses and supplementary safeguards for such operations. The scope depends on the service and enabled features. See the Zoho privacy FAQ and subprocessor directory.

After the user deliberately loads the video, data may also be processed by Google/YouTube under Google's rules, which may involve processing outside the EEA.

7. Retention

• pseudonymous form-rate-limit digest — up to 10 minutes
• enquiries and correspondence — while needed to answer and handle the voluntarily initiated relationship, and afterwards only where justified for claims
• sample, order or contract data — during performance and then for statutory and limitation periods
• accounting and tax documents — for the period required by law
• technical and security logs — for the period required by the security purpose and infrastructure configuration, subject to periodic review

After deletion from active systems, copies may remain for a limited period in protected provider backups according to their retention cycle.

8. Cookies and YouTube video

Ordinary browsing does not activate analytics, advertising or first-party tracking cookies. The video is not loaded automatically. A notice about connecting to Google/YouTube is shown first. Only after a click is the player loaded from youtube-nocookie.com. Google/YouTube may then process device data and store or access information under its own rules. The video is optional.

See the Google Privacy Policy.

9. Your rights

Subject to the GDPR conditions, you have rights of access, rectification, erasure, restriction and objection to processing based on Article 6(1)(f). Portability applies only where Article 20 GDPR conditions are met. Where processing relies on consent, consent can be withdrawn without affecting prior lawful processing.

Send a request to radoslaw@wachowskiherbs.pl. We will respond without undue delay, normally within one month. The period may be extended by two further months in GDPR cases; the controller will explain the extension. Identity information may be requested where reasonably necessary.

You may complain to the President of the Polish Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or to the competent supervisory authority in your EEA country.

10. Security and automated decisions

Measures proportionate to risk include HTTPS, request size and rate limits, validation and minimised application logs. Data is not used for profiling or decisions based solely on automated processing.

11. Document changes

The current document version is 2026-08-23. Changes apply from the published version date and do not retroactively change the legal bases or purposes of earlier processing.