Skip to content

Privacy policy

Last updated: 14 October 2026

1. General provisions

  1. This Privacy policy explains how personal data are processed on this website, which presents the products of ECOBEN BIOTECH sp. z o.o. to business partners. The Website does not sell products online, has no customer accounts and does not process payments.
  2. Personal data are collected on the Website only through two forms (the contact form and the B2B enquiry form) and, technically, in server logs. We also process the data of people who contact us by email or phone.

2. Definitions

  • Controller: ECOBEN BIOTECH sp. z o.o., ul. Zabrska 28B, 44-177 Paniówki, Poland, tax number (NIP/VAT) PL9691676092, entered in the register of entrepreneurs of the National Court Register of Poland (KRS) kept by Sąd Rejonowy w Gliwicach, X Wydział Gospodarczy KRS, under KRS number 0001210623.
  • Website: this website and all its subpages and language versions.
  • User: a natural person who uses the Website or contacts the Controller, including a person acting on behalf of a company or other organisation.
  • GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

3. The Controller and the applicable law

  1. The Controller is the controller of personal data within the meaning of the GDPR. The Controller is established in Poland, so the GDPR applies to all processing described in this policy, wherever the User is located.
  2. If the User is located outside the European Economic Area, the data protection law of their own country may also apply and give them additional rights. The Controller respects those rights to the extent that such law applies to it.
  3. All matters relating to personal data can be sent to shop@ecoben.co.uk.

4. What data we process

  1. Contact form: name, email address, phone number (optional) and the content of the message.
  2. B2B enquiry form: name, email address, phone number (optional) and the content of the message.
  3. Email and phone: the data the User gives us, for example their name, email address, phone number, company details and the content of the correspondence.
  4. Server logs: technical data described in section 11.

Please do not send us more personal data than needed to answer your question, and in particular no special categories of data (for example health data).

5. Purposes, legal bases and retention periods

PurposeLegal basis (GDPR)Retention period
Replying to messages sent through the contact form, by email or by phoneArt. 6(1)(a) (the consent given in the form) and Art. 6(1)(f) (the Controller’s legitimate interest in communicating with people who contact it)until the matter is resolved and then for as long as needed to show how it was handled, but no longer than the limitation period for possible claims; data processed on the basis of consent until consent is withdrawn
Handling B2B enquiries: answering questions, sending samples, preparing and negotiating an offerArt. 6(1)(f) (the Controller’s legitimate interest in answering business enquiries from companies and their representatives); where the User acts on their own behalf, Art. 6(1)(b) (steps taken at the User’s request before entering into a contract); and Art. 6(1)(a) (the consent given in the form)for the time needed to handle the enquiry and follow up the offer; if cooperation begins, for the duration of the business relationship and then until the limitation periods for claims expire
Sending further commercial information about our products to business contactsArt. 6(1)(f) (the Controller’s legitimate interest in maintaining business relationships), only in connection with an enquiry or existing cooperation, and subject to the rules on electronic communications that apply to the Useruntil the User objects or the business contact ends
Meeting accounting and tax obligations if cooperation begins (for example invoices)Art. 6(1)(c) (legal obligation)for the period required by accounting and tax legislation
Establishing, exercising or defending legal claimsArt. 6(1)(f) (the Controller’s legitimate interest)until the limitation periods for claims expire
Ensuring the technical operation and security of the Website (necessary cookies, server logs)Art. 6(1)(f) (the Controller’s legitimate interest)as set out in sections 10 and 11
  1. The Controller does not send newsletters and does not use the data collected on the Website for marketing to consumers.
  2. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, nor processing based on another legal basis set out above.

6. Recipients of the data

  1. Personal data are shared only to the extent needed for the purposes above, with:
    • the website hosting provider, Hostido, on whose servers the Website and the form submissions are stored;
    • the provider of the Controller’s email service, through which messages and form notifications are sent and received;
    • other IT service providers that support the Controller, under data processing agreements;
    • courier and transport companies, if we send samples or goods;
    • the accounting firm, if cooperation begins;
    • the Controller’s employees and associates who need the data to handle the matter.
  2. Data may be disclosed to public authorities only where the law requires it.

7. Transfers outside the European Economic Area

  1. The Controller processes personal data within the European Economic Area and does not transfer them to third countries on its own initiative.
  2. If the User is located outside the European Economic Area, our replies and offers are sent to the address the User has given us, because this is necessary to answer their enquiry.

8. Automated decision-making and profiling

The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning the User or similarly significantly affect them.

9. The User’s rights

  1. The User has the right to request access to their personal data, rectification, erasure (the ‘right to be forgotten’) and restriction of processing, and the right to data portability. They also have the right to object at any time to processing based on the Controller’s legitimate interest, including processing for commercial communication, and, where processing is based on consent, the right to withdraw consent at any time.
  2. To exercise these rights, the User can write to shop@ecoben.co.uk or to the Controller’s postal address.
  3. The User has the right to lodge a complaint with a supervisory authority. The Controller’s lead supervisory authority is the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. Users in the European Economic Area may also lodge a complaint with the data protection authority of the country where they live, where they work or where the alleged infringement took place. Users outside the European Economic Area may also contact the data protection authority of their own country, where local law provides for this.
  4. Providing personal data is voluntary. However, the fields marked as required in the forms are necessary for us to reply; without them we cannot handle the message or enquiry.
  5. The Controller may refuse to erase personal data if keeping them is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

10. Cookies

  1. Cookies are small text files that a website stores on the visitor’s device.
  2. At present, the Website uses only cookies that are strictly necessary for it to work and to be secure, set by the WordPress platform and the plugins that run the Website (for example, to protect the forms and for the administrators’ login). Strictly necessary cookies do not require consent.
  3. The Website does not currently use cookies or other tools for analytics, advertising or tracking. If such tools are introduced, we will update this policy and ask for Users’ consent before enabling them.
  4. The User can delete or block cookies in their browser settings. Blocking strictly necessary cookies may stop some functions of the Website, such as the forms, from working properly.

11. Server logs

  1. Like most websites, the Website keeps a record of the requests made to the server (server logs). These include the IP address, the date and time of the request, the address of the page requested and the previous page (referrer), information about the browser and operating system, and information about errors.
  2. Log data are used solely for administering and securing the Website and are not used to identify Users. They are kept only for as long as needed for that purpose and are available only to the people authorised to administer the Website and to the hosting provider.

12. Data security

The Controller uses appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access to the form submissions is limited to authorised persons.

13. Changes and contact

  1. We may update this policy, for example when the functions of the Website change. The current version is always published on this page, with the date of the last update.
  2. Questions and requests concerning personal data can be sent by email to shop@ecoben.co.uk, by post to ECOBEN BIOTECH sp. z o.o., ul. Zabrska 28B, 44-177 Paniówki, Poland, or by phone on +48 32 428 10 20 on working days. Other contact details are on the Contact page.