Privacy and cookie policy

Working draft pending legal review.

1. Data controller

The controller of the personal data processed on the ALIAX website available at aliax.com, and also at aliaxit.com, aliax.pl and aliax.hk (hereinafter: the Website) is:

• NameALIAX IT spółka z ograniczoną odpowiedzialnością
• Registered officeul. Boczna 28, 64-115 Wilkowice
• KRS0001102190
• NIP6972399808
• REGON528440575
• E-mailprivacy@aliaxit.com

Matters concerning personal data can be raised by e-mail at the address given above or by post to the registered office. The controller has not appointed a data protection officer.

2. Scope and purposes of processing

The Website is informational. It requires no account or login and contains no forms through which personal data would be submitted. We process data in three situations.

a) Technical data from server logs

The Website is hosted on the infrastructure of Vercel Inc. The server records technical data for every request in its logs: the IP address, the date and time of the request, the address of the page requested, and the browser and operating system identifier (user agent). This data is needed to display the page, maintain the Website, keep it secure and detect abuse.

b) E-mail correspondence

When you write to us at the e-mail address given on the Website, we process the data contained in the message: first name and surname, e-mail address, company name and position if they appear in the signature, and the content of the correspondence. The purpose is to reply, to discuss possible cooperation and, if it comes about, to prepare and perform a contract. Providing the data is voluntary. Without an e-mail address we cannot reply.

If the correspondence contains data of other people, for example people named as contacts on the company's side, the source of that data is the sender of the message. We process it to the extent provided by the sender and solely for the purpose of conducting that correspondence.

c) Cookies and visit statistics

The Website stores on the user's device the cookies described in section 3. We activate analytics cookies and the associated Google Analytics 4 tool only after consent has been given. The purpose is to count visits and check which pages of the Website are read. With the same consent we also activate the Vercel Web Analytics tool described in section 3.

We do not make decisions about Website users based solely on automated processing, including profiling.

3. Cookies and analytics tools

Cookies are small text files that the browser stores on the user's device at the request of the page visited. The consent settings distinguish three categories.

Category	Use	Retention period
Necessary	One file, ‘aliax_zgoda’, stores the user's decision about cookies. Without it the Website would not remember the choice and would ask for consent on every visit.	180 days
Analytics	Files of the Google Analytics 4 tool (names beginning with ‘_ga’). They make it possible to distinguish visitors, count visits and check which pages are read. Activated only after consent.	13 months from the last visit
Marketing	Not currently used. The category is visible in the settings in case it is activated in the future. Activation requires separate consent and an update of this policy.	not applicable

Consent and changing your decision

On the first visit a bar appears at the bottom of the window with three options: ‘Accept all’, ‘Necessary only’ and ‘Settings’. Until a decision is made, the Website loads no analytics or marketing script and sends the Google tags a default denial signal (Google Consent Mode v2).

The decision can be changed at any time via the ‘Cookie settings’ link in the footer of every page. Withdrawing analytics consent stops the tool and removes its cookies stored in the Website's domain. It does not affect the lawfulness of processing carried out before the withdrawal.

Consent is stored for 180 days. After that time the Website will ask for it again. Cookies can also be deleted or blocked in the browser settings. Blocking the necessary cookies means the Website will not remember the consent decision.

Google Analytics 4

The tool is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records the pages visited, the time and source of the visit, and information about the device and browser, and assigns them to a random identifier stored in a cookie. How Google processes this data is described in Google's documents: the Google Privacy Policy and the information on how Google uses data from sites that use its services.

Vercel Web Analytics

The tool is provided by Vercel Inc. (address in section 6). According to the provider's documentation, the tool does not use third-party cookies and recognises a visitor by a hash calculated from the incoming request; the visitor session is discarded automatically after 24 hours. With each page view the tool may record the time of the event, the page address, the referring page, filtered URL parameters, approximate location (country, region, city), the operating system, the browser and the device type, including their versions. The data is used only for aggregated statistics and is not tied to any individual or IP address. We activate the tool only after analytics consent has been given. Details are described in Vercel's document: Vercel Web Analytics: Privacy and Compliance.

4. Legal bases

We process data on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). The individual purposes rest on the following bases:

• Server logs: Article 6(1)(f) GDPR, the Controller's legitimate interest in maintaining the Website and keeping it secure.
• E-mail correspondence: Article 6(1)(b) GDPR, where the correspondence is aimed at concluding or performing a contract with the data subject and is conducted at their request. Where you write on behalf of a company or institution, the basis is Article 6(1)(f) GDPR: the legitimate interest in replying and maintaining contact with the organisation you represent.
• Necessary cookies: Article 6(1)(f) GDPR, the legitimate interest in keeping the Website working and remembering the user's decision. Storage on the user's device takes place under the Electronic Communications Law (Prawo komunikacji elektronicznej), which does not require consent for files necessary to provide the requested service.
• Analytics cookies, Google Analytics 4 and Vercel Web Analytics: Article 6(1)(a) GDPR, consent given via the cookie bar. Storage on the user's device likewise requires consent under the Electronic Communications Law.
• Marketing cookies: not currently used. Any activation will be based on consent, Article 6(1)(a) GDPR.

5. Retention periods

• Server logs: 1 day. The period follows from the hosting provider's configuration (Vercel, Pro plan).
• E-mail correspondence: for as long as the matter it concerns is being handled, and then for 12 months from the last contact if no cooperation follows. If a contract is concluded, for the duration of its performance and the limitation period for claims under the applicable provisions, and correspondence concerning settlements for the retention period required by tax and accounting law.
• Cookie holding the consent decision: 180 days from the decision.
• Google Analytics 4 cookies: 13 months from the last visit.
• Visitor session in Vercel Web Analytics: 24 hours. The period follows from the provider's documentation.
• Data in the Google Analytics 4 service: 14 months. The period is set in the service configuration.

6. Data recipients

We pass data only to entities needed for the operation of the Website and for conducting correspondence:

• Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States: hosting of the Website. It processes technical data from server logs as a processor. Processing takes place under a data processing agreement (Vercel Data Processing Addendum). The transfer of data to the United States is based on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework, in which Vercel Inc. participates, and on standard contractual clauses. After analytics consent has been given, it also provides the Vercel Web Analytics tool (section 3).
• Google Ireland Limited: the Google Analytics 4 tool, only after consent has been given. The provider may process data outside the European Economic Area. Data may be transferred to Google LLC in the United States; the transfer is based on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework, in which Google LLC participates.
• The e-mail provider we use for correspondence: Google (Google Workspace service).
• Public authorities, where the obligation to disclose data follows from a provision of law.

We do not share data with other entities for marketing purposes.

7. Rights of data subjects

Every person whose data we process has the right to:

• access the data and obtain a copy of it (Article 15 GDPR),
• have the data rectified (Article 16 GDPR),
• have the data erased (Article 17 GDPR),
• have processing restricted (Article 18 GDPR),
• portability of data processed by automated means on the basis of consent or a contract (Article 20 GDPR),
• object to processing based on legitimate interest, on grounds relating to their particular situation (Article 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. Consent to cookies is withdrawn via ‘Cookie settings’ in the footer.

Requests can be sent to the e-mail address privacy@aliaxit.com or by post to the registered office. We respond without undue delay and no later than one month from receipt of the request. In complex cases the period may be extended by a further two months, of which we will inform you within one month of receiving the request.

Anyone who considers that the processing of their data infringes the law has the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl.

8. Changes to the policy

We update the policy when the scope of processing, the tools used or the law change. The current version is always available at this address. Activating a new category of cookies requires the user's separate consent.

Version date: 26 October 2026.