Privacy Policy
Version 1.0 — effective November 3, 2026
Version 1.0 — 3 November 2026. This policy explains which personal data PolyMatch processes, why, for how long, with whom, and how to exercise your rights. It applies to visitors of the site, registered Users, contact persons of listed companies, whether registered or not, and recipients of our e-mails.
1. Controller
[First name SURNAME], sole trader (CEIDG), [registered address], Poland, NIP [NIP]. Contact for any question about your data: contact@polymatch.eu. PolyMatch has not appointed a data protection officer, as this appointment is not mandatory for its activity.
2. Which data, why, on what basis, for how long
| Data | Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| User account: surname, first name, job function, business e-mail, phone if provided, language, preferred units, password (hashed), notification preferences | Create and manage your account, authenticate you, notify you | Performance of the contract (Art. 6(1)(b)) | Duration of the account, then deletion within 30 days; security logs follow their own period |
| Company: legal name, addresses, identification and VAT numbers, sites, logo, certificates, generic contact e-mail address | List the Company, put it in contact, invoice it | Performance of the contract; legitimate interest (listing after the end of the contract) | As long as the Company is listed, then statutory periods |
| Content: technical data sheets, grades, photos, projects, messages, offers, shared documents, reasons for a choice | Provide the services (extraction, matching, leads, messaging, offers) | Performance of the contract | Duration of the listing or of the match; message threads archived after 3 months of inactivity and kept as long as both Companies exist |
| Acceptance of the terms and consents: version, date, language, certified profile, newsletter choice | Prove what was accepted | Legal obligation and legitimate interest (evidence) | 6 years after the end of the contract |
| Activity log: actions performed in the Platform (ranking displayed, sheet opened, comparison, lead sent, e-mail sent), errors | Security, traceability, usage measurement, improvement of the service | Legitimate interest | 24 months |
| Technical data: IP address, browser, login timestamps, result of the anti-bot check | Security, rate limiting, abuse prevention | Legitimate interest | 12 months at most |
| Billing: billing address, invoices, payment references (never card numbers, which are kept by the payment provider) | Invoice, keep the accounts | Legal obligation (accounting, tax) | 5 years from the end of the tax year concerned |
| Newsletter: e-mail, language, opens | Send you our news | Consent (Art. 6(1)(a)) | Until consent is withdrawn |
| Unregistered companies: company name, published technical data sheets, contact e-mail address published by the company, and where applicable the name, function and business contact details of a contact person made public by the company or handed over by it (business card, trade fair) | Build a reference base of recycled materials; inform a company that a buyer is looking for one of its materials; invite it to register | Legitimate interest (Art. 6(1)(f)): professional matchmaking based on information the company has itself published | Until objection, registration of the company or removal of its sheets; reviewed every 3 years |
| Data received from another Company after an unlock: identity and contact details of your counterparts | Enable the introduction | Performance of the contract | Duration of the match and of the project |
| Support requests, reports, complaints | Answer them, take the necessary measures | Performance of the contract; legitimate interest | 3 years after closure |
Data marked as mandatory in the forms is necessary to create the account or to provide the service; without it, the service cannot be provided.
3. Where the data comes from
From you, when you create an account, complete your company or use the Platform; from your Company or its Administrator, when they invite you; from another Company, after an unlock; from public sources for unregistered companies (the company's website, published catalogues and technical data sheets, trade fairs, business cards handed over by the company). When we contact an unregistered company for the first time, the e-mail states the source of the data and how to object.
4. Third-party data in your content
If you enter personal data of third parties in the Platform (contacts of subcontractors or customers, persons named in documents or messages), your Company is the controller of that data within the meaning of the GDPR and PolyMatch processes it on its behalf under the Data Processing Agreement (Annex 1 to the Terms). Limit such data to what is necessary.
5. Artificial intelligence and automated decisions
The Platform uses artificial intelligence services to extract the properties of technical data sheets, analyse photos of material and certificates, standardise and translate texts, propose a weighting of criteria and write ranking explanations. The content sent to these services consists of technical documents, project descriptions and messages; the matching engine does not receive the identity of the Buyer. Messages are translated by an AI service: avoid writing unnecessary personal data in them. No decision producing legal effects concerning you is taken in an automated way: rankings are indicative and the activation of a company account is decided by a person.
6. Who receives your data
- Other Companies: before an unlock, a Supplier sees of the Buyer only its country, region and specification, and a Buyer sees neither the name of the Grade nor that of the Supplier; after the unlock, each party sees the identity and business contact details of the other party's contacts.
- Our technical service providers, who act only on our instructions and under a data processing agreement (table below).
- Authorities, where the law requires it.
| Category of provider | Role | Place of processing |
|---|---|---|
| Database hosting, authentication, file storage | Run the Platform | European Union (Ireland) |
| Site and processing execution | Serve the pages, run the functions | European Union (Dublin); provider established in the United States |
| Extraction and document rendering engines | Analyse technical data sheets, produce PDFs | European Union |
| E-mail sending | Notifications and contractual e-mails | European Union (France) |
| Anti-bot protection and file backup | Security, backup copy | Global network; provider established in the United States |
| Cache and rate limiting | Security, performance | European Union |
| Artificial intelligence services | Extraction, standardisation, translation, ranking | European Union or United States depending on the service |
| Address entry assistance | Complete an address in the forms | United States |
| Online payment | Collect payments and invoice | European Union |
| Audience measurement (with your consent) | Visit statistics | European Union |
The named list of these providers, with their role, country and the applicable transfer safeguard, is set out in Annex B of the Data Processing Agreement; it is accessible to client Companies in My company (Contract documents) and provided on request to contact@polymatch.eu.
7. Transfers outside the European Union
Your data is hosted in the European Union. Some providers are established in the United States or may access the data from there: the transfer then relies on an adequacy decision (EU–US Data Privacy Framework) or on the European Commission's standard contractual clauses, supplemented by technical measures. You may request a copy of these safeguards from contact@polymatch.eu.
8. Security
Encryption of communications (TLS) and of data at rest at the host; access control per Company and per role down to the database; authentication with protection against compromised passwords; logout after 7 days of inactivity; anti-bot check on registration and login; technical secrets kept in a dedicated vault; encrypted backups; logging of administration actions; automated tests before each release.
9. Cookies
The cookies used and your choices are described in the Cookie Policy.
10. Your rights
You may obtain a copy of your data, rectify it, request its erasure, request the restriction of its processing, object to processing based on legitimate interest, receive your data in a portable format and withdraw a consent at any time.
- Access and portability: the "Download my data" button in your settings produces a file containing what you have entered or done yourself on the Platform. The full detail of the processing concerning you may be requested in writing; we reply within one month.
- Rectification: your profile and the My company page.
- Erasure: the "Delete my account" button in your settings deletes your personal account; the closure of a Company is requested from My company by an Administrator. Data subject to a retention obligation (invoices, proof of acceptance) is kept for the statutory period and then deleted.
- Objection: for unregistered companies, each e-mail contains a link to stop being contacted and to request the removal of the sheets; for the newsletter, an unsubscribe link.
- Any request may also be sent to contact@polymatch.eu. We may ask for reasonable identity verification.
You may lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority of your country of residence.
11. Minors
The Platform is reserved for adult professionals. We do not knowingly collect data from minors.
12. Changes
We publish each new version with its date. Substantial changes are notified by e-mail to registered Users at least fourteen days before they take effect.