Custom Wrought Iron Gates, Railings & Metal Sculptures
Master Artistic Blacksmiths since 2005

Custom Wrought Iron Gates, Railings & Metal Sculptures

Master Artistic Blacksmiths since 2005

PL EN

Privacy Policy

Privacy and cookie policy of mbnylec.com
Last updated: 12 October 2026

1. Data controller

The controller of personal data processed in connection with the use of the website mbnylec.com (the “Website”) is Mieczysław Nylec, running a business under the name M.B. Mieczysław Nylec, Sandomierska 55, 39-200 Dębica, Poland, Tax ID (NIP) 8721319799, REGON 180114669, e-mail: mbnylec@gmail.com.

We process personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, “GDPR”).

The Website is informational: it presents the products and projects of our workshop and allows you to contact us. You cannot place an order, create an account or make a payment on the Website.

2. What data we process

Depending on how you use the Website, we may process:

  • your name, e-mail address, the subject and the content of your message, entered in the contact form,
  • data you send us by e-mail or give us by phone, for example the address of the property, dimensions, photos or a project,
  • data needed to prepare a quote, to conclude and perform a contract and to issue sales documents,
  • your IP address and technical data about your device and browser,
  • information about how the Website is used, collected by Google Analytics – only if you give your consent.

Providing data is voluntary, but without an e-mail address we cannot reply to your enquiry.

3. Purposes and legal bases

  • Replying to an enquiry and preparing a quote or an offer – Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and otherwise Article 6(1)(f) GDPR (our legitimate interest in corresponding with you).
  • Concluding and performing a contract (design, manufacture, delivery, installation) – Article 6(1)(b) GDPR.
  • Meeting our accounting and tax obligations – Article 6(1)(c) GDPR.
  • Handling complaints and warranty claims and establishing, pursuing or defending legal claims – Article 6(1)(f) GDPR.
  • Visit statistics (Google Analytics) – Article 6(1)(a) GDPR (the consent you give in the cookie banner).
  • Keeping the Website secure and working properly (server logs) – Article 6(1)(f) GDPR.

4. Who receives the data

Data may be passed on only to the extent needed for a given purpose, to:

  • providers of hosting and IT infrastructure,
  • our e-mail provider,
  • Google Ireland Limited / Google LLC – Google Analytics (only with your consent) and YouTube (embedded videos),
  • Vimeo – when a page shows an embedded Vimeo video,
  • Cloudflare, Inc. – Turnstile, which protects our contact form from spam,
  • transport and installation companies – when an order is carried out,
  • our accountants, lawyers and public authorities, where the law requires it.

We do not sell personal data.

5. How long we keep the data

  • Correspondence and enquiries that do not lead to an order – until the conversation ends and then for no longer than 3 years (the limitation period for possible claims).
  • Copies of messages sent through the contact form, kept in the Website’s administration panel – up to 12 months, after which they are deleted automatically.
  • Data related to a contract – for the time it is performed, for the warranty period and until claims become time-barred.
  • Accounting records – for the period required by tax law (as a rule, 5 years from the end of the tax year).
  • Data processed on the basis of consent – until you withdraw your consent.
  • Server logs – for the period set by the hosting provider, usually no longer than a few weeks.

6. Your rights

Within the scope set out in the GDPR, you have the right to:

  • access your data and receive a copy of it,
  • have your data rectified,
  • have your data erased,
  • restrict processing,
  • data portability,
  • object to processing based on our legitimate interest,
  • withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal,
  • lodge a complaint with a supervisory authority – in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa), or the data protection authority of the EU country where you live or work.

In matters concerning personal data, please write to mbnylec@gmail.com or to our postal address.

7. Cookies

Cookies are small text files that your web browser saves on your device.

The Website remembers in your browser the choice you made in the cookie banner; without it the banner would appear on every visit.

Google Analytics is loaded and its cookies are saved only after you click “Accept”. If you click “Decline”, no statistics are collected and the Website works exactly the same.

You can change your decision at any time with the “Cookie settings” link at the bottom of every page. You can also delete or block cookies in your browser settings.

Embedded YouTube and Vimeo videos connect to the servers of those services and may save their own cookies under the providers’ rules.

8. Google Analytics

We use Google Analytics 4 for visit statistics, for example which pages are viewed, from what type of device and from where visitors come to the Website. The tool runs only after you give your consent. We do not use Google Analytics for advertising or to build advertising profiles. More information is available in Google’s privacy policy: policies.google.com/privacy.

9. Contact form

A message sent through the contact form goes to our e-mail inbox and is used only to reply to your enquiry. A copy of each message is also kept in the Website’s administration panel, so that no enquiry is lost if an e-mail does not arrive; these copies are deleted automatically after 12 months.

To protect the form from spam we use Cloudflare Turnstile. When you open a page with the form, Turnstile checks whether the visitor is a person, using technical data such as your IP address and information about your browser and device. It does not use advertising cookies. The legal basis is our legitimate interest in protecting the Website from spam and abuse (Article 6(1)(f) GDPR). More information is available in Cloudflare’s privacy policy.

10. Videos and social media profiles

Some pages show embedded videos from YouTube and Vimeo. When a video loads, your browser connects to the servers of the service concerned.

Links to our Facebook, Instagram and YouTube profiles are ordinary links: data is passed to those services only when you click a link and visit their pages, under their own privacy policies.

11. Server logs

The server records standard technical information: IP address, time of the request, the address of the page visited, the address of the page you came from and information about your browser. This data is used only to administer the Website and keep it secure.

12. Transfers outside the European Economic Area

Google, Vimeo and Cloudflare may also process data in the United States. Such transfers are based on a European Commission adequacy decision (the EU-U.S. Data Privacy Framework) or on standard contractual clauses.

13. Profiling, security and children

We do not make decisions based solely on automated processing and we do not profile users. The connection to the Website is encrypted (HTTPS), and only authorised persons have access to the data. The Website is not directed at children.

14. Changes to this policy

This policy may change when the law, the way the Website works or the tools we use change. The current version is always available on this page. The rules for using the Website are set out in the Terms of Use.