Privacy policy

This policy explains what personal data we collect through wdw-nordics.com, why we collect it, how long we keep it and what rights you have.

1. Who is responsible for your data

The controller of your personal data is WDW Nordics Sp. z o.o., ul. Świętokrzyska 17/9, 20-867 Lublin, Poland (KRS 0001178892, NIP PL7123495037).

In Norway we operate through our branch WDW Nordics Sp. z o.o. NUF (org. no. 935 754 305 MVA), which is part of the same company.

For privacy questions, write to inquiries@wdw-group.eu. We have not appointed a data protection officer, as this is not required for our business.

2. Which rules apply

We process personal data in line with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). It applies across the EU and, through the EEA Agreement, in Norway.

National rules on cookies and similar technologies also apply: in Norway the Electronic Communications Act (ekomloven) section 3-15, in Sweden the Electronic Communications Act (2022:482) chapter 9 section 28, in Denmark the Cookie Order (cookiebekendtgørelsen) and in Finland the Act on Electronic Communications Services (917/2014) section 205. This policy is also available in Norwegian, Swedish, Danish and Finnish.

We never ask for national identity numbers through this website.

3. What data we collect and why

Enquiry and quote form. Name, company, email address, phone, country, your message and attachments (drawings, bills of materials, instructions). We use them to answer your enquiry and prepare a quote. Legal basis: steps taken before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries from businesses and communicating with their representatives (Article 6(1)(f)).

Email and phone. When you write or call us directly, we process the data you give us for the same purposes and on the same legal basis.

Cooperation and contracts. We use contact details of clients and principals to perform the contract, invoice and communicate on site (Article 6(1)(b) and (f)) and to meet accounting and tax obligations (Article 6(1)(c)).

Technical data (server logs). On each visit the server records the IP address, date and time, the page opened, browser and operating system type and the response code. We need this to keep the website secure and detect abuse (Article 6(1)(f)).

Filling in the form is voluntary, but without an email address or phone number we cannot reply. Please do not include personal data in attachments that is not needed for the quote.

4. Cookies and videos

This website does not use analytics or marketing cookies. We do not use Google Analytics, advertising pixels or tracking tools. Fonts and images are served from our own server. That is why there is no cookie banner.

YouTube videos load only when you click the player. Until then your browser does not connect to Google’s servers. After the click the video plays in privacy-enhanced mode (youtube-nocookie.com), and Google may store information in your browser and process your data, including outside the EEA. Clicking is your consent (Article 6(1)(a) GDPR and the national cookie rules). Google’s privacy policy: policies.google.com/privacy.

If we ever add tools that require consent, we will ask first, and withdrawing consent will be as easy as giving it.

5. Who we share data with

• our hosting provider cyber_Folks S.A. (Poland), which runs the website and the form;
• our email service provider;
• WDW Group Sp. z o.o. (Lublin), which handles enquiries and projects with us;
• accountants and legal advisers when needed;
• public authorities when the law requires it.

We have data processing agreements with our service providers (Article 28 GDPR). We do not sell data or share it for marketing.

6. Transfers outside the EEA

Data is stored on servers in the EEA. If a provider processes data outside the EEA, this happens only on the basis of a European Commission adequacy decision (such as the EU-US Data Privacy Framework) or the EU standard contractual clauses.

7. How long we keep data

• enquiries that do not lead to a contract: 24 months after the last contact;
• data related to a contract: for the term of the contract and until claims become time-barred;
• accounting records: as long as accounting law requires (in Poland, and under the Norwegian Bookkeeping Act, generally 5 years after the end of the financial year);
• server logs: only as long as needed for security, unless needed to investigate an incident.

After that we delete or anonymise the data.

8. Your rights

• access to your data and a copy (Article 15);
• rectification (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• data portability (Article 20);
• objection to processing based on our legitimate interest (Article 21);
• withdrawal of consent at any time, without affecting earlier processing.

Write to the address in section 1. We reply without undue delay and within one month at the latest. It is free of charge. We may ask you to confirm your identity.

9. Complaints

You can lodge a complaint with the data protection authority in the country where you live or work, or where the alleged infringement took place. Our lead supervisory authority is the Polish authority UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. In the Nordic countries:

• Norway: Datatilsynet, datatilsynet.no;
• Sweden: Integritetsskyddsmyndigheten (IMY), imy.se;
• Denmark: Datatilsynet, datatilsynet.dk;
• Finland: Office of the Data Protection Ombudsman, tietosuoja.fi.

Please contact us first and we will try to resolve the matter directly.

10. Security

The website uses encrypted connections only (HTTPS). Only people who need them for their work have access to enquiries and attachments. Files sent through the form are attached to the email and then removed from the server; they are not publicly accessible.

11. Profiling and children

We do not make automated decisions or use profiling. The website is aimed at businesses, not children, and we do not knowingly collect data about minors.

12. Changes

If we change how we process data, we will update this policy and the date below. Version 1.0, effective from 4 October 2026.