Privacy Policy

The data controller is ARSO Steel Sp. z o. o., ul. Gdańska 89/1, 85-022 Bydgoszcz, Tax ID (NIP): 9671482232, KRS: 0001140519.

Contact the controller at: zapytania@arsosteel.com or by phone at +48 519 44 39 38.

We collect personal data only to the extent necessary for the purposes set out below. This may include:

• identification data (first name, surname, job title),
• contact data (e-mail address, phone number),
• company data (company name, tax ID, address),
• data contained in RFQs and business correspondence,
• password for an ARSO DEALS or auction account, stored only in hashed, irreversible form,
• technical data (IP address, cookies, see §6). When an ARSO DEALS account is registered, the IP address is additionally recorded as proof of consent, see §7.

Personal data may be shared with:

• IT service providers (hosting, e-mail), strictly to the extent necessary to provide those services,
• accounting and legal service providers,
• carriers and freight forwarders, for the purpose of delivery,
• the Polish Ministry of Finance, through the Whitelist of VAT payers (wl-api.mf.gov.pl): the Tax ID (NIP) submitted when registering an ARSO DEALS account is automatically checked against this register,
• the European Commission, through VIES (VAT Information Exchange System): for foreign counterparties, the EU VAT number is checked against this system on the same terms.

We do not sell personal data. We do not transfer data to third countries outside the EEA.

• Data from RFQs (without a resulting contract): 12 months from the last contact.
• Contract data: 5 years from the end of the tax year in which the contract expired (tax obligation).
• Early-access (waitlist) data: until consent is withdrawn or the project ends.
• Technical logs: 30 days.
• An ARSO DEALS account whose submitted Tax ID (NIP) was not confirmed by the register and which was not granted access: 30 days from registration, after which the data is deleted automatically.
• An ARSO DEALS or auction account the user has stopped logging into: 24 months from the last login. We send a warning e-mail 30 days before deletion, to the address provided at registration.

arsosteel.com uses two categories of cookies:

• Essential session cookies: required for the site to function (e.g. the contact form, preview mode). No consent is required.
• deals_session: session cookie for an ARSO DEALS account, valid for 30 days, required to keep you logged in. No consent is required.
• Analytics (Plausible.io): we use Plausible Analytics, a privacy-friendly statistics tool. Plausible does not use cookies, does not collect personal data, and does not enable cross-site tracking. Data is anonymous and processed in accordance with GDPR. More information: plausible.io/data-policy.
• Analytics (Google Analytics 4): we use Google Analytics with Consent Mode v2. Until you click “Accept” in the cookie banner the tool runs without cookies. Once consent is given it stores the _ga and _ga_* cookies (up to 2 years) used to distinguish sessions and devices. Advertising signals and remarketing are permanently disabled. The provider is Google Ireland Limited. More information: policies.google.com/technologies/cookies. To withdraw consent, clear this site's data in your browser — the banner will reappear.

You can block standard cookies in your browser settings. This will not affect the site's functionality.

When registering an ARSO DEALS account, the submitted Tax ID (NIP) is automatically checked against the Whitelist of VAT payers (Polish companies) or VIES (foreign companies, see §4). This is a decision made in a fully automated way, without human involvement, as referred to in Art. 22 GDPR:

• if the register clearly confirms that the submitted Tax ID does not exist or the company is not registered, account access is refused automatically,
• if the register does not respond (technical failure or the daily query limit has been reached), access is granted and the account is flagged internally for manual review.

If you believe an automated refusal of access to an ARSO DEALS account is a mistake, write to zapytania@arsosteel.com. A person, not a system, will review the case and make the decision manually.

At registration we also record the IP address as proof that consent to the terms of use (and, if given, marketing consent) was granted, together with a timestamp.

Under GDPR you have the following rights:

• Access to your data (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16 GDPR),
• Erasure of data, the "right to be forgotten" (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Portability of data (Art. 20 GDPR),
• Objection to processing (Art. 21 GDPR),
• Withdrawal of consent at any time (without affecting prior processing).

Send requests to: zapytania@arsosteel.com. We respond within 30 days.

You have the right to lodge a complaint with the President of the Polish Data Protection Authority (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

We reserve the right to amend this policy. The current version is always available at /en/polityka-prywatnosci. We will notify you of material changes via the site or by e-mail (if you are on our mailing list).