Privacy Policy

The most important points in brief

• Grandis is a manufacturer of made-to-measure furniture, not an online shop. We do not sell goods or accept payments through the website. The forms are used for contact, booking a measurement, preparing a quotation and handling the project.
• We collect only the data needed to reply to you and to work with you. We do not sell data and do not share it for the advertising purposes of other companies.
• Analytics cookies (Google Analytics) and advertising cookies (Meta Pixel, Google Ads tags) operate only with your consent. You can change your consent at any time — click the cookie icon in the lower left corner of the screen or the “Cookie settings” link in the footer.
• Artificial intelligence tools help our staff prepare texts. Prices, offers and cooperation are always decided by a human.
• You have the right of access to your data, and the rights to rectification, erasure, restriction, portability and objection. Write to: bobiditrade.pl@gmail.com. We reply within one month.

1. Data controller and contact

For all matters concerning personal data, contact us by email or by post at the address above. This policy applies to the website grandis-trade.pl in all its language versions (the “Website”), as well as to contact with us by telephone, email and messaging apps. It describes how we apply Regulation (EU) 2016/679 of the European Parliament and of the Council (Regulation (EU) 2016/679 (GDPR)), the Act of 10 May 2018 on the protection of personal data, the Act of 18 July 2002 on the provision of services by electronic means, and the Act of 12 July 2024 — the Polish Electronic Communications Law (Prawo komunikacji elektronicznej, PKE).

2. Where we get your data and what data it is

If you represent a company (e.g. in a business brief), we may also receive your business contact details from your colleagues or from public registers (KRS, CEIDG). Please do not give us special categories of data (e.g. health data) — we do not need them.

3. Purposes, legal bases and retention periods

Where we process data on the basis of a legitimate interest (point (f)), you may object at any time — we will then stop, unless we demonstrate compelling legitimate grounds or the data is needed to defend claims. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

5. Who we share data with

Authorised employees and associates of Grandis have access to the data — each to the extent needed for their work, through an individual access code. We also use external providers who process data on our behalf (processors) under data processing agreements or data processing terms:

The following may be separate data controllers: accounting firms, banks and payment operators (when settling the contract), transport and installation companies and subcontractors carrying out part of the order, law firms, insurers, and public authorities where required by law. We share with them only the data necessary for the given task.

6. Transfers of data outside the European Economic Area

Some providers are based or have servers outside the EEA. We then transfer data only with the safeguards required by Chapter V of the GDPR:

• USA — to companies certified under the EU-US Data Privacy Framework (European Commission decision of 10 July 2023 finding an adequate level of protection), and in other cases on the basis of the standard contractual clauses approved by the Commission (Art. 46(2)(c) GDPR);
• Telegram — data of accounts registered in the EEA is stored in data centres in the Netherlands. Telegram group companies established outside the EEA (including in the United Arab Emirates and the British Virgin Islands) access it on the basis of standard contractual clauses. Telegram's representative in the EU within the meaning of Art. 27 GDPR is the European Data Protection Office (EDPO) — contact form.

The text of the safeguards is publicly available: the Data Privacy Framework decision, the list of certified companies and the standard contractual clauses (Commission Decision (EU) 2021/914).

7. Artificial intelligence

Our employees use language models of an external provider (USA, DPF or standard contractual clauses) to prepare drafts of replies or offers, translations and draft documents more quickly. The model receives the content needed for the task — e.g. the description of your enquiry and your first name. Files and photos from the quotation form are not passed to AI.

• Every text prepared with the help of AI is reviewed and approved by a human. The price, the offer and the decision on cooperation are never the result of solely automated processing.
• We use the business (API) version of the services, in which, under its terms, the provider does not use submitted data to train its models.
• Visualisations and graphics on the Website may be created with the help of AI tools; we do not use clients' likeness for this without their consent.

9. Cookies and similar technologies

Cookies are small files stored in the browser. Browser storage (localStorage, sessionStorage) works in a similar way. In accordance with Art. 399 PKE, we store and read such information without your consent only where it is necessary for the Website to function. For all the rest — analytics and advertising — we ask for consent in a banner on your first visit.

Essential (no consent required)

Analytics (only with consent)

We use Google Consent Mode v2: until you give consent, Google Analytics and Google Ads do not store cookies and receives only anonymous signals without identifiers. After you click “Essential only” we delete any Google Analytics cookies stored earlier. Pixels and advertising cookies are described in section 10.

Changing your decision at any time: the cookie icon in the lower left corner of the screen, the link “Cookie settings” or the same link in the footer of every page. You can also delete or block cookies in your browser settings — some functions (e.g. the client panel, chat) may then not work.

Umami statistics run on our server and do not use cookies or identifiers that would allow a person to be recognised.

10. Pixels and advertising cookies (Meta, Google)

We promote our services on Meta (Facebook, Instagram) and Google. To understand which ads lead to enquiries and to show ads to people who have already visited the Website (remarketing), we use or may use the tools described below. They work only with your consent given in the cookie banner (the “Accept” button). Without consent they are not loaded and do not store cookies.

• What data: IP address, browser and device information, the address of the page visited and of the referring page, cookie identifiers and events on the Website, e.g. a page view or a form submission (only the fact of submission, not the content of the form). Meta and Google may link this information to your account on their services if you are logged in.
• Legal basis: your consent — Art. 6(1)(a) GDPR and Art. 399 PKE. Consent is voluntary, and refusing it does not limit your use of the Website.
• Roles: for the collection of data by the Meta Pixel and its transmission to Meta, we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR) under the Meta Controller Addendum; Meta carries out further processing, such as ad delivery, as a separate controller. Google Ireland Ltd. processes data from Google Ads tags as a separate controller under the Google Ads data protection terms.
• Transfers outside the EEA: data may be transferred to Meta Platforms, Inc. and Google LLC in the USA. Both companies participate in the EU-US Data Privacy Framework and also use standard contractual clauses (see section 6).
• How long: until consent is withdrawn; cookie lifetimes are shown in the table. Data transferred to Meta and Google is retained in accordance with their policies.
• Withdrawing consent: the cookie icon in the lower left corner of the screen or the “Cookie settings” link → “Essential only”. From that moment the Meta Pixel and Google advertising tags are not loaded. You can delete previously stored cookies in your browser settings.

More information and ad settings: Meta Privacy Policy, Meta ad settings (activity off Meta), Google Privacy Policy, how Google uses data from partner sites, Google ad settings.

11. Enquiries from forms in ads on Facebook and Instagram

Some of our ads on Facebook and Instagram contain a contact form (Meta Lead Ads, “instant form”). You fill it in without leaving for the Website, and after you click “Submit”, Meta passes your enquiry to us.

• What data: name, phone, email and answers to the questions in the form, as well as which ad, campaign and form the enquiry came from and the date it was sent. Meta may automatically pre-fill some fields with data from your Facebook or Instagram profile — you can correct them before submitting. We receive the data only after you submit the form.
• Purpose and legal basis: contacting you about the enquiry, booking a measurement, preparing a quotation and offer — Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract); assessing which ads bring enquiries — Art. 6(1)(f) GDPR (our legitimate interest).
• Roles: the controller of the data in the enquiry we receive is BOBIDI TRADE sp. z o.o. The form is displayed and operated on its services by Meta Platforms Ireland Ltd. — in this respect (displaying the form, pre-filling fields, storing the submitted data) Meta processes data as a separate controller, in accordance with its privacy policy. We use enquiry data under Meta’s Lead Ads Terms: we do not sell it and do not use it for other purposes without your consent. Transfers of data by Meta to the USA (Meta Platforms, Inc.) are based on the EU-US Data Privacy Framework and standard contractual clauses (see section 6).
• What happens next: the enquiry automatically goes to our CRM system (server in the EEA) and, as a notification, to the team’s internal Telegram chat — just like enquiries from forms on the Website (recipients — section 5).
• How long: as for enquiries from the Website — 3 years from the last contact if no contract is concluded; once a contract is concluded — as described in section 3.
• Your rights: the same as for other enquiries (section 12), including erasure of data and objection to assessing ad effectiveness. Write to: bobiditrade.pl@gmail.com.

12. Your rights

• access to your data and receiving a copy of it (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16),
• erasure of data — the “right to be forgotten” (Art. 17),
• restriction of processing (Art. 18),
• portability of data we process on the basis of consent or a contract (Art. 20),
• objection to processing based on legitimate interest, including, at any time, to direct marketing (Art. 21),
• withdrawal of consent at any time — as easily as it was given.

Write to bobiditrade.pl@gmail.com or by post. We will reply without undue delay, and at the latest within one month; in complex cases we may extend the deadline by a further two months — we will then inform you of this. We may ask for information confirming your identity so as not to disclose data to an unauthorised person. Exercising your rights is free of charge.

Complaint: you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.