Privacy Policy

Effective date: 4 October 2026

This Privacy Policy explains how Caldermark Prosta Spolka Akcyjna ("Caldermark", "we", "us") processes personal data when you visit a Caldermark-operated website, contact us, request a demo or quotation, submit an ISO certification intake, communicate with us about a project, or otherwise interact with us in a business context.

This policy applies to Caldermark corporate websites and to product websites that expressly identify Caldermark P.S.A. as their operator. A product may publish an additional privacy notice where its processing activities differ materially from those described here.

1. Data controller

The controller is:

Caldermark Prosta Spolka Akcyjna ul. Sw. Filipa 23 lok. 3 31-150 Krakow, Poland KRS 0001263631 NIP 6762726709 REGON 545582260 Share capital: PLN 10,000 Email: info@caldermark.com

2. Personal data we may process

Depending on how you interact with us, we may process:

• identification and business contact data, such as name, company, job title, email address and telephone number;
• company and project information supplied in an enquiry, assessment, demo request, quotation request or certification intake;
• correspondence and records of our communications;
• documents that you choose to upload or send to us;
• contract, order, billing and transaction data where a commercial relationship exists;
• technical data generated when you use our websites, such as IP address, date and time, requested page, browser/device information, security events and server logs;
• cookie, preference and analytics data where the relevant technology is used and, where required, you have consented;
• any other personal data you voluntarily provide in connection with a legitimate business purpose.

Please do not send special-category personal data or confidential third-party personal data unless they are necessary for the requested service and you are authorised to provide them.

3. Purposes and legal bases

We process personal data only where we have a lawful basis. The main purposes are:

Website operation and security

We process technical logs, security events and limited device/network information to operate, protect, troubleshoot and improve our websites and systems. The legal basis is our legitimate interest in operating secure and reliable digital services (Article 6(1)(f) GDPR), and where applicable performance of a contract or steps requested before entering into a contract (Article 6(1)(b) GDPR).

Enquiries, demos, assessments and project discussions

We process contact details and the content of your request so that we can respond, evaluate requirements, prepare a proposal, schedule a demo or assessment, and communicate about a possible project. The legal basis is Article 6(1)(b) GDPR where the processing is necessary to take steps at your request before entering into a contract, and Article 6(1)(f) GDPR for ordinary B2B relationship management and correspondence.

ISO certification intake and certification coordination

Where you submit a certification intake, we process the company, contact, scope, security, documentation and uploaded information needed to assess the requested certification route, prepare documentation, coordinate the audit process and administer the service. The legal basis is Article 6(1)(b) GDPR and, where applicable, Article 6(1)(f) GDPR. Data may be shared with the independent certification body and other specifically involved service providers where this is necessary for the requested certification process.

Contract performance and customer administration

We process data required to conclude and perform contracts, deliver services, provide support, manage orders and communicate with authorised customer representatives. The legal basis is Article 6(1)(b) GDPR.

Accounting, tax and legal obligations

We process data contained in invoices, accounting records, corporate records and other documents where retention or disclosure is required by law. The legal basis is Article 6(1)(c) GDPR.

Establishment, exercise or defence of legal claims

We may retain and use relevant records where reasonably necessary to document transactions, prevent abuse, resolve disputes or establish, exercise or defend legal claims. The legal basis is Article 6(1)(f) GDPR.

Analytics and non-essential cookies

Where we use optional analytics, advertising or similar technologies, we activate them only on the basis of your consent where consent is required. The GDPR basis is Article 6(1)(a). You can withdraw consent at any time through Cookie Settings without affecting the lawfulness of processing before withdrawal.

Direct electronic marketing

We may send direct electronic marketing only where we have a lawful basis under data-protection law and any consent required by applicable electronic-communications rules. Where consent is the basis, it may be withdrawn at any time.

4. Data obtained from other sources

Most data is obtained directly from you. In B2B contexts, we may also obtain professional contact details or publicly available company information from your employer, corporate websites, public registers, professional networks, business partners or other legitimate sources. Where required, we provide the information required by Article 14 GDPR.

5. Recipients and service providers

We may disclose personal data only to recipients that need it for a legitimate purpose, including:

• hosting, infrastructure, email, security and IT service providers;
• professional advisers, accountants, auditors and legal advisers;
• payment or financial-service providers where relevant to a transaction;
• independent certification bodies, auditors and certification-process providers where you request certification services;
• contractors or specialist partners involved in a project where disclosure is necessary for delivery;
• public authorities or courts where disclosure is required by law;
• a purchaser, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and legal safeguards.

Service providers that process data on our behalf are required to process it only for authorised purposes and under appropriate contractual and security obligations.

6. International data transfers

Where personal data is transferred outside the European Economic Area, we use a lawful transfer mechanism where required, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or another mechanism permitted by Chapter V GDPR. Additional safeguards may be applied where appropriate.

7. Retention

We keep personal data only for as long as reasonably necessary for the relevant purpose and any applicable legal, accounting, security or claims-retention requirements.

As a working rule:

• ordinary enquiries that do not lead to a business relationship are normally retained for up to 24 months after the last substantive contact;
• unsuccessful certification intake material is normally retained for up to 12 months after the process is closed, unless a longer period is justified by correspondence, dispute or legal requirement;
• active customer and project records are retained for the duration of the relationship and afterwards for the period needed to meet legal obligations and manage possible claims;
• accounting and tax records are retained for the periods required by applicable law;
• security and server logs are retained for a limited period appropriate to security, diagnostics and incident investigation;
• consent records may be retained as evidence for as long as reasonably necessary to demonstrate compliance.

When data is no longer required, we delete or anonymise it, subject to backup cycles and mandatory retention obligations.

8. Your rights

Subject to the conditions and limitations in the GDPR, you may have the right to:

• obtain confirmation whether we process your personal data and receive access to it;
• request correction of inaccurate or incomplete data;
• request erasure of data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain data in a portable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

Requests can be sent to info@caldermark.com. We may ask for information reasonably necessary to verify identity before acting on a request.

The competent Polish supervisory authority is the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych), Personal Data Protection Office, ul. Stanislawa Moniuszki 1A, 00-014 Warsaw, Poland.

9. Automated decision-making

Caldermark corporate websites do not make decisions producing legal or similarly significant effects about website visitors solely by automated means unless a specific service expressly states otherwise.

10. Security

We use technical and organisational measures appropriate to the nature of the data and the risks involved. These may include access controls, authentication, encryption in transit, logging, backups, system hardening and restricted administrative access. No online system can be guaranteed to be completely secure, so users should also avoid sending unnecessary sensitive data through general contact channels.

11. Product and customer data

For some software products, Caldermark may process personal data on behalf of a business customer rather than as the independent controller. In that situation, the customer normally determines the purposes and means of processing and its own privacy notice applies to the relevant end users. A separate data processing agreement may govern Caldermark's processor role.

12. Third-party websites

Our websites may contain links to third-party websites or services. Their privacy practices are governed by their own policies and not by this Privacy Policy.

13. Children

Caldermark's corporate and B2B technology services are not directed to children. We do not knowingly request personal data from children through our corporate contact channels.

14. Changes to this policy

We may update this Privacy Policy when our services, technology or legal obligations change. The current version and effective date will be published on the relevant website.

15. Contact

Questions about this Privacy Policy or the handling of personal data can be sent to:

info@caldermark.com