Privacy Policy – DRAMIŃSKI S.A.
Version updated as of October 7, 2026 – including the CRA cybersecurity reporting form.
- Data Controller
The controller of the personal data of customers, contractors, users of DRAMIŃSKI S.A.’s online services, and persons using the forms made available by the Company, including the form for reporting vulnerabilities and security incidents in connection with the Cyber Resilience Act (CRA), is DRAMIŃSKI S.A., ul. Wiktora Steffena 21, 11-036 Sząbruk, Poland, Tax ID (NIP): 7393855706, REGON: 281418440, phone: +48 89 675 26 00, e-mail: biuro@draminski.pl. - Data Protection Officer
The Controller has appointed a Data Protection Officer – Michał Minurski. The DPO can be contacted at: iod@draminski.pl. - Purposes, legal bases, and retention period of personal data processing
Personal data may be processed for the following purposes and on the following legal bases:
– conclusion and performance of a contract, or taking steps prior to its conclusion – Art. 6(1)(b) GDPR,
– fulfillment of legal obligations incumbent on the Controller, including tax, accounting, and – where applicable – obligations arising from cybersecurity regulations – Art. 6(1)(c) GDPR,
– pursuit of the Controller’s legitimate interests, in particular own marketing, ensuring the security of systems, services and products, establishment or defense against claims, and handling of cybersecurity and vulnerability reports – Art. 6(1)(f) GDPR,
– performance of actions requiring consent, in particular with respect to certain cookies, analytical tools, marketing tools, or other functions, where required by law – Art. 6(1)(a) GDPR.
Retention period:
Data is stored for a period adequate to the purpose and legal basis of the processing, in particular:
– for the time necessary to manage the relationship with the user or customer and – in the case of a contract – for its duration and until the relevant limitation period for claims expires,
– for the period required by accounting, tax, or other applicable legal provisions,
– for data processed on the basis of consent – until the consent is withdrawn, unless another legal basis for further processing exists,
– for data processed on the basis of legitimate interest – until that interest ceases to apply, an effective objection is raised, or the period necessary to establish, pursue, or defend claims has elapsed.
Providing data is voluntary but necessary for the conclusion and performance of the contract. Failure to provide the data may prevent the Controller from providing the service.
- CRA Form – Reporting Vulnerabilities and Security Incidents
The Controller provides, or may provide, a form for submitting information about potential vulnerabilities, security flaws, incidents, or other events that may affect the cybersecurity of DRAMIŃSKI S.A.’s products, services, or systems. This form is used in particular for receiving the report, registering it, analyzing, verifying and clarifying it, contacting the reporting party, taking remedial or risk-mitigating action, and documenting the handling of the report.
Purpose and legal basis of processing. With respect to receiving, analyzing, and handling reports concerning vulnerabilities or other cybersecurity threats, the legal basis for processing is Art. 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in ensuring and improving the security of products with digital elements, systems, and users, detecting and remediating vulnerabilities, mitigating the effects of incidents, and protecting against cybersecurity threats. If the content of a report gives rise to an obligation imposed on the Controller by law, in particular the reporting obligation under Article 14 of Regulation (EU) 2024/2847 of the European Parliament and of the Council (Cyber Resilience Act), the data is also processed on the basis of Art. 6(1)(c) GDPR – to the extent necessary to fulfill that legal obligation.
Scope of data. Within the form, data provided by the reporting party may be processed, in particular identification and contact details, information about the represented organization, the content of the report, and technical data necessary to assess the event, such as information about the product, software version, environment, logs, IP addresses, timestamps, attachments, and other technical data submitted with the report. The Controller applies the principle of data minimization and does not expect personal data that is not necessary for the analysis of the report to be provided.
Retention period. Data related to a report will be stored for the time necessary to receive, analyze, clarify, and close the report, and to implement any remedial or risk-mitigating measures. After the handling of the report has concluded, the data may be retained for the period necessary to demonstrate the correctness of the Controller’s actions, to fulfill obligations arising from cybersecurity regulations, and until the relevant limitation period for potential claims expires. If legal provisions require longer retention of specific documentation, the data will be stored for the period resulting from those provisions.
Voluntariness of providing data. Providing identification or contact details is voluntary, unless a specific form field has been marked as required due to the need for proper handling of the report. Lack of contact details may prevent the Controller from requesting additional information or providing feedback on how the report was handled.
Recipients of data in connection with a CRA report. Data may be shared with authorized employees and associates of the Controller, providers of IT, cybersecurity, hosting, form maintenance, or legal services, and – where required by law or necessary to fulfill a legal obligation – with the relevant CSIRTs, ENISA, market surveillance authorities, or other authorized bodies.
- Rights of the data subject
The data subject has, within the limits set out in the GDPR, in particular the right to:
– access the data and obtain a copy thereof (Art. 15 GDPR),
– rectify the data (Art. 16 GDPR),
– erasure of data, where the conditions under Art. 17 GDPR are met,
– restrict processing (Art. 18 GDPR),
– data portability – in the cases specified in Art. 20 GDPR,
– object to processing based on Art. 6(1)(f) GDPR, for reasons related to their particular situation, and at any time in the case of direct marketing (Art. 21 GDPR),
– withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal, where consent is the basis for processing (Art. 7(3) GDPR),
– lodge a complaint with the President of the Personal Data Protection Office (UODO).
Where data is processed to fulfill a legal obligation referred to in Art. 6(1)(c) GDPR, the right to object does not apply to that scope of processing. - Recipients of data and data processors
Personal data may be disclosed to entities that support the Controller in conducting its business and achieving the purposes described above, in particular providers of IT, hosting, website and form maintenance, analytical and marketing tool services, payment and delivery operators, entities providing accounting, legal, audit, and cybersecurity services, as well as public authorities or other entities authorized under applicable law. Where an entity acts as a processor, it processes data under a data processing agreement and in accordance with the Controller’s instructions. - Transfer of data outside the European Economic Area
In connection with the use of certain technology providers, data may be transferred outside the European Economic Area. In such cases, the Controller ensures the legal basis for the transfer required by the GDPR, in particular by relying on a European Commission adequacy decision – where applicable – or on appropriate safeguards, such as the European Commission’s standard contractual clauses. Information on the transfer mechanism applied can be obtained by contacting the Controller or the DPO. - Cookies and similar technologies
The Controller’s websites may use:
– cookies and technologies necessary for the proper functioning of the website or the provision of the requested service,
– analytical, functional, or marketing cookies and technologies – where consent is required, these are activated only after consent has been given.
Consent for optional cookies is given through the consent management mechanism available on the website. The user may refuse or withdraw consent at any time using the consent settings. Withdrawal of consent does not affect the lawfulness of operations carried out before it was withdrawn.
- Profiling and marketing activities
The Controller may use data for analysis and tailoring of marketing communications to the extent permitted by law. Where profiling makes use of optional cookies or similar technologies, it is carried out only after the required consent has been obtained. To the extent that the basis for processing is the Controller’s legitimate interest, the data subject has the right to object in accordance with Art. 21 GDPR. - Changes to the Privacy Policy
The Privacy Policy may be periodically updated, in particular to adapt it to changes in the law, guidelines issued by supervisory authorities, technologies used, and the actual scope of data processing carried out by the Controller.
Last updated: October 7, 2026
Data Controller: DRAMIŃSKI S.A.
