Privacy policy

Last updated: 23 October 2026

We respect the privacy of people who visit the Industria Core Labs website, write to us and use our services. Below we describe what personal data we process, why, on what legal basis, who we share it with and what rights you have. This is an English translation of our Polish privacy policy; if the two versions differ, the Polish version prevails.

1. Who is the data controller

The controller of your personal data is:
Industria Core Labs
***
Tax ID (NIP): ***

For any matter concerning personal data, write to us at: [email protected].

2. What data we process and why

The data we process depends on how you use the website and how you contact us. In particular, it may include:

• your first and last name,
• your email address and phone number,
• your company name and your position or role,
• the content of your message and the information given in the form (e.g. the selected project area),
• data needed to prepare an offer, carry out our cooperation and handle invoicing,
• technical information related to your use of the website, e.g. IP address, device identifiers and data stored by technologies used on the website.

Answering your enquiry and staying in touch

When you write to us through the form, by email, by phone or through another channel, we use your data to reply and continue the conversation. Legal basis: Art. 6(1)(b) GDPR where the conversation concerns steps taken before entering into a contract, and otherwise Art. 6(1)(f) GDPR, i.e. our legitimate interest in handling enquiries and correspondence.

Offers and providing our services

We process data to prepare an offer, to conclude and perform a contract and to handle ongoing cooperation. Legal basis: Art. 6(1)(b) GDPR.

Accounting and taxes

We process data from accounting, tax and billing documents to the extent required by law. Legal basis: Art. 6(1)(c) GDPR.

Protection against claims

We may process data to establish, pursue or defend against claims. Legal basis: Art. 6(1)(f) GDPR, i.e. our legitimate interest in protecting our rights.

Marketing our services

We may process data to market our own services and build business relationships on the basis of Art. 6(1)(f) GDPR. Where the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) requires prior consent for marketing contact through a given channel (e.g. email or phone), we use that channel only after obtaining your consent. You may object at any time to the processing of your data for direct marketing.

Website and form security

We also use technical data to protect the website and forms against spam, abuse and automated submissions. Legal basis: Art. 6(1)(f) GDPR, i.e. our legitimate interest in keeping the website and our systems secure.

3. Do you have to provide your data

Providing your data is voluntary. However, the fields marked as required in the form are needed for us to answer your enquiry. Data necessary to conclude and perform a contract is a condition of cooperation, and data required by tax and accounting law is processed to the extent that law specifies. Signing up for the newsletter is entirely voluntary.

4. Contact form, chat and newsletter

We use the data from the contact form to answer your enquiry, prepare an offer, continue the correspondence and take steps before entering into a contract. We store the submission on the website server together with the date and the wording of the consents you ticked, and then pass it to our customer service system (ICL Core and Twenty CRM), which runs on our own server. The form is protected by Cloudflare Turnstile.

Website chat. On the website you can talk to Ewa, the Industria Core Labs AI assistant. Her answers are written by an artificial intelligence program based on public information about our company. You can ask to talk to a person at any time. We store the conversation (your messages and the answers), the page language and the date in the Chatwoot conversation system, which runs on our own server. To prepare an answer, we pass your messages to an artificial intelligence model provider (OpenRouter, which uses a model by Anthropic). When you open the chat, your browser remembers the conversation identifier so the conversation is not lost when the page is refreshed. Do not share in the chat any data you do not want to give us, especially sensitive data. Legal basis: Art. 6(1)(b) GDPR where the conversation concerns steps taken before entering into a contract, and otherwise Art. 6(1)(f) GDPR, i.e. our legitimate interest in answering questions from website visitors.

If you sign up for the newsletter, we process your email address and information about the consent you gave, including the data needed to show that you gave it. The newsletter may contain information about smart homes, automation, artificial intelligence in business, new publications and Industria Core Labs services.

The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR) and, where required by law, your consent to electronic communication under the Polish Electronic Communications Law. You can unsubscribe at any time by clicking the link in any message or by writing to us. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn. After you unsubscribe, we may keep the minimum information needed to record that you unsubscribed and not to send you messages again.

5. Business contacts (B2B) and data from other sources

In running our business, we may process data of entrepreneurs and of employees, associates and representatives of other companies and organisations. If we did not receive this data directly from you, it may come from, among other sources, company websites, public registers and industry directories, LinkedIn, the organisation you represent, or a referral. It usually includes your first and last name, position or role, company name, business email and phone number, and other publicly available information related to your professional work.

Legal basis: Art. 6(1)(f) GDPR, i.e. our legitimate interest in running our business and in establishing and maintaining business relationships. If the data did not come from you, we provide the information required by Art. 14 GDPR within the time limits set out there (as a rule within one month of obtaining it, and where the data is used to contact you, at the latest at the first contact), unless an exception under Art. 14(5) GDPR applies. The fact that your email address or phone number is publicly available does not mean you consent to marketing; for commercial information we apply the requirements of the Polish Electronic Communications Law.

6. Cookies and tools on the website

The website uses cookies and similar technologies. We manage consent with the Complianz plugin. In the consent window you can accept all cookies, reject those that are not necessary, choose individual categories, or change or withdraw your consent at any time (the “Cookie policy” link in the website footer).

Depending on the current configuration of the website, we may use the following tools:

• Cloudflare – website delivery and protection against attacks; Cloudflare Turnstile – protection of forms against spam and automated submissions,
• Google Tag Manager – managing tags and integrations on the website,
• Google Analytics 4 – analysing traffic and how the website is used,
• Complianz – managing consent for cookies and similar technologies.

We only activate technologies that are not necessary for the website to work or for the service you request after you make your choice in the consent window. Where we process personal data in connection with cookies for analytics or marketing, the legal basis is your consent (Art. 6(1)(a) GDPR), obtained in line with the Polish Electronic Communications Law. The current list of cookies, their providers, purposes and duration is in the Cookie policy.

The website may offer voice recordings of articles and podcasts made with speech synthesis (AI). You play them directly from our server; no data of yours is needed to listen to them.

7. Who we share data with

Data may be shared with or entrusted to entities that help us run our business, always only to the extent needed for the given purpose. In particular, these are:

• LH.pl – website and email hosting,
• Cloudflare – website delivery and protection, form protection (Turnstile),
• Google – analytics and technical tools,
• artificial intelligence model providers (OpenRouter, Anthropic, OpenAI), which we use for chat answers and when preparing replies and offers,
• other IT and technology service providers,
• our accounting office and legal and tax advisers,
• associates and subcontractors, where access to the data is needed to provide the service.

Depending on the type of cooperation, these entities process data on our behalf (as processors) or as separate controllers, under their own data protection rules. Our customer service system (ICL Core, Twenty CRM, Chatwoot, n8n) runs on our own server.

8. Transfers of data outside the European Economic Area

Some of our providers belong to international groups or use infrastructure outside the European Economic Area, so data may be transferred to countries outside the EEA, in particular to the United States. This happens only on the basis of mechanisms provided for in the GDPR, in particular: a European Commission adequacy decision, the EU-US Data Privacy Framework (for companies certified under it), standard contractual clauses approved by the European Commission, or other mechanisms permitted by law. To find out which mechanism applies in a given case and to obtain a copy of the safeguards, write to: [email protected].

9. How long we keep data

We keep data only as long as needed for the purpose for which we collected it and then, where justified, for the period required by law or needed to secure claims. In particular:

• enquiries and chat conversations – for the duration of the correspondence and then until the period in which claims may arise has expired,
• contract-related data – for the duration of the cooperation and then for the period resulting from the law or from limitation periods for claims,
• accounting and tax records – for the period required by law,
• data processed on the basis of consent – until consent is withdrawn or the purpose ends, whichever is earlier,
• data for direct marketing – until you effectively object or withdraw the required consent,
• newsletter – until you unsubscribe, keeping the minimum data needed to record that you unsubscribed,
• cookies – for the lifetime of the given cookie or until you withdraw consent, if earlier (details in the Cookie policy).

10. Your rights

Depending on the basis and type of processing, you have the right to:

• access your data and receive a copy of it,
• have your data corrected,
• have your data erased where the GDPR conditions are met,
• restrict processing,
• data portability in the cases set out in the GDPR,
• object to processing based on Art. 6(1)(f) GDPR,
• withdraw consent at any time, where processing is based on it,
• lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

If you object to the processing of your data for direct marketing, we will stop processing it for that purpose. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn. To exercise your rights, write to: [email protected].

11. Automated decisions and profiling

Industria Core Labs does not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Art. 22 GDPR). We use artificial intelligence tools that help us prepare replies and offers, but every decision is made by a person. Analytics tools, in line with your choice in the consent window, may be used to assess how effective our marketing is; this does not mean decisions that produce legal effects for you.

12. Changes to this privacy policy

We may update this policy, in particular when the law, the way the website works, the tools and providers we use, the scope of our services or the way we process data change. The date of the last update is given at the top of this document, and the current version is always available on this page.