The controller of personal data is CHEMAXA Adrian Matusiak, ul. Promienna 14, 71-218 Bezrzecze, Poland, VAT ID (NIP) 8512981442 (“CHEMAXA”, “we”).
Data protection contact:
We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Polish data protection and e-services law, following the data minimisation principle.
This policy describes the processing of personal data of: users of the www.chemaxa.com website (the “Website”); users of the “Chemaxa” mobile application for iOS and Android (the “App”); customers, contractors and their representatives; drivers who collect goods on behalf of our customers at the producer’s plant; persons contacting us by e-mail, phone, SMS or WhatsApp; and job applicants.
When you contact us (including sending a quotation request or an order — also from the App), we process the data provided in the correspondence: name, company name, VAT ID, delivery address, phone number, e-mail address and message content.
| Purpose | Legal basis (GDPR) |
|---|---|
| handling the enquiry, preparing a quotation, accepting and performing an order (pre-contractual steps and contract performance) | Art. 6(1)(b) |
| contractor verification (including in public registers), invoicing, tax and accounting obligations | Art. 6(1)(c) |
| ongoing business communication; establishing, pursuing or defending claims; system security (legitimate interest) | Art. 6(1)(f) |
| direct marketing of our own products and services — where you give separate consent | Art. 6(1)(a) / (f) |
| assessing the effectiveness of Google ads (which keywords and devices bring enquiries and customers) — legitimate interest | Art. 6(1)(f) |
When you send a quotation request from a page you reached through a Google ad, we store information about that ad together with the request: the keyword that triggered it, the keyword match type, the device type (phone, tablet or computer) and the ad group and ad numbers. We use it only to assess which ads bring enquiries and customers and to set ad bids. We do not store the click identifier and we do not pass this information to Google. We keep it with the enquiry and in the e-mail notifying us of it, for the periods given in section 8 for enquiries and correspondence.
Providing the data is voluntary but necessary to receive a quotation or have an order fulfilled.
Consent to contact by SMS and e-mail — Electronic Communications Law. Beyond the GDPR, sending messages to your phone number and e-mail address is governed by the Polish Electronic Communications Law of 12 July 2024 (in force since 10 November 2024; it replaced the Telecommunications Law). Under its Article 398, sending commercial information and direct marketing requires your prior consent. We therefore separate two kinds of messages:
You may withdraw consent at any time — an e-mail to info@chemaxa.com or a reply to the message received is enough. Withdrawal does not affect the lawfulness of messages sent beforehand and does not stop messages concerning orders to which you are a party.
AI-assisted draft replies. We may prepare a reply to a quotation request or an order with the help of the Claude artificial intelligence model (provider: Anthropic). This happens only when an authorised person at CHEMAXA clicks the button for a specific enquiry — never automatically. The provider then receives the text of the remarks entered in the enquiry — with phone numbers, e-mail addresses, VAT IDs, bank account numbers, PESEL numbers and identity document numbers (identity card, passport) removed before sending — together with the quantity and town of delivery (without the street or postcode) and the type of enquiry (quotation or order). We do not pass on the company name or the name of any person given in the enquiry or recorded on the company’s account in our panel; however, if you enter other information about yourself or about other people in the remarks, it reaches the provider together with the rest of the text. The model only prepares a draft: an authorised person at CHEMAXA reads it, edits it and sends it, and the model sends nothing itself. We do not keep the draft — the panel keeps only the reply that person sends (as correspondence) and a technical record without content (date and service usage), needed to account for its cost. The legal basis is Art. 6(1)(b) GDPR (replying to your enquiry before a contract is concluded) and Art. 6(1)(f) GDPR (legitimate interest: a prompt and accurate reply to the enquiry). Sections 6, 7 and 8 describe the recipient, the transfer outside the EEA and the retention period.
Correspondence pasted into the panel. An authorised person at CHEMAXA may paste an e-mail from a customer or contractor into our administration panel to save it as a note on the company’s record or — where it concerns a delivery date — as a short note on the order. At that person’s request, never automatically, the text of the message may be sent to the Claude artificial intelligence model (provider: Anthropic) to prepare a short summary and to read the dates in it (e.g. a proposed delivery date). Before sending, we remove quoted earlier correspondence, e-mail addresses, phone numbers, bank account numbers, VAT IDs, PESEL numbers and identity document numbers (identity card, passport) from the text; together with the text we send the date of the message, so that expressions such as “next Thursday” can be turned into a date. The rest of the text — including the sender’s signature with their name, if it contains one — reaches the provider as written. A person checks the summary and the dates read; the panel stores only the note that person approves, and we do not keep the model’s result (only a technical record without content remains, as with draft replies). The legal basis is Art. 6(1)(b) GDPR (performing the order, including agreeing the delivery date) and Art. 6(1)(f) GDPR (legitimate interest: an accurate record of what was agreed in correspondence). At that person’s request the model may also prepare a draft reply to the message in Polish, English or German — the provider then receives the same text as for the summary, the chosen language and that person’s short instruction on what to reply, from which we likewise remove e-mail addresses, phone numbers, bank account numbers, VAT IDs, PESEL numbers and identity document numbers; we do not keep the draft, and the panel sends nothing — that person copies the reply into their own e-mail, edits it and sends it (the legal basis is Art. 6(1)(b) GDPR — replying about an order — and Art. 6(1)(f) GDPR — legitimate interest: a prompt and accurate reply to correspondence). Sections 6, 7 and 8 describe the recipient, the transfer outside the EEA and the retention period.
Contact noted during a conversation (prospective customers). If we discuss AdBlue® deliveries over the phone — because you call us or respond to our contact — we record a note of that conversation in our admin panel: company name, VAT ID, phone number, e-mail address, the postcode of the delivery location, your current supplier and the price you pay today, the volume you are interested in and the price level discussed, together with a short note on what you need. This data comes from you alone — we do not buy contact lists and do not obtain it from external databases. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest: keeping a record of what was agreed and preparing an offer).
Periodic price-offer updates. The price of AdBlue® changes over time and an offer is valid for a defined period. To people and companies we have spoken to about deliveries — both established contractors and people whose contact details we noted during a conversation — we send a price-offer update to the e-mail address provided: the price level for each volume band and the period for which that offer applies. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: direct marketing of our own products, carried out towards businesses with whom we are in commercial contact) and, to the extent that the rules on providing services by electronic means require consent for sending commercial information, consent given by providing us with an e-mail address for the purpose of receiving an offer (Art. 6(1)(a) GDPR).
You may object at any time — simply reply to any of our messages or write to info@chemaxa.com. An objection takes effect immediately and needs no justification; once raised we stop sending offer updates and, if you wish, delete the conversation note in full. Sending offer updates is not an automated decision and not profiling (section 10): the content and price level are set by a human on the basis of the earlier conversation, and the send is triggered manually.
Confirmation that an e-mail was opened. E-mails we send from our order system to customers, contractors and suppliers (including people we correspond with about an enquiry) contain an invisible image of 1×1 pixel. When the e-mail program downloads this image, we record with that e-mail: the date and time it was opened, the full IP address from which the image was downloaded, and the description of the e-mail program or browser, device and operating system that the program itself sends (the User-Agent header). We record up to 20 openings of one e-mail — further ones are only counted. For every e-mail we also record the date and time it was sent, the recipients, the subject, the type of message and the number of the order it concerns — without the content of the message. Where there are several recipients, the record does not show which of them opened the e-mail. The image does not set cookies on your device.
We do this to know whether an e-mail was delivered and opened — when handling enquiries, offers, orders and amounts due (e.g. whether a reply to an enquiry, an offer, an order confirmation, information about the delivery date, an invoice or a payment reminder was opened). The legal basis is Art. 6(1)(f) GDPR (legitimate interest: efficient handling of enquiries, offers, orders and amounts due). The record is not always reliable: some e-mail programs and services (e.g. Apple Mail with Mail Privacy Protection turned on, Gmail) and e-mail scanners download images automatically, through their own servers — the record then does not show whether the e-mail was read; other programs block images — we then record no opening, although the e-mail may have been read. You can also turn off automatic loading of images in your e-mail program. We do not use opening data for profiling or advertising and do not combine it with Google ad measurement (section 5); in the administration panel it is seen only by authorised CHEMAXA staff. We keep it for 12 months from sending the e-mail and then delete it automatically (section 8). Data about e-mails linked to a customer account and their openings (date sent, subject and, for openings, date and time, IP address and device) is included in the copy of your data that you can download yourself from your account in the App.
Objecting to open tracking. You can object at any time to openings of e-mails being recorded — simply write to info@chemaxa.com. An objection needs no justification: once it is raised, we add your e-mail address to the list of addresses we do not track, and further e-mails sent to that address do not contain the image — we then record only that the e-mail was sent, without openings. Once the objection is raised, we also delete the previously recorded confirmations that e-mails sent to that address were opened — only the record that they were sent remains.
In connection with concluding and performing contracts we process data of contractor representatives and contact persons: name, position, business e-mail and phone number, together with company details. The legal basis is our legitimate interest in maintaining business contacts (Art. 6(1)(f) GDPR) and, for contracting parties’ data, Art. 6(1)(b) and (c) GDPR.
After a completed delivery we may send you an e-mail asking for a review of our cooperation on our Rzetelna Firma business card. Leaving a review is entirely voluntary and happens on that service’s own website under its own privacy policy — we receive no additional data as a result. On your account we store only the date such a request was sent, so that we do not ask repeatedly. Legal basis: Art. 6(1)(f) GDPR (legitimate interest: building the company’s credibility). You may object at any time — simply reply to the message.
Confirmation that e-mails to contractors were opened. E-mails we send from our order system to contractors — including suppliers and carriers (e.g. an order to a supplier, an invoice, a payment reminder or demand) — contain the image confirming opening described in section 3.1; the same rules apply: the data recorded, the purpose, the legal basis, the retention period and the right to object.
Drivers collecting goods at the plant (FCA). When a customer collects the goods themselves at the producer’s plant (Grupa Azoty), the plant releases them only to a driver notified in advance. We then record with the order in our administration panel the driver’s details: first and last name, PESEL number, the series and number of the identity card or the passport number (with a passport, the PESEL number is given only if the driver has one), the registration numbers of the tractor unit and the trailer, and the driver’s phone number. We receive this data from the customer who orders the collection — not from the driver. It serves solely to notify the driver at the plant releasing the goods: we pass it to the Grupa Azoty company operating that plant in the collection order we send by e-mail from our panel (section 6). In the panel we show it in shortened form (e.g. only the last digits of the PESEL number); in full it is seen only by the authorised person at CHEMAXA who enters, corrects or sends it to the plant. The driver’s details recorded with the order are not shown in the App, are not included in the copy of your data that you can download from your account, are not recorded in system logs and are not passed to the artificial intelligence model. If a message containing this data is pasted into the panel and passed to the model (section 3.1), we first remove the PESEL number, the document number and the phone number from it; the name and the registration numbers remain in the text. We do not collect PESEL numbers for any other purpose. We delete the driver’s details recorded in our order system automatically 90 days after the goods are collected, and for a cancelled order — 90 days after they were recorded; earlier — together with the order or at the request of the customer or the driver (section 8). The e-mail with the order to the plant that contains the driver’s details, and the customer’s reply with those details, remain in our e-mail system and are kept like other correspondence about the order (section 8). The legal basis is Art. 6(1)(f) GDPR (legitimate interest of CHEMAXA and the customer: releasing the goods to the driver designated by the customer, in line with the requirements of the plant releasing the goods).
On the contractor’s record in our admin panel we store the details of contact persons on their side: name, role (e.g. owner, driver, accounts, logistics), business phone number, business e-mail address and a short note that makes contact easier (e.g. the hours at which it is best to call). This data is given to us by the contractor — we do not obtain it from any other source. It is used solely to arrange and complete deliveries and for day-to-day business contact. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: maintaining contact with the contractor).
We also record the history of business contact: the date and type of the conversation (phone, e-mail, SMS, WhatsApp, meeting), a short note on what was discussed, any reminder date for the next contact, and the CHEMAXA person who wrote the note. These records are strictly internal — only authorised CHEMAXA staff can see them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: serving the contractor and keeping track of what was agreed).
Payment-reliability assessment. Before we offer a contractor deferred payment (trade credit), we check their payment reliability. For that purpose we obtain a business report from Krajowy Rejestr Długów Biuro Informacji Gospodarczej S.A. (the Polish National Debt Register, “KRD BIG S.A.”) and store it — the report file together with a copy of the reading: the score, the report date and number, and the suggested trade-credit limit. These two things have different retention periods and section 8 lists them separately: the archived report (the file and the copy of the reading attached to it) is deleted after 24 months, whereas the current reliability assessment held on the contractor’s record stays for as long as the cooperation lasts — it is what we base the deferred-payment decision on with every further order, and the date of the reading shown next to it makes clear when the assessment has aged and is worth refreshing. We also keep our own internal assessment of how punctually the contractor pays, and we record the agreed commercial terms (payment term, credit limit, current supplier and their price, status and how the contact was acquired). The legal basis is Art. 6(1)(f) GDPR (legitimate interest: assessing commercial risk before granting deferred payment and protecting against financial loss).
Where the contractor is a sole trader, this data concerns a natural person and is fully covered by this policy — you then have the right to access, rectify and erase it, and to object to the processing (section 9). The assessment is not an automated decision: the terms of cooperation are decided by a human being (section 10). The data described in the three paragraphs above is processed in the CHEMAXA admin panel and is not shown on the App’s screens. Of that data, the copy of your data that you can download yourself from your account in the App includes: the contact persons’ details (name, role, phone, e-mail address, whether the person is the main contact and the date added — without our note) and a list of the National Debt Register reports we have uploaded to our system (upload date, file name and size, report date and number — without the score and the suggested trade-credit limit). It does not include the history of business contact, the payment-reliability score and the suggested trade-credit limit, our assessment of how punctually the contractor pays, or the commercial terms listed above (payment term, credit limit, current supplier and their price, status and how the contact was acquired). This does not limit your right of access: on a request sent to info@chemaxa.com we will provide this data as well.
Additional e-mail addresses. At the contractor’s request we also store on their record in our admin panel additional business e-mail addresses of people who handle orders on their side. We send them the messages we send to the contact e-mail — including order and delivery-date confirmations, payment reminders and demands, information about our offer and prices, the invitation to the App and the request for a review. We do not send them invoices or messages about consent to an entry in the National Debt Register. Additional addresses are not used for signing in. They are provided by the contractor; we delete an address at the contractor’s request or at the request of the person it belongs to — including when that person does not wish to receive information about our offer (info@chemaxa.com). A record of messages sent before deletion remains in our log of sent messages for the period set out in section 8. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: contact with the people who handle orders on the contractor’s side). These addresses are included in the copy of your data that you can download from your account in the App.
Carriers. When we order transport, we record the carrier’s details — name, address and country, also where the carrier is a sole trader — and include them in the transport order. The legal basis is Art. 6(1)(b) GDPR (concluding and performing the contract of carriage) and, for keeping the list of carriers, Art. 6(1)(f) GDPR (legitimate interest: organising deliveries). We keep the data for the duration of the cooperation, and in transport documents for the periods set out in section 8.
AI-assisted reading of invoices. In our administration panel we may read purchase and sales invoices, as well as carriers’ invoices for transport, with the help of the Claude artificial intelligence model (provider: Anthropic). We may read cost invoices and receipts (e.g. for fuel, telephone or services) in the same way, including those issued by sole traders. In the same way we may read the pro forma invoices we issue before delivery — to record the pro forma number, the amount due, the currency and the issue date on the order (the customer then sees this data in the App — section 4.3). This happens only when an authorised person at CHEMAXA clicks the reading button for a specific invoice — never automatically. The provider then receives the invoice file with the data shown on it: names, VAT IDs and addresses of the seller and the buyer (and of the delivery recipient and place of delivery where shown), document numbers, quantities, prices and amounts, the name of the person who issued the invoice where shown, and — on a carrier’s invoice — also the vehicle registration number where the carrier has included it. On a cost invoice or a receipt this may also include the name of a seller who is a sole trader, their bank account number and the cashier’s identifier, where printed. That person checks the values read and records them on the order only after approving them — the model decides nothing; values from a cost invoice or a receipt are recorded in the same way with the company’s costs. We keep the result of the reading in the panel so that the same file is not sent again. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: transcribing invoice data efficiently and without errors) and, for recording the cost in the accounts, Art. 6(1)(c) GDPR (tax and accounting obligations). Sections 6, 7 and 8 describe the recipient, the transfer outside the EEA and the retention period.
Invoices from the Betterfly software — help from artificial intelligence. We keep our sales, purchase and cost invoices in the Betterfly invoicing software, and our administration panel compares them with orders. For these invoices an authorised person at CHEMAXA may use the help of the Claude artificial intelligence model (provider: Anthropic) — only by clicking a button for a specific item, never automatically — in three situations: explaining a mismatch — when something does not match (e.g. the invoice number, amount or KSeF number differs from the order, or an invoice could not be recorded on an order), the model points out what does not match, the most likely cause and the places in the panel worth checking; suggesting the order for a purchase invoice without an order number — our system itself selects the orders the invoice may match (by amount and date), and the model only ranks that list from the most likely and explains the ranking; orders outside that list are not accepted; answering a question about invoices asked by an authorised person — the model turns the question into one of a fixed set of summaries, which our system runs, and describes the result. In all three situations the provider receives invoice and order data: invoice and order numbers, amounts, dates and document statuses, and for a question — also its text, from which we remove phone numbers, bank account numbers, VAT IDs, PESEL and identity card numbers, e-mail addresses, postal addresses written with a street and number or a postcode, and the company names and contact persons held in our records before sending; please do not enter any other personal data in a question. It does not receive company names, VAT IDs or KSeF numbers — we replace them with labels (e.g. “Firma A”, “KSeF-A”) — nor personal data contained in invoices and orders: names, addresses, e-mail addresses and phone numbers; descriptions and remarks from the invoice are not sent at all. The numbers and amounts of invoices of a contractor who is a sole trader may be personal data. The model records nothing and decides nothing: the result is only a suggestion, and assigning an invoice to an order and every other change is done by a person. We keep the result in the panel for 90 days so that the same question is not sent again. Separately, the PDF file of an invoice downloaded from the Betterfly software may be read in the same way as other invoices (the paragraph “AI-assisted reading of invoices” above) — the provider then receives the whole invoice file, including the names, VAT IDs and addresses shown on it, and we compare the values read with the data from the Betterfly software. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: keeping invoices consistent with orders). Sections 6, 7 and 8 describe the recipient, the transfer outside the EEA and the retention period.
With your consent we may submit to the National Debt Register (Krajowy Rejestr Długów Biuro Informacji Gospodarczej S.A., ul. Danuty Siedzikówny 12, 51-214 Wrocław, Poland, KRS 0000169851) positive information — that is, confirmation that you paid us on time.
Legal basis: Article 6(1)(a) GDPR (consent) in conjunction with Article 18 of the Polish Act of 9 April 2010 on the disclosure of business information and the exchange of business data. Without your consent we submit nothing about you to the register — unless you yourself request such an entry, which the Act treats as equivalent to consent.
What we submit: company name, address, tax identification number (NIP) and, for each obligation, the amount, currency, due date and payment date. We do not submit your phone number or e-mail address.
Why: a positive entry builds a documented payment history for your company, visible to counterparties, banks and leasing providers who check the register.
How to give and how to withdraw consent — any of these, as you prefer:
Withdrawing consent is as easy as giving it (Article 7(3) GDPR) and takes effect for the future: from the moment of withdrawal we submit nothing new to the register. ⚠️ Withdrawal does not delete entries already submitted — these remain in the register under the Act and the register's own rules. You may ask us separately to have an existing entry removed; we will then apply to the register on your behalf.
Consent log. So that we can demonstrate consent, as Article 7(1) GDPR requires, we keep a record of it. For every grant and every withdrawal of consent — both to the National Debt Register entry and to SMS messages — we note:
An IP address is personal data and is covered by this policy. We store it solely so that the consent record has evidential value, and we use it for nothing else — we do not build a profile from it, we do not derive location from it, and we do not combine it with the Website technical data described in section 3.5.
Register of clause wordings. We keep the full wording of every version of the consent clause shown in the App and on the consent page reached through the link in a message in our register of clause wordings. We only add new versions to the register — entries already recorded are never changed — so that, even years later, the identifier in the consent log can be traced back to the words consent was given to. The register contains no personal data.
An unticked box when creating an account. If you leave a consent box unticked when creating an account in the App, we record in the log the date and the identifier of the clause wording we showed you — so that your profile in the App does not claim we never asked for that consent. Such a record is neither consent nor refusal, contains no IP address and is deleted together with the account. Legal basis: Article 6(1)(f) GDPR (legitimate interest: an accurate record of what we asked you).
⚠️ We keep the consent log for longer than the account itself. If you delete your account and we had previously, with your consent, submitted a positive entry to the National Debt Register, that entry remains in the register — and the proof that consent existed must remain with it. Deleting the log would leave an entry in the register with nothing behind it. Legal basis: Article 17(3)(b) GDPR (legal obligation) and Article 17(3)(e) GDPR (establishment, exercise or defence of legal claims). Only the record of consent to the register entry (together with any withdrawal of it) is kept — for 5 years after the account is deleted; after that we delete it automatically. The record of consent to SMS messages, and a record of consent to the register entry after which NO entry was submitted, are deleted together with the account.
From job applicants we process the data required by labour law (name, date of birth, contact details, education, qualifications, employment history) under Art. 6(1)(b) and (c) GDPR. Additional data included in a CV (e.g. photo, interests) is processed on the basis of consent (Art. 6(1)(a) GDPR), and special-category data (e.g. disability status) solely on the basis of explicit consent (Art. 9(2)(a) GDPR). Consent may be withdrawn at any time.
When you use the Website, technical data is processed automatically: IP address, date and time of the request, browser and system type, pages visited. This data serves the proper functioning and security of the Website (Art. 6(1)(f) GDPR) and — with consent — the measurement purposes described in section 5.
The App is used to order bulk AdBlue® deliveries and to send quotation requests. It is a business-to-business tool and is not directed at persons under 16. The App works in two modes: (1) without signing in — an enquiry/order form for new customers; and (2) signed in — a returning-customer account with an individual price list, unloading points and order history.
For part of its functionality the App uses the CHEMAXA server (api.chemaxa.com), on which we process the data described below as the controller. We do not share this data with third parties for marketing purposes.
The iOS and Android versions provide the same functionality and use the same server. The differences follow from the platform: Sign in with Apple, address autocomplete (Apple Maps, section 4.6) and crash reports (MetricKit, section 4.9) exist only in the iOS version. In the Android version you sign in with an e-mail address and password, and push notifications are delivered by Firebase Cloud Messaging (Google) — see section 4.4.
Data entered in the form (VAT ID, company name, delivery address, phone, e-mail, order parameters) is also stored locally on your device so you do not have to re-enter it. You can delete it by overwriting the fields or uninstalling the App. Local data is protected by operating-system security mechanisms — the Keychain on iOS and encrypted preference storage (EncryptedSharedPreferences) on Android; in the Android version backup of App data is disabled.
When you fill in the form and tap “Send quotation request” or “Send order”, the form data (company name, VAT ID, delivery address/location, phone, e-mail, approximate quantity, delivery dates and unloading hours) is saved on our server as an enquiry so that we can prepare a quotation and contact you. This happens when you tap the button, even if you ultimately do not complete sending the message via WhatsApp, e-mail or SMS (we do not want to lose contact with interested prospects). We also record limited technical data (IP address, device/app information) to ensure security and prevent abuse. Separately, if you choose a channel (WhatsApp, e-mail or SMS), the message content is handed to the app you choose and sending requires your confirmation.
| Purpose | Legal basis (GDPR) |
|---|---|
| handling the enquiry, preparing a quotation and contacting you back; pre-contractual steps | Art. 6(1)(b) and (f) (legitimate interest: responding to the enquiry and keeping in touch with a prospect) |
| system security and abuse prevention (technical data) | Art. 6(1)(f) |
Providing the data is voluntary, but without contact details we cannot send a quotation. Enquiries are deleted automatically after the retention period (section 8) and at your request.
An authorised person at CHEMAXA may use the quantity and town of delivery (without the street or postcode) from such an enquiry to prepare an AI-assisted draft reply — without the company name, VAT ID, phone number or e-mail address; section 3.1 (“AI-assisted draft replies”) sets out the rules.
You can sign in in two ways, and both can be linked to the same account:
…@privaterelay.appleid.com), and, at first sign-in, your name if you share it. Sign in with Apple does not disclose your password to us.You can have both methods linked to the same account at the same time (e.g. add a password to an account created via Apple in the "My Profile" screen) and choose which one to use the next time you sign in.
Within the account we process on our server: company data (name, VAT ID, phone, address, contact e-mail, invoice e-mail, additional e-mail addresses of people handling orders — section 3.2 “Contractors and their representatives”), your individual price list, saved unloading points (address, contact person, phone, hours, notes) and order details and history.
| Purpose | Legal basis (GDPR) |
|---|---|
| operating the account, presenting your individual price list, accepting and performing orders | Art. 6(1)(b) |
| invoicing, tax and accounting obligations | Art. 6(1)(c) |
| support and contact, establishing/pursuing/defending claims, security | Art. 6(1)(f) |
| limiting bulk account creation (IP address and e-mail domain recorded at registration) | Art. 6(1)(f) (legitimate interest: system security and protecting contractors against accounts being created against their data) |
Pro forma invoice and payment details. When we send you a pro forma invoice for an order by e-mail from our system, the App shows it with that order: the file (PDF), the pro forma number and amount, the payment details (CHEMAXA’s bank account number, the bank and a transfer title with the pro forma and order numbers) and the payment status — paid, partly paid, awaiting payment or “checking the payment”. We determine the payment status by comparing the pro forma amount with the payments to our account that we have assigned to that order. A pro forma sent another way (e.g. by ordinary e-mail outside our system) does not appear in the App. The legal basis is Art. 6(1)(b) GDPR (performing the order).
Creating an account — limiting abuse. At the moment of registration we record on our server the IP address the request came from and the domain of the e-mail address provided (the part after the @ sign, e.g. company.com — without the part before it). This serves solely to count how many accounts are created from a single IP address and a single domain within a short period, and to stop bulk creation of accounts against other companies' VAT IDs. We do not build a profile from this and we do not link these records to your account once registration is complete. The records are deleted automatically after 2 days (section 8).
Account deletion: you can delete your account at any time directly in the App — we then permanently erase the account data (company profile, price list, unloading points, order history), except for data we must retain for tax and accounting purposes (section 8). The consent log (section 3.3) is deleted together with the account as well — except for the record of consent to the National Debt Register entry where, on the basis of that consent, we submitted a positive entry to the register. If the account has unsettled invoices, an order in progress or a delivered order for which we have not yet issued an invoice — or this cannot be checked — we do not delete the account straight away: we disable it (the App then shows the disabled-account screen, with your settlements still available beneath it), record the date of your deletion request and pass it to an authorised person at CHEMAXA, and we delete the account data once the amounts due are settled and the orders completed. The legal basis is Article 17(3)(e) GDPR (establishment, exercise or defence of legal claims) and Art. 6(1)(b) and (c) GDPR (performing orders and accounting obligations).
If you consent to notifications, we store your device’s notification token to send you notifications about orders and pricing. Delivery relies on the service of the operating system you use:
The push service receives the device token and the notification text (order status or a pricing notice). We do not send company data, order contents or prices through this channel. We also record whether and when a given notification was opened and on which platform (iOS or Android) — once for each message sent. This serves solely to confirm that the information about your order status or about pricing reached you; apart from that single event we do not record how you use the App. You can withdraw consent at any time in your system settings (iOS or Android). Legal basis: Art. 6(1)(b) and (f) GDPR (informing you about order status and our offer).
Signing out and changing the password. With the token we also record the sign-in session in which the device registered it. As a result, signing out disables notifications on the device you sign out of, changing the password — on your other devices signed in to the account (we also sign them out of the App), and resetting the password with a code from an e-mail — on all devices. A device that still has access to the account registers its token anew after signing in again or opening the App. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: account security — order notifications do not reach a device that has lost access to the account).
The message list in the App. The messages we send you are also available in the App itself — under the bell icon next to “My profile”. There you will find pricing and order information as well as current announcements (for example about a production stoppage). The list works independently of your consent to notifications: if you never enabled notifications, or turned them off, the message will still be waiting for you there. We record a read marker alongside it — whether and when you read that message in the App. It serves solely to stop marking the message as new; it is separate from the confirmation that a push notification was opened described above and it is likewise not a statistic of how you use the App. The retention periods for both markers are given in the table in section 8.
Deleting messages from the list. You can delete a message from the list — one at a time or all at once. It then disappears from the App, and we record the date of its deletion. The message itself is not erased: its content, the date it was sent and the date of deletion remain in the CHEMAXA panel so that we can handle your enquiries and demonstrate what information we sent you and when (accountability). Legal basis: Art. 6(1)(f) GDPR. We keep the date of deletion for as long as the message itself — until your account is deleted (table in section 8).
When you enter a VAT ID, the App sends that number to our server, which queries public registers to suggest the company name and address: the Polish Ministry of Finance VAT register and CEIDG (dane.biznes.gov.pl). Only the VAT ID is sent to those registers.
Applies to the iOS version only. While you type the delivery address, text fragments are sent to Apple’s mapping service to display suggestions (Apple privacy policy). The App does not use device location.
If you choose to send via WhatsApp (Meta Platforms), your mail client or Messages (SMS), processing within those services is governed by their own privacy policies.
iOS only. If the App crashes or stops responding, iOS prepares a technical diagnostic report (MetricKit, a mechanism built into Apple’s operating system). The App sends that report to our server (CHEMAXA) so that we can fix the fault. The Android version does not send such reports.
The report contains technical data only: the type of event (crash or hang), a record of the program state at the moment of failure (a call stack), the App version, the iOS version and the device model. It contains no company data, no order contents and no identifier of your account, and it is not linked to them. Together with the report we store the IP address of the connection, solely to limit abuse of this mechanism; an IP address is personal data and is covered by this policy (retention: 90 days, same as the report). We use no third-party tools for this purpose — the data does not leave the CHEMAXA server. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: keeping the App working correctly).
If you order regularly, you can save a schedule in the App: quantity, unloading point, the interval between deliveries and the date of the next one. We process this data to remind you by notification before the date and to pre-fill the order form.
A schedule never places an order automatically — every delivery requires your confirmation in the App. You can pause or delete a schedule at any time; deleting it does not affect orders already placed. The legal basis is Art. 6(1)(b) GDPR (performance of a contract at your request).
As a signed-in customer you can obtain an individual referral code and pass it to another company. If that company enters the code when creating an account, we record the link between your accounts (who referred whom, the code and the date) in order to settle the discount on both sides.
This means that both companies will know that the link exists — it is visible to us and is the basis for granting the discount. We do not disclose the referred company's contact details to the referrer or vice versa, and we do not share this information with anyone outside CHEMAXA. Passing the code to another company is your decision and happens outside the App (e.g. by e-mail or phone). The legal basis is Art. 6(1)(f) GDPR (legitimate interest: settling the referral programme and preventing abuse).
After a completed delivery you can rate it in the App on a scale of 1–5 and add an optional comment. The rating is internal: it is visible only to CHEMAXA and serves our quality control (after a low rating we may contact you to resolve the issue). Ratings are not published and are not shared with anyone outside CHEMAXA — this is not an App Store review or a public opinion.
Rating is voluntary and tied to a specific order; you can change it at any time by submitting a new one. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: quality control and maintaining customer relationships). Ratings are deleted together with the account.
The Website uses:
_gcl_au) and similar identifiers used to attribute a visit or call to an ad click. Provider: Google Ireland Ltd. (Google privacy policy). We use these technologies on the basis of consent (Art. 6(1)(a) GDPR and the Polish e-communications law implementing the ePrivacy rules).You may withdraw or change your consent to non-essential cookies at any time — via the consent settings on the Website or your browser settings (blocking/deleting cookies). Withdrawal does not affect the lawfulness of prior processing. You may also use Google My Ad Center.
The Website does not display third-party advertising and does not carry out profiling producing legal effects.
The image confirming that an e-mail was opened (section 3.1) does not set cookies and is not used for ad measurement.
We may disclose personal data to: authorised CHEMAXA staff; processors acting on our behalf (the hosting/server provider that runs the App back-end and stores account and enquiry data, accounting offices, IT and e-mail providers, transport and courier companies); the Grupa Azoty company operating the plant from which the customer collects the goods (the plant in Police, Puławy or Kędzierzyn-Koźle — for collection at the plant (FCA) we pass it the details of the driver notified for collection, see section 3.2 “Contractors and their representatives”; the plant releases the goods only to a notified driver); Krajowy Rejestr Długów Biuro Informacji Gospodarczej S.A. (when we check a contractor’s payment reliability we pass the company’s identifying data — VAT ID and name — to that register and receive a business report in return, see section 3.2 “Contractors and their representatives”; that register is also the source of the payment-reliability data we did not receive from you); Apple (for Sign in with Apple account authentication and Apple Push Notification service delivery in the iOS version); Google Ireland Limited (Firebase Cloud Messaging — push notification delivery in the Android version); the SMS gateway operator — PROMOHUB sp. z o.o., ul. Bagatela 10/39, 00-585 Warsaw, Poland, KRS 0001077455, VAT ID (NIP) 7011181115, REGON 527265555, operator of the SMS-fly service (sms-fly.pl), to which we entrust your phone number when we send you an SMS invitation to the App, an order notice or a notice that your account has been activated; Anthropic Ireland, Limited (the provider of the Claude artificial intelligence model, acting as our processor under a data processing agreement — we send it an invoice file only when an authorised person at CHEMAXA requests that invoice to be read, see section 3.2 “Contractors and their representatives” — including a cost invoice or a receipt — and the text of the remarks in an enquiry or of pasted correspondence (after removing the data listed in section 3.1) only when that person requests a draft reply or a summary, see section 3.1; under the provider’s terms this data is not used to train models; on the same terms we send it invoice and order data — without company names, VAT IDs, KSeF numbers or personal data — and, for a question about invoices, also its text, only when an authorised person at CHEMAXA requests, for invoices from the Betterfly software, an explanation of a mismatch, a suggested order or an answer to a question about invoices, see section 3.2 “Contractors and their representatives”); providers of communication services chosen by the user (Meta Platforms — WhatsApp; telecom operators — SMS/phone); Google (for the measurement tools described in section 5, subject to consent); and public authorities and courts where required by law.
As a rule we process data within the EEA. However, the use of certain services may involve transfers to third countries (in particular the USA): Google (Website measurement tools and Firebase Cloud Messaging push notifications in the Android version), Meta Platforms (WhatsApp communication), Apple (Sign in with Apple, APNs push notifications and address autocomplete in the App) and Anthropic (AI-assisted reading of invoices, section 3.2 “Contractors and their representatives”, including the number and amount of pro forma invoices, and AI-assisted draft replies to enquiries, summaries of correspondence pasted into the panel and draft replies to it, section 3.1 — the provider stores data in the USA and may also process it in other countries, including outside Europe — in Asia and Australia; the transfer relies on standard contractual clauses incorporated into the data processing agreement), also for invoices from the Betterfly software (explaining a mismatch, suggesting an order, answering a question about invoices), section 3.2 “Contractors and their representatives”. These providers participate in the EU–US Data Privacy Framework or rely on Standard Contractual Clauses approved by the European Commission, ensuring the level of protection required by the GDPR.
| Data category | Retention period |
|---|---|
| enquiries and correspondence not resulting in a contract | up to 3 years after the correspondence ends (defence against claims) |
| enquiries saved from the App form (leads) | deleted automatically after the retention period (2 years by default) or earlier on request |
| note of a conversation with a prospective customer (company contact details, current supplier and price, the price level discussed, note on needs) — section 3.1 | up to 2 years from the last contact and, where an objection or a deletion request is raised, without undue delay |
| e-mail address used to send periodic price-offer updates — section 3.1 | until an objection to such sending is raised, or until the note/account is deleted |
| returning-customer account in the App (company profile, price list, unloading points, order history) | until the customer deletes the account or the relationship ends (where there is an unsettled amount due or an order in progress — once it is settled, section 4.3); order- and invoice-related data as in the row below |
| data related to contracts, orders and invoices | the term of the contract and thereafter the period required by accounting and tax law — as a rule 5 years from the end of the year in which the tax obligation arose |
| result of AI-assisted reading of an invoice — section 3.2 “Contractors and their representatives” | in the CHEMAXA panel — together with the data of the order the invoice relates to (as in the row above); at the provider (Anthropic) the invoice file and the model’s response are deleted automatically within 30 days, longer only in the cases set out in the provider’s terms (breach of its usage rules, legal obligation) |
| result of AI-assisted reading of a cost invoice or a receipt — section 3.2 “Contractors and their representatives” | in the CHEMAXA panel — together with the cost entry it relates to, i.e. 5 years from the end of the tax year in which the cost was recorded; a reading result from which no cost entry was created — no longer than 90 days from the reading; at the provider (Anthropic) the file and the model’s response — as in the row above |
| draft reply to an enquiry, summary of correspondence pasted into the panel and draft reply to it, prepared with the help of AI — section 3.1 | not kept — the CHEMAXA panel keeps only the reply sent by the authorised person (as enquiries and correspondence) or the note that person approved (as business contact history or order data), plus a technical record without content; at the provider (Anthropic) the text sent and the model’s response are deleted automatically within 30 days, longer only in the cases set out in the provider’s terms (breach of its usage rules, legal obligation) |
| number, amount, currency and date of a pro forma invoice — entered by hand or read with the help of AI (section 3.2 “Contractors and their representatives”), shown in the App (section 4.3) | in the CHEMAXA panel — together with the data of the order the pro forma relates to (as data related to contracts, orders and invoices); the result of the AI-assisted reading — likewise; at the provider (Anthropic) the pro forma file and the model’s response — as for the reading of invoices |
| result of AI assistance with invoices from the Betterfly software (explaining a mismatch, suggesting an order, answering a question about invoices) — section 3.2 “Contractors and their representatives” | in the CHEMAXA panel — 90 days from the result, after which the content of the result is deleted automatically (a technical record without content remains: date, model, number of tokens), and a result relating to a specific order — earlier, when that order or the customer account is deleted; at the provider (Anthropic) the data sent and the model’s response are deleted automatically within 30 days, longer only in the cases set out in the provider’s terms (breach of its usage rules, legal obligation) |
| push notification token | until notifications are disabled, the App is uninstalled, you sign out, or the password is changed or reset (section 4.4) — from then on we send no notifications to it; the record itself is deleted together with the account |
| confirmation that a notification was opened (section 4.4) | up to 12 months from the confirmation being recorded |
| marker recording that a message on the list in the App has been read (section 4.4) | up to 12 months from the marker being recorded |
| history of notifications sent (date, content, delivery result, date the message was deleted from the list in the App — section 4.4) | until the customer’s account is deleted — as evidence that information about an order or a change of pricing was sent |
| log of e-mail and SMS messages sent (e-mail address or phone number, subject, content, date and delivery result) — section 3.2 “Contractors and their representatives” | 36 months from sending (deleted automatically); entries linked to a customer account — at the latest together with that account |
| confirmation that an e-mail sent from our order system was opened (date and time sent, recipients, subject, type of message, order number; for an opening — date and time, IP address, e-mail program and device) — section 3.1 | 12 months from sending the e-mail (deleted automatically); entries linked to a customer account — at the latest together with that account |
| e-mail address on the list of addresses we do not track (objection to open tracking) — section 3.1 | until the objection is withdrawn — so that further e-mails to that address do not contain the image |
| job applicants’ data | the duration of the recruitment and, with the candidate’s consent, up to 12 months afterwards (for future recruitment) |
| data processed on the basis of consent (e.g. marketing) | until consent is withdrawn |
| measurement cookies on the Website | the lifetime of the given cookie or until consent is withdrawn |
| delivery schedules and referral links | until deleted by the customer or until the account is deleted (deleting the account removes both) |
| delivery ratings (1–5 scale with optional comment) | until the account is deleted (deleting the account removes the ratings) |
| date a review request was sent (Rzetelna Firma) | until the account is deleted |
| contact persons at a contractor (name, role, phone, e-mail, note) | until the customer’s account is deleted or the relationship ends |
| additional e-mail addresses of people handling orders at a contractor | until the address is deleted at the request of the contractor or that person, the customer’s account is deleted, or the relationship ends |
| driver’s details for collection at the plant (name, PESEL, identity document, registration numbers, phone) — section 3.2 “Contractors and their representatives” | 90 days from collection of the goods, and for a cancelled order — 90 days from the data being recorded (deleted automatically); earlier — together with the order or on request; e-mails containing these details (the order to the plant, the customer’s reply) — like data related to orders |
| business contact history (call notes, reminder dates) | until the customer’s account is deleted |
| archive of payment-reliability reports (KRD) — the report file together with the copy of the reading attached to that file (score, date, report number, suggested trade-credit limit) | 24 months from the report being uploaded to the system (deleted automatically together with the report file), or earlier — when the customer’s account is deleted |
| current reliability assessment on the contractor’s record (KRD score, date of the reading, report number, suggested trade-credit limit, remark), the internal payment-discipline assessment and the commercial data (payment term, credit limit, current supplier and their price, status and how the contact was acquired) | until the customer’s account is deleted or the relationship ends |
| technical data from the Website (IP address, date and time of the request, browser and operating system, pages visited — including opens of a quotation page shared by link) | up to 12 months from being recorded |
| consent log (date and time, route, identifier of the clause wording, IP address or the person who made the entry) — for consent to the National Debt Register entry and to SMS messages | together with the customer account; and where an entry was submitted to the register on the basis of that consent — the record of that consent for 5 years after the account is deleted (then deleted automatically) |
| record of an unticked consent box when creating an account (date, identifier of the clause wording, no IP address) — section 3.3 | together with the customer account |
| register of consent clause wordings (full wording of every version, no personal data) — section 3.3 | without time limit — entries are only added |
| records from account registration used to limit abuse (IP address, e-mail domain) | 2 days from being recorded (deleted automatically) |
| App crash and hang reports | 90 days from receipt (deleted automatically) |
| data stored locally in the App | until overwritten by the user or the App is uninstalled (device-only) |
You have the right to: access your data and obtain a copy; rectification; erasure (“right to be forgotten”); restriction of processing; data portability; objection to processing based on legitimate interest (including direct marketing); withdrawal of consent at any time (without affecting prior processing); and to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).
We respond to requests without undue delay, at the latest within one month. Requests may be sent to info@chemaxa.com.
We do not make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you. Ad-measurement (section 5) serves statistical and billing purposes only. AI-assisted reading of invoices (section 3.2 “Contractors and their representatives”) is not such a decision either — a person checks and approves the values read. Nor are AI-assisted draft replies to enquiries, summaries of pasted correspondence or draft replies to it (section 3.1) — a person reads, edits and sends the draft, and records a note only after approving it. Nor is the AI-assisted reading of a pro forma invoice (section 3.2 “Contractors and their representatives”) — a person approves the number and amount, and the payment status shown in the App (section 4.3) is information from comparing amounts, not a decision. Nor is AI assistance with invoices from the Betterfly software (explaining a mismatch, suggesting an order, answering a question about invoices — section 3.2 “Contractors and their representatives”) — the model points out a possible cause, ranks the orders or describes the result of a summary, and assigning an invoice and every change are done by a person. Nor is the confirmation that an e-mail was opened (section 3.1) — it tells authorised CHEMAXA staff whether an e-mail was opened; we do not profile on that basis and do not combine it with advertising.
We apply appropriate technical and organisational measures, including: encryption of data in transit (SSL/TLS — on the Website, in the App and in communication with the CHEMAXA server and external services), access control to systems and the admin panel (authentication, login-attempt limiting), the least-privilege principle (a database account with restricted permissions), protection of database queries against SQL injection, storing session tokens only as a hash, protection of configuration files and secrets, regular backups and staff training. Data stored locally in the App is protected by operating-system security mechanisms: on iOS — device encryption and the Keychain (which holds the session token); on Android — EncryptedSharedPreferences (AES-256), with backup of App data disabled.
This policy may be updated, e.g. when Website or App features or legal requirements change. The current version, with its effective date, is always available at this address.