Get in touch

Privacy Policy

Who is responsible for your data?

The controller of your personal data is Maas Loop sp. z o.o., registered office: Jasionka 954, 36-002 Jasionka, Poland – a company entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000861834, REGON: 387109820, NIP (tax ID): 8133844818 (the “Controller”).

If you have any questions about data protection, email us at [email protected] or call us on +48 797 120 254.

What data do we collect and why?

We collect nothing “just in case”. We process only what our services need to work and to stay secure.

The detailed rules on cookies and similar technologies – the types of cookies, what they are used for and how consent is managed – are set out in a separate cookie policy.

Category: Running and securing the Website

  • Data processed: Strictly necessary cookies, technical preferences, information about your device and browser, and the user preferences that individual features of the Website need to work.
  • Purpose: To make sure the Website works properly and securely, to protect it against misuse and to display its content correctly.
    Legal basis – Article 6(1)(f) GDPR (the Controller’s legitimate interest in the proper operation of the Website) and Article 399(3) of the Polish Electronic Communications Law (strictly necessary cookies).

Category: Contacting us (contact form/email) and answering enquiries

  • Data processed: First name, surname, email address, any other details you include in your message, phone number.
  • Purpose: To answer your question or prepare a quote.
    Legal basis – Article 6(1)(f) GDPR (the Controller’s legitimate interest in handling enquiries) and Article 6(1)(b) GDPR (steps taken at your request before entering into a contract).

Category: Direct marketing (newsletter, promotional offers)

  • Data processed: Email address.
  • Purpose: To send you our newsletter and commercial offers.
    Legal basis – Article 6(1)(a) GDPR (consent) and Article 398 of the Polish Electronic Communications Law (consent to receive commercial information by electronic means).

Category: After-sales communication

  • Data processed: Email address and the feedback you give.
  • Purpose: After-sales communication is neutral and serves only to assess the quality of the service provided; it contains no promotional or sales content and no encouragement to buy. The data used for this purpose comes from the information you gave us in connection with using our services.
    Legal basis – Article 6(1)(f) GDPR (the Controller’s legitimate interest in assessing and improving the quality of its services).

Category: Analytics and statistics

  • Data processed: IP address, information about your device and browser, statistics on how the Website is used.
  • Purpose: To analyse how the Website is used and to improve it.
    Legal basis – Article 6(1)(a) GDPR (consent).

Providing your details in the contact form or in an email is voluntary, but we may need them to answer you or to prepare a quote. Without them, we may be unable to handle your enquiry.

How long do we keep your data?

At Maas Loop we believe that personal data – like packaging – should not be left lying around for ever. We keep it only for as long as the purposes it was collected for require, and in line with the law.

  • Data processed to run and secure the Website is kept for as long as needed to keep the Website working properly and securely, but no longer than until the purpose ends or you successfully object – where an objection is possible.
  • Data processed on the basis of consent (e.g. for marketing or analytics) is kept until you withdraw your consent, without affecting the lawfulness of processing carried out before the withdrawal.
  • Data processed in our legitimate interest is kept until you successfully object to the processing or until the purpose ends – whichever comes first.
  • Data used for after-sales communication is kept for as long as needed to carry out and analyse the feedback survey, and then for as long as needed to establish, pursue or defend legal claims – where this applies.
  • Data processed for direct marketing is kept until you withdraw your consent or object to processing for this purpose.
  • Data needed for tax, accounting or archiving purposes is kept for the period required by law – as a rule, 5 years from the end of the calendar year in which the tax liability arose or the settlement was made.
  • Data processed to pursue or defend against claims is kept until those claims become time-barred – as a rule, 3 to 6 years, and longer for periodic or special claims where the law requires it.

Once these periods have passed, your data is deleted so that it cannot be restored, or anonymised so that it becomes no more than safe statistical data.

Your rights and how to exercise them

You have:

  • the right of access (Article 15 GDPR) – you can find out from us whether and how we process your data;
  • the right to rectification (Article 16 GDPR) – if your data is inaccurate or incomplete, you can ask us to correct or complete it;
  • the right to erasure (“the right to be forgotten”) (Article 17 GDPR) – you can ask us to delete your personal data if it is no longer needed for the purposes it was collected for, or if the processing is unlawful;
  • the right to restriction of processing (Article 18 GDPR) – you can ask us to suspend operations on your data, e.g. while its accuracy is checked or your objection is considered;
  • the right to data portability (Article 20 GDPR) – if we process your data by automated means on the basis of consent or a contract, you have the right to receive it in a structured, machine-readable format and to transfer it to another controller;
  • the right to object to processing (Article 21 GDPR) – you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest; you can object to direct marketing at any time;
  • the right to withdraw consent at any time (Article 7(3) GDPR) – where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of anything we did before the withdrawal;
  • the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), the Polish supervisory authority (Article 77 GDPR).

Sharing personal data

  • We may pass your personal data only to organisations that help us run the Website and provide our services (e.g. hosting companies, providers of analytics tools and mailing systems, and IT or postal service providers).
  • These organisations process the data on our behalf and only on our instructions, under contracts that protect your data.
  • As a rule, we do not transfer your personal data outside the European Economic Area. If such a transfer is ever necessary, we will use one of the mechanisms provided for in Chapter V of the GDPR.

Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, including profiling, that could have legal effects on you or otherwise significantly affect you.

You will not be subject to decisions based solely on automated processing, including profiling, that produce or could produce legal effects concerning you or similarly significantly affect you.

Changes to this Privacy Policy

This Privacy Policy may change to reflect new legislation, new services or higher standards of personal data protection. We will tell you about any significant change by email or with a banner on the Website. We recommend checking the date of the last update from time to time.

Last updated: 30 September 2026.