Privacy Policy

§1 Data Controller

1. The controller of personal data is CHIAS BROTHERS EUROPE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (a limited liability company) with its registered office in Poznań, address: ul. Wichrowa 1A, 60-449 Poznań, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Poznań – Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS number 0000592789, NIP (tax identification number) 9721259715, REGON 363262807, share capital PLN 135,700.00 (hereinafter: the “Controller”).
2. In matters concerning the protection of personal data, you can contact the Controller:
   1. by e-mail at: hello@chias.eu,
   2. in writing at the Controller’s registered office address given in paragraph 1,
   3. by telephone at +48 602 189 031.
3. The Controller has not appointed a data protection officer. Personal data processing within the Controller’s organisation is overseen by a designated person, who can be contacted in the manner indicated in paragraph 2.
4. This Policy sets out the rules for processing personal data in connection with use of the Website, submission of enquiries, scheduling of meetings, business correspondence and the Controller’s LinkedIn profile — including the purposes and legal bases of processing, data recipients, transfers of data outside the European Economic Area, retention periods and the rights of data subjects.
5. Personal data is processed in accordance with applicable law, in particular the GDPR and the Act of 12 July 2024 – Electronic Communications Law.

§2 Definitions

1. Controller — the entity indicated in §1 paragraph 1.
2. Personal data — information about an identified or identifiable natural person, including online identifiers, the IP address of a device and information collected through cookies and similar technologies.
3. EEA — the European Economic Area, comprising the Member States of the European Union and Iceland, Liechtenstein and Norway.
4. ECL — the Act of 12 July 2024 – Electronic Communications Law (Journal of Laws 2024, item 1221, as amended).
5. Processor — an entity that processes personal data on behalf of the Controller under a data processing agreement (Article 28 GDPR).
6. Policy — this Privacy Policy.
7. Cookie Policy — the document setting out the rules for the use of cookies on the Website, available at: https://shotcopacker.eu/cookie-policy/.
8. Profiling — any form of automated processing of personal data that consists of using the data to evaluate certain personal aspects, in particular to analyse or predict interests or behaviour (Article 4(4) GDPR).
9. GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
10. Website — the website operated by the Controller at https://shotcopacker.eu, including its subpages.
11. User — any natural person who visits the Website, submits an enquiry, schedules a meeting, contacts the Controller or interacts with the Controller’s LinkedIn profile — including a person acting on behalf of or for a business.

§3 Nature of the Website

1. The Website is informational and is aimed at businesses (B2B). It serves to present the Controller’s services in contract manufacturing of functional beverages (including private label, white label, co-packing and new product development) and to obtain requests for quotations.
2. No online sales are conducted on the Website, no payments are accepted and no user account can be created. The Controller therefore does not process data on the Website relating to orders, payments, delivery or returns.
3. Data processed in connection with the Website relates primarily to persons representing businesses or acting on their behalf (e.g. owners, board members, employees, associates), as well as persons visiting the Website.

§4 What Data We Process and Where We Obtain It

1. In the contact form, the User provides: first and last name, business e-mail address, telephone number, the company’s website address, information on the type of business (selected from a list), estimated annual production volume, the type of cooperation sought, the content of the message, and information on how the User learned about the Controller.
2. On subpages devoted to events (e.g. trade fairs), the User may provide an e-mail address in order to receive an informational material (e.g. a guide to the Controller’s stand).
3. When booking a meeting via Calendly, the User provides: first and last name, e-mail address, answers to the questions in the booking form and the chosen time slot; the tool also records the User’s time zone.
4. In the course of further correspondence, conversations and meetings, the Controller processes data provided by the User, including data contained in the e-mail signature (e.g. job title, company name, contact details) and the content of the correspondence.
5. When the Website is used, technical data is collected automatically: IP address, information about the device and browser, subpages visited, time of visit and — to the extent that the User has consented to analytics or marketing cookies — also cookie identifiers and information about actions on the Website (e.g. submitting a form, clicking an e-mail address or telephone number, booking a meeting, downloading a material).
6. If personal data has not been provided by the User personally but by the business that the User represents or works for (e.g. when indicating a contact person for cooperation), the Controller processes the following categories of data: first and last name, job title or function, company name and business contact details.
7. The Controller does not collect special categories of personal data referred to in Article 9 GDPR on the Website. Please do not include such data in the content of messages.

§5 Purposes and Legal Bases of Processing

1. On the basis of Article 6(1)(a) GDPR (consent), personal data is processed for the purpose of:
   1. using cookies and analytics and marketing technologies (Google Analytics, Google Ads, remarketing, LinkedIn Insight Tag) — in accordance with the settings selected by the User in the consent management tool (CookieYes); this consent is also consent within the meaning of Article 399(1) ECL,
   2. profiling for marketing purposes using cookies and similar technologies, as described in §11 paragraph 2,
   3. marketing contact, i.e. sending commercial information by e-mail or telephone — on the basis of separate consent given for each communication channel; this consent is also consent within the meaning of Article 398(1) ECL.
2. On the basis of Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract), personal data is processed for the purpose of:
   1. handling requests for quotations submitted via the contact form,
   2. scheduling business meetings and calls, including via Calendly,
   3. sending the material requested by the User (e.g. a guide made available on an event subpage).

   This basis applies where the User acts on their own behalf (e.g. as an entrepreneur running a sole proprietorship) or is themselves a party to the service they are requesting. If the User acts on behalf of or for another business, their data is processed for the same purposes on the basis of the Controller’s legitimate interest referred to in paragraph 4(b).

3. On the basis of Article 6(1)(c) GDPR (legal obligation incumbent on the Controller), personal data is processed for the purpose of:
   1. issuing and retaining accounting and tax documents — if discussions lead to the conclusion of a contract,
   2. keeping the records and documentation required by data protection regulations, including demonstrating that consents have been given,
   3. cooperating with public authorities to the extent required by law.
4. On the basis of Article 6(1)(f) GDPR (the Controller’s legitimate interest), personal data is processed for the purpose of:
   1. operating and securing the shotcopacker.eu Website, including protecting forms against spam and abuse (Google reCAPTCHA) and keeping server logs — the legitimate interest being to ensure the security and proper functioning of the Website,
   2. conducting business contact with company representatives (B2B) and handling enquiries and leads in the Livespace CRM system — the legitimate interest being to respond to the enquiry, to establish and develop cooperation with the business the User represents, and to maintain an organised history of contacts,
   3. scoring and assessing enquiries in order to handle them properly (§11 paragraph 3) — the legitimate interest being to assign the enquiry to the appropriate person and to determine the order of handling,
   4. using artificial intelligence tools in the internal enquiry-handling process (§9) — the legitimate interest being efficient, fast and reliable handling of enquiries,
   5. direct marketing of the Controller’s own services addressed to businesses — the legitimate interest being to promote the Controller’s services; commercial information is sent by e-mail or telephone only after obtaining the consent referred to in paragraph 1(c),
   6. establishing, pursuing or defending legal claims — the legitimate interest being to protect the Controller’s rights,
   7. maintaining the Controller’s social media profile (LinkedIn) and communicating with persons who interact with it — the legitimate interest being to promote the brand and services and to communicate with the audience,
   8. displaying the Website using fonts downloaded from Google servers (Google Fonts) — the legitimate interest being the correct and consistent display of the Website’s content.
5. Personal data may be processed for a purpose other than that for which it was collected only where the new purpose is compatible with the original purpose or the Controller has a separate legal basis. The Controller will inform you of the new purpose before starting processing for that purpose.

§6 Forms on the Website (Contact Form 7 and Flamingo)

1. The forms on the Website are based on the Contact Form 7 plugin. Data submitted through a form is delivered to the Controller’s e-mail inbox and is also saved in the Website’s database using the Flamingo plugin, which stores a copy of the submitted messages. The Website’s database is located on the servers of the hosting provider (§13).
2. Data from an enquiry may be transferred to the Livespace CRM system for further handling (§7).
3. The forms are protected by the Google reCAPTCHA service, which, in order to distinguish a human from automated software, analyses information about the device and the way the form is used (including IP address, browser data and cursor movements) and transmits it to Google.
4. Data marked in the form as mandatory is necessary to respond to the enquiry or to send the material requested by the User. The remaining data is provided voluntarily; it helps tailor the response.
5. Submitting a form or requesting a material does not constitute consent to receive commercial information. The marketing consent referred to in §5 paragraph 1(c) is collected separately.

§7 Livespace CRM System

1. The Controller handles enquiries and business contacts in the Livespace CRM system, provided by Livespace S.A. with its registered office in Warsaw, acting as a Processor.
2. The CRM stores: the User’s contact details, the name and website of the company represented, the content of the enquiry and the answers given in the form, the history of correspondence, conversations and meetings, sales notes, the status and stage of discussions, the source of the contact, information on marketing consents given, and the scoring result referred to in §11 paragraph 3.
3. Access to data in the CRM is limited to persons authorised by the Controller, to the extent necessary to perform their tasks.

§8 Scheduling Meetings — Calendly and Microsoft Calendar

1. To schedule meetings and business calls, the Controller uses Calendly, provided by Calendly LLC (United States). The booking calendar may be embedded in the Website or made available to the User as a link, e.g. in correspondence.
2. Calendly is synchronised with the Microsoft 365 calendar of the person hosting the meeting. The synchronisation serves to check the availability of time slots and to create in the Microsoft calendar an event containing the data provided at booking (first and last name, e-mail address, answers to questions, meeting date and time).
3. Calendly sends the User a booking confirmation, a calendar invitation, a reminder before the meeting and a link enabling the User to change or cancel the appointment.
4. With respect to data processed for the Controller’s purposes, Calendly LLC and Microsoft Ireland Operations Limited act as Processors. To the extent that Calendly processes data for its own purposes (e.g. where the User uses their own Calendly account), it acts as a separate controller on the terms set out in its privacy policy.
5. Information about a booked meeting may be recorded in Google Analytics as a statistical event — only where consent to analytics cookies has been given and without the User’s first name, last name or e-mail address.

§9 Artificial Intelligence Tools in Enquiry Handling

1. In its internal enquiry-handling process, the Controller uses artificial intelligence tools, including the Claude model provided by Anthropic. These tools support the Controller’s staff in organising and summarising the content of enquiries, preliminarily categorising them and preparing draft replies.
2. Only data necessary for the given task is passed to the tool — primarily the content of the enquiry and information about the company’s needs. The Controller limits the transfer of data identifying the User where it is not needed to perform the task.
3. The output of the tool is always verified by a member of the Controller’s staff. The reply to an enquiry and decisions concerning cooperation are made by a human. AI tools do not make decisions concerning the User that produce legal effects or similarly significantly affect them.
4. The provider of the tool for Users in the EEA is Anthropic Ireland, Limited, acting as a Processor under a data processing agreement. In accordance with the terms of service for business customers, data passed to the tool is not used to train AI models. Processing may involve the transfer of data to Anthropic PBC in the United States (§14).
5. No chatbot or other AI system that conducts a direct conversation with the User operates on the Website.

§10 Cookies, Analytics and Advertising

1. The Website uses cookies and similar technologies. Detailed information on individual cookies, their purposes and storage periods is provided in the Cookie Policy.
2. The Controller manages cookie consents using the CookieYes tool, provided by CookieYes Limited (United Kingdom). On their first visit, the User may accept all cookies, reject non-essential cookies or select the categories they consent to. The User’s choice is stored in a cookie and in the CookieYes consent log, which allows the Controller to demonstrate that consent has been given or refused. Consent can be changed or withdrawn at any time in the CookieYes settings available on the Website; withdrawing consent is as easy as giving it.
3. Cookies necessary for the operation of the Website and for remembering the User’s choice are used without consent, on the basis of Article 399(3) ECL. Until consent is given, analytics and advertising tools do not store analytics or advertising cookies on the User’s device (Google’s consent mode — Google Consent Mode).
4. After consent is given, the following operate on the Website:
   1. Google Tag Manager — a tool for managing scripts on the Website; it launches the other tools in accordance with the choice made in CookieYes,
   2. Google Analytics 4 — traffic statistics and analysis of Website usage, including measurement of events such as form submission, clicks on an e-mail address or telephone number, meeting booking and material download,
   3. Google Ads and Google remarketing — measuring the effectiveness of advertising and displaying the Controller’s ads to people who have previously visited the Website,
   4. LinkedIn Insight Tag — measuring the effectiveness of campaigns on LinkedIn, targeting ads at people who have visited the Website, and aggregated demographic reports about visitors (e.g. industry, job title, company size); these reports do not allow the Controller to identify a specific person.
5. Regardless of cookie consent, the Google reCAPTCHA service (form protection, §6 paragraph 3) and Google Fonts (downloading fonts from Google servers, as a result of which the User’s browser passes its IP address to Google) operate on the Website — on the basis of the Controller’s legitimate interest (§5 paragraph 4(a) and (h)).
6. The Calendly calendar embedded in the Website may use the provider’s own cookies, on the terms set out in Calendly’s privacy policy.
7. With respect to the collection of data on the Website using Google Ads and LinkedIn Insight Tag and its transfer to the providers of these tools, the Controller and the provider may be regarded as joint controllers. Further processing of data by Google and LinkedIn for their own purposes is their responsibility and takes place on the terms set out in their privacy policies.
8. The User may also restrict or disable the storage of cookies in their browser settings. Disabling necessary cookies may make it difficult to use some features of the Website.

§11 Profiling

1. The Controller uses profiling for the two purposes described in paragraphs 2 and 3. Neither leads to decisions based solely on automated processing that would produce legal effects concerning the User or similarly significantly affect them (Article 22 GDPR).
2. Marketing profiling. On the basis of consent to marketing cookies (§5 paragraph 1(b)), the Controller and the providers of advertising tools (Google, LinkedIn) analyse the User’s activity on the Website — including subpages visited and actions taken — in order to tailor ads displayed in Google Search, in the Google advertising network and on LinkedIn, and to create ad audiences. The only effect of profiling is which of the Controller’s ads the User sees. Consent can be withdrawn at any time in the CookieYes settings.
3. Scoring of enquiries (leads). On the basis of the legitimate interest (§5 paragraph 4(c)), the Controller assesses enquiries submitted by Users in order to determine their priority and assign them to the appropriate person. The assessment is based on data provided in the form (type of business, estimated volume, type of cooperation sought, company website, source of information about the Controller), the content of the enquiry and previous correspondence. The scoring result is stored in the CRM and serves solely to organise the work of the sales team — every enquiry receives a reply, and decisions concerning cooperation are made by a human.
4. The User has the right to object to profiling based on the Controller’s legitimate interest (Article 21(1) GDPR) and, with respect to profiling related to direct marketing, an unconditional right to object (Article 21(2) and (3) GDPR).

§12 LinkedIn Profile

1. The Controller maintains a company profile on LinkedIn: https://www.linkedin.com/company/chiasbrotherseurope/. In connection with this, the Controller processes data of persons who follow the profile, comment or react to posts, or send messages — to the extent visible on those persons’ profiles and in the content of the interaction.
2. This data is processed on the basis of the Controller’s legitimate interest (§5 paragraph 4(g)) for the period during which the interaction on LinkedIn is maintained or until an effective objection is lodged.
3. With respect to profile statistics (Page Insights), the Controller and LinkedIn Ireland Unlimited Company are joint controllers. The essence of the arrangement between them is set out in the “Page Insights Joint Controller Addendum” available at https://legal.linkedin.com/pages-joint-controller-addendum. The statistics made available to the Controller are aggregated. Rights under the GDPR in this respect may be exercised both against the Controller and against LinkedIn.
4. LinkedIn Ireland Unlimited Company is responsible for the processing of data by LinkedIn for its own purposes, on the terms set out in LinkedIn’s privacy policy.

§13 Recipients of Personal Data

1. Personal data may be disclosed to the following recipients, solely to the extent necessary to achieve the purposes described in the Policy:
   1. LH.pl Sp. z o.o. (Poland) — hosting of the Website and the forms database — Processor,
   2. Livespace S.A. (Poland) — CRM system — Processor,
   3. Microsoft Ireland Operations Limited (Ireland) — Microsoft 365 e-mail and calendar — Processor,
   4. Calendly LLC (United States) — scheduling of meetings — Processor,
   5. Google Ireland Limited (Ireland) — Google Tag Manager, Google Analytics, Google reCAPTCHA and Google Fonts (as a Processor or — to the extent specified in Google’s terms — a separate controller) and Google Ads and remarketing (as a separate controller or joint controller, §10 paragraph 7),
   6. LinkedIn Ireland Unlimited Company (Ireland) — LinkedIn Insight Tag and company profile (as a separate controller or joint controller, §10 paragraph 7 and §12),
   7. CookieYes Limited (United Kingdom) — management of cookie consents — Processor,
   8. Anthropic Ireland, Limited (Ireland) — AI tools used in internal enquiry handling — Processor,
   9. providers of IT services and technical support for the Website, marketing and SEO agencies, the accounting office and law firms — to the extent that they provide services to the Controller,
   10. public authorities and other entities authorised under the law — solely where the obligation to disclose data results from legal provisions.
2. Processors process data solely on the Controller’s instructions, under a data processing agreement, and are obliged to apply appropriate security measures.

§14 Transfers of Data Outside the European Economic Area

1. Some of the providers indicated in §13 belong to corporate groups headquartered outside the EEA or use infrastructure outside the EEA. As a result, personal data may be transferred to the United States and the United Kingdom.
2. Data is transferred solely using one of the mechanisms provided for in Chapter V of the GDPR:
   

   Provider	Recipient’s country	Basis for transfer
   Google (Google LLC)	United States	European Commission adequacy decision under the EU-US Data Privacy Framework (Article 45 GDPR) — Google LLC participates in the programme; additionally, standard contractual clauses (Article 46(2)(c) GDPR)
   LinkedIn (LinkedIn Corporation)	United States	EU-US Data Privacy Framework (Article 45 GDPR) — LinkedIn Corporation participates in the programme; additionally, standard contractual clauses (Article 46(2)(c) GDPR)
   Calendly LLC	United States	EU-US Data Privacy Framework (Article 45 GDPR) — Calendly LLC participates in the programme; additionally, standard contractual clauses included in the data processing agreement (Article 46(2)(c) GDPR)
   Microsoft (Microsoft Corporation)	United States	EU-US Data Privacy Framework (Article 45 GDPR) — Microsoft Corporation participates in the programme; additionally, standard contractual clauses (Article 46(2)(c) GDPR)
   Anthropic (Anthropic PBC)	United States	Standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR)
   CookieYes Limited	United Kingdom	European Commission adequacy decision for the United Kingdom (Article 45 GDPR)

3. The EU-US Data Privacy Framework is a mechanism that the European Commission has recognised as ensuring an adequate level of protection for personal data transferred to US companies certified under it (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023). The list of programme participants is available at https://www.dataprivacyframework.gov.
4. Standard contractual clauses are model contractual provisions approved by the European Commission (Commission Implementing Decision (EU) 2021/914 of 4 June 2021), obliging the data recipient to ensure protection corresponding to GDPR standards.
5. The User may obtain a copy of the safeguards applied to data transfers, or information on where they have been made available, by contacting the Controller in the manner indicated in §1 paragraph 2.

§15 Data Retention Period

1. Personal data is stored for no longer than necessary to achieve the purpose of processing, and is then deleted or anonymised. In particular:
   1. data from enquiries, forms (including copies saved in Flamingo), meeting bookings and correspondence that did not lead to cooperation — for 12 months from the end of the correspondence or from the date of the meeting, unless the User lodges an effective objection earlier,
   2. data in the CRM system concerning cooperation that has been undertaken — for the duration of the cooperation, and then until the expiry of the limitation period for claims, which for claims related to the conduct of business activity is in principle 3 years, ending on the last day of the calendar year (Article 118 of the Civil Code),
   3. data processed on the basis of consent — until the consent is withdrawn; information on the giving and withdrawal of consent may be stored for longer, to the extent necessary to demonstrate the lawfulness of processing,
   4. data processed for direct marketing on the basis of the legitimate interest — until an objection is lodged,
   5. accounting and tax documents — for 5 years, counted from the end of the calendar year in which the tax payment deadline expired (Article 70 § 1 and Article 86 § 1 of the Tax Ordinance, Article 74 of the Accounting Act),
   6. data stored using cookies — for the period indicated for the given cookie in the Cookie Policy or until deleted by the User; data in Google Analytics — for the retention period set in the service,
   7. data passed to AI tools — only for the time needed to perform the task and for the period resulting from the agreement with the tool provider; AI tools are not used by the Controller to store data,
   8. data related to the LinkedIn profile — for the period during which the interaction on LinkedIn is maintained or until an effective objection is lodged.
2. The retention period may be extended if the data is necessary to establish, pursue or defend legal claims — until they are finally resolved — or where further retention is required by law.

§16 User Rights

1. The User has the following rights:
   1. the right of access to their personal data and to obtain a copy of it (Article 15 GDPR),
   2. the right to rectification of data (Article 16 GDPR),
   3. the right to erasure of data (Article 17 GDPR),
   4. the right to restriction of processing (Article 18 GDPR),
   5. the right to data portability — with respect to data processed on the basis of consent or a contract by automated means (Article 20 GDPR),
   6. the right to object to processing based on the Controller’s legitimate interest, on grounds relating to the User’s particular situation (Article 21(1) GDPR),
   7. the right to object at any time to the processing of data for direct marketing purposes, including profiling to the extent related to such marketing — after an objection is lodged, the data will no longer be processed for this purpose (Article 21(2) and (3) GDPR),
   8. the right to withdraw consent at any time; withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal (Article 7(3) GDPR),
   9. the right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw. A complaint may also be lodged with the supervisory authority in the EU Member State of the User’s habitual residence or place of work, or where the alleged infringement took place (Article 77 GDPR).
2. To exercise these rights, please contact the Controller in the manner indicated in §1 paragraph 2. The Controller responds without undue delay and no later than within one month of receiving the request. Taking into account the complexity of the request or the number of requests, this period may be extended by a further two months; the Controller will inform the User of the extension and the reasons for it within one month of receiving the request.
3. The rights listed in paragraph 1 are not absolute. The Controller may refuse to comply with a request in the cases provided for in the GDPR, in particular where further processing of the data is required by law or is necessary to establish, pursue or defend legal claims. The Controller will inform the User of a refusal and the reasons for it.

§17 Voluntary Provision of Data

1. Providing personal data is voluntary.
2. Providing the data marked in the form as mandatory is necessary to respond to an enquiry, schedule a meeting or send a material. Without this data, the Controller will not be able to fulfil the User’s request.
3. Giving consent to analytics and marketing cookies and to marketing contact is entirely voluntary, and refusal does not limit the ability to use the Website or to contact the Controller.
4. To the extent that the obligation to provide data results from legal provisions (in particular tax and accounting regulations), providing the data is a statutory requirement.

§18 Security of Personal Data

1. The Controller applies appropriate technical and organisational measures to ensure the security of the data processed, selected on the basis of a risk analysis, in particular encryption of data transmission (SSL/TLS), restriction of access to systems to authorised persons, and procedures protecting against unauthorised access, loss or destruction of data.
2. Access to data is granted only to persons authorised by the Controller, who are bound to keep it confidential, and only to the extent necessary to perform their tasks.
3. The Controller cooperates only with entities that provide sufficient guarantees of implementing appropriate technical and organisational measures (Article 28(1) GDPR).

§19 Changes to the Privacy Policy

1. The Policy is reviewed on an ongoing basis and updated where necessary — in particular where the tools used, the purposes of processing or the legal provisions change.
2. The current version of the Policy was adopted and has been in force since 2026-09-30. The legal compliance of this document is guaranteed by lawyers from Kancelaria KZ. Legal drafting: Kancelaria KZ · kancelariakz.pl