A plain-language explanation of the data we collect through this website, why we collect it, the legal basis for each purpose and how long we keep it.
REQUIRES OWNER REVIEW — this document was drafted from the technologies actually found in this application's code. Every item marked “REQUIRES OWNER REVIEW” must be confirmed by the controller and a qualified privacy professional before the document is treated as final.
Effective date: 1 September 2026 · Last updated: 1 September 2026 · Document version: 2026-09-01
The controller is BioTech Agro Africa Sp. z o.o., ul. Nenckiego 136A, 52-223 Wrocław, Poland, tax ID (NIP): 8992678777.
Privacy contact: sfk@biotechagroafrica.com.
No data protection officer has been appointed. REQUIRES OWNER REVIEW — if a DPO or an EU/UK representative exists, their details must be added here.
This policy covers this website and its contact form. It does not cover correspondence conducted outside the site, meetings, or third-party websites we link to.
We collect only the data you provide directly through the contact form, plus limited technical data generated by the server for security purposes.
We do not buy personal data and we do not obtain it from data brokers or social networks.
Subject, name, email address and message are required to answer you — without them we cannot handle the enquiry. The remaining fields (organisation, country, project type, attachments) are optional; leaving them out only means our answer may be less specific.
Form submissions are stored in our database and delivered to our business email address. We use the following processors acting on our instructions:
Formspree, Inc. is a United States provider, so enquiry content may be processed outside the EEA. REQUIRES OWNER REVIEW — confirm the Standard Contractual Clauses or EU-U.S. Data Privacy Framework certification in place, and the storage region of the hosting and database provider.
We use transport encryption (HTTPS/HSTS), a Content Security Policy, restrictive database permissions (row-level security, no public write access), input validation, submission rate limiting, and attachment type and size checks. No safeguards can guarantee absolute security.
We do not make decisions based solely on automated processing and we do not profile visitors. The only automated logic is rate limiting per IP address, which protects the form from abuse and produces no legal effects.
This site addresses business and institutional audiences. We do not target children and do not knowingly collect data from anyone under 16. If such data reaches us, contact us and we will delete it subject to applicable law.
| Data category | Purpose | Legal basis | Recipients | Retention period | Required |
|---|---|---|---|---|---|
| Contact details and enquiry content | Answering the enquiry and conducting related correspondence | GDPR Art. 6(1)(b) (pre-contractual steps) or Art. 6(1)(f) (legitimate interest in business contact) | Lovable/Supabase (hosting, database), Formspree (email delivery) | 24 months after the last correspondence; if cooperation starts, until it is contractually settled | Yes — subject, name, email, message |
| Attachments submitted with the form | Reviewing submitted project documentation | GDPR Art. 6(1)(b) or Art. 6(1)(f) | Lovable/Supabase (file storage) | 24 months from submission | No |
| IP address and submission timestamp | Protecting the form against spam and abuse (rate limiting) | GDPR Art. 6(1)(f) (service security) | Lovable/Supabase (database) | 24 hours | Yes — technical data required to submit the form |
| Consent record for browser technologies | Demonstrating and honouring your choice about optional technologies | GDPR Art. 6(1)(c) together with the ePrivacy consent obligation | None — the record stays in your browser | 12 months, or until you clear browser storage | Yes — strictly necessary category |
You have the right to access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent with future effect.
Not every erasure request can be fulfilled in full — legal obligations (for example evidentiary, accounting or defence of legal claims) may require us to keep certain data. Where that applies, we will explain the basis for the refusal.
Send requests to sfk@biotechagroafrica.com with the subject “Privacy request”. We respond within 30 days. Where we cannot reasonably verify your identity, we may ask for additional verification details.
You may lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or with the supervisory authority of your place of residence.
Residents of California and other US states with applicable privacy laws have rights to know, access, delete, correct, and opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising them.
We do not sell personal information and we do not share it for cross-context behavioural advertising — no advertising pixels, ad networks or marketing identifiers were found in this application. We also do not collect sensitive personal information as defined by those laws.
We honour Global Privacy Control: when your browser sends the signal, all optional categories stay off and we treat the signal as an opt-out of sale and sharing.
If purposes, vendors or terms change materially, we increment the document version and ask you to make a new choice about optional technologies. The effective and last-updated dates are shown at the top of this document.
The following items must be confirmed by the controller and a qualified privacy professional. Until then this implementation must not be described as final or fully compliant.
