This policy explains what personal data WestFlow collects, why we process it, how long we keep it and what rights you have. We keep it plain and honest, no dark patterns, no hidden tracking.
WestFlow is a B2B logistics and fulfillment business operated by Mateusz Zdanowski, based in Warsaw, Poland. We help e-commerce brands from the United States and the United Kingdom sell into Poland and the wider EU.
We are the controller of the personal data described here, meaning we decide why and how it is processed.
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. For any privacy matter, write to contact@westflowlog.eu.
This policy covers personal data we process through the website westflowlog.eu, when you contact us by email or our contact form, when you interact with us on LinkedIn in a business context, and in the course of providing, or preparing to provide, our fulfillment services. It does not cover third-party websites we link to, which have their own policies.
Our form collects your name, email address, company name, approximate monthly order volume, product category and the content of your message. Only your name, email and message are strictly needed to reply; the rest helps us give a meaningful answer. The form includes a hidden anti-spam field, which is not personal data and is discarded.
If you email us, we process your email address, name, any details you include, and the content and metadata of the correspondence.
Our hosting provider automatically records standard technical data when you visit: IP address, browser type and version, operating system, referring page, pages viewed, date and time. We use this for security and to keep the site running, not to identify you or build a profile.
Our site loads fonts and a script from external providers. When your browser requests them, your IP address and basic technical data are transmitted to those providers (Google for fonts; Cloudflare and jsDelivr for scripts and map data). We do not control what they do with that data beyond delivering the resource. See section 07 on international transfers.
If you connect with us or interact with our posts, LinkedIn processes your data under its own policy as an independent controller. We only process what you send us directly.
We use Search Console to monitor how our site performs in search. It gives us aggregated, anonymous statistics only, no personal data about individual visitors, and no cookies set on your device through our site.
We do not use analytics tools, advertising pixels, tracking scripts or profiling software. We do not buy personal data, and we do not sell or rent your data to anyone.
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your enquiry and preparing a possible offer | Art. 6(1)(b), pre-contract steps at your request; Art. 6(1)(f), legitimate interest in business correspondence |
| Providing fulfillment services under a contract | Art. 6(1)(b), performance of a contract; Art. 6(1)(f) for corporate client representatives |
| Invoicing, bookkeeping, tax records | Art. 6(1)(c), legal obligation (Polish accounting and tax law) |
| Site security, preventing abuse and spam | Art. 6(1)(f), legitimate interest in a secure service |
| Establishing or defending legal claims | Art. 6(1)(f), legitimate interest |
| Sending commercial information electronically, if you ask for it | Art. 6(1)(a), your consent, with Art. 398 of the Polish Electronic Communications Law |
Where we rely on legitimate interest, we have weighed it against your rights, and you may object at any time (section 09).
| Data | Retention |
|---|---|
| Enquiries that do not lead to a contract | 12 months from our last correspondence, then deleted |
| Form submissions held by our form provider | Deleted automatically by the provider after 30 days. Submissions are also delivered to us by email and retained per the enquiry rules above. |
| Client contract and correspondence data | Duration of the contract, then until claims are time-barred, generally 3 years for business claims under Polish law |
| Accounting and tax records | 5 years from the end of the calendar year of the tax obligation (Polish law) |
| Server logs | Short-term, as retained by our hosting provider for security |
| Consent-based communications | Until you withdraw consent |
When a period ends, we delete the data or irreversibly anonymise it.
We do not sell your data. We share it only with providers that help us operate, each acting as a processor under a contract, or where required by law. Our two core website providers are:
| Provider | Role | Location |
|---|---|---|
| Netlify, Inc. | Website hosting and server logs | United States |
| Web3Forms | Contact form processing and delivery | United States (AWS, US-East) |
Beyond those, we may share data with the following categories of recipients: our email provider; the domain registrar; content-delivery and font providers (Google, Cloudflare, jsDelivr); our accountant and legal advisers; couriers and carriers once services launch; and public authorities where legally required. We can name any specific provider on request.
Our form provider may share a submitter's IP address and email address with anti-spam services to detect abuse and phishing.
Some providers are based in the United States, so your data may be transferred outside the European Economic Area. We rely on these safeguards:
You may request a copy of the safeguards we rely on by writing to contact@westflowlog.eu.
Our website does not use cookies. We do not store cookies, local storage entries, pixels, tags or similar identifiers on your device, and we run no analytics or advertising technologies. That is why you will not see a cookie consent banner, under Article 398 of the Polish Electronic Communications Law, consent is required only where such technologies are actually used.
Third-party providers that deliver fonts and scripts to your browser receive your IP address as a technical necessity of the request, but do not set cookies through our site. If we introduce cookies or analytics in future, we will update this policy and ask for your consent beforehand where the law requires it.
Under the GDPR you have the right to access your data, rectify it, erase it, restrict processing, data portability, object to processing based on our legitimate interest (including at any time for direct marketing), and withdraw consent at any time without affecting earlier processing.
To exercise any of these, email contact@westflowlog.eu. We respond within one month, extendable by two further months for complex requests, we will tell you if that happens. It is free, unless a request is manifestly unfounded or excessive.
If you believe we process your data unlawfully, you may lodge a complaint with the Polish supervisory authority:
If you are in another EEA country or the UK, you may also complain to your local supervisory authority.
Providing your data is voluntary. But without at least your name, email and message we cannot reply to your enquiry, and without the data needed to perform a contract we cannot provide our services. Some data must be collected to meet tax and accounting obligations.
We do not make decisions about you based solely on automated processing, and we do not carry out profiling within the meaning of Article 22 GDPR. The shipping cost calculator on our site performs a simple arithmetic estimate from figures you select; it processes no personal data and produces no decision about you.
We apply measures appropriate to the risk: encrypted transmission (HTTPS/TLS across the whole site), access limited to those who need it, encryption at rest by our providers, and choosing providers committed to recognised security standards. No internet transmission is completely secure, but we work to protect your data and review these measures as we grow.
If a personal data breach occurs that is likely to risk your rights, we will notify the supervisory authority within 72 hours and inform you without undue delay where the risk is high.
Our services are directed exclusively at businesses. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
This matters if you become a WestFlow client. When we store your stock and ship orders to your customers, we process your customers' personal data, name, delivery address, phone, email, solely on your documented instructions. In that relationship you are the controller and we act as a processor under Article 28 GDPR.
That arrangement is governed by a separate data processing agreement concluded alongside the service contract, covering the subject matter and duration, our confidentiality and security obligations, the use of sub-processors such as carriers, assistance with data subject requests, and what happens to the data when the contract ends. This privacy policy does not govern that processing, it describes only the data for which WestFlow is itself the controller.
We may update this policy as our services or the law change. The current version is always here, with the effective date at the top. If changes materially affect your rights, we will notify clients and contacts directly.
Questions about this policy or your data: contact@westflowlog.eu