Privacy policy of the Komak Partner Portal
Last updated: 20 October 2026
This policy describes how we process personal data in the Komak Partner Portal at portal.komak.com.pl: in the partner application form, in partner accounts and in the messages we send from the portal.
1. Data controller
The data controller is:
Komak Konstrukcje Sp. z o.o.
ul. Krakowska 47-49, 50-424 Wrocław, Poland
NIP (tax ID) 8952230912, REGON 389017358, KRS 0000902404
For data protection matters, write to: nowosci@komak.com.pl
2. What data we collect and where it comes from
2.1 Partner application form (/partner and /partner-en)
Company name, tax ID (NIP), company address, first and last name, email, phone, city, type of business, website or Instagram, whether you sell loft doors, the content of your message, consents together with the date they were given.
With the application we also record how you reached the page: campaign parameters (utm), the Google Ads click identifier (gclid, gbraid, wbraid) and the Meta click identifier (fbclid), the address of the landing page and of the referring page.
2.2 Partner account
Company details (name, address, tax ID, contact details, logo, offer settings), details of the people in the partner's team (first and last name, email, role, abbreviation used in quote numbering), password (stored only in a secured form), acceptance of the terms, quotes, orders, attachments (e.g. a measurement sheet), chat messages with Komak Konstrukcje Sp. z o.o., confirmation of production dimensions (who, when and with what content).
2.3 Data of the partner's clients
The partner enters their client's details in the quote: first and last name, location, address, email, phone.
2.4 Assistant in the portal
When you write to the assistant, the content of your question goes to a language model that prepares the answer based on the portal instructions. When you use the "Report a problem" button, the description goes to Komak Konstrukcje Sp. z o.o. together with the number of the open quote.
2.5 Technical data
IP address and browser information in the server logs, needed for security and fixing errors (e.g. a limit on the number of applications from one address).
2.6 Where we get data from
Apart from the form, we use only public information about the company (the REGON, KRS, CEIDG and VIES registers, the company's website, its public profiles). We take personal data from the registers only to the extent it is public there (management board members, owner of a sole proprietorship).
2.7 Record of activity in the portal
On the partner account we record: the date of each person's last sign-in, the history of quote changes (who changed what and when), orders and changes of their status, and acceptances of the terms (who and when). For a decision on an approval drawing and for the confirmation of production dimensions we additionally record the content, time and IP address. We do this to protect the security of accounts and of the portal content (the configurator, prices, drawings), to detect breaches of the Partner Portal Terms (§ 4(4) and § 6) and to have evidence in the event of a dispute. Technical connection data is kept in the server logs (point 2.5).
2.8 Work in the configurator
When you work in the configurator, we record the course of that work on your account: opening the configurator, moving to the next steps, displaying a message that stopped the configuration (we record only its type), saving a quote, printing an offer and closing the window, with the date and the information which person from your team was working. We do not record your clients' data, the content of the fields you fill in or prices. This lets us see where the configurator causes difficulty, improve it and reach out to help.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Reviewing the partner application, contacting you about cooperation, setting up the account | Art. 6(1)(b) (steps taken before entering into a contract) |
| Verifying the partner application: checking the company in public registers (REGON, KRS, CEIDG, VIES), on its website and in its public social media profiles | Art. 6(1)(f) (our legitimate interest: choosing partners who work with doors, glazing, windows, interior finishing or construction) |
| Running the account, quotes, orders, chat, sending pro forma invoices, approval drawings, invitations and order notifications | Art. 6(1)(b) (contract) |
| Data of people in the partner's team who are not a party to the contract | Art. 6(1)(f) (our legitimate interest: handling the cooperation with the partner's company) |
| Invoices, pro forma invoices, accounting, KSeF | Art. 6(1)(c) (legal obligation) |
| Commercial information by email from nowosci@komak.com.pl | Art. 6(1)(a) (consent) and consent to receive commercial information by electronic means |
| Portal security, limits, protection against abuse, detecting breaches of the Partner Portal Terms (record of activity, point 2.7), pursuing claims | Art. 6(1)(f) |
| Measuring the effectiveness of Google ads (gclid, gbraid, wbraid with the application) | Art. 6(1)(f), and where storage in the browser requires it, consent (point (a)) |
| Assistant answers and handling "Report a problem" | Art. 6(1)(b) |
| Recording the course of work in the configurator (point 2.8): helping the partner and improving the portal | Art. 6(1)(f) (our legitimate interest: support in using the portal and its development) |
Providing data in the form is voluntary, but without the required fields we cannot review the application. Consent to commercial information is voluntary and is not a condition of cooperation.
4. Messages from the portal and unsubscribing
- portal@komak.com.pl sends messages related to orders: pro forma invoices, approval drawings, order changes.
- nowosci@komak.com.pl sends invitations to the portal (a link to set your password) and, only with your consent, information about news in the portal and the offer.
- Both mailboxes send through Amazon Simple Email Service in the EU region (Frankfurt). Replies to these messages go to the Komak Konstrukcje Sp. z o.o. mailbox at Google.
- Order messages and the account invitation are not commercial information and are sent without separate consent.
- You can withdraw your consent to commercial information at any time: using the link in the message footer or by writing to nowosci@komak.com.pl. Withdrawal does not affect the lawfulness of earlier sending.
- For recipients in the United Kingdom, emails with commercial information are also subject to the Privacy and Electronic Communications Regulations (PECR). We send them to companies in the United Kingdom on the same terms as described above: only with consent, and you can unsubscribe from every message.
5. Who we share data with
| Recipient | Purpose | Where |
|---|---|---|
| Amazon Web Services EMEA SARL | portal servers, database, files, sending emails (SES), assistant (Amazon Bedrock) | EU, Frankfurt region (eu-central-1); assistant in EU regions |
| Amazon CloudFront (AWS) | delivering the portal website | AWS server network |
| Hostinger | the server running the ERP system of Komak Konstrukcje Sp. z o.o. (handling applications, orders, invitations) and automations | European Union |
| Fakturownia sp. z o.o. | issuing orders, pro forma invoices and invoices for the partner | European Economic Area (Amazon servers in the EEA) |
| Airtable | order data needed for production | United States (transfer basis in point 6) |
| Google (for the EEA: Google Ireland Limited) | the mailbox that receives replies to our messages; Google Analytics, Google Ads and Google Tag Manager on the partner application page, with your consent (point 7) | Google servers in various countries, also outside the EEA (transfer basis in point 6) |
| Meta Platforms Ireland Limited | advertising (point 7) | Meta servers in various countries, also outside the EEA (transfer basis in point 6) |
| Microsoft Ireland Operations Limited | advertising (point 7) | Microsoft servers in various countries, also outside the EEA (transfer basis in point 6) |
| Accounting office | accounting and tax settlements | Poland |
| National e-Invoice System (KSeF, Polish Ministry of Finance) | invoices with a tax ID | Poland |
Only authorised people at Komak Konstrukcje Sp. z o.o. have access to the data. A partner sees only their own company's data.
6. Transfers outside the European Economic Area
Some recipients are based in the United States. We transfer data on the basis of standard contractual clauses approved by the European Commission or the EU-U.S. Data Privacy Framework, where the recipient holds such a certification.
7. Browser storage, cookies, analytics and advertising tools
The portal does not use analytics or advertising cookies after you sign in. In browser storage (localStorage) it saves only what is needed for it to work: the signed-in session and the selected language. Signing out removes the session. We record the course of work in the configurator (point 2.8) on our server, without cookies and without third-party analytics tools.
On the partner application page we keep the campaign parameters and the ad click identifier from the page address in the browser tab storage (sessionStorage) until the tab is closed, so that we can attach them to the application. We do not use cookies for this.
The partner application page (/partner and /partner-en) runs Google Tag Manager with Google Analytics, Google Ads, Microsoft Advertising and Meta. On your first visit we ask for consent separately for statistics and for advertising: “Accept”, “Reject” or “Settings”. Without consent the tools do not save cookies, and the Meta and Microsoft tools do not start. We save your choice in browser storage (localStorage) for 12 months, then we ask again. You can change it at any time with the “Cookie settings” link at the bottom of the page.
Without consent the Google tools send Google signals without cookies (Google consent mode), and the ad click identifier may be passed on in the page address, so that we know whether the application came from an ad.
| Tool | Purpose (type of consent) | Cookies and how long |
|---|---|---|
| Google Analytics | statistics: number of visits and submitted applications | _ga, _ga_DNXYT1V01S: 400 days |
| Google Ads | advertising: which ad the application came from, audience lists for our ads | _gcl_au, _gcl_aw: 90 days |
| Microsoft Advertising | advertising: which ad the application came from | _uetsid: 1 day, _uetvid: 390 days (and their copies in browser storage) |
| Meta (Meta Pixel) | advertising: which ad the application came from | _fbp: lifetime set by Meta |
The legal basis is your consent (Art. 6(1)(a) GDPR and the rules on storing information on the user's device, Article 399 of the Polish Electronic Communications Law). You can withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal. Google, Meta and Microsoft may also process this data outside the European Economic Area (basis in point 6).
8. How long we keep data
| Data | Period |
|---|---|
| Partner application rejected or without a reply | 12 months from sending the application |
| Partner account and team data | for the duration of the cooperation and 6 years after it ends (limitation of claims) |
| Record of activity in the portal (point 2.7) | together with the partner account it relates to: for the duration of the cooperation and 6 years after it ends |
| Invoices, pro forma invoices, accounting documents | 5 years from the end of the tax year in which they were issued |
| Consent to commercial information | until it is withdrawn |
| Questions to the assistant | assistant technical logs: 14 days |
| Server technical logs | 14 days |
| Course of work in the configurator (point 2.8) | 90 days, then deleted automatically |
9. Your rights
You have the right to: access your data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), object to processing based on legitimate interest, including direct marketing (Art. 21), and to withdraw consent at any time, without affecting earlier processing (Art. 7(3)).
To exercise them, write to nowosci@komak.com.pl. We reply without undue delay, and no later than within one month.
You can object to the recording of the course of work in the configurator (point 2.8) by writing to portal@komak.com.pl.
10. Security
The connection to the portal is encrypted (HTTPS). We keep files in private encrypted storage, and for attachments we provide only time-limited links. The account activation link is single-use and valid for 72 hours, and we store only its hash in the database. We make regular backups.
11. Complaints
If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
If you are in the United Kingdom, you can also lodge a complaint with the Information Commissioner's Office (ICO), ico.org.uk.
12. Changes to this policy
When the policy changes, we will publish the new version on this page with a new date. We will inform partners with an account about any significant change in the portal.
The policy in Polish: Polityka prywatności.