Privacy policy
Version: draft of 29.09.2026
This policy describes what data the ctech.com.pl website and the enquiry form collect, for what purpose and on what legal basis, to whom we pass the data, and which cookies and similar technologies the website uses.
On this page
1.Data controller
The controller of personal data is C-TECH Sp. z o.o., ul. Zamkowa 9, 58-530 Kowary, Poland, entered in the Polish National Court Register (Krajowy Rejestr Sądowy, KRS) under number KRS 0000034041, registry court: Sąd Rejonowy dla Wrocławia-Fabrycznej we Wrocławiu, IX Wydział Gospodarczy Krajowego Rejestru Sądowego (District Court for Wrocław-Fabryczna in Wrocław, 9th Commercial Division of the National Court Register); NIP (tax ID) 611-213-96-28, REGON 230457320, share capital 1 108 000,00 PLN.
Send questions about personal data to rfq@ctech.com.pl or by post to the address of the registered office. Phone: +48 75 718 24 18.
2.What data we process
- Enquiry form: full name, company, business e-mail, phone, country, description of the part or need, and the ticked consent and the information that an NDA is needed. In the “Contract injection moulding” path also the material, annual quantity, part weight, deadline and information about the mould. In the “MasterFlow hot runners” path (Polish version of the website only) also the type of enquiry, material, shot weight, number of cavities and the brand of the existing system.
- Files attached to the enquiry: 3D models and drawings (STEP, IGES, STL, PDF), up to 5 files, 50 MB in total.
- Data recorded with the enquiry: IP address, date and time of sending, language of the website.
- Source of the enquiry: campaign parameters (
utm_source,utm_medium,utm_campaign,utm_term,utm_content), click IDs from Google ads (gclid,gbraid,wbraid), the channel of the visit (traffic_class, e.g. Google search, Google ad, LinkedIn, direct visit), the landing page (entry_page) and the page from which the enquiry was sent (submit_page), without parameters. Description: point 10. - Consent state at the time of sending:
consent_adsandconsent_analytics(value “granted” or “denied”, according to the choice in the cookie banner). - Correspondence: e-mails exchanged about the enquiry.
- Technical server data: IP address and time of the request in the server logs.
- Statistics and ad measurement: points 11 and 12.
3.Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| answering the enquiry and preparing a quotation | Art. 6(1)(b) GDPR (steps taken at the request of the data subject before entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest: contact with business customers) |
| measuring the effectiveness of marketing: recording the source of the enquiry | Art. 6(1)(f) GDPR (legitimate interest: knowing which channels and campaigns enquiries come from) |
| recording the consent state with the enquiry | Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR (demonstrating what the person consented to) |
| visit statistics without cookies (Umami) | Art. 6(1)(f) GDPR (legitimate interest: developing the website) |
| Google Analytics 4 statistics and the measurement and optimisation of Google Ads advertising (cookies) | consent: Art. 6(1)(a) GDPR and the provisions on storing information in terminal equipment |
| website security and protection against abuse (anti-spam, enquiry limit, logs) | Art. 6(1)(f) GDPR |
| establishing, pursuing and defending claims | Art. 6(1)(f) GDPR |
4.Technical files from enquiries
Files from enquiries are confidential. Only the people at C-TECH and C-FORM who work on the enquiry have access to them. We store the files on the website server, outside the public directory; we attach them to the enquiry e-mail if together they take up no more than 20 MB.
On request we sign an NDA before documentation is sent.
5.Recipients of the data
- C-FORM Sp. z o.o. (KRS 0000250967), the sole shareholder of C-TECH and a company of the C-FORM Group in which the same people work, in the same building; in particular when the enquiry concerns an injection mould. C-TECH passes the data on; the form does not send them to C-FORM automatically.
- MasterFlow AB (Västervik, Sweden), manufacturer of MasterFlow hot runners: only for an enquiry sent through the “MasterFlow hot runners” path (Polish version of the website) and only to the extent needed to select the system. C-TECH passes the data on; the form does not send them to MasterFlow AB automatically.
- Google Ireland Limited (Ireland), provider of Google Analytics 4 and Google Ads: only after consent in the cookie banner (point 12).
- Processors acting on the instructions of C-TECH: the provider of the website server and the provider of the e-mail service.
- Public authorities, where the law requires it.
6.Transfer of data outside the European Economic Area
C-TECH, C-FORM and MasterFlow AB operate in the European Union. With Google services, data may be transferred to Google LLC in the United States.
7.How long we keep the data
- the consent cookie and the Google cookies: lifetime in the table in point 12.
8.Your rights
You can request access to your data, its rectification or erasure, the restriction of processing and data portability. Where the basis is our legitimate interest, you can object at any time (Art. 21 GDPR), including to the recording of the source of the enquiry. You can withdraw your consent to cookies at any time with the “Cookie settings” button in the website footer; the withdrawal does not affect the lawfulness of processing before it. You can also lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
9.Voluntary provision of data and automated decisions
Providing data is voluntary, but without the fields marked as required we will not answer the enquiry. We do not make decisions based solely on automated processing that would produce legal effects concerning you.
10.How we know the source of the enquiry
The source fields are filled in by a script on the website, without cookies and without browser storage. On the first page of the visit it reads the campaign parameters and click IDs from the address, remembers the address of that page and determines the channel of the visit from the address of the page the visit came from (referrer). Only the open page knows these values, and we do not add them to links. Moving between the pages of the website keeps them, and closing or reloading the tab deletes them. The consent state comes from the cookie banner. Without JavaScript the fields stay empty.
We record the source of the enquiry and the consent state with the enquiry even when “Reject” was chosen in the banner, because these are not cookies but data from the page address and the state of the banner. We do not add click IDs or personal data to the Umami statistics or to the event parameters.
11.Statistics without cookies (Umami)
We measure the number of visits and events (sending an enquiry, clicking the phone number or the e-mail address) with Umami on our own server. Umami works without cookies. It records page addresses and the address of the previous page without parameters (without utm_*, gclid, gbraid and wbraid). Events contain only technical data: when an enquiry is sent, the path (type), the language of the website (locale) and the number of files (files); when the phone number or the e-mail address is clicked, the C-TECH number or address that was clicked (to) and the page (page); in every event, the channel of the visit (source). They contain no personal data and no click IDs.
12.Cookies and the consent banner
On the first visit the website shows a consent banner with three categories: “necessary”, “statistics” and “marketing”. The “Reject” button is as easy to reach as “Accept”. You can change or withdraw your choice at any time with the “Cookie settings” button in the footer of every page.
Until you make a choice, Google consent mode (Consent Mode v2) sets ad_storage, analytics_storage, ad_user_data and ad_personalization to “denied”, and no Google tag loads. Each category switches on only its own tool:
| Choice in the banner | What loads | Google consent signals (“granted”) |
|---|---|---|
| before a choice | nothing | none |
| “Reject” (“necessary” only) | the consent cookie with the saved choice | none |
| “statistics” | Google Analytics 4 | analytics_storage |
| “marketing” | Google Ads: conversion measurement and remarketing | ad_storage, ad_user_data, ad_personalization |
Without JavaScript the banner is not shown and the Google tag does not load.
Data from Google cookies goes to Google for visit statistics and for the measurement and optimisation of ads (conversions, remarketing). After consent, the Google tag also reads the page address together with the click ID gclid, in order to attribute the enquiry to an ad. In Google Analytics 4 reports, the further pages of a visit have addresses without campaign parameters and click IDs. The same events as in Umami go to Google under the names rfq_sent, phone_click and email_click, with the same parameters, and only when the Google tag runs after consent. The legal basis is your consent.
13.Changes to the policy
We publish the current version on this page with the date of the update.