Privacy policy & cookies

Last updated: 11 August 2026. This document is written in plain English on purpose. Where it is unclear, the GDPR text prevails.

1. Who is the data controller

The controller of personal data collected through this website is:

For any question about how your data is used, write to biuro@sterilco.pl with "GDPR" in the subject line. We have not appointed a Data Protection Officer; enquiries go to the address above.

2. What this policy covers

This policy applies to the English-language hexamine website operated by Sterilco. It covers the personal data we process when you browse the site, when you send an enquiry, and when you contact us by e-mail or telephone as a result of visiting it.

It does not cover third-party websites we link to. Those operate under their own policies.

3. What we process, why, and on what legal basis

3.1 Website enquiries

This website is static and has no server-side form processing. When you complete the enquiry form on the contact page, your browser assembles the details into an e-mail and opens your own mail client. Nothing is transmitted to us, and nothing is stored, until you press send in your own e-mail program.

Once that e-mail reaches us, we process the data it contains:

• Data: company name, contact person, business e-mail, telephone, country, requested grade, quantity, packaging, declared end use and any free-text message.
• Purpose: to answer the enquiry, prepare a quotation and, where an order follows, to perform the contract.
• Legal basis: Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract, and performance of that contract; and Art. 6(1)(f) GDPR — our legitimate interest in responding to business correspondence.

3.2 Regulatory due diligence on precursor sales

Hexamine is a substance covered by European Union rules on the marketing and use of explosives precursors. Before supplying it we verify the business identity and declared end use of the buyer, and we are required to record, and where relevant report, suspicious transactions, significant disappearances and thefts.

• Data: company identification details, the identity and role of the person placing the order, declared end use, transaction records.
• Purpose: compliance with precursor control obligations.
• Legal basis: Art. 6(1)(c) GDPR — compliance with a legal obligation to which we are subject.

3.3 Direct contact by e-mail or telephone

• Data: the contact details and content you choose to provide.
• Purpose: handling the correspondence.
• Legal basis: Art. 6(1)(b) or Art. 6(1)(f) GDPR, depending on whether the contact relates to a prospective contract.

3.4 Server logs

Our hosting provider records standard technical information — IP address, date and time of the request, requested resource, HTTP status, referrer and user-agent string — for the purpose of operating the service securely and diagnosing faults. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in the security and stability of the site.

3.5 Analytics and marketing measurement

Only with your consent. See section 4.

4. Cookies and Google Consent Mode v2

4.1 How consent works here

Before any analytics or advertising technology may set an identifier on your device, this site asks for your consent. Until you decide, Google Consent Mode v2 is initialised with every non-essential signal set to denied:

We additionally set ads_data_redaction to true, so that where advertising consent is absent, identifiers are removed from any network requests that are sent. When you make a choice in the banner, a consent update is issued and the relevant signals switch to granted.

4.2 Categories you control

• Strictly necessary — required for the site to function, for basic security, and to remember your cookie choice. These cannot be switched off, and they are used on the basis of our legitimate interest and the technical-storage exemption in Art. 5(3) of the ePrivacy Directive.
• Analytics — aggregate statistics about which pages are read and where visitors arrive from, so we can tell which technical content is worth expanding. Consent-based.
• Marketing — measurement and targeting of advertising campaigns. Consent-based.
• Preferences — remembering non-essential display choices. Consent-based.

4.3 Storage used by this site

If Google Analytics has not yet been activated on this installation, no _ga cookies are set at all, regardless of your choice.

4.4 Changing or withdrawing consent

Use the Cookie settings link in the footer of any page. Withdrawing consent is as easy as giving it, and it takes effect immediately for future processing. You can also delete cookies and site data through your browser settings.

5. Recipients and transfers outside the EEA

We do not sell personal data and we do not share it for anyone else's marketing purposes. Data may be made accessible to:

• Our hosting provider, as processor, for the operation of the website.
• Our e-mail provider, as processor, for the handling of correspondence.
• Google Ireland Limited, where you have consented to analytics or marketing cookies. Google may transfer data to the United States; such transfers rely on the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.
• Competent public authorities, where a legal obligation requires it — in particular under explosives-precursor reporting rules.
• Advisers such as accountants or lawyers, where necessary and bound by confidentiality.

6. How long we keep data

• Enquiries that do not lead to a contract: up to 12 months from the last correspondence, then deleted.
• Contract and transaction records: for the period required by Polish accounting and tax law, generally 5 years from the end of the relevant tax year.
• Precursor due-diligence and transaction records: for the period prescribed by the applicable precursor control rules.
• Consent records: 180 days in your browser's local storage, or until you clear it.
• Server logs: in line with our hosting provider's standard retention, typically no more than 12 months.

7. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access your personal data and obtain a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased where the conditions are met (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand (Art. 7(3)).

To exercise any of these, write to biuro@sterilco.pl. We respond within one month; if a request is complex we may extend that period and will tell you why.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

Please note that where processing is required by precursor control law, the rights to erasure and to object are limited.

8. Security

The site is served over HTTPS. It is a static website: there is no database, no login system and no server-side form handling, which removes entire categories of risk by design. Access to correspondence is limited to staff who need it. We apply appropriate technical and organisational measures, but no method of transmission over the internet is completely secure.

9. Children

This is a business-to-business website. It is not directed at children and we do not knowingly collect personal data from anyone under 16.

10. Changes to this policy

We may update this policy to reflect changes in our processing or in the law. The current version is always the one published at this address, with the "last updated" date at the top. Material changes affecting consent will be accompanied by a fresh request for consent.