This policy explains what personal data we collect in connection with the nadzisiaj.com website and our cooperation with business customers, why we process it and what rights you have. Last updated: wrzesień 2026. This is a courtesy translation — in case of any discrepancy, the Polish version prevails.

1. Data controller

The controller of your personal data is Express spółka z ograniczoną odpowiedzialnością spółka komandytowa, with its registered office in Kraków, Poland, ul. Puszkarska 7F, 30-644 Kraków, KRS 0000434068, VAT ID (NIP) 677-004-66-33, REGON 008156612 — the operator of the nadzisiaj.com brand.

For any matter concerning personal data, write to [email protected] or to our registered address marked “personal data”.

2. What data we process

The scope depends on how you contact us and whether we work together:

  • Contact form and correspondence — first name, last name, work email address, company name, and optionally: approximate shipment volume, the service you are interested in and your message.
  • Business contact details — name, position, work phone and email of people designated as contacts for the performance of an agreement.
  • Data needed to make deliveries — recipient data provided to us by the sender: name, delivery address, phone or email for notifications, shipment details and proof of delivery.
  • Billing data — data required to issue and settle invoices.
  • Technical data — IP address, device and browser information, date and time of the visit, and data collected through cookies and analytics tools.

3. Purposes and legal bases

  • Replying to an enquiry and conducting correspondence — Article 6(1)(b) GDPR (steps prior to entering a contract) and Article 6(1)(f) GDPR (our legitimate interest in ongoing business communication).
  • Concluding and performing an agreement for logistics services — Article 6(1)(b) GDPR; for the data of the customer’s contact persons and of parcel recipients — Article 6(1)(f) GDPR.
  • Delivering shipments and sending delivery notifications — Article 6(1)(b) GDPR (agreement with the sender) and Article 6(1)(f) GDPR (interest in the correct completion of the delivery).
  • Settlements, accounting and tax obligations — Article 6(1)(c) GDPR in connection with Polish accounting and tax law.
  • Handling complaints — Article 6(1)(b), (c) and (f) GDPR.
  • Service quality reviews and improving our services — Article 6(1)(f) GDPR.
  • Website statistics and analytics — Article 6(1)(a) GDPR (your consent given for cookies other than strictly necessary ones).
  • Direct marketing of our own services — Article 6(1)(f) GDPR, and for electronic communication, on the basis of separate consent required by telecommunications law.
  • Establishing, pursuing and defending claims — Article 6(1)(f) GDPR.
  • Website security and preventing abuse — Article 6(1)(f) GDPR.

4. Where we obtain your data

Usually directly from you — through the contact form, email correspondence or a phone call. Recipient data comes from the party ordering the delivery, that is the store or operator we work with. Contact person data may come from your employer or principal.

5. Recipients of the data

We share data only with parties we entrust with specific tasks, and only to the extent necessary:

  • couriers and subcontractors carrying out deliveries in our network,
  • IT providers: hosting, email, courier systems and analytics tools,
  • accounting firms and law firms,
  • banks and payment providers, for settlements,
  • insurers, in connection with damage claims,
  • public authorities, where disclosure is required by law.

Processors acting on our behalf work under data processing agreements and may not use the data for their own purposes.

6. Retention periods

  • Correspondence and enquiries that did not lead to cooperation — up to 12 months from the last contact.
  • Data related to an agreement — for the term of the agreement and afterwards until claims become time-barred.
  • Accounting and tax records — 5 years from the end of the year in which the tax obligation arose.
  • Delivery data and proof of delivery — up to 3 years, unless a longer period follows from the agreement with the sender or from ongoing proceedings.
  • Data processed on the basis of consent — until consent is withdrawn.
  • Analytics data — for the periods indicated in the Cookie policy.

7. Is providing data mandatory

Providing data is voluntary but in some cases necessary. Without a name, email address and company name we cannot reply to a contact form enquiry. Without billing data we cannot issue an invoice. Without recipient data a shipment cannot be delivered.

8. Your rights

In connection with the processing of your data you have the right to:

  • access your data and obtain a copy of it,
  • have inaccurate or incomplete data rectified,
  • have your data erased,
  • restrict processing,
  • data portability, for data processed under a contract or consent,
  • object to processing based on legitimate interest,
  • withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand,
  • lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise any of these rights, write to [email protected].

9. Objecting to processing

Where we process your data on the basis of legitimate interest, you may object. For direct marketing we will stop processing without you having to give reasons. In other cases we will consider your situation and stop processing unless we have compelling legitimate grounds to continue.

10. Transfers outside the European Economic Area

We process data primarily within the European Economic Area. Some tools — in particular Google analytics tools — may involve transfers to third countries. Such transfers take place on the basis of mechanisms provided for in the GDPR, in particular standard contractual clauses approved by the European Commission or an adequacy decision.

11. Automated decision-making

We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. We do not use profiling for that purpose.

12. Cookies and analytics

The website uses cookies and analytics tools that help us understand how the site is used. The types of files, their providers and retention periods are described in a separate Cookie policy.

13. Contact form

Data submitted through the contact form is used solely to handle your enquiry and reply to you. We store the enquiry in the website’s administration panel and send it to our company email address so that no enquiry is missed.

14. Data security

We apply technical and organisational measures appropriate to the risk: encrypted connections to the website, access control, backups and confidentiality obligations for everyone with access to the data.

15. Updates to this policy

We update this policy when our processes, tools, scope of services or the law change. The current version is always available on the website, together with the date of the last change.