Privacy policy
Last updated: 10.08.2026 r.
Website: ruthenia-alba.com
1. Controller of personal data
The controller of personal data is:
RUTHENIA ALBA Spółka z ograniczoną odpowiedzialnością
ul. Niekłańska 35/1, 03-924 Warszawa, Polska
KRS: 0000991859 · NIP: 1133071494 · REGON: 523106794
BDO: 000576957
For all matters concerning the processing of personal data, you may contact us:
- e-mail: contact@ruthenia-alba.com
- telephone: +48 571 513 741
- by post: to the registered office address indicated above.
The controller has not appointed a Data Protection Officer (DPO). The contact point for data protection matters is contact@ruthenia-alba.com.
2. Legal bases
We process personal data in accordance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: GDPR);
- the Act of 10 May 2018 on the protection of personal data;
- the Act of 18 July 2002 on the provision of services by electronic means;
- the Act of 16 July 2004 – Telecommunications Law (as regards cookies).
3. Purposes, legal bases and retention period of data processing
| Purpose of processing | Legal basis (GDPR) | Retention period |
|---|---|---|
| Responding to an enquiry sent via the contact form or the request for quotation form (RFQ), e-mail or telephone | Article 6(1)(b) (steps prior to entering into a contract) and (f) (legitimate interest – handling correspondence) | Until the enquiry has been handled, then for up to 12 months for evidentiary purposes; if cooperation begins – for its duration |
| Conversation with the AI assistant “Alba” (chat on the website) and handling of an enquiry sent from the chat | Article 6(1)(f) (legitimate interest – handling enquiries, website security and improving the quality of the assistant's answers), and after an enquiry is sent also (b) (steps prior to entering into a contract) | We keep the record of the conversation (questions and answers) for 12 months — under a random conversation identifier, without IP address and without contact data; once an enquiry is sent, the record is linked to the enquiry (period — as above) |
| Improving website search | Article 6(1)(f) (legitimate interest – website development) | We store only the content of searches that returned no results — in order to supplement the catalogue or the search dictionary. No IP address, no user identifier and no successful searches. Up to 12 months |
| Conclusion and performance of a contract (sale, delivery of machinery and parts, services) | Art. 6(1)(b) | For the duration of the contract |
| Fulfilment of tax and accounting obligations | Art. 6(1)(c) (legal obligation) | 5 years from the end of the year in which the tax obligation arose |
| Marketing of our own products and services, including the newsletter (if the function is active) | Art. 6(1)(f), and for electronic communication – separate consent (Art. 6(1)(a)) | Until an objection is lodged or consent is withdrawn |
| Establishing, pursuing or defending claims | Art. 6(1)(f) | Until the limitation periods for claims expire |
| Statistics and analytics of the website, cookies | Art. 6(1)(a) (consent) or (f) (essential cookies) | In accordance with the Cookie Policy |
4. AI assistant “Alba” (chat on the website)
On the website (home page and machine pages) we provide a chat with an AI assistant called “Alba”. Alba is an artificial intelligence system, which we inform you about when a conversation begins. The assistant’s answers are for information only and do not constitute an offer within the meaning of the Civil Code; the assistant does not state prices, and every valuation is prepared individually by our team. The assistant does not take any decisions with legal effects towards users.
Rules for data processing in the chat:
- the content of the conversation is processed to provide answers by the provider of the language model — Anthropic PBC (USA), acting as a processor; the provider does not use conversation content to train its models and stores it temporarily (up to 30 days) solely for security purposes;
- the conversation history is stored locally in the user’s browser (sessionStorage) and disappears when the tab is closed;
- a record of the conversation — the questions asked and the assistant’s answers — is also kept in our system, so that we know what our customers are asking about and, on that basis, improve the quality of the assistant’s answers and the content on the website. The record is created under a random conversation identifier: we do not store an IP address, name or contact details with it, and the identifier does not allow us to recognise the user during a subsequent visit. Storage period — up to 12 months;
- if the user sends an enquiry from the chat, we link the record of the conversation to that enquiry so that our team knows its context (storage period — as for enquiries, up to 12 months);
- the assistant does not ask for personal data in the chat window; please do not enter personal data or confidential information in the chat — contact details are provided only in the enquiry form, together with acceptance of the Terms and this Policy;
- To protect against abuse (bots, automated submissions), we use the Cloudflare Turnstile mechanism (Cloudflare, Inc.) as well as message volume limits; for this purpose we temporarily process the IP address and technical browser signals — the limit counters are deleted after one day.
5. Voluntary provision of data
Providing data is voluntary, but necessary to answer an enquiry, prepare an offer, and conclude and perform a contract. Failure to provide data may make it impossible to achieve these purposes.
6. Recipients of data
Data may be passed on to:
- entities providing IT, hosting, e-mail and website maintenance services to the Controller, in particular Google Ireland Limited (Google Workspace) — for delivering e-mail messages from contact forms;
- providers of analytics tools, in particular Plausible Insights OÜ (Plausible Analytics) — solely website visit statistics and, after consent to analytics files; see Cookie Policy;
- the provider of the AI assistant’s language model — Anthropic PBC (USA) — solely the content of conversations with the assistant “Alba” (see section 4);
- Cloudflare, Inc. (USA) — for protecting the chat against bots (Turnstile);
- the accounting office, legal and tax advisers;
- courier companies and carriers — for the purpose of delivering orders;
- manufacturers and trade partners — solely to the extent necessary to fulfil an order or offer;
- financing entities (leasing and credit partners), in particular CLS Sp. z o.o. with its registered office in Warsaw (ul. Odolańska 17, 02-562 Warsaw) — only where separate consent to the transfer of data for preparing a financing offer has been given;
- public authorities — where required by law.
Entities processing data on the Controller’s behalf do so on the basis of data processing agreements and solely in accordance with our instructions.
7. Transfers of data outside the EEA
As a rule, data is processed within the European Economic Area (EEA). If, in connection with the use of tools from providers outside the EEA (analytics services, the language model provider Anthropic PBC or Cloudflare, Inc. — both based in the USA), data is transferred to a third country, this will take place only with appropriate safeguards referred to in Art. 46 GDPR (including standard contractual clauses) or on the basis of a European Commission decision finding an adequate level of protection.
8. Rights of data subjects
You have the right to:
- access to your data and to obtain a copy of it (Art. 15 GDPR);
- rectification of data (Art. 16 GDPR);
- erasure of data (Art. 17 GDPR);
- restriction of processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- object to processing based on a legitimate interest (Art. 21 GDPR);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR).
To exercise your rights, please contact: contact@ruthenia-alba.com.
9. Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), if you consider that the processing of data infringes the GDPR.
10. Profiling and automated decisions
The Controller does not make decisions based solely on automated processing, including profiling, which would produce legal effects or similarly significantly affect the data subjects.
11. Cookies
The site uses cookies and similar technologies. Detailed information can be found in the Cookie Policy.
12. Changes to the Privacy Policy
The Controller may update this Policy. The current version is always available at ruthenia-alba.com, together with the date of the last update.