Legal document

Privacy policy

This document explains what personal data we collect, why, on which legal basis, and which rights the GDPR gives you.

Last updated: 16 August 2026

§ 1. Data controller

The controller of your personal data is Alto Design Sp. z o.o. — a Stretchgroup company and the owner of the StretchMetal brand (“we”).

For any data-protection matter, write to the email address above with “GDPR” in the subject line.

§ 2. What data we collect

Quote (RFQ) form

  • full name (required), email address (required)
  • optionally: company, phone, country, selected services, material, quantity, deadline
  • message text (required)
  • attached technical files (DXF, DWG, STEP, IGES, PDF, ZIP) — the drawings and models you submit for quoting

Contact form

  • full name, email address, message text

Analytics (only with consent)

  • an anonymous identifier (cookie / local storage)
  • device and browser type, pages visited
  • traffic source (search engine, link, ad)

Analytics and marketing tools load only after you consent in the cookie banner. Without consent they do not load at all.

§ 3. Purposes and legal bases

  • Preparing your quote and answering enquiries (quote and contact forms) — art. 6(1)(b) GDPR: steps taken at your request prior to entering into a contract.
  • Website analytics (PostHog, Google Analytics 4, Microsoft Clarity) and ad measurement (Meta Pixel) — art. 6(1)(a) GDPR: your consent from the cookie banner, given separately for the analytics and marketing categories.
  • Site security and abuse prevention (server logs, submission rate limits, anti-spam filters) — art. 6(1)(f) GDPR: our legitimate interest.

§ 4. Technical files from the quote form

Uploaded files are treated as confidential design data. The website stores them in no database — they travel exclusively as attachments of the email delivered to our mailbox (Microsoft 365, EU data centres) and are used only to prepare your quote and execute the order. We keep them until the quote is closed and, where an order follows, for the period required by accounting law. An NDA is available on request.

§ 5. Recipients of data

We entrust data only to providers necessary to run the site, under data-processing agreements (art. 28 GDPR):

  • Microsoft Corporation (Microsoft 365 / Microsoft Graph) — the mailbox that carries form submissions and their attachments; EU data centres.
  • Vercel Inc. — website hosting and standard access logs.
  • PostHog Inc. (PostHog EU, Frankfurt) — analytics; only after analytics consent.
  • Google LLC (Google Analytics 4) — traffic statistics; only after analytics consent.
  • Microsoft Corporation (Clarity) — click maps and session recordings with form fields masked; only after analytics consent.
  • Meta Platforms (Meta Pixel) — ad performance measurement; only after marketing consent.

§ 6. Transfers outside the EEA

Our mailbox and PostHog analytics run in EU data centres. For Google and Meta, part of the processing may take place in the United States — based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses (SCCs).

§ 7. Retention periods

  • form submissions that do not lead to an order — until the quote is closed, no longer than 12 months;
  • submissions that lead to an order — for the period required by accounting law (as a rule 5 years from the end of the financial year);
  • analytics data — per the table in the cookie policy;
  • server logs — up to 30 days.

§ 8. Your rights

  • right of access (art. 15 GDPR),
  • right to rectification (art. 16 GDPR),
  • right to erasure (art. 17 GDPR),
  • right to restriction of processing (art. 18 GDPR),
  • right to data portability (art. 20 GDPR),
  • right to object to processing based on legitimate interest (art. 21 GDPR),
  • right to withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal,
  • right to lodge a complaint with a supervisory authority — in Poland: the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw; you may also complain to the authority of your own EU member state.

Send requests to info@stretchmetal.pl. We answer within 30 days at the latest.

§ 9. Automated decision-making

We make no decisions about you based solely on automated processing, including profiling, that would produce legal effects.

§ 10. Cookies

How cookies and similar technologies are used, the full inventory table and how to withdraw consent are described in the separate cookie policy.

§ 11. Changes to this policy

We update this policy when our infrastructure, providers or the law change. The current version, with its update date, is always available at this address. This document fulfils the information duty of art. 13 GDPR and is not legal advice.

Call usSend your drawing