Privacy Policy
This policy explains how MATANGEL sp. z o.o. processes personal data of people who use this website, submit inquiries or requirements, or register as suppliers. It is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data controller
The controller of your personal data is MATANGEL sp. z o.o., ul. Garbary 6/7, 80-827 Gdańsk, Poland, entered in the National Court Register (KRS) under number 0000652715, NIP 5833223695, REGON 366079162 (“MATANGEL”, “we”).
Contact in data-protection matters: sourcing@mvautoai.site, phone +48 453 108 326, or by post to the address above.
2. What data we process
- Contact and company data you provide: name, company, business email, phone, country, website and role.
- Content of your inquiry, requirement or supplier registration, including attached documents.
- Consent records: whether you acknowledged the privacy policy (required) and whether you gave the optional marketing consent, when, in which language, the version of the text and a pseudonymised hash of your IP address.
- Security data: a pseudonymised hash of your IP address (salted and rotated daily), used for rate limiting and abuse prevention and stored with your submission and consent records. We do not store raw IP addresses. With form submissions we also store the technical identification string of your browser (user agent).
- Email delivery data: the delivery status of emails we send you (e.g. delivered, bounced, opened), as reported by our email provider.
- Usage statistics: pages visited, clicks on calls to action, form steps, the referring website (host only), campaign (UTM) parameters, browser type, device class (mobile/tablet/desktop) and country — derived from your browser’s time zone or language setting, not from your IP address (we do not use IP-based geolocation).
- Only if you allow it in the consent banner: a random visitor identifier and a session identifier stored in your browser.
3. Purposes and legal bases
| Handling your inquiry or requirement (RFQ), communicating with you and taking steps prior to entering into a contract | Art. 6(1)(b) GDPR; for persons acting on behalf of a company — Art. 6(1)(f) GDPR (our legitimate interest in handling business communication) |
|---|---|
| Sourcing: searching supply channels and obtaining quotations from potential suppliers (without disclosing your identity unless you agree) | Art. 6(1)(f) GDPR — legitimate interest in performing the intermediary service you requested |
| AI-assisted analysis of inquiry content, including attached PDF documents up to 5 MB (extracting technical requirements, identifying missing information, suggesting clarification questions, preparing drafts that staff review before anything is sent) | Art. 6(1)(f) GDPR — legitimate interest in efficient and accurate handling of requests |
| Supplier registration, qualification and verification | Art. 6(1)(b) and (f) GDPR |
| Security of the website and forms, prevention of spam and abuse | Art. 6(1)(f) GDPR |
| Cookieless, aggregated usage statistics | Art. 6(1)(f) GDPR — legitimate interest in understanding and improving the website |
| Storing a random identifier in your browser to recognise returning visits (optional) | Art. 6(1)(a) GDPR — your consent, in line with the rules on storing information on terminal equipment (Art. 5(3) of Directive 2002/58/EC as implemented in Polish law) |
| Commercial information by email (optional) | Art. 6(1)(a) GDPR — your consent, which also serves as consent to electronic commercial communication under applicable law |
| Compliance with legal obligations (e.g. accounting and tax) if a transaction follows | Art. 6(1)(c) GDPR |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) GDPR |
No decisions producing legal effects or similarly significantly affecting you are made solely by automated means (Art. 22 GDPR). AI tools support our staff; decisions are made by people. Every AI-generated draft is reviewed by a staff member before anything is sent — nothing is sent to buyers or suppliers automatically on the basis of AI output.
4. Recipients and processors
We use the following service providers, who process data on our behalf under data processing agreements:
- Supabase (Supabase Inc.) — database, private file storage and server functions; project hosted on Amazon Web Services in the eu-central-1 region (Frankfurt, Germany).
- Resend (Resend, Inc.) — delivery of transactional emails (e.g. acknowledgements with your reference number and messages approved by our staff), sent through Amazon SES in the eu-west-1 region (Ireland). Resend reports delivery status events (e.g. delivered, bounced, opened), which we record.
- OpenAI (OpenAI, L.L.C. / OpenAI Ireland Ltd.) and Anthropic (Anthropic PBC) — AI providers configured for analysing inquiry content (form fields and attached PDF documents up to 5 MB) and preparing drafts for our staff, via their business APIs.
- Google (Gemini API; Google LLC / Google Ireland Ltd.) — AI provider configured as a fallback for the same tasks; at present, the analyses are in practice performed by Google Gemini.
- Cloudflare (Cloudflare, Inc.) — hosting of this static website (Cloudflare Pages) and delivery through its global content delivery network; processes technical connection data needed to deliver the website.
AI providers receive only the inquiry content needed for the analysis or draft: we do not send your name, e-mail address, phone number or company name to the AI analysis (only, for example, the e-mail domain and the technical content of the inquiry and attached documents). According to the API terms of OpenAI and Anthropic, data submitted via their business APIs is not used to train their models by default. For Google Gemini, depending on the service plan, Google may use submitted content to improve its services in accordance with the Gemini API terms — which is why we do not include contact details in it.
Potential suppliers or buyers receive only the information necessary to prepare a quotation or continue a negotiation. Your identity is not disclosed to the other party without your agreement.
Data may also be disclosed to public authorities where we are legally obliged to do so, and to our IT, legal and accounting advisers bound by confidentiality.
5. Transfers outside the EEA
Our database and files are stored in the EU (Frankfurt, Germany), and emails are sent through infrastructure in the EU (Ireland). Some providers (in particular Resend, OpenAI, Anthropic, Google and Cloudflare) are based in, or may process data in, the United States — this concerns in particular AI analysis (currently performed mainly via the Google Gemini API) and Cloudflare’s global network. Such transfers are based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) where the recipient is certified, or on standard contractual clauses approved by the European Commission. You may request information about these safeguards using the contact details above.
6. Retention
- Inquiries, requirements and supplier data: for as long as necessary to handle the matter and maintain the business relationship, and afterwards for the period in which claims may arise under applicable law.
- Accounting documents (if a transaction follows): for the period required by tax and accounting law.
- Usage statistics: up to 13 months, after which they are deleted.
- Security records (pseudonymised IP hashes used for rate limiting): up to 2 days.
- Records of completed technical tasks (e.g. email dispatch or AI analysis jobs): 90 days after completion.
- Administration panel login codes and sessions (staff only): login codes up to 2 days; sessions are deleted 7 days after they expire.
- Consent records: for as long as needed to demonstrate that consent was given or acknowledged.
- Data stored in your browser: until you withdraw consent, change your privacy settings or clear your browser storage.
7. Your rights
You have the right to access your data, to rectification, erasure and restriction of processing, to data portability, and to object to processing based on legitimate interest (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
To exercise your rights, contact us at sourcing@mvautoai.site. You also have the right to lodge a complaint with the supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.
Providing data is voluntary, but the fields marked as required are necessary to handle your request.
8. Statistics, cookies and browser storage
This website does not set cookies and does not use Google Analytics, advertising pixels or other third-party tracking tools — statistics are collected by our own system and stored in our database. By default, we collect usage statistics without cookies and without identifiers stored on your device: the server derives a pseudonymised identifier by hashing your IP address and browser user agent together with a secret value and the current date, so the identifier changes every day and visits cannot be linked over time. The IP address itself is not stored.
When you submit a form, the campaign parameters, referring site (host only), landing page and the pseudonymised visit identifier are stored together with your submission, so that we know how it reached us.
If you click “Allow” in the statistics banner, we store a random identifier in your browser’s local storage to recognise returning visits. You can change your choice at any time using “Privacy settings” in the footer.
The website uses the following browser storage entries:
| matangel_consent (local storage) | Your statistics choice (granted/denied) |
|---|---|
| matangel_lang (local storage) | Your language preference |
| matangel_attr (session storage) | Campaign parameters, referring site and landing page of the current visit — attached to statistics and form submissions |
| matangel_vid, matangel_seen (local storage) — only with consent | Random visitor identifier and returning-visit marker |
| matangel_sid, matangel_ret (session storage) — only with consent | Session identifier and returning-visit flag for the current visit |
9. Security
Data is transmitted over encrypted connections (TLS). Documents are kept in private storage that is not publicly accessible and can be downloaded only by authorised staff through the administration panel, using signed links valid for 2 minutes. Buyers and suppliers do not have user accounts or passwords on this website. Access to the administration panel is limited to authorised persons, requires a one-time code sent by email and is logged; sessions are stored only as hashes. Forms are protected against automated abuse by a hidden anti-bot field, a submission-timing check and rate limits.
10. Changes to this policy
We may update this policy when our services or legal requirements change. The current version is always available on this page.