Privacy policy

Privacy Policy for Customers of the Website https://patonwelders.com/

I. Data Controller Information

We would like to inform you that the controller of your personal data is PATON Global OÜ, Sepapaja 6, 15551 Tallinn, Estonia, EU VAT number: EE102854866, hereinafter referred to as “the Company”. Contact with the Company regarding the protection of personal data is possible at the email address: sale@patonwelders.com

II. Purposes and Legal Bases for Processing Personal Data

In order to provide services in accordance with our business profile, the Company processes your personal data for various purposes, but always in accordance with the law. Below you will find a list of purposes for processing personal data along with legal bases.

For the purpose of quoting services and performing services, we process the following personal data:

name and surname or company name
delivery address
email address
VAT number in the case of entrepreneurs
order number
registration date

The legal basis for such data processing is Article 6(1)(b) GDPR, which allows the processing of personal data if it is necessary for the performance of a contract or to take steps prior to entering into a contract.

For the purpose of handling complaints, we process the following personal data:

name and surname or company name
email address
order number
residential address if applicable – if a refund is made
bank account number if applicable – if a refund is made

For the purpose of sending email notifications about messages in the customer panel, we process the following personal data:

email address
order number

The legal basis for such data processing is Article 6(1)(f) GDPR, which allows the processing of personal data if the Data Controller thereby pursues its legitimate interest (in this case, the Company’s interest is to inform the customer about activities related to service performance in order to increase the comfort of using the service).

For the purpose of telephone contact in matters related to service performance, we process the following personal data:

telephone number
order number

provided that you are interested in telephone contact (we do not require mandatory provision of a telephone number). The legal basis for such data processing is Article 6(1)(a) GDPR, which allows the processing of personal data based on voluntarily given consent.

For the purpose of issuing invoices and fulfilling other obligations arising from tax law provisions, such as storing accounting documentation for 5 years, we process the following personal data:

name and surname or company name
company name
residential address or registered office address
VAT number
order number

The legal basis for such data processing is Article 6(1)(c) GDPR, which allows the processing of personal data if such processing is necessary for the Data Controller to comply with legal obligations.

For the purpose of storing unpaid inquiries, we process the following personal data:

name and surname or company name
email address
order number

as you may decide to use the service some time after receiving the quote. The legal basis for such data processing is Article 6(1)(f) GDPR, which allows the processing of personal data if the Data Controller thereby pursues its legitimate interest (in this case, the Company’s interest is to enable the conclusion of a contract for a certain period without the need to repeat the quotation).

For the purpose of creating registers and records related to GDPR, including a register of customers who have objected in accordance with GDPR, we process the following personal data:

name and surname
email address

GDPR provisions impose certain documentation obligations on us to demonstrate compliance and accountability, so if you object to the processing of your personal data for marketing purposes, we need to know who not to apply direct marketing to because they do not wish it.

The legal basis for such data processing is firstly, Article 6(1)(c) GDPR, which allows the processing of personal data if such processing is necessary for the Data Controller to comply with legal obligations; secondly, Article 6(1)(f) GDPR, which allows the processing of personal data if the Data Controller thereby pursues its legitimate interest (in this case, the Company’s interest is to have knowledge about persons exercising their rights under GDPR).

For the purpose of establishing, pursuing or defending against claims, we process the following personal data:

name and surname or company name
residential address (if provided)
personal identification number or VAT number (if provided)
email address
IP address
order number

The legal basis for such data processing is Article 6(1)(f) GDPR, which allows the processing of personal data if the Data Controller thereby pursues its legitimate interest (in this case, the Company’s interest is to have personal data that will allow establishing, pursuing or defending against claims, including from customers and third parties).

For archival and evidentiary purposes, we process the following personal data:

name and surname (if provided)
email address
order number

for the purpose of securing information that may serve to demonstrate facts of legal significance. The legal basis for such data processing is Article 6(1)(f) GDPR, which allows the processing of personal data if the Data Controller thereby pursues its legitimate interest (in this case, the Company’s interest is to have personal data that will allow proving certain facts related to service performance, e.g., when a state authority requests it).

For analytical purposes, i.e., researching and analyzing activity on the Company’s website, we process the following personal data:

date and time of website visits
type of operating system
approximate location
type of web browser used to browse the site
time spent on the site
visited subpages
subpage where the contact form was filled out

For the purpose of using cookies on the website, we process such text information. The legal basis for such processing is Article 6(1)(a) GDPR, which allows the processing of personal data based on voluntarily given consent (upon first entry to the website, a request for consent to use cookies appears).

For the purpose of website administration, we process the following personal data:

IP address
server date and time
web browser information
operating system information

this data is automatically saved in so-called server logs with each use of the Company’s website. Website administration without using a server and without this automatic recording would not be possible. The legal basis for such data processing is Article 6(1)(f) GDPR, which allows the processing of personal data if the Data Controller thereby pursues its legitimate interest (in this case, the Company’s interest is website administration).

Newsletter Subscription

If you have consented to newsletter subscription, the email address you provided will be used for marketing purposes of patonwelders.com’s own products.

Consent may be withdrawn at any time, e.g., by writing to us at: sale@patonwelders.com

In this email, you should provide your email address given during newsletter subscription and the name of the person subscribing. Unsubscription from the newsletter will be processed immediately.

CHILDREN’S PRIVACY

The services we offer are not intended for children under 16 years of age. For these reasons, we inform you that if we learn that without the consent of legal guardians we are processing personal data of children under 16 years of age, we will take appropriate steps to remove such data as soon as possible.

We do not knowingly process personal data of children under 16 years of age without valid consent from their legal guardians.

III. Cookies

The Company uses so-called cookies on its website, like other entities, i.e., short text information saved on computers, phones, tablets, or other user devices. They can be read by our system, as well as by systems belonging to other entities whose services we use (e.g., Facebook, Google).
Cookies perform many functions on the website, most often useful ones, which we will try to describe below (if the information is insufficient, please contact us):
ensuring security – cookies are used to authenticate users and prevent unauthorized use of the customer panel. Therefore, they serve to protect the user’s personal data from access by unauthorized persons;
impact on processes and performance of using the website – cookies are used to ensure the website functions smoothly and that functions available on it can be used, which is possible, among other things, by remembering settings between successive visits to the site. Thanks to them, you can therefore navigate efficiently on the website and individual subpages;
session status – cookies often store information about how visitors use the website, e.g., which subpages they view most often. They also enable identification of errors displayed on some subpages. Cookies serving to save the so-called “session status” therefore help improve services and increase browsing comfort;
maintaining session status – if a customer logs into their panel, cookies enable session maintenance. This means that after going to another subpage, there is no need to enter the login and password again each time, which contributes to the comfort of using the website;
creating statistics – cookies are used to analyze how users use the website (how many open the website, how long they stay on it, which content generates the most interest, etc.). Thanks to this, we can constantly improve the website and adapt its operation to user preferences. To track activity and create statistics, we use Google tools such as Google Analytics; in addition to reporting website usage statistics, the Google Analytics pixel may also serve, together with some of the cookies described above, to help display more relevant content to the user in Google services (e.g., in Google search) and across the web;
using social functions – on the website we have the so-called Facebook pixel, which enables liking our fanpage on this service while using the website. However, for this to be possible, we must use cookies provided by Facebook.
Your web browser by default allows the use of cookies on your device, so during your first visit we ask you to consent to the use of cookies. However, if you do not wish to use cookies when browsing the website, you can change the settings in your web browser – completely block automatic cookie handling or request notification of each cookie placement on your device. Settings can be changed at any time.
Respecting the autonomy of all persons using the website, we nevertheless feel obliged to warn that disabling or limiting cookie handling may cause quite serious difficulties in using the website, e.g., in the form of the need to log in on each subpage, longer page loading times, limitations in using functionality, limitations in liking the page on Facebook, etc.

IV. Right to Withdraw Consent

If personal data processing is based on consent, you may withdraw this consent at any time – at your own discretion.
If you would like to withdraw consent to personal data processing, for this purpose it is sufficient to:
- send an email directly to the Company at sale@patonwelders.com or
- click the link in the email message attached at the end of the message or
- delete the posted comment under the article or
- delete the posted opinion about services.
If your personal data processing was based on consent, its withdrawal does not mean that personal data processing up to that point was illegal. In other words, until consent is withdrawn, we have the right to process your personal data and its revocation does not affect the lawfulness of processing up to that point.

V. Requirement to Provide Personal Data

Providing any personal data is voluntary and depends on your decision. However, in some cases, providing certain personal data is necessary to meet your expectations regarding the use of services.
To order a service on the website, it is necessary to provide a name and email address – without this we are unable to conclude and execute the contract.
In order for you to receive an invoice for services, it is necessary to provide all data required by tax law, i.e., name and surname or company name, residential address or registered office address, VAT number – without this we are unable to properly issue an invoice.
To contact you by telephone in matters related to service performance, it is necessary to provide a telephone number – without this we are unable to establish telephone contact.
If you wish to receive SMS notifications about messages in the customer panel, it is necessary to provide a telephone number – without this we are unable to send messages.
In order for you to receive discounts on future services, it is necessary to provide a name and email address – without this we are unable to send discount codes.

VI. Automated Decision-Making and Profiling

We would like to inform you that we do not perform automated decision-making, including based on profiling. The content of the inquiry that is sent via the contact form is not evaluated by a computer system. The proposed service price is in no way the result of an evaluation made by any computer system.

VII. Recipients of Personal Data

Like most entrepreneurs, in our operations we use the help of other entities, which often involves the need to transfer personal data. In connection with the above, if necessary, we transfer your personal data to cooperating lawyers who provide services, companies handling fast payments, accounting firms, hosting companies, companies responsible for sending SMS communications, as well as insurance companies (if there is a need to repair damage).
In addition, it may happen that, e.g., based on an appropriate legal provision or decision of an appropriate authority, we will have to transfer your personal data to other entities, whether public or private. Therefore, it is extremely difficult for us to predict who may request access to personal data. Nevertheless, on our part, we ensure that we analyze each case of a request to disclose personal data very carefully and thoroughly, so as not to inadvertently transfer information to an unauthorized person.

VIII. Transfer of Personal Data to Third Countries

Like most entrepreneurs, we use various popular services and technologies offered by entities such as Facebook, Microsoft or Google. These companies have headquarters outside the European Union, and therefore in light of GDPR provisions are treated as third countries.
GDPR introduces certain restrictions on the transfer of personal data to third countries, because if European regulations do not apply there as a rule, the protection of personal data of European Union citizens may unfortunately be insufficient. Therefore, every personal data controller is obliged to establish a legal basis for such transfer.
On our part, we ensure that when using services and technologies, we transfer personal data only to entities from the United States and only to those that have joined the Privacy Shield program, based on the European Commission’s implementing decision of July 12, 2016 – more on this can be read on the European Commission’s website available at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_pl. Entities that have joined the Privacy Shield program guarantee that they will comply with the high standards of personal data protection that apply in the European Union, so the use of their services and offered technologies in the personal data processing process is in accordance with the law.
At any time we will provide you with additional explanations regarding the transfer of personal data, especially if this issue causes you concern.
At any time you have the right to obtain a copy of personal data transferred to a third country.

IX. Period of Personal Data Processing

In accordance with applicable legal provisions, we do not process your personal data “indefinitely”, but for the time that is needed to achieve the set goal. After this period, your personal data will be irreversibly deleted or destroyed.
In a situation where we do not need to perform other operations on your personal data than storing them (e.g., when we store the order content for the purpose of defending against claims), until permanent deletion or destruction, we additionally secure them – through pseudonymization. Pseudonymization consists of encrypting personal data or a set of personal data in such a way that without an additional key they cannot be read, and therefore such information becomes completely useless to an unauthorized person.
Regarding individual personal data processing periods, we would like to inform you that we process personal data for the period of:
- contract duration – in relation to personal data processed for the purpose of concluding and performing the contract;
- 3 years or 10 years + 1 year – in relation to personal data processed for the purpose of establishing, pursuing or defending claims (the length of the period depends on whether both parties are entrepreneurs or not);
- 6 months – in relation to personal data collected during service quotation, and at the same time no immediate contract was concluded;
- 5 years – in relation to personal data related to fulfilling tax law obligations;
- until withdrawal of consent or achievement of the processing purpose, but no longer than 5 years – in relation to personal data processed based on consent;
- until effective objection or achievement of the processing purpose, but no longer than 5 years – in relation to personal data processed based on the legitimate interest of the Data Controller or for marketing purposes;
- until becoming outdated or loss of usefulness, but no longer than 3 years – in relation to personal data processed mainly for analytical purposes, cookie use and website administration.
- Periods in years are counted from the end of the year in which we started processing personal data, to streamline the process of deleting or destroying personal data. Separate counting of the deadline for each concluded contract would involve significant organizational and technical difficulties, as well as significant financial expenditure, so establishing one date for deleting or destroying personal data allows us to manage this process more efficiently. Of course, if you exercise your right to be forgotten, such situations are considered individually.
- The additional year related to processing personal data collected for the purpose of contract performance is dictated by the fact that you may hypothetically submit a claim just before the expiration of the limitation period, the request may be delivered with significant delay, or you may incorrectly determine the limitation period of your claim.

X. Rights of Data Subjects

We would like to inform you that you have the right to:
- access your personal data;
- rectify personal data;
- delete personal data;
- restrict processing of personal data;
- object to processing of personal data;
- data portability.
We respect your rights arising from personal data protection regulations and try to facilitate their implementation to the highest possible degree.
We indicate that the mentioned rights are not absolute, and therefore in some situations we may lawfully refuse to fulfill them. However, if we refuse to grant a request, it is only after thorough analysis and only in a situation where refusal to grant the request is necessary.
Regarding the right to object, we explain that at any time you have the right to object to the processing of personal data based on the legitimate interest of the Data Controller (these were mentioned in point III) in connection with your particular situation. However, you must remember that according to regulations, we may refuse to grant the objection if we demonstrate that:
- there are legitimate grounds for processing that override your interests, rights and freedoms or
- there are grounds for establishing, pursuing or defending claims.
In addition, at any time you may object to the processing of your personal data for marketing purposes. In such a situation, after receiving the objection, we will cease processing for this purpose.
You can exercise your rights by:
- sending an email directly to the Company at sale@patonwelders.com or
- clicking the link in the email message attached at the end of the message or
- independently changing data in the customer panel, in the “Data information” tab.

XI. Right to Lodge a Complaint

If you believe that your personal data is being processed inconsistently with applicable law, you may lodge a complaint with the President of the Personal Data Protection Office.

XII. Final Provisions

To the extent not regulated by this Privacy Policy, provisions in the field of personal data protection shall apply.
You will be notified by email of any changes made to this Privacy Policy.
This Privacy Policy is effective from May 25, 2018.