1. Data controller

The controller of your personal data is GH Trade Sp. z o.o., ul. Dźwigowa 61, 01-367 Warsaw, Poland, VAT ID (NIP) 5223264796. For any matters concerning your personal data, you can contact us at: [email protected].

2. What data we collect

  • Through the contact form: full name, phone number and email address (required) and, optionally: car model, city / location, film variant you are interested in and additional notes.
  • Automatically, in server logs: IP address, date and time of the visit, browser and operating system type.

3. Purposes and legal bases for processing

  • Replying to your enquiry and preparing a quote – Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).
  • Passing your enquiry on to the selected partner studio (form on the “PPF Installation” page) – Art. 6(1)(a) GDPR (your consent).
  • Security and proper operation of the website, including checking that the phone number and email address entered in the form are valid and spam protection – Art. 6(1)(f) GDPR (our legitimate interest).
  • Establishing, exercising or defending legal claims – Art. 6(1)(f) GDPR.

We do not carry out email marketing or send newsletters. We do not profile you or make automated decisions about you.

4. Do you have to provide your data

Providing your data is voluntary, but your name, phone number and email address are necessary for us to reply to your enquiry. Without them the form cannot be sent.

5. Data recipients

  • Bright PPF partner studios (listed on the Partners page) – only if you send the form on the “PPF Installation” page and consent to it. For the purpose of handling the job, the studio becomes a separate controller of your data.
  • Our website hosting and email provider – processes data on our behalf.
  • Cloudflare, Inc. – content delivery network and website protection. When you type your email address into the form, we check via Cloudflare whether its domain exists; only the domain name (e.g. “gmail.com”) is sent, not the full address.
  • jsDelivr (public CDN) – your browser downloads from it the tool used to check phone numbers (pages with a form) and the map data (Partners page); the CDN server sees your IP address in the process.

We do not sell your data or share it with any other parties.

6. Transfers outside the EEA

Cloudflare and jsDelivr may process your IP address on servers outside the European Economic Area, including in the USA. Such transfers are based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission.

7. Data retention period

  • Form enquiries – up to 12 months from the last contact; if we start working together – for the duration of the cooperation and until the limitation periods for any claims expire.
  • Server logs – up to 30 days.
  • Data passed on to a partner studio – the studio keeps it in line with its own rules.

8. Your rights

You have the right to access your data, to have it rectified, erased, restricted and to data portability, as well as the right to object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time – this does not affect the lawfulness of processing carried out before the withdrawal. To exercise these rights, write to [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland).

9. Cookies and browser storage

We only use strictly necessary mechanisms, which do not require consent:

  • pll_language (cookie) – remembers your selected language version, for 12 months;
  • bpf_cookie_consent (browser storage) – remembers that you have closed the cookie notice;
  • people logged in to the website’s admin panel (our staff) additionally receive strictly necessary login cookies.

We do not use analytics or marketing cookies. You can delete or block cookies at any time in your browser settings.

10. Social media

The Instagram, Facebook and WhatsApp icons on the website are plain links – we do not embed any plugins from these services. Only after clicking do you go to the Meta service, which processes data in line with its own privacy policy.

11. Changes to this privacy policy

This privacy policy may be updated from time to time. The current version is always available on this page.

Last updated: 27 October 2026.