Privacy policy

This site is not a shop. We sell nothing online here and take no payments. We collect data only when you give it to us yourself: in the contact form, in a partner application, when you subscribe to the newsletter, when you set up an account for the file area and the visualiser, in a chat conversation, or when you book a meeting at a trade fair.

• Your data goes to our own server in the European Union and to our company system, which runs on the same machine.
• We do not sell or trade data. Nor do we buy visitor data from anyone outside.
• Analytics and advertising tools start only after you consent. Without that, not one of their scripts loads.
• Two features use an external artificial intelligence model: chat replies and the visualisation of your photo. We describe this plainly below, because that is where data leaves our server.
• Some data is deleted automatically once its period ends: every night the site removes old form submissions, unconfirmed newsletter sign-ups, old entries in the download log and unused accounts from its database. Other data, for example in our company system, we remove by manual review, and immediately when you ask us to. We give the periods in the section on retention.
• At any time you can ask for access to your data, for it to be corrected, or for it to be deleted: [email protected].

The rest of this document says the same thing precisely, point by point. The contents are alongside, and above the text on a narrow screen.

The controller of your personal data is Strama Panels Sp. z o.o., with its registered office in Łomianki, ul. Rolnicza 138, 05-092 Łomianki, Poland.

The company is entered in the register of entrepreneurs of the Polish National Court Register under number KRS 0000782880. VAT number: PL 5862344094. We read the registration details from our company system on 7 September 2026 and they match what is stated above.

On matters of personal data write to [email protected], call +48 504 265 748 or send a letter to the registered office.

Data protection officer

We have not appointed a data protection officer and we are not required to: we do not monitor individuals on a large scale and we do not process special categories of data, and those are the cases in which the rules require one. We handle personal data matters ourselves, within the company. For all such matters write to the company contact address, [email protected]. It will reach the right hands.

What this document covers

The stramapanels.com site and all its parts: the information pages, the contact form, the We're looking for partners page with the partner application form, the newsletter, the file area, the finish browser, the visualiser and the chat. It does not cover other companies' sites that we link to from here.

Below we list every place on the site where personal data comes into being, as at the date of the last update of this document.

Contact form

We ask for four things: full name, email address, phone number (optional) and the message. Nothing else is required. The same form handles an ordinary enquiry from the Contact page, a request for design materials and a sample order from the Order samples page, so the range of data is the same every time.

A submission goes to two places and only two: it is saved in this site's database, where we read it in the editing panel, and it goes in parallel by email to our mailbox [email protected]. A form submission is not copied into our sales system. We do not store your IP address with the submission; it serves only the counter that enforces the sending limit, and it disappears after a day.

Partner application

On the We're looking for partners page, companies interested in working with us (wholesalers, shops, installation crews, design studios and others) can send a partner application. The form collects: type of business, country, full name, email address and, optionally, company name, phone number and message. It is also mandatory to confirm that you are aware of this privacy policy; we record that you did so.

Together with the application we store information about where it came from: the page language, the address of the page from which the form was sent, the address of the referring page if your browser passed it on, the first page opened during this visit and the page that referred you to it, the page variant (for example for installation crews or for wholesalers), the page of our site from which you went on to the application, and the campaign parameters from the page address: UTM tags (source, medium, campaign, content, keyword) and the Google, Meta and TikTok ad click identifiers (gclid, fbclid, ttclid), if you came to us from an ad. In addition, the date of sending and the IP address from which the application came.

The application is first saved in this site's database. It then goes to our company system (Odoo, CRM module). There we create a contact record (full name, email, phone, company, country, language) with a partner application tag, and a sales opportunity whose description contains the form data and the source information listed above; we fill in the source, medium and campaign fields with the UTM tags. If you already have a contact record with us with the same email address, we do not overwrite it; we only fill in the empty fields (phone, company, country) and add the tag. The IP address does not go into the company system. It stays only in this site's database and is used to protect the form against abuse.

After saving, we send two emails. The first is a notification to our mailbox [email protected] with the application data and the UTM tags. The second is a one-off confirmation to the address given in the form, in the language of the page: it tells you that the application has arrived and what happens next. Of the form data it contains only your first name. It contains no advertising and no tracking links, and sending it does not subscribe you to the newsletter or to any other mailing. A reply to it goes to our office.

Newsletter

We ask for an email address and, optionally, a first name. On subscribing we also record the date, the language of the site and the IP address the subscription came from. The IP address is our evidence that consent was actually given, and we use it for nothing else.

The newsletter works on double opt-in. After you subscribe we send one message with a link, valid for three days. Until you click it, your address does not reach the mailing list and you receive no other post from us. After you click, your address and first name go into our company system, onto the mailing list “Newsletter”, tagged “Website”, which tells us the subscription came from here rather than from a sales conversation. The IP address and the site language stay in this site's database only and do not go into the company system. You can unsubscribe from any mailing with one click in the footer of the message.

Account for the file area and the visualiser

One account opens the Downloads area (data sheets, guides, sample books, 3D models) and the visualiser. We collect: email address, first name, and optionally phone and company name. You may also tick consent to sales contact; it is optional and the account works without it.

The account has no password. You sign in with a link we send to your address: the account confirmation link is valid for 48 hours, the sign-in link for 1 hour. We record the date the account was created and the date of the last sign-in.

When the account is confirmed we also create a contact record for you in our company system, tagged “Visualiser”, with a sales opportunity attached to it. That is where the history of what you downloaded and what you visualised collects, so that a salesperson does not have to ask you all over again.

The visualiser, that is a photo of your room

In the visualiser you upload a photo of your room and choose a finish and a wall. The photo may show your home and the things in shot, so we treat it seriously.

What happens to it, step by step:

1. The photo leaves our server. We reduce it to 1024 pixels on the longer side, repackage it as JPEG (which incidentally strips the EXIF data, including location coordinates if the camera recorded them) and send it to OpenRouter, which brokers access to artificial intelligence models. The same transmission carries a sample of the chosen finish and a text instruction describing what the model is to draw. We do not send your name, email address or account number there.
2. We keep the input photo and the finished visualisation on our own server, with your account, so that “before” and “after” can be compared and so that the visualisation does not vanish when you close the tab.
3. The visualisation itself, that is the resulting image, additionally goes to your record in our company system, as an attachment to the sales opportunity. With it we record a note: which finish, which wall, how long it took and what it cost. Your input photo does not go into the company system.

The cost and time of a single render are technical data with no bearing on you as a person.

Do not upload photos showing identifiable people, documents or anything else you would rather not show us. An empty wall is enough to choose a finish.

File downloads

Every download by a signed-in user is recorded in a log: who, which file, when and from which IP address. The IP address stays in this site's database only. Your record in our company system receives only the list of downloaded materials with dates, without the IP address, plus the tag “Downloads”. We do this so that we know what interests you and can give you a sensible answer when you get in touch.

Downloads from open categories, the ones we release without a sign-in, are not logged at all.

Live chat

The chat window in the bottom right corner opens only when you click it. Until then it sends nothing and stores no file in your browser.

We collect the content of the conversation. If you give a name, phone number or email address in it, those are saved along with the conversation. When nobody is at the desk, the chat offers to take a message and then asks explicitly for a first name, an email and a phone number (optional).

The first replies are written by our assistant, built on a language model. At any moment you can ask to speak to a person; from then on the assistant goes quiet. The conversation is saved in our company system, on the same server the site runs on.

Booking a meeting at a trade fair

When we take bookings for a meeting at our stand, the form collects a first name, an email, a phone number, a company name, the chosen day and time and a message. The booking goes straight into our company system: we create a contact record there and a registration for the event. To the note on that registration we add the site language and the IP address the booking came from. This is the only place on the whole site where a visitor's IP address reaches the company system; we use it to filter out bulk submissions sent by bots.

Technical connection data

The server records ordinary connection information in its log: IP address, date, the address of the page visited and browser type. Every server on the internet does this. It serves the upkeep and security of the site, not the building of a visitor profile.

What we do not do

We take no payments. We do not ask for invoicing details or card numbers. We do not record what you search for on the site. We do not buy visitor data from brokers. We do not sell your data to anyone.

Every purpose has its legal basis in the GDPR. We list them one by one so that they can be checked.

Answering your enquiry

Purpose: to get in touch with you, prepare a quotation, send samples or materials.
Basis: Article 6(1)(b) GDPR where we are working towards a contract, or Article 6(1)(f) GDPR, that is our legitimate interest in handling enquiries, where no contract follows.

Once a matter is closed we keep the same correspondence only so that we can defend ourselves should anyone bring a claim. Basis: Article 6(1)(f) GDPR.

Partner application

Purpose: to consider the application, reply to it and establish whether, and on what terms, we will enter into business cooperation. This purpose also covers the confirmation sent by email after the application.
Basis: Article 6(1)(b) GDPR, that is steps taken at your request prior to entering into a contract, where you apply on your own behalf, for example as someone running their own business. Where you apply on behalf of a company that you work for or represent, the basis is Article 6(1)(f) GDPR, that is our legitimate interest in establishing and maintaining business contact with that company.

Purpose: to see which advertising campaigns and pages the applications come from, so that we spend the advertising budget sensibly. The information about the source of the application described above is used for this.
Basis: Article 6(1)(f) GDPR, that is our legitimate interest in assessing the effectiveness of our own marketing.

Purpose: to protect the form against spam and abuse (IP address) and, once the matter is closed, to be able to demonstrate the course of the contact and to defend ourselves against any claims.
Basis: Article 6(1)(f) GDPR.

You may object at any time to processing based on our legitimate interest. Sending an application is not consent to the newsletter or to commercial information: we reply because you ask to be contacted about this matter.

Newsletter

Purpose: sending messages about news, finishes and materials.
Basis: Article 6(1)(a) GDPR, that is your consent confirmed by clicking the link in the message. We send commercial messages to your email address on the basis of that same consent, in line with electronic communications law.

Account, file area and visualiser

Purpose: to give you the materials and the tool you ask for, and to know who we are giving them to.
Basis: Article 6(1)(b) GDPR, because without an account the service you want to use cannot be provided.

Consent to sales contact, if you tick it, is a separate basis: Article 6(1)(a) GDPR. You can withdraw it without losing the account.

Download log and sales contact after a download

Purpose: to know which materials are needed, and to get in touch about a project.
Basis: Article 6(1)(f) GDPR, that is our legitimate interest in running the business and looking after those who show interest. You may object to this processing.

Chat

Purpose: to answer your question straight away.
Basis: Article 6(1)(f) GDPR, that is handling a conversation with an interested person, and where the conversation leads to a quotation, Article 6(1)(b) GDPR.

Booking a meeting at a trade fair

Purpose: to reserve a slot and confirm the meeting.
Basis: Article 6(1)(b) GDPR.

Security and upkeep of the site

Purpose: so that the site works, so that the forms are not used to send spam and so that a fault or abuse can be investigated.
Basis: Article 6(1)(f) GDPR.

Statistics and advertising

Purpose: to see how the site is used and to measure how well ads perform.
Basis: Article 6(1)(a) GDPR, that is your consent in the cookie banner. Without consent these tools do not start. You can withdraw consent at any time.

Obligations under the law

Purpose: to account for an order, if one is placed.
Basis: Article 6(1)(c) GDPR, in connection with tax and accounting rules.

Do you have to give us data

No. Giving data is voluntary and follows from no rule or contract. Without an email address or a phone number, though, we have no way to reply; without an email address an account cannot be set up; and without a photo a visualisation cannot be made.

In the partner application, the type of business, country, full name, email address and the confirmation that you are aware of this policy are mandatory. Without them we will not accept the application. You may leave the other fields empty.

We do not sell data and we do not make it available to anyone for their own purposes. Below is the full list of companies that come into contact with it, and the reason why.

Where this site runs

The site runs on a server we manage ourselves. The server sits in Google Cloud infrastructure, in the europe-north1 region (Finland), that is within the European Union. The infrastructure supplier does not look into the content of submissions, but technically it holds the disk they sit on.

Our company system

Our company system (Odoo) runs on the same server as the site. It is not an external service but our own software, so data does not leave our machine. Into it go: chat conversations, confirmed newsletter subscriptions, accounts from the file area and the visualiser together with the download history and finished visualisations, and bookings for meetings at trade fairs.

Submissions from the contact form (the Contact and Order samples pages) do not go into it: they stay in the site's database and in our mailbox. A partner application is different: we save it in the company system as a contact record and a sales opportunity, without the IP address, as described in the section on the data we collect.

Outgoing mail

Messages from the site, that is notifications of submissions, confirmations of partner applications, newsletter confirmations and account links, are sent through Google mail from the mailbox [email protected]. The content of those messages therefore passes through the mail provider's servers, and notifications of submissions remain in that mailbox.

Cloudflare

Traffic to the site passes through Cloudflare, which acts as an intermediary: it speeds the site up and protects it against attacks. Cloudflare therefore sees visitors' IP addresses and basic information about the browser. Basis: Article 6(1)(f) GDPR, that is the security and availability of the site.

Artificial intelligence model: chat and visualiser

Two places on the site use a model made available by OpenRouter of the United States, which brokers access to models from other suppliers:

• Chat: to prepare a reply we send the content of the conversation there. This covers only what you write in the chat window. If you would rather that did not happen, write to us through the contact form or by email.
• Visualiser: to draw panels on your wall we send your photo there together with a sample of the finish. If you would rather the photo of your room did not leave our server, simply do not use the visualiser.

OpenRouter does not create models itself: it passes the request to the supplier of the chosen model and returns the result. In the visualiser that is currently a Google image model. The model may change when a better one appears; we will update this document then. Under OpenRouter's privacy policy in the version of 31 August 2026, image files sent to them are not stored longer than handling the request requires, apart from cases of abuse detection, security, billing and legal obligations.

Both features are optional and you start them yourself. See also the section on transfers outside the European Economic Area.

Embedded YouTube videos

On some pages we embed videos from YouTube (Google Ireland Limited). We use privacy-enhanced mode (youtube-nocookie.com): the video loads only when the page containing it opens, and YouTube then receives your IP address and information about your device. The player itself sets no advertising cookies until you press play.

Tools we start only after your consent

Until you click consent, none of them loads. After consent we start Google Tag Manager (container GTM-57PQXFWF), and through it:

• Google Analytics 4 (Google Ireland Limited): visit statistics,
• Google Ads (Google Ireland Limited): measuring ad performance and remarketing, that is showing you our ad after a visit to the site,
• Meta Pixel (Meta Platforms Ireland Limited): measuring ads on Facebook and Instagram,
• Microsoft Clarity (Microsoft Ireland Operations Limited): statistics and recordings of cursor movement on the page,
• Apollo.io (Zenleads Inc., trading as Apollo.io, United States): identifying the company whose network a visit came from, by IP address. The tool does not establish who specifically is at the computer,
• Umami Cloud (Umami Software, Inc., United States; the script loads from cloud.umami.is): simple visit statistics.

There is one Google Tag Manager container and it does not start by itself: it is inserted only by our consent script, once you agree to at least one category. In addition, each tool in the container has its own consent condition: the statistics tools (Google Analytics 4, Microsoft Clarity, Umami Cloud) run only after consent to statistics, and the advertising tools (Google Ads, Meta Pixel, Apollo.io) only after consent to marketing. We have described the container's contents above in full.

Partner applications and measurement tools

After a partner application has been sent successfully, the site records an "application submitted" event. It reaches the statistics tools only after your consent to statistics, and the advertising tools (Google Ads as conversion measurement, Meta Pixel as an application event) only after consent to marketing. The event carries only the type of business, the country, the page language and the page variant. We do not pass your full name, email address, phone number, company name or message content to these tools. Without your consent the event does not leave your browser.

Fonts and other page elements

Fonts, images, scripts and stylesheets are loaded from our own server. We do not use Google Fonts or other external libraries, so simply displaying the page does not send your IP address to third parties, apart from the Cloudflare intermediary described above.

Other recipients

When we send samples or an order, the delivery details go to the courier or haulage company handling the shipment. When contact leads to an invoice, the data on the document goes to our accountants and into the systems required by tax rules. Data may also be disclosed to public authorities where they demand it under the law.

Most of the companies listed above process data on our behalf, under the terms of the services we use, which include a personal data processing agreement. Two cases work differently and we say so plainly.

Meta: joint controllership. For the events collected by the Meta Pixel on this site, we and Meta Platforms Ireland Limited are joint controllers within the meaning of Article 26 GDPR, because we jointly decide why those events are collected. The split of roles: we are responsible for obtaining your consent and for this notice, Meta is responsible for the further processing on its side, including security and handling your rights towards it. You can send a request to us or directly to Meta; if it reaches us, we pass it on. Meta describes the essence of the arrangement in its controller addendum. Outside those events, for matching and measurement alone, Meta acts as a processor on our instructions.

Microsoft Clarity: separate controller. Microsoft processes Clarity data as an independent controller, for its own purposes, not on our instructions. There is therefore no processing agreement here: the basis is your consent to statistics, which you can withdraw at any time, and Microsoft's rules are set out in its privacy statement.

By default your data stays in the European Union: the server is in Finland and our company system runs on the same machine.

Transfers outside the EEA do occur, however, because some of the tools we use belong to companies in the United States or process data there. We do not hide this and we list every such case below.

Always, regardless of consent

• Cloudflare, Inc. (United States) acts as an intermediary for traffic to the site, so it sees the IP address and basic browser data of every visitor. This is necessary in order to serve the site securely.

Only after your consent to statistics and marketing

• Google (Analytics 4, Google Ads, Tag Manager, the YouTube player): our contract is with Google Ireland Limited, but the group also processes data in the United States,
• Meta (Meta Pixel): contract with Meta Platforms Ireland Limited, processing also in the United States,
• Microsoft (Clarity): contract with Microsoft Ireland Operations Limited, processing also in the United States,
• Apollo.io (Zenleads Inc., United States),
• Umami Cloud (Umami Software, Inc., United States).

Only when you start the feature yourself

• when you write in the chat, the content of the conversation goes to OpenRouter of the United States, which brokers access to a language model,
• when you use the visualiser, your photo travels the same way to an image model,
• when you send the contact form or a partner application, sign up for the newsletter or create an account, the related emails (a notification for us, a confirmation or a link for you) pass through Google Workspace email: our contract is with Google Ireland Limited, but the group also processes data in the United States.

On what basis

The reference point is the European Commission's decision of 10 July 2023, which finds an adequate level of data protection at United States companies enrolled in the Data Privacy Framework. The list of participants is public and anyone can check it at dataprivacyframework.gov. We checked all our suppliers in it on 7 September 2026. We report the result as it came out, including the parts that came out inconveniently.

Suppliers enrolled in the Data Privacy Framework

In the list, with active status, we found: Google LLC, Meta Platforms, Inc., Microsoft Corporation, Cloudflare, Inc. and Zenleads Inc., the company trading as Apollo.io. Transfers to these five companies therefore rest on Article 45 GDPR, that is on the Commission's adequacy decision. Independently of that, each of them has standard contractual clauses in its terms of service, which act as a fallback basis should the framework cease to apply.

Suppliers not on the list

Two suppliers are not on the list and we do not pretend otherwise. Their transfers rest on standard contractual clauses under Article 46 GDPR, and in both cases this can be pointed to in the supplier's own documents:

• Umami Software, Inc. of San Francisco, supplier of the Umami Cloud statistics. Its data processing agreement, available at umami.is/dpa in the version of 2 August 2026, incorporates the European Commission's standard contractual clauses into the agreement in clause 10, “International transfers”, together with annex 3.
• OpenRouter of the United States, the broker of access to artificial intelligence models. Its privacy policy in the version of 31 August 2026 refers expressly to adequacy decisions under Article 45 GDPR and to standard contractual clauses approved by the European Commission under Article 46 GDPR, and provides a separate data processing agreement for those using the programming interface.

Where the Umami servers are

That supplier's documentation, checked on 7 September 2026, states that Umami Cloud servers stand both in the United States and in the European Union, but does not say which region serves a given account. We do not guess: we take the cautious view that a transfer to the United States occurs, and base it on the clauses described above.

Transferring data outside the EEA carries a risk: a third country may have different rules on public authorities' access to data than the European Union. If you would like to see the documents on which we base a transfer, or to ask about the details, write to [email protected].

If you do not consent to statistics and marketing, do not write in the chat, do not use the visualiser and do not send us anything through a form, the only transfer outside the EEA that remains is Cloudflare's intermediation in traffic to the site.

Since 20 September 2026 the site deletes some data by itself once its period ends. Every night at 4:10 a job runs that removes from this site's database: submissions from the contact form (the Contact and Order samples pages) after 2 years, partner applications after 24 months, unconfirmed newsletter sign-ups after 30 days, entries in the download log after 12 months and accounts nobody has signed in to for 3 years, together with their photos and visualisations. We count the periods from the day of the entry, and for accounts from the last sign-in (or from when the account was created, if there has been no sign-in).

The job works only in this site's database. It does not cover our company system (Odoo) or our mailbox: we remove data in those places by manual review, according to the periods given below. If you want your data gone earlier, write one sentence to [email protected], giving the email address or phone number used in contact with us. We will remove it without delay, and within a month at the latest.

An enquiry that came to nothing

We delete a submission from the contact form (the Contact and Order samples pages) from this site's database automatically 2 years after it was sent. We delete the notification about it in our mailbox manually within the same period. We delete a chat conversation, which remains in our company system, 3 years after the last contact in that matter, because that is the limitation period for claims connected with running a business (Article 118 of the Polish Civil Code).

Partner application

If an application does not lead to cooperation, we delete it after 24 months. From this site's database, together with the IP address and information about the source of the application, the nightly job deletes it 24 months after the day it was sent. From the company system (the sales opportunity) and from our mailbox (the notification) we delete it manually, no later than 24 months after the last contact in that matter. We then also delete the contact record, unless something else connects us, for example an order or an account. We will delete the data earlier if you ask us to or object, unless we need it to establish, pursue or defend claims. If cooperation does come about, the data passes to its handling in the company system, and the periods for correspondence that ended in an order and for accounting documents, described below, apply.

Correspondence that ended in an order

6 years, counted from the end of the year in which the order was fulfilled. That is how long a buyer who is not running a business has to bring claims against us (Article 118 of the Polish Civil Code). A company has 3 years, but we do not separate such correspondence, because it goes hand in hand with the accounting documents from the same transaction.

Accounting documents

5 years, counted from the end of the calendar year in which the tax payment fell due. Here we have no choice: this is required by Article 86 of the Tax Ordinance and Article 74 of the Accounting Act.

Newsletter

We keep an address until you unsubscribe or withdraw consent. A subscription that was never confirmed by a click deletes itself. After 3 days the confirmation link stops working, so such an address never reaches the mailing list and you will not receive a single message from us, and 30 days after the sign-up the nightly job removes it from this site's database. Evidence of consent, that is the date and IP address of the confirmed subscription, we keep for the limitation period for claims.

Account, visualisations and download log

We keep them for as long as you use your account. An account nobody has signed in to for 3 years (or, if there has been no sign-in, 3 years after it was created) is deleted by the nightly job together with the uploaded photos, finished visualisations, quote requests and download history. Separately, we delete individual entries in the download log (which file was downloaded and when) after 12 months. The job does not cover copies of visualisations and the case description in our company system.

Write to [email protected] from the address the account is registered to and we will delete it together with the photos, the visualisations and the download history, including the copy of a visualisation in our company system. We do this without delay, within a month at the latest.

Booking a meeting at a trade fair

The registration stays in our company system and likewise does not delete itself. We remove it when you ask, and otherwise at the latest when the limitation period for claims connected with the meeting expires, that is after 3 years. If the meeting gave rise to a sales matter or an order, the periods above apply.

Server logs

14 days. The server log rotates daily, and after fourteen rotations the oldest file disappears. We checked this on the server on 7 September 2026.

Consents and cookies

Data processed on the basis of consent we keep until that consent is withdrawn. The record of your cookie decision itself lives in your browser for a year. The lifetime of individual files is in the table below.

At any time you may:

• ask for access to your data and for a copy of it,
• demand rectification of the data if it is wrong or out of date,
• demand erasure of the data,
• demand restriction of processing,
• demand portability of data you gave us on the basis of consent or a contract, to yourself or to another organisation,
• lodge an objection to processing based on our legitimate interest, including to sales contact,
• withdraw consent: to the newsletter, to sales contact, or to statistics and marketing cookies.

Withdrawing consent does not invalidate what we did lawfully before you withdrew it.

To exercise these rights, write to [email protected]. We reply within a month of receiving the request. If the matter proves complex, we will tell you and the period may be extended by up to two further months.

You can change your cookie consent yourself, without writing to us: use the Privacy settings button at the foot of every page.

Complaint to the supervisory authority

If you consider that we process data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland. You do not have to write to us first, though we will usually settle the matter faster directly.

Profiling and automated decisions

We do not take decisions about you solely by automated means and we do not profile you in a way that would produce legal effects concerning you or similarly significantly affect you.

Two things on the site work automatically and we say so plainly: chat replies are drafted by a language model, and the image in the visualiser is drawn by an image model. That is help in a conversation and an indicative tool, not a decision in your case. In the chat you can ask for a person at any moment.

Statistics and advertising tools, if you consent to them, count behaviour on the site and make it possible to tailor an ad, but they decide nothing that concerns you.

Children

The site is aimed at adults: clients, architects and contractors. We do not knowingly collect data of people under 16. If it turns out that such data has reached us, we will delete it once notified.

We do not claim certificates we do not hold. We list the specific measures that are in place on this site.

• All traffic runs over an encrypted HTTPS connection. An unencrypted connection is redirected to the encrypted one.
• The server sits behind Cloudflare, which filters out bot traffic and protects against attacks aimed at saturating the connection.
• Accounts in the file area have no passwords, so there is nothing to steal or guess. Access is by a single-use, signed link that expires: confirmation after 48 hours, sign-in after one hour.
• Files uploaded to the visualiser sit at addresses with a random, unguessable identifier, and the directory does not allow its contents to be listed.
• Files from the “Downloads” area are released by the server only after it checks who is asking for them. A direct link to a file does not work.
• Forms are protected today by three layers, all on our side and none of them sending anything outside: a bot trap, that is a hidden field a human neither sees nor fills in; a timestamp signed by our server for when the form was opened, which rejects a submission faster than a few seconds and older than several hours; and a limit on submissions from one IP address, counted over a window of an hour and a day. The counter holds the address alone, separately from the content of the submission, and clears after a day. Thanks to these three layers the form cannot be used to send spam to other people's addresses.
• Forms are also protected by Cloudflare Turnstile, a silent check that tells a human from a bot, with no distorted letters to retype and no pictures to pick. It has been switched on since 14 September 2026 on pages with a form: contact, newsletter sign-up, chat, creating an account in the visualiser and in the Downloads area, and also the partner application. Your browser then loads a Cloudflare script (challenges.cloudflare.com) and receives a token from it, which you send together with the form. Our server verifies that token with Cloudflare, passing on the token itself and your IP address, never the content of the form. Turnstile is not used for tracking and does not build a visitor profile.
• Forms and the chat are protected against submission from another site (CSRF protection).
• Access to the editing panel and to the company system is held only by named individuals, on separate accounts.
• The browser talks to our server, never directly to the company system: we do not expose it externally.

Should a personal data breach nevertheless occur that could result in a high risk to your rights, we will notify you without undue delay and report the matter to the President of the Personal Data Protection Office within 72 hours of becoming aware of it.

Cookies are small files that a site stores in your browser. We divide them into three groups, exactly as the consent banner does:

• Essential: without them the site does not work properly. They are always set and we do not ask for consent to them, because the rules do not require it.
• Analytics: they show us how the site is used.
• Marketing: they measure how well ads perform and make it possible to tailor them.

Analytics and marketing we start only after your consent. By default they are off. Until you click consent, not one script from these tools is downloaded at all. We use Google Consent Mode v2 alongside this, which starts in the denied state.

Our measurement tools sit in a single Google Tag Manager container. The container starts only after consent to at least one category, and each tool in it separately checks whether you have consented to its category: the statistics tools start only after consent to statistics, the advertising tools only after consent to marketing. Without any consent the container does not load at all.

How to change your decision

Click Privacy settings at the foot of every page. The same panel opens as on your first visit and you can choose differently. You can also delete and block cookies in your browser settings; every browser has such an option, usually in the privacy section.

Other data in the browser

Besides cookies, the site stores a few small things in the browser's storage: whether the chat window was open, and also the address of the first page opened during this visit and the campaign parameters from the page address (UTM tags and ad click identifiers). The latter are stored when you arrive on the site, even without consent in the banner, but they do not leave the browser until you yourself send the account form or a partner application; we then attach them to the submission. Entries in session storage disappear when you close the tab. We have listed each of them in the table below.

Only after consent to statistics and marketing do external tools add their own entries in the browser's local storage. We have listed them in the table below.

The site does not create IndexedDB databases and does not install a service worker.

If you use the wall panel visualiser or the facade visualiser, we additionally process the photo of your interior or building that you upload and the visualisation created from it.

Why: to produce the visualisation you ask for, keep it in your account and let an advisor prepare a quote. The basis is performance of the service contract (Art. 6(1)(b) GDPR) and, for sales contact, our legitimate interest (Art. 6(1)(f) GDPR).

Who we pass it to: to produce the visualisation the photo goes to an external artificial intelligence provider, which processes it solely on our instruction in order to generate the image. This may involve a transfer outside the European Economic Area, on the basis of standard contractual clauses. Only the finished visualisation goes to our sales system, so that the advisor sees the same thing you do. The photo you upload does not go there: it stays on this site's server, with your account.

How long: as long as your account exists. An account nobody has signed in to for 3 years is deleted by the site itself, together with the photos and visualisations. We then keep the copy of the finished visualisation in the sales system for the limitation period of possible claims. We also delete the account, the uploaded photos and the copy of the visualisation at your request sent to [email protected].

What we do not do: we do not publish your photos or visualisations, we do not share them with other customers and we do not use them for anything other than handling your enquiry.

The rules of the service itself are set out in the Terms of service.

If we change the way we process data, we will change this document too. A new version applies from the moment it is published on this page. We state the date of the last update in the contents, at the beginning of the document.

Changes that materially affect newsletter subscribers or account holders will be notified by email before they take effect.

One matter, one address. You write, we answer.

• Email: [email protected]
• Phone: +48 504 265 748
• Address: Strama Panels Sp. z o.o., ul. Rolnicza 138, 05-092 Łomianki, Poland

In your message say what it is about and give the email address or phone number you contacted us through. That way we can find your data without having to ask you for more information.

Supervisory authority: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.