Privacy Policy – HRT Foods

Last updated: 8 September 2026

1. Who we are

The controller of your personal data is HRT GLOBAL Sp. z o.o., with registered office at ul. 1 Maja 4, 33-200 Dabrowa Tarnowska, Poland.

Contact for privacy matters: sales@hrt-foods.com.

Company identifiers: NIP 8711784402, REGON 529891529, KRS 0001131623.

2. Scope of this Policy

This Policy explains how we process personal data when you visit hrt-foods.com, use our contact form, subscribe to website updates or marketing communications, contact us, request information or a quotation, enter into or discuss a business relationship with us, receive permitted business communications, or otherwise interact with HRT Foods in a professional context.

3. Personal data we process

Depending on the relationship, we may process:

• name and surname, job title, company name and professional contact details;
• country, business address and company information;
• content of enquiries, correspondence, quotations and negotiations;
• product interests, expected volumes, requested specifications, target prices and purchasing windows;
• order, delivery and cooperation information where relevant;
• technical data relating to website use, such as IP address, device/browser information and security logs, where collected;
• source of professional contact details where the data was obtained indirectly.

4. Business contacts and data obtained from public sources

As part of B2B sales and supplier/customer relationship management, we may obtain professional contact details from sources other than the individual concerned. These sources may include:

• company websites and public contact pages;
• public business directories and registers;
• professional networking platforms;
• trade fairs, exhibitions and industry events;
• publicly available business profiles, including map and directory services;
• referrals and other lawful business sources.

The categories of data typically include name and surname, job title or function, company name, professional email address, professional telephone number, country, source of the contact details, and information relevant to a potential or existing business relationship.

We process such data primarily on the basis of our legitimate interests under Article 6(1)(f) GDPR, including identifying potential business partners, managing B2B relationships, responding to business opportunities, documenting communications and organising follow-up activities. Where processing is necessary to take steps at the request of an individual before entering into a contract, Article 6(1)(b) GDPR may also apply.

Where a company or professional contact makes an email address or telephone number available specifically for commercial enquiries, supplier proposals, quotation requests or similar business contact, or where a person asks us during a telephone call or other interaction to send information or an offer to a specified address, we may use that contact channel within the scope of that invitation or request.

Where Article 14 GDPR applies because personal data was not obtained directly from you, we provide the required information within the applicable time limit and, where we communicate with you, no later than at the time of the first communication, unless an exception under the GDPR applies.

5. CRM and AI-assisted business relationship management

We may use customer relationship management (CRM) systems and AI-assisted tools to support business relationship management. Depending on the context, this may include processing professional contact details, correspondence, quotations, product interests, expected purchasing volumes, previous offers, target prices, follow-up dates and other information relevant to a business relationship.

These tools may be used to:

• organise and search business contact information;
• summarise communications and sales notes;
• schedule and prioritise follow-ups;
• identify products that may be relevant to an existing or potential business discussion;
• prepare internal sales recommendations and draft communications;
• maintain continuity of customer service and sales activity.

We may use specialised providers acting on our behalf, including CRM, cloud, IT and AI service providers. At the date of this Policy, such tools may include Pipedrive for CRM functions and OpenAI services, including ChatGPT Business, for AI-assisted workflows. The exact providers used may change over time, provided that appropriate contractual, organisational and technical safeguards are maintained.

AI tools are used as support tools. We do not use them to make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect that individual within the meaning of Article 22 GDPR.

6. Purposes and legal bases

Depending on the circumstances, we process personal data for the following purposes and legal bases:

• to respond to enquiries and take steps requested before entering into a contract – Article 6(1)(b) GDPR where applicable;
• to perform contracts and manage orders, deliveries and business cooperation – Article 6(1)(b) GDPR where applicable;
• to manage B2B relationships, maintain CRM records, organise follow-ups, assess business opportunities and protect our legal claims – Article 6(1)(f) GDPR;
• to comply with accounting, tax and other legal obligations – Article 6(1)(c) GDPR;
• to send newsletter or other electronic marketing communications where consent or another legally recognised basis for that communication channel is required and has been established.

7. Newsletter, business communications, direct marketing and objections

If you subscribe through a newsletter or updates form on hrt-foods.com, we may use the email address you provide to send the type of updates described next to that form, subject to the consent and electronic marketing rules applicable to that communication. You may unsubscribe or withdraw consent at any time. We may retain limited suppression information so that we can respect a request not to receive further marketing communications.

We may also analyse professional contact data and business relationship information in order to identify relevant business opportunities and manage sales activity on the basis of our legitimate interests under Article 6(1)(f) GDPR. You have the right to object at any time to processing of your personal data for direct marketing purposes.

Where the use of email, telephone or another electronic communications channel for commercial information or direct marketing requires prior consent under applicable law, we use that channel only when the required consent or another legally recognised basis for that channel has been established. A specific request to receive an offer or information by email, including a request made during a telephone call, may constitute such a basis for the requested communication. Likewise, contact details expressly published for receiving supplier offers, quotations or commercial enquiries may be used within the purpose for which they were made available. A generic email address published without such context is not treated by us as a blanket consent to receive any form of marketing communication.

If you ask us not to contact you for marketing purposes, we record the objection or suppression information necessary to respect that request.

8. Recipients and service providers

Personal data may be disclosed or made available, where necessary, to:

• hosting, website and e-commerce service providers;
• CRM, cloud, IT and AI service providers;
• email, newsletter and communication service providers;
• payment service providers and financial institutions, where relevant;
• shipping, logistics and fulfilment partners, where relevant;
• accounting, legal and professional advisers;
• public authorities where required by law.

Where a provider acts as our processor, it processes personal data on our documented instructions and under appropriate contractual safeguards.

9. International transfers

Some service providers or their subprocessors may process personal data outside the European Economic Area. Where this occurs, we rely on a lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where applicable, or another mechanism permitted by data protection law, together with supplementary safeguards where required.

10. How long we keep personal data

We retain personal data only for as long as necessary for the purpose for which it was collected and for any additional period required by law or reasonably necessary to establish, exercise or defend legal claims. Business prospect records are periodically reviewed and may be deleted or anonymised when there is no longer a reasonable business purpose or other legal basis for retaining them.

11. Your data protection rights

Subject to the conditions of the GDPR, you may have the right to:

• access your personal data;
• have inaccurate data corrected;
• request erasure of data;
• request restriction of processing;
• object to processing based on legitimate interests, including direct marketing-related processing;
• receive data portability where applicable;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with a competent supervisory authority, including the President of the Personal Data Protection Office (UODO) in Poland.

To exercise your rights, contact us at sales@hrt-foods.com. We may need to verify your identity before acting on a request.

12. Security

We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Measures may include access controls, multi-factor authentication, encryption provided by relevant service providers, device security, role-based permissions, contractual controls and periodic review of integrations and user access.

13. Cookies and similar technologies

Our website may use cookies and similar technologies for essential operation, security, preferences, analytics and, where applicable, marketing. The website may also embed third-party content or services, such as map, anti-spam or security functionality, which may process technical data such as IP address or device information. Non-essential cookies or third-party technologies are used only where permitted by applicable law and, where consent is required, after consent has been obtained. Cookie choices should be made available through an appropriate consent mechanism where non-essential technologies are used.

14. Changes to this Policy

We may update this Policy when our services, legal obligations or data-processing practices change. The current version will be published on the relevant website with the date of the latest update.

15. Contact

For questions about privacy or the processing of personal data, contact HRT GLOBAL Sp. z o.o. at office@hrt-global.com or at ul. 1 Maja 4, 33-200 Dabrowa Tarnowska, Poland.