Privacy policy

1. Data controller

The controller is Grow Easy sp. z o.o., Orpelów-Numerki 44A, 95-082 Dobroń, NIP 7312090933, KRS 0001161127 (Poland). The company runs suplab.pl and mysuplab.com (SupLab).

Data protection contact: e-mail m@suplab.pl or post to Orpelów-Numerki 44A, 95-082 Dobroń, Poland. We have not appointed a data protection officer.

2. Sample requests without an account

Data: e-mail, full name, country and delivery address, phone number for the courier, optionally company name and VAT/tax ID, and the campaign source of your visit (UTM parameters). We also record which version of the Terms you accepted and which version of this policy we showed next to the form.

Purpose: handling your request, contacting you about it, and fulfilling and settling the sample order.

• If you order in your own name (including as a self-employed individual): Art. 6(1)(b) GDPR (contract and steps before entering into it).
• If you act on behalf of a company (e.g. as its employee or representative): Art. 6(1)(f) GDPR. Our legitimate interest is handling the request and the contract with the company you represent. The company, not you, is then the party to the contract.
• Invoices and accounting records: Art. 6(1)(c) GDPR (tax and accounting law).
• Proof of acceptance of the Terms and possible claims: Art. 6(1)(f) GDPR.
• A sample request is not consent to marketing messages.
• Retention: a request that did not lead to payment, up to 12 months from the request; accounting records 5 years from the end of the tax year; data needed for claims until those claims are time-barred.

3. The PDF guide

Data: e-mail, language, date, the source of your visit (UTM parameters) and IP address. Older forms also collected an optional first name and company.

Purpose: sending the guide at your request (a free service, Art. 6(1)(b) GDPR) and protecting the form against abuse, e.g. a limit on requests from one IP address (Art. 6(1)(f) GDPR). You get the guide without marketing consent.

Retention: the record of sending the guide up to 12 months; the IP address up to 12 months, after which we delete or anonymise it.

4. Marketing e-mails

We send them only if you tick a separate, voluntary consent box (Art. 6(1)(a) GDPR and the rules on electronic communications). The consent covers e-mails from Grow Easy sp. z o.o. (SupLab) about products, offers and prices.

As evidence we record: the wording and version of the consent box, date and time (UTC), purpose and channel, language, the form it came from and the versions of this policy and the Terms. We also record refusal and withdrawal.

You can withdraw consent at any time with the link in our e-mails, without logging in, or by e-mail to the controller. Withdrawal applies to your e-mail address across all our records and does not affect the lawfulness of earlier messages.

Duration: until you withdraw, for no longer than 24 months from the day you gave consent. After that we send no marketing without new consent. We keep evidence of consent, refusal and withdrawal for up to 3 years after withdrawal or expiry, in case of claims or an inspection (Art. 6(1)(f) GDPR).

5. Customer account, offers by link and orders

• Data: e-mail, password (stored as a hash), name, company, VAT number, delivery address, phone, orders, label files, pro forma and invoices, activity in the panel (logins, page views, document downloads).
• Purpose and basis: running your account and performing contracts (Art. 6(1)(b) GDPR; for company representatives point (f)), accounting records (point (c)), activity log and security (point (f)).
• Retention: the account until it is deleted; accounting records 5 years from the end of the tax year; activity log up to 12 months.

6. Contact form, correspondence and CRM

• Data: name, e-mail, company, phone (optional), your message and correspondence.
• We run a CRM system (HubSpot) where we record contacts, sample requests, guide downloads and the grant, refusal or withdrawal of marketing consent. A CRM entry does not mean marketing consent.
• An assistant based on AI models (OpenAI) organises business correspondence in the CRM. It proposes tasks; a person makes the decisions.
• Basis: Art. 6(1)(f) GDPR (replying to you and managing business relationships) or point (b) when the conversation concerns a contract with you.
• Retention: contact form messages up to 12 months after the conversation ends; CRM contacts without an order up to 24 months after the last request, unless you object earlier.

7. Cookies, browser storage and the Meta Pixel

Necessary (no consent needed): login session (up to 30 days), access to an offer shared by link, your language and your cookie choice (up to 12 months). Not used for advertising or profiling.

Marketing (consent only): on the campaign page we may use the Meta Pixel to measure how our ads on Facebook and Instagram perform. The pixel loads only after you click "Allow marketing". Your browser then sends data about your visit to Meta (including the page address, form events and the _fbp and _fbc cookies). Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law).

We are jointly responsible with Meta Platforms Ireland Ltd. for collecting and transmitting this data through the pixel. Meta then processes it as a separate controller under its own policy (facebook.com/privacy/policy), including for ad personalisation.

You can change your choice at any time in "Cookie settings" in the footer. When you withdraw, we stop sending events immediately and delete the _fbp and _fbc cookies we can access. We cannot recall data already sent to Meta ourselves; you can contact Meta about it.

8. Security, diagnostics and statistics

• Server and hosting logs (IP address, time, requested address) are used for security and troubleshooting; we keep them according to the hosting provider's settings, for no longer than 12 months.
• Error reports (Sentry) contain the error description and the page address without parameters; we do not send form contents, cookies, headers or codes from links.
• On other pages of the site we may measure traffic with PostHog (EU servers): no cookies, no session recording, no form field contents. We do not use it on the campaign page /creatine-gummies, on the legal documents or on the e-mail opt-out page.
• Basis: Art. 6(1)(f) GDPR (security and operation of the site).

9. Recipients and their roles

We share data only as far as each purpose requires:

• Processors acting on our behalf: application hosting (Vercel Inc.), database (Neon Inc.), e-mail delivery (Resend), CRM (HubSpot), company e-mail (Google), invoicing (Fakturownia), error reports (Sentry), statistics (PostHog), correspondence assistant (OpenAI), our accounting office, warehouse and logistics partners.
• The payment provider Stripe, only when the sample form shows online payment. Stripe processes payment data partly as a separate controller, under its own terms.
• Courier and postal companies: as separate controllers, for the data needed for delivery.
• Meta Platforms Ireland Ltd.: only with your consent to the pixel (role described in section 7).
• Public authorities, where the law requires it.

10. Transfers outside the EEA

Some providers are based in the USA or use servers outside the European Economic Area (e.g. Vercel, Neon, HubSpot, Resend, Google, Sentry, OpenAI, Meta, Stripe). Such transfers may take place only on the basis of safeguards under Chapter V GDPR, e.g. a European Commission adequacy decision (EU-U.S. Data Privacy Framework, where the recipient is certified) or standard contractual clauses.

Information on the safeguards used for a particular recipient, and a copy of them, is available on request: m@suplab.pl.

11. Your rights

You have the right to access, rectify, erase and port your data and to restrict processing. You can withdraw consent at any time, without affecting the lawfulness of earlier processing.

• Objection: you can object to processing based on legitimate interest (Art. 21 GDPR). We always honour an objection to direct marketing.
• An e-mail to m@suplab.pl or a letter to the controller's address is enough. We reply without undue delay and within one month at the latest.
• You can lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warsaw; current contact details: uodo.gov.pl/p/kontakt) or with the authority in the country where you live or work.

12. Do you have to provide data?

• Samples: e-mail, full name, country, address and phone are needed to handle the request and deliver it. Without them we cannot send samples. Company and VAT number are optional (needed if you want a company invoice).
• Guide: your e-mail is needed to send the file. Marketing consent is voluntary.
• Marketing cookies are voluntary; the site works without them.

13. Automated decisions and profiling

We do not take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). If you consent to the Meta Pixel, Meta may use the data for advertising profiling under its own terms.

14. Changes to this policy

Whenever we change this policy we update the effective date. We archive previous versions and provide them on request.