About usContact

Privacy policy

What personal data we process, why, to whom we pass it, how long we keep it and what rights you have.

Last updated

Informational translation of version 1.2 of the Polish document (effective from 20 November 2026). The Polish version is binding.

This policy fulfils the information duties under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). It applies to substraty.pl (including the client panel) and to the language versions of the site run by the same controller under the feedstockdata.com domain.

1. Controller

The controller of personal data is Samael Spółka z ograniczoną odpowiedzialnością (Samael Sp. z o.o.), Czarna Droga 84, 33-101 Tarnów, Poland, KRS 0000503734, NIP 9930654255 (“we”). Contact on personal data: contact@feedstockdata.com (for the Polish edition: biuro@substraty.pl) or by post to the registered office; these matters are handled by the company’s management board.

We have not appointed a data protection officer (Article 37 GDPR does not require it of us).

2. Principles in brief

  • The site uses no analytics or advertising cookies and no external tracking tools (details: Cookie policy).
  • We do not profile you and make no decisions about you based solely on automated processing (Article 22 GDPR) — including in connection with the use of artificial intelligence (section 5a). If we ever used profiling, we would tell you and, where required, obtain consent.
  • We do not sell data and do not pass it on for the marketing purposes of other entities.
  • The co-digestion calculator runs in your browser — the data you enter goes only into the page address, not to us.
When What data Purpose and legal basis How long
You browse the site (substraty.pl and feedstockdata.com) IP address, date and time, page address, browser header (server logs) security and diagnostics of the site — legitimate interest (Article 6(1)(f) GDPR) 90 days
You view a company profile in the directory IP address and browser header — only in the server’s working memory counting views and clicks for company statistics without repetition, and protection against abuse — Article 6(1)(f). We store only daily totals without personal data; we use no cookies up to 30 minutes, not written to disk
You correspond with the Editorial Team in the panel (enquiries, questions, complaints, problem reports) account data (e-mail), company, category and subject of the case, message text, any attachments, dates and status handling requests, questions, problem reports and complaints — Article 6(1)(b) (contract for the account and paid services); documenting case handling and establishing, pursuing and defending claims — Article 6(1)(f); complaints — also Article 6(1)(c). Messages are read and answered by authorised employees of Samael Sp. z o.o. (the Editorial Team); we notify you of replies by e-mail for the duration of the case, then 3 years from its closure (Article 118 of the Civil Code); correspondence forming part of contract documentation, a complaint, a legal obligation or an ongoing dispute — until the relevant period expires; after the account is deleted — no longer than those periods
You write to us (e-mail, correction, company submission, complaint, content report) e-mail address, name, message text and attachments handling the matter — Article 6(1)(f); where it concerns a contract — Article 6(1)(b); complaints and DSA reports — also Article 6(1)(c) until the matter is closed, then 3 years (limitation of claims)
You subscribe to the newsletter e-mail address, dates of subscription, confirmation and unsubscription, source of subscription, wording and version of consent (we do not store the IP address in the newsletter database or link it to the e-mail address; it may be processed in server logs — the “You browse the site” row) sending the newsletter — consent (Article 6(1)(a); Article 398 of the Polish Electronic Communications Law); proof of consent and unsubscription — Article 6(1)(f) until you unsubscribe; an unconfirmed subscription is deleted after 7 days; after unsubscription we keep the address and dates as evidence for 3 years
You create an account in the panel e-mail, password hash (argon2id — we do not know the password), optionally the secret and backup codes of two-step login, version and date of acceptance of the terms, sessions concluding and performing the contract for the account — Article 6(1)(b) until the account is deleted; an account without a confirmed e-mail is deleted after 30 days. After deletion the password, 2FA and sessions are deleted and the e-mail is anonymised — unless you have a paid service in progress: then we process the e-mail until it ends and is settled (the “You order a paid service” row)
Panel security event log: logins, failed attempts, account changes, rejected forms — with IP address and browser protecting accounts and the site, detecting abuse — Article 6(1)(f) 12 months
You also publish a company listing in FeedstockData (an option in the panel, off by default; only companies that operate outside Poland as well) listing data from the “You maintain a company profile” row (for a sole proprietorship — the entrepreneur’s personal data: name in the company name, address, phone, e-mail), their translations into the site’s languages (including AI-assisted ones — section 5a), a record of the choice and consent (text, version, date, withdrawal) publication in the second domain of the same controller (feedstockdata.com) at the company’s request — Article 6(1)(b) (contract for the account or package — publication in FeedstockData is part of every package); data of contact persons named by the company — Article 6(1)(f). You can change the choice in the panel at any time; switching it off removes the listing from feedstockdata.com until the option is switched off or the listing deleted; the consent record — 3 years after switching off (evidence)
You maintain a company profile company data and data of contact persons given in the profile (name, position, phone, e-mail, photos), profile version history publication in the directory at the company’s request — Article 6(1)(b) (contract for the account or package); data of contact persons named by the company — Article 6(1)(f) (the company’s and our interest in presenting a contact). A company naming a contact person informs that person of the transfer of data (section 4) until the entry is deleted; data of a paid package after it expires — 12 months
You use the Listing wizard country, tax or EU VAT number; data fetched from the VAT taxpayers’ register (name — for sole proprietorships including the entrepreneur’s name, NIP, REGON, KRS, VAT status, address disclosed in the register) or from the VIES system (validity of the number, name and address, if made available); date and identifier of the query; data entered manually; the company’s consent to publish the listing (text, version, date, withdrawal) preparing and publishing a listing at your request — Article 6(1)(b) (consent to publish is a declaration of the company and is not consent under Article 6(1)(a) GDPR; withdrawing it suspends publication); checking company data in public registers (reliability of the directory, preventing impersonation of other companies) and proof of consent to publication — Article 6(1)(f) listing data — as in the “You maintain a company profile” row; a listing not submitted for publication — until the account is deleted; the consent record — during publication and 3 years after it ends
You use the AI listing assistant (voluntarily) NIP; company data from the VAT register or VIES (for a sole proprietorship — the entrepreneur’s name, address); the company’s website address and the content of its public subpages; the generated listing proposal; a declaration that you checked the proposal (text, date); technical log without content: account, date, website host, number of pages read, token use, cost preparing a listing proposal at your request — Article 6(1)(b); technical log (usage limits, cost control, security, settlement with the provider) and proof of the declaration — Article 6(1)(f). We pass data to the AI providers named in section 5a; we take no decisions solely by automated means proposal — like a draft listing (the “You use the Listing wizard” row); technical log — 12 months; declaration — like the record of consent to publish
A company is in the directory without an account data from public sources (company website, KRS, CEIDG, REGON, VAT register) — for sole proprietorships also the name in the company name running an industry directory — Article 6(1)(f) until the entry is deleted or an objection upheld
You take over a company profile e-mail, domain, documents confirming authority verifying entitlement — Article 6(1)(f) documents — 12 months from the decision
You upload files text of the declaration on rights to materials, its version and hash, date, account, company, file type, IP address, browser proof of granting a licence and defence against claims — Article 6(1)(f) during publication of the material and 3 years after it ends (Article 442¹ of the Civil Code)
You order a paid service invoice data (name, NIP, address, e-mail for documents), orders, pro forma invoices, data of the person placing the order, correspondence concluding and performing the contract — Article 6(1)(b); establishing and pursuing claims — Article 6(1)(f) duration of the contract and 3 years after it ends, counted to the end of the calendar year (Article 118 of the Civil Code)
You pay amount, date, title, sender’s account number (bank transfer); transaction identifier and status (online payment) settling the contract — Article 6(1)(b); tax and accounting duties — Article 6(1)(c) as for invoices
We issue an invoice invoice data duties under the VAT Act (including KSeF) and the Accounting Act — Article 6(1)(c) 5 years from the end of the calendar year in which the tax payment deadline expired (Article 70(1) of the Tax Ordinance, Article 112 of the VAT Act); accounting records — at least 5 years (Article 74(2) of the Accounting Act)
You order a BMP test at the laboratory contact data (name of the contact person, phone, e-mail), shipping address of the Kit, sample description, ordered items, shipment tracking, test results and the laboratory report performing the contract (shipping the Kit, collecting the sample, testing, providing results) — Article 6(1)(b); invoice after results — as in the “We issue an invoice” row duration of the contract and 3 years after it ends, counted to the end of the calendar year; results and reports in the Panel — until the account or company is deleted from the Panel, not shorter than the limitation period for claims
You agree to publish a test result in the BMP database sample description and test result data in anonymous form (without company name and contact data); a record of the text and date of consent publication in the BMP database of the site — consent (Article 6(1)(a)); you can withdraw it in the Panel or by e-mail until publication (withdrawal does not affect the lawfulness of earlier processing); published anonymous data are not personal data the consent record — until withdrawal and 3 years after that day; published anonymous data — indefinitely
You request contact from the laboratory (the “Request laboratory contact” form in the Panel, BMP testing tab) name or company name, company name, phone number, account e-mail, preferred contact time, description of the matter (up to 1000 characters), request status; proof of consent: text and version of consent, hash of the text, date, IP address and browser passing the request and data to the partner laboratory’s contact person for a phone call about BMP testing — consent (Article 6(1)(a)); storing the request and proof of consent and settling with the laboratory for passed contacts — Article 6(1)(f) (demonstrating consent, defending claims, settlement with the laboratory); accounting documents — Article 6(1)(c). You may withdraw consent at any time by writing to the contact address; withdrawal does not affect the lawfulness of passing before withdrawal. After the transfer the laboratory is a separate controller for further contact request (contact data and description) — 12 months from submission; proof of consent and the record of passing to the laboratory — 3 years from the end of the calendar year in which the request was made; settlement documents with the laboratory (without your contact data) — as for invoices
You order an article (including language versions) brief, texts, materials, data of experts named by the Client, comments on versions; materials may be processed by AI providers (section 5a) for editing and translation performing the contract — Article 6(1)(b) (experts’ data — Article 6(1)(f)) duration of the article’s publication and 3 years
Messages about the contract e-mail, message text (pro forma, invoice, end-of-period reminders, change of price list or terms, notifications of Editorial Team replies) performing the contract — Article 6(1)(b) copies of sent messages — 12 months
Commercial information by e-mail (voluntary consent: a checkbox at account registration or in the Listing wizard, unticked by default) e-mail, text and version of consent, place and date it was given, date of withdrawal sending commercial information about our services — consent (Article 6(1)(a), Article 398 of the Electronic Communications Law), which you may withdraw in the panel or by e-mail; proof of consent and its withdrawal — Article 6(1)(f) until consent is withdrawn (at any time in the panel); after withdrawal we move the address to a blocking list (to prevent further sending) and keep a minimal record of consent and withdrawal (address, text of consent, dates) as evidence for 3 years — Article 6(1)(f), to which you may object (section 7); these data are separated from the active mailing database
Backups all of the above system data business continuity and recovery after a failure — Article 6(1)(f) 30-day rotation. Backups are overwritten within 30 days and are not used for current processing; data deleted or rectified in the production system are not restored from backups, and after restoring the system we repeat deletion instructions

Providing data is voluntary but necessary to use a given service (e.g. without an e-mail address you cannot create an account or subscribe to the newsletter; without invoice data we will not conclude a paid contract). Invoice data are required by VAT law.

4. Where we get data if not from you

We obtain data of companies in the directory (and, for sole proprietorships, the entrepreneur’s name) from public sources: company websites, the National Court Register, CEIDG, the REGON register and the VAT taxpayers’ register (Article 14 GDPR). Data of contact persons in a profile are provided by the company that named them (name, position, phone, e-mail, photo). A company passing on a contact person’s data must inform that person of the transfer of data to Substraty.pl and give them a link to this policy; independently of that, if we have that person’s contact data, we provide the Article 14 GDPR information on request or at first contact.

Listing wizard. When you prepare a listing in the panel, after you give the country and tax identifier we fetch company data from public registers (Article 14 GDPR):

  • Polish companies — from the VAT taxpayers’ register (“white list”) kept by the Head of the National Revenue Administration and made available by the Ministry of Finance (wl-api.mf.gov.pl): name, NIP, REGON, KRS, VAT status and the address disclosed in the register;
  • companies from other EU states — from the European Commission’s VIES system: validity of the EU VAT number and — if the Member State makes them available — name and address;
  • companies from outside the EU — you enter the data yourself.

For persons running a sole proprietorship these data (including the name in the company name and the address) are personal data. We process them for the purposes and on the bases described in section 3 (the “You use the Listing wizard” row). You can correct the fetched data before submitting the listing, and the Editorial Team checks it before publication. We also use the VAT taxpayers’ register to complete invoice data from the NIP.

5. Recipients of data

We pass data only to the extent necessary for the purpose:

  • OVHcloud (OVH group; parent company: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France) — hosting of the server (VPS) on which the site, panel, content system and our mail server (Mailcow) run; processor (Article 28 GDPR). The main server is in an OVHcloud data centre in Germany. Possible access from outside the European Economic Area or the involvement of sub-processors is permitted only in accordance with the processing agreement and a Chapter V GDPR mechanism. Mail for our addresses is handled on our own server, without an external mail provider.
  • Krajowy Integrator Płatności S.A., Poznań, Poland (operator Tpay; plac Andersa 3, 17th floor, 61-894 Poznań; KRS 0000412357) — online payments by methods offered by Tpay (including BLIK, payment card, online transfer); for payment data the operator acts as a separate controller. We pass to the operator only data needed to carry out the payment (amount, title, the payer’s e-mail address and name).
  • mBank S.A. — the bank that keeps our account; it receives transfer data as a separate controller.
  • Head of the National Revenue Administration / Ministry of Finance — the National e-Invoice System (structured invoices) under statutory provisions, and the VAT taxpayers’ register (NIP queries for invoice data and in the Listing wizard).
  • Providers of artificial-intelligence models (OpenRouter, Google, OpenAI — USA) — on the terms described in section 5a.
  • European Commission — the VIES system: when checking an EU VAT number (in the Listing wizard and when ordering) we pass the number checked and our own VAT number.
  • An entity providing accounting and tax services to the Provider — for settlement documents (invoices, pro formas, proofs of payment); processor (Article 28 GDPR).
  • Carrier (DPD Polska Sp. z o.o.) delivering the Kit for taking a sample and carrying the sample to the laboratory — receives the recipient’s name, address and contact phone to the extent necessary for delivery; for delivery it acts as a separate controller or a processor, depending on its contract with us. We give the shipment number and tracking address in the e-mail and in the Panel.
  • The laboratory performing BMP tests (currently T & B – Die Biogasoptimierer GmbH, Tarp, Germany) — an external entity independent of us (it is not part of Samael Sp. z o.o.). For an ordered test it receives the sample description, order number and contact data needed to perform the test and pass on results; to this extent it acts as our processor (Article 28 GDPR), and for its own legal obligations (e.g. laboratory records) as a separate controller. The laboratory is in the European Economic Area — we do not pass data to it outside the EEA.
  • The partner laboratory (contact person) — contact on request — when you use the “Request laboratory contact” form and give consent, we pass to the partner laboratory’s contact person named in the Panel your phone number and the form data (section 3, “You request contact from the laboratory” row). From the transfer the laboratory is a separate controller of the data for further contact and informs you separately; you may exercise your rights (including objection) directly against the laboratory. We keep the request and proof of consent and settle with the laboratory for passed contacts.
  • OpenStreetMap Foundation (United Kingdom) — only when you click “Load map” in a company profile: your browser connects to the OpenStreetMap server, which receives your IP address as a separate controller. We base the transfer to the United Kingdom on the European Commission’s adequacy decision in force at the time; should the decision cease to apply, we will suspend the integration until another Chapter V basis is in place. Without the click we do not connect to OpenStreetMap.
  • Public authorities and courts — where they demand it under the law.

Data from a public company profile in the directory are available to all visitors to the site (from the launch of the company directory — 1 January 2027).

In our company, access to data from the panel, including the correspondence with the Editorial Team, is limited to authorised employees of Samael Sp. z o.o. (the Editorial Team).

5a. Artificial intelligence

  1. What we use AI for. We use artificial-intelligence models (language models) for three purposes: (a) preparing and fact-checking editorial content of the site (articles, FAQ, substrate descriptions); (b) translating the site’s content into English and German (feedstockdata.com), including translating listings of companies that have switched on publication in FeedstockData (AI-assisted translation is checked by the Editorial Team; the Polish version is binding) and — at the Client’s order — editing and translating Sponsored articles; (c) the AI listing assistant in the Listing wizard, which only prepares a proposal for the User to check.
  2. Providers. Model providers act as our processors (Article 28 GDPR) or — depending on the service terms — as sub-processors: OpenRouter (USA; an intermediary routing requests to models — the AI listing assistant), Google (USA; Gemini models — the AI listing assistant) and OpenAI (USA; translations and editing of content). We give the current list of providers in this policy and announce changes in its new version.
  3. What data go to the models.
    • Editorial content and translations of the site — editorial texts and public sources; no personal data of users of the site (we do not pass panel account data, orders, correspondence or newsletter subscribers). If a public source contains personal data (e.g. names of authors of publications), we pass them only to models of providers admitted to personal data, or replace them with markers before sending (pseudonymisation).
    • Listings published in FeedstockData — listing texts (slogan, descriptions, services, projects) provided by the company in the panel; for a sole proprietorship they may contain the entrepreneur’s personal data (name; contact data are published without translation and do not go to the model); we pass to the model only texts to be translated, without account data; basis — Article 6(1)(b) GDPR (publication in FeedstockData is part of the package), and for contact persons — point (f).
    • Sponsored articles — materials provided by the Client (brief, texts, photos, data of experts named by the Client) to the extent necessary for editing and translation; basis — performance of the contract (Article 6(1)(b); for experts’ data — point (f)). The Client should not pass personal data that are not necessary to perform the order.
    • AI listing assistant — company data from the register (VAT register or VIES; for a sole proprietorship they contain the entrepreneur’s name and address) and the content of the company’s public web pages named by the User. We do not pass the password, the account e-mail address or payment data.
  4. No storage and no training. In the AI listing assistant we require providers to use a setting that disables storing data and using it to train models (parameter data_collection=deny). In other uses we use the providers’ programming interfaces whose terms — as of the date this policy was published — do not provide for using the data passed to train models.
  5. Technical log. For the AI listing assistant we keep a technical log without the content of requests and replies: account, date, host of the company website, number of pages read, token use and cost — for usage limits, cost control and security (Article 6(1)(f)); we keep it for 12 months.
  6. No automated decisions. We make no decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Article 22 GDPR). The AI listing assistant only prepares a proposal: you check and confirm it, and publication requires your consent and verification by the Editorial Team (a human). Editorial content and translations are checked by the Editorial Team (editorial principles on substraty.pl).
  7. Transfer outside the EEA. Data are passed to providers in the USA on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework — where the provider is certified) or standard contractual clauses — in accordance with Chapter V GDPR (section 6).

6. Transfers outside the European Economic Area

A transfer outside the EEA may take place only through the entities listed in section 5 (OpenStreetMap — United Kingdom) and through AI model providers in the USA (section 5a: OpenRouter, Google, OpenAI). We base a transfer to the USA on an adequacy decision (Article 45 GDPR — EU-US Data Privacy Framework, where the provider is certified) or on standard contractual clauses (Article 46(2)(c) GDPR), in accordance with Chapter V GDPR. You may obtain a copy of the safeguards used, or information about them, by writing to the contact address.

7. Your rights

You have the right to:

  • access your data and receive a copy (Article 15 GDPR),
  • rectification (Article 16),
  • erasure (Article 17),
  • restriction of processing (Article 18),
  • data portability for data processed on the basis of a contract or consent (Article 20),
  • object to processing based on legitimate interest (Article 21) — including to publication of data in the company directory,
  • withdraw consent at any time (e.g. the unsubscribe link in the newsletter; consent to commercial information — in the panel or by e-mail; consent to laboratory contact — by e-mail to the contact address) — without affecting the lawfulness of processing before withdrawal (Article 7(3)),
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

Please send a request to contact@feedstockdata.com. We reply without undue delay and no later than within one month (Article 12(3) GDPR). You can delete your account yourself in the panel (“Account and security”); you can unsubscribe from the newsletter with the link in every message.

8. Security

We use, among other things: encrypted connections (HTTPS, HSTS), passwords stored as an argon2id hash, two-step login (TOTP), login attempt limits, protection of forms against CSRF attacks, security headers (CSP), removal of metadata (EXIF, GPS) from photographs, checking of the types of uploaded files and a security event log. Access to data in the administration panel is limited to authorised persons.

9. Changes to the policy

We announce changes on this page (with a version number and an archive) and, for panel users and newsletter subscribers, also by e-mail where the change concerns them.