Privacy policy
Version dated: 24.08.2026
1. Data controller
The controller of your personal data is PPHU GALI Michał Galios, based in Kalety (Silesia, Poland), VAT no. 5751479721. Data contact: biuro@gali-group.pl.
2. What data we collect
Data provided in the enquiry form: name, e-mail address, phone number, delivery country and the message together with the window configuration. We also record the IP address and browser information for security and abuse prevention.
3. Purpose and legal basis
We process data to prepare and present an offer and to contact you (Art. 6(1)(b) GDPR — steps prior to entering a contract), to fulfil the order and tax obligations (points b and c), and to defend against claims (point f — legitimate interest).
4. How long we keep data
Enquiries with no further contact are deleted no later than 24 months. Data relating to a concluded contract is kept for the period required by tax law and the limitation period for claims.
5. Who we share data with
Providers of services necessary to fulfil the order: the window manufacturer (regarding the order specification), transport companies, our e-mail provider, our accounting office and our hosting provider. These entities process data under data-processing agreements. If you consent to marketing cookies, pseudonymised data (a hashed e-mail address and phone number) is also sent to Meta Platforms Ireland Ltd. and TikTok Information Technologies UK Limited — solely to measure ad performance and match audiences. The delivery address typed into the form (the address text only, without your name or e-mail) is passed from our server to Google Ireland Ltd. (Google Maps Platform) to suggest the correct address and calculate the distance for the indicative transport estimate. Your browser does not connect to Google in the process.
6. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, port it, and object to processing based on legitimate interest. You may withdraw consent at any time — this does not affect the lawfulness of processing before withdrawal. You may lodge a complaint with the President of the Personal Data Protection Office.
7. Cookies
The site uses three kinds of files: essential (always active — remember your chosen language and save your configurator project in browser storage so it survives a page refresh), analytics (our own, internal traffic measurement — page views and which configurator step people most often drop off at; this data is never shared with anyone outside GALI), and marketing (Meta Pixel and TikTok Pixel — let us measure how well our Facebook, Instagram and TikTok ads perform). Analytics and marketing cookies load ONLY after you consent in the banner shown on your first visit. You can change your decision at any time — the "Cookie settings" link is in the footer of every page.
8. Voluntary provision of data
Providing data is voluntary but necessary to prepare an offer and make contact. Without it we cannot respond to your enquiry.
9. Meta Pixel and advertising
With your consent, we use Meta Pixel (Facebook, Instagram) to measure ad campaign performance and show you more relevant GALI ads. Some events (e.g. sending a quote request) are sent to Meta on two tracks — from the browser and from our server — so measurement keeps working even when a browser blocks cookies. Personal data (e-mail, phone) is irreversibly hashed (SHA-256) before sending — Meta never sees it in plain form. The data controller on Meta's side is Meta Platforms Ireland Ltd.; see Meta's own privacy policy for details. Withdrawing consent (the "Necessary only" button on the cookie banner) stops any new events being sent.
10. TikTok Pixel and advertising
With your consent, we also use TikTok Pixel to measure the performance of advertising campaigns on TikTok. As with Meta, your e-mail and phone are irreversibly hashed (SHA-256) before sending — TikTok never sees them in plain form. The data controller on TikTok's side is TikTok Information Technologies UK Limited; see TikTok's own privacy policy for details. Withdrawing consent (the "Necessary only" button on the cookie banner) stops any new events being sent.