Privacy Policy
How OUTBO Sp. z o.o. processes personal data in connection with the OUTBO Europe website. Last updated: 25 October 2026.
1. Who is the controller
The controller of your personal data is OUTBO Sp. z o.o., ul. Chełmska 21, bud. 9, lok. 22, 00-724 Warszawa, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000916238, NIP 5272967776, REGON 389713158 (“OUTBO Europe”, “we”, “us”). OUTBO Europe is a member of EVG Group.
This policy explains how we process personal data in connection with the outboeurope.com website, including the inquiry forms on it. It provides the information required by Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).
2. How to contact us about data protection
For any question about your personal data or to exercise your rights, write to [email protected] or to our postal address above.
3. What personal data we process
Inquiry forms. When you use the quote request form, the credentials request form or the Chinese-language contact form, we process:
- identification and contact data: your name, work email address, company or factory name and your preferred contact method, which may include a phone number, WeChat ID or other messaging ID;
- information about your business inquiry: product category, target markets, number of SKUs, the services you need and your message; on the credentials request form also your role or position, company website, industry, reason for the request and project interest; on the Chinese-language form also your company website;
- information we add when we receive the inquiry: date and time, form type, language and the source label of the form.
Providing this data is voluntary. Your name, a valid work email address and your company name are required, because we cannot handle the inquiry without them. Please do not include special categories of personal data (such as health data) in your message.
Correspondence. If we correspond with you after your inquiry, by email or, if you choose, through WeChat, we process the content of that correspondence and, for WeChat, your WeChat name and ID.
Technical data. When you visit the website, our hosting provider processes technical data needed to deliver the pages and the form and to keep them secure, such as your IP address, browser type, the requested address and the time of the request. When you submit a form, our application records a log entry with the form type and the company name you entered, but not your message or contact details. DigitalOcean processes request data as part of operating and securing its platform. It does not publish a fixed retention period for its infrastructure logs, and we do not store them ourselves.
Analytics data, only with your consent. If you accept analytics cookies, Google Analytics 4 collects pseudonymous usage data: pages viewed, interactions, device and browser information and an approximate location derived from your IP address. Google states that Google Analytics 4 does not log or store IP addresses. See section 9.
Fonts and other page resources are served from our own hosting. Apart from Google Analytics after your consent, the website does not load content from third parties.
4. Why we process your data and on what legal basis
- To respond to your inquiry, prepare a quote or share credentials materials and communicate with you about your request, including through WeChat if you choose it. Legal basis: Article 6(1)(b) GDPR where you contact us on your own behalf and ask us to take steps before entering into a contract; otherwise Article 6(1)(f) GDPR, our legitimate interest in responding to business inquiries and communicating with representatives of businesses.
- To send you an automatic confirmation that we received your inquiry. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in confirming receipt.
- To record and manage inquiries internally: delivering them to our inquiry mailbox, notifying the responsible team and keeping an inquiry register so that each inquiry is assigned and followed up. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in organising our sales process.
- To operate the website securely and prevent spam and abuse of the forms. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in the security of our services.
- To establish, exercise or defend legal claims. Legal basis: Article 6(1)(f) GDPR.
- To measure website use with Google Analytics. Legal basis: your consent, Article 6(1)(a) GDPR, together with consent to storing and reading cookies on your device under Article 399 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej).
We do not use data submitted through the forms for marketing, we do not sign you up for newsletters and we do not sell personal data. Submitting a form is not consent to marketing.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
5. Who receives your data
Your data is available to authorised OUTBO Europe personnel who handle inquiries. We also share it with the following recipients:
- EVG Group sp. z o.o. handles inquiries exclusively on our behalf and acts as our processor. Inquiries are delivered to the mailbox [email protected], routed to EVG Group Microsoft Teams channels and recorded in an inquiry register in the EVG Group Notion workspace, where they are handled by EVG Group team members.
- DigitalOcean, LLC (USA): hosting of the website and of the form endpoint.
- Plus Five Five, Inc. (Resend, USA): sending the internal inquiry email and the confirmation email to you.
- Microsoft Ireland Operations Limited: Microsoft 365 services (Exchange Online email, Power Automate and Microsoft Teams) used to receive inquiries and route them to the responsible team.
- Notion Labs, Inc. (USA): the inquiry register in which inquiries are recorded and tracked.
- Google Ireland Limited, with Google LLC: Google Analytics, only if you consent.
- Public authorities, where we are required to disclose data by law.
DigitalOcean, Resend, Microsoft, Notion and Google (for Google Analytics) act as processors for us or, where the service is used through EVG Group sp. z o.o., as its sub-processors. They do so under the data processing terms that form part of their service terms (see section 6).
WeChat. If you contact us through our WeChat (Weixin) Official Account or ask us to contact you on WeChat, note that WeChat is operated by Tencent group companies. Tencent processes messages and account data as an independent controller under its own terms and privacy policy, and we have no control over that processing. We use WeChat only when you choose it; you can always contact us by email instead.
6. Transfers outside the European Economic Area
Some of our providers are established in the United States or store data there. The safeguards for each of them are listed below. You can request a copy of the standard contractual clauses using the contact details in section 2.
- DigitalOcean, LLC: the website and form endpoint are hosted in DigitalOcean’s Frankfurt, Germany region. DigitalOcean is a US company; where data is transferred to the United States, the transfer is based on DigitalOcean’s certification under the EU-U.S. Data Privacy Framework, with standard contractual clauses as a fallback, under DigitalOcean’s Data Processing Agreement.
- Plus Five Five, Inc. (Resend): stores email content and delivery logs in the United States. Transfers are based on the standard contractual clauses in Resend’s Data Processing Addendum and on Resend’s participation in the EU-U.S. Data Privacy Framework.
- Microsoft: data stored in Exchange Online, Exchange Online Protection and Microsoft Teams is held in the European Union/EFTA. Some processing, for example for support, security or service operations, may take place outside the EEA. Such transfers are covered by the standard contractual clauses in the Microsoft Products and Services Data Protection Addendum and by Microsoft’s certification under the EU-U.S. Data Privacy Framework. Power Automate, which routes inquiry emails to Teams, is covered by the same addendum.
- Notion Labs, Inc.: the inquiry register is stored in the United States. Transfers are based on the standard contractual clauses in Notion’s Data Processing Addendum.
- Google: Google Analytics data may be transferred to Google LLC in the United States on the basis of Google’s certification under the EU-U.S. Data Privacy Framework, and on the standard contractual clauses in the Google Ads Data Processing Terms where the framework does not apply.
- Tencent (WeChat): messages exchanged through WeChat may be processed in the People’s Republic of China, for which there is no adequacy decision of the European Commission. Such transfers take place only when you choose to communicate with us through WeChat. If you do not want your data to be processed in China, please contact us by email instead.
7. How long we keep your data
- Inquiries that do not lead to cooperation: 12 months from our last contact with you. We review stored inquiries every three months, so deletion takes place at the first review after the 12 months have passed, that is up to about 3 months later. At that review we delete the inquiry from every place where we keep it: the inquiry mailbox, team channels, the inquiry register and our correspondence, including WeChat conversations.
- Inquiries that lead to cooperation: the data becomes part of our customer and contract records and is kept for the duration of the cooperation, then until the limitation periods for claims expire and for as long as accounting and tax laws require us to keep the related documents.
- Copies held by our email delivery provider (Resend): deleted automatically after 30 days; Resend’s backups are kept for up to 7 days longer.
- Application logs: shown in our hosting provider’s console while the website runs. Log forwarding is disabled, so they are not archived.
- Google Analytics data linked to cookies and user identifiers: 2 months, after which Google deletes it; aggregated reports that do not identify you are kept.
- Data processed on the basis of legitimate interest: until you successfully object, unless we have compelling legitimate grounds or need the data for legal claims.
- Your cookie choice: stored in your browser for 12 months or until you change it or clear your browser storage.
8. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy of it (Article 15);
- have inaccurate data rectified (Article 16);
- have your data erased (Article 17);
- restrict processing (Article 18);
- data portability, for data you provided that we process on the basis of consent or a contract by automated means (Article 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Article 21);
- withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal. For analytics, use “Cookie settings” in the footer or the button in section 9.
To exercise these rights, contact us as described in section 2. We may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also contact the authority in the EU country where you live or work or where the alleged infringement took place.
10. Security
The website and form are served over an encrypted HTTPS connection. Access to inquiry data is limited to people who need it to handle inquiries. We use established service providers whose terms include data protection and security commitments.
11. Changes to this policy and language versions
We may update this policy when our services, providers or legal requirements change. The current version is always available on this page, with the date of the last update at the top.
This policy is available in English and Chinese. Both versions provide the same information.