Legal information
This website sets no cookies, loads nothing from third parties and has no accounts or forms. It is provided by DOT CAR sp. z o.o.
Version 1. In force from 16 September 2026.
01 / Company details
Required by Art. 206 §1 of the Polish Commercial Companies Code and Art. 5 of the Polish Act on Providing Services by Electronic Means. Checked against the National Court Register on 13 September 2026.
02 / Terms of service
The rules for using this website (regulamin) under Art. 8 of the Polish Act of 18 July 2002 on Providing Services by Electronic Means. Free of charge, available before you use the website, and you can save or print this page.
These terms apply to the website at maluti.eu (the website), provided by DOT CAR spółka z ograniczoną odpowiedzialnością, whose details are in section 1. They apply to everyone who uses the website, including companies.
The website provides one electronic service: it makes information about the MALUTI quality management system available to read, including the catalogue of work and its references to published regulations.
The website has no user accounts, no forms and no payments. The MALUTI product itself is not provided through the website. It is supplied only under a separate written agreement, and these terms do not apply to it. The sign-in button on the overview page leads to the product only where the product is installed; on this website it is inactive and says so.
You need a device connected to the internet and a current web browser with JavaScript enabled. Without JavaScript the text of the overview remains, but the interactive catalogue does not work. No cookies, plug-ins or installed software are needed.
The agreement for the service is concluded when you open the website and ends when you leave it. You may stop using the website at any time, without giving a reason and without cost. We may change or discontinue the website. A change to these terms applies from its publication on this page and does not affect use of the website before that.
You may not provide unlawful content, including in messages sent to the addresses listed in section 5, and you may not attempt to disrupt the website or to gain access to it or to our systems without authorisation.
Any service used over the internet carries risks: malicious software, messages impersonating a sender (phishing), and interception or alteration of traffic. The website reduces them in three ways: it is served only over HTTPS, it loads no content from other hosts, and it carries a content security policy that blocks anything else from running.
We never ask for passwords, payment details or smart card PINs by e-mail. A message that claims to come from us and asks for them is not ours; please report it to security@maluti.eu.
Clause references and descriptions of regulations are information, read from the published texts. They are not legal or regulatory advice and do not replace your own assessment or that of your competent authority. Figures about the product describe it on the build date shown at the foot of the overview page.
Send complaints about the website to info@maluti.eu, with an address for our reply and a description of the problem. We reply by e-mail within 14 days of receiving the complaint.
Polish law applies. If you use the website as a consumer, this choice does not deprive you of the protection of the mandatory rules of the country where you habitually live (Art. 6(2) of Regulation (EC) No 593/2008).
How we process personal data is described in the privacy notice in section 3.
03 / Privacy notice
Information under Art. 13 of the General Data Protection Regulation (EU) 2016/679 (GDPR) for people who visit this website or write to us.
DOT CAR spółka z ograniczoną odpowiedzialnością, ul. Bracka 20/21, 00-028 Warszawa, Poland. Write to privacy@maluti.eu or by post to that address. We have not appointed a data protection officer: our processing does not meet the conditions of Art. 37 GDPR.
What. When your browser requests a page, our server and Cloudflare, which carries traffic to it, receive technical data: your IP address, the date and time, the address requested, the response status, the browser identification (user agent) and the referring address if your browser sends one.
Why, and on what basis. To deliver the page and to protect the website against attacks and misuse. The basis is our legitimate interest in running a secure website, Art. 6(1)(f) GDPR.
How long. Server logs are deleted after 14 days. If a specific entry is needed to investigate a security incident, it is kept until that investigation is closed.
What. Your e-mail address, your name if you give it, and what you write.
Why, and on what basis. To reply to you. Where you ask for an offer or an agreement, the basis is taking steps at your request before entering into a contract, Art. 6(1)(b) GDPR; otherwise it is our legitimate interest in answering messages, Art. 6(1)(f) GDPR.
How long. 12 months after the last message in the conversation. Longer only if the correspondence becomes part of an agreement or is needed to establish, exercise or defend legal claims.
We set no cookies and run no analytics, advertising or tracking. The website loads nothing from third parties. We make no decisions about you by automated means, including profiling (Art. 22 GDPR). We do not send marketing e-mail without your prior consent.
Only service providers who process it on our behalf and on our instructions, under agreements required by Art. 28 GDPR:
Public authorities receive data only where the law requires us to disclose it.
Cloudflare, Inc. is established in the United States, and its network may process request data outside the EEA. The transfer relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), in which Cloudflare participates, and on the standard contractual clauses in Cloudflare's data processing addendum. Our server is located in Lithuania.
You have the right of access to your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to object to processing based on our legitimate interest (Art. 21). Where we process data to take steps towards a contract, you also have the right to data portability (Art. 20). Write to privacy@maluti.eu; we answer within one month (Art. 12(3)). Server logs hold an IP address and not a name, so to find your entries we will ask for the address, date and time of your visit.
You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, or with the supervisory authority of the EU country where you live or work (Art. 77 GDPR).
No law or contract requires it. Without the technical data a browser cannot receive the page, and without an e-mail address we cannot reply.
Data about people at a customer site that are recorded in a MALUTI installation are controlled by that customer. Where we process them, we do so as a processor under a separate agreement (Art. 28 GDPR). This notice does not cover them.
04 / Cookies
Art. 399 of the Polish Electronic Communications Law asks for information and, in most cases, consent before anything is stored on or read from your device.
This website sets no cookies and stores or reads nothing on your device — no cookies, no local storage, no session storage. That is why it shows no consent banner.
The overview page sends one request to this same host, to check whether the product's sign-in is installed here. It stores nothing and sends nothing about you beyond what any page request carries.
Cloudflare features that set cookies are not enabled on this website. If that changes, this section changes first.
05 / Contact
Write to the address that fits your question; each is read by a person.
06 / Customers and business partners
Information under Art. 13 and 14 of the General Data Protection Regulation (EU) 2016/679 for people who work for our customers, prospective customers and suppliers, and whose details we receive in the course of business.
DOT CAR spółka z ograniczoną odpowiedzialnością, ul. Bracka 20/21, 00-028 Warszawa, Poland. Write to privacy@maluti.eu. We have not appointed a data protection officer.
Records made inside a customer's MALUTI installation, including data about the people of its site, are controlled by that customer. Where we handle them — during support the customer approves — we act as its processor under a data processing agreement, and the customer informs its people.
From your organisation, when it names you as a contact, signatory, approver or auditor; from you, when you write to us; and for company representatives, from public registers such as the Polish National Court Register (KRS) and the EU VAT number check (VIES).
Contact persons. Name, position, organisation, business e-mail and telephone. To prepare, perform and manage the agreement with your organisation, and to send you the service, quality, security and release notices the agreement requires. Basis: our legitimate interest in performing the agreement with your organisation, Art. 6(1)(f); where you contract with us yourself as a sole trader, Art. 6(1)(b). Kept for the term of the agreement and 12 months after it; for a prospective customer who does not sign, 12 months after the last message.
Signatories and representatives. Name, function, the basis of the right to represent (register entry or power of attorney), signature. To conclude the agreement and to be able to prove who concluded it. Basis: Art. 6(1)(f). Kept with the agreement for its term and 10 years after it, because a regulated customer may have to show the agreement to its inspectors for that long.
Invoicing. Where an invoice or payment record names a person. To issue invoices through the Polish National e-Invoice System (KSeF) and keep tax records. Basis: legal obligation, Art. 6(1)(c). Kept 5 years from the end of the year in which the tax falls due, as Polish tax law requires.
Audits and inspections. Names and organisations of auditors and inspectors who examine our work for a customer. To organise the audit and keep its record. Basis: Art. 6(1)(f). Kept with the audit record for the same period as the agreement.
Legal claims. Any of the above, where needed to establish, exercise or defend legal claims. Basis: Art. 6(1)(f). Kept until the claim is resolved.
Performing agreements with the organisations we work for, communicating with the people they appoint, meeting the quality obligations we accept towards regulated customers, and being able to prove what was agreed (Art. 14(2)(b)).
Your organisation and its authorised representatives; providers of hosting, e-mail and accounting services acting on our behalf under agreements required by Art. 28; the Polish tax administration through KSeF; auditors and competent authorities of our customers, where an audit or inspection requires it; courts and authorities where the law requires.
When your organisation is outside the EEA, we send contract, service and quality communications to it, and they contain the names of its people. Where the country has no adequacy decision of the European Commission, we transfer such data only under the standard contractual clauses adopted by the Commission in Implementing Decision (EU) 2021/914, in place before the first transfer. You can obtain a copy by writing to privacy@maluti.eu.
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and objection to processing based on our legitimate interest (Art. 21); portability (Art. 20) where we process your data under a contract with you. We make no decisions about you by automated means (Art. 22). You may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa, Poland, or with the supervisory authority where you live or work (Art. 77).
No law requires it. Without a contact person or signatory we cannot conclude or perform an agreement with your organisation.
Our agreements refer to it, and our first message to a person whose details we received from someone else links to it (Art. 14(3)(b)).