Privacy policy
Version of 25 August 2026
Below we explain what personal data we process, for what purpose, on what basis, how long we keep it and what rights you have. If anything is unclear, write to us.
1. Who is the controller of your data
The controller of your personal data is VSTREFA Sp. z o.o., registered office at al. Jana Pawła II 80/4, 00-175 Warsaw, Poland, entered in the register of entrepreneurs of the National Court Register under number 0001224934, tax identification number (NIP) 5253080428, statistical number (REGON) 544048422.
For any matter concerning personal data you can write to kontakt@vstrefa.com. We have not appointed a data protection officer — we are not required to.
This policy covers situations in which WE decide on the purposes and means of processing. Correspondence addressed to our clients is a separate matter: there the client is the controller and we act on their instruction. Those rules are set out in §13 of the Terms of Service.
2. What data we process
The scope depends on your relationship with us. The full list follows.
| Who it concerns | What data |
|---|---|
| Person completing the order form | Full name, e-mail address, telephone number, data of the represented company (name, address, tax and registration numbers) |
| Person signing the agreement | Full name, role, national identification number (PESEL), type and number of the identity document, e-mail address, telephone number |
| Person authorised to collect correspondence | Full name, national identification number (PESEL), identity document number |
| Client Panel user | E-mail address (which is also the login), encrypted password, panel usage history |
| Invoiced client | Data required to issue an invoice and payment history |
| Person calling our number | Call recording, telephone number, date and time of the call |
| Person using the contact form | Full name, e-mail address, telephone number, message content |
| Website visitor | IP address, browser type, pages visited, cookie data |
We collect national identification numbers and identity document numbers only where it is necessary: when concluding an agreement and when authorising someone to collect another party's correspondence. In both cases they serve solely to confirm identity and are not used for any other purpose.
Telephone calls to our business number are recorded. Recordings serve to confirm arrangements made by telephone and to improve service quality. If you do not wish to be recorded, please contact us in writing.
3. Why we process data and on what basis
| Purpose | Legal basis | Retention period |
|---|---|---|
| Conclusion and performance of the agreement: handling correspondence, running the Client Panel, day-to-day contact | Art. 6(1)(b) GDPR — performance of a contract | For the term of the agreement |
| Issuing invoices and keeping accounting records | Art. 6(1)(c) GDPR — legal obligation (tax and accounting law) | 5 years from the end of the year in which the tax payment deadline fell |
| Confirming the identity of signatories and persons collecting correspondence | Art. 6(1)(c) and (f) GDPR — legal obligation and our legitimate interest | For the term of the agreement and the limitation period for claims |
| Establishing, pursuing and defending claims, including debt collection | Art. 6(1)(f) GDPR — legitimate interest | Until claims become time-barred |
| Recording telephone calls | Art. 6(1)(f) GDPR — legitimate interest in confirming arrangements and improving service quality | No longer than needed for that purpose |
| Replying to a message from the contact form | Art. 6(1)(a) GDPR — your consent | Until the reply is given, then until consent is withdrawn |
| Ensuring the security of the service and preventing abuse | Art. 6(1)(f) GDPR — legitimate interest | Up to 12 months |
| Traffic analysis and advertising performance measurement | Art. 6(1)(a) GDPR — your consent given in the consent banner | Until consent is withdrawn or cookies expire |
Providing data is voluntary, but to the extent necessary to conclude and perform the agreement it is required. Without it we cannot enter into an agreement or provide the service.
4. Who we share data with
We do not sell data and do not share it with other entities for marketing purposes. We pass it on only where necessary to provide the service or required by law.
| Recipient | Scope |
|---|---|
| Server infrastructure providers | Storage of data and backups |
| IT services provider | Maintenance and development of the website and Client Panel |
| Invoicing system provider | Data required to issue and send an invoice |
| Telecommunications operator | Handling calls and storing call recordings |
| Accounting office and legal advisers | To the extent necessary for settlements and legal support |
| Postal operators and courier companies | Delivery of correspondence — they act as separate controllers |
| Public authorities | Only upon a request based on law |
A full and current list of the entities we entrust with processing is available on a separate page: vstrefa.com/podmioty-przetwarzajace.
Some of the tools we use may process data outside the European Economic Area. This takes place on the basis of standard contractual clauses approved by the European Commission. Details are given for each entity in the list referred to above.
5. Your rights
In connection with the processing of your data you have the following rights:
- to access your data and obtain a copy of it
- to rectify data that is inaccurate or incomplete
- to erase data where we have no basis for further processing
- to restrict processing — you may ask us to suspend processing until a matter is clarified
- to data portability for data you provided on the basis of consent or a contract
- to object to processing based on our legitimate interest
- to withdraw consent at any time — withdrawal does not affect the lawfulness of processing carried out beforehand
To exercise any of these rights, write to kontakt@vstrefa.com. We respond without undue delay and no later than within one month.
If you consider that we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
6. Do we make automated decisions
We do not take decisions concerning you based solely on automated processing that would produce legal effects or similarly significantly affect you. Nor do we carry out profiling in that sense.
We do use tools that support our work — for example to pre-read data from scanned correspondence or to prepare a draft reply. The output of such tools is always reviewed by a person before anything is sent or saved.
7. Cookies
Cookies are small text files stored in your browser. We use them for three purposes: to make the service work correctly, to remember your settings and — after you give consent — to measure traffic and advertising performance.
| Type | Purpose | Consent required |
|---|---|---|
| Essential | Maintaining the session, form security, remembering the language choice | No — the service does not work without them |
| Analytics | Statistics on visits and how the site is used | Yes |
| Advertising | Measuring the performance of advertising campaigns | Yes |
You give consent in the banner shown on your first visit. You can withdraw it at any time by changing your choice in that banner or by deleting cookies in your browser settings. Restricting essential cookies may make the Client Panel unusable.
8. Security
We apply technical and organisational measures appropriate to the risk: the connection to the service is encrypted, passwords are stored only as an irreversible hash, access to data is limited to authorised persons, and that access is limited to what is needed to perform their duties.
We take regular backups, including a copy kept off the server. Access to administrative systems is restricted and logged.
9. Changes to this policy
We may update this policy when the law or the way our services work changes. The current version is always available at this address, together with the date of the last change shown at the top of the document.
If a change materially affects your rights, we will inform you separately — by e-mail or through a notice in the Client Panel.