This document sets out the rules for the processing and protection of personal data provided by Users and Clients in connection with the use of the https://vectrondevise.com/ website and the company's services, in accordance with the requirements of:

• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
• The Act of 10 May 2018 on the protection of personal data (Journal of Laws of 2019, item 1781, as amended);
• The Act of 18 July 2002 on providing services by electronic means (Journal of Laws of 2020, item 344, as amended);
• Electronic Communications Law.

1. Personal Data Controller

The Controller of your personal data is VectronDevise Sp. z o.o., with its registered office in Poznań:

• Address: ul. Wierzbięcice 44A / 40A, 61-568 Poznań, Poland
• NIP (Tax ID): 7831944457 | REGON: 543563760 | KRS: 0001213571
• Contact e-mail: contact@vectrondevise.com
• Phone: +48 661 180 688 / +48 690 644 758

2. Source, Purposes, and Legal Bases for Data Processing

We obtain personal data directly from the data subjects via contact forms, e-mail messages, or when concluding contracts.

Your personal data is processed for the following purposes:

• Handling inquiries and contacting the Client: Processing data entered in forms (e.g., "Request a quote") or sent via e-mail.
  Legal basis: Art. 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract) and Art. 6(1)(f) GDPR (the Controller's legitimate interest in responding to inquiries).
• Execution of B2B contracts and delivery of IT equipment: Processing necessary to finalize orders, CTO (Configure-to-Order) processes, and freight forwarding.
  Legal basis: Art. 6(1)(b) GDPR (processing necessary for the performance of a contract).
• Fulfillment of accounting and tax obligations: Issuing VAT invoices and maintaining financial documentation.
  Legal basis: Art. 6(1)(c) GDPR in conjunction with applicable tax regulations and the Accounting Act.
• Pursuing or defending against claims: Verification of potential business disputes.
  Legal basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest).
• Direct marketing: Sending commercial information, provided that separate consent has been given for a specific communication channel.
  Legal basis: Art. 6(1)(a) GDPR (consent to data processing).

Providing data is voluntary, however, it may be necessary to respond to an inquiry or to conclude and perform a contract.

3. Data Recipients (Processors)

Your data may be entrusted to third parties on the basis of concluded data processing agreements (Art. 28 GDPR) or shared with authorized entities. These include in particular:

• carriers and courier companies;
• subcontractors participating in the provision of services;
• accounting and bookkeeping offices;
• IT service providers, including the e-mail operator, hosting provider, and domain provider;
• banks and payment operators;
• law firms supporting the Controller;
• state authorities and institutions authorized to obtain data on the basis of mandatory provisions of law.

4. Data Transfer outside the European Economic Area (EEA)

If we use the services of providers based outside the European Economic Area (e.g., cloud service providers), data may be transferred outside the EEA with the application of appropriate safeguards, including in particular Standard Contractual Clauses (SCC) approved by the European Commission, or based on other transfer legalizing mechanisms provided for in the GDPR.

5. Data Retention Period

In accordance with the storage limitation principle, data is processed for the time necessary to achieve the purposes:

• Contractual data: For the duration of the contract and until the expiration of the limitation periods for claims under the provisions of law.
• Accounting data: For a period of 5 years, starting from the beginning of the year following the financial year to which the data relates.
• Data obtained on the basis of consent: Until its withdrawal.

6. Rights of Data Subjects and Automated Decision-Making

Every data subject has the following rights based on the provisions of the GDPR:

• Right of access to data (Art. 15 GDPR).
• Right to rectification (Art. 16 GDPR).
• Right to data deletion ("right to be forgotten", Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object (Art. 21 GDPR) – to processing based on the Controller's legitimate interest.
• Right to withdraw consent (Art. 7(3) GDPR) – at any time.

To exercise the above rights, please contact us at: contact@vectrondevise.com. You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO).

The Controller does not make automated decisions towards Users, including profiling within the meaning of Art. 22 GDPR.

7. Cookies Policy

Our website may use cookies exclusively to the extent necessary for its proper functioning. We use only those IT data that are absolutely required to display the structure of the website, maintain sessions, and ensure security.

Please be advised that our website does not collect data for analytical or advertising purposes, does not use external tracking scripts, and the Controller does not conduct automated profiling of Users. The processing of functional cookies takes place on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

8. Security Measures

The Controller applies appropriate technical and organizational measures ensuring data security in accordance with Art. 32 GDPR. This includes, among others, SSL certificates encrypting data transmission and strict rules of access to IT systems.

9. Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy in the event of amendments to the provisions of law on personal data protection, the development of internet technologies, or modifications to the functioning of our website. The current version of the Privacy Policy is always published on this website.