1. Data Controller
The controller of your personal data is [Company name], registered at [street, postal code, city, Poland], tax ID (NIP): [NIP], registration number: [KRS / CEIDG number] (hereinafter: "Controller" or "v5v").
For all data protection inquiries: privacy@v5v.pl.
2. What Data We Collect
Depending on how you use v5v, we may process the following categories of data:
- Contact data: first name, last name, email address, phone number.
- Account credentials: email (login), encrypted password hash (we have no access to the plain-text password).
- Business / invoicing data: company name, tax ID (NIP), registered address.
- Session cookies: required for secure login and panel operation.
- Anonymous analytics: Plausible Analytics — no cookies, no personal identifiers, fully GDPR-compliant without a consent banner. Aggregated data; server in the EU.
3. What We Do NOT Collect
We do not process personal data of your end consumers. From the Base platform we retrieve only operational data required for billing: order numbers, SKU codes, and quantities. We do not retrieve names, delivery addresses, phone numbers, or any other data that identifies consumers. Therefore, no Data Processing Agreement (DPA) between you and v5v is required.
4. Purposes and Legal Bases
- Handling contact inquiries — responding to messages via contact form or email (Art. 6(1)(b) and (f) GDPR).
- Providing v5v SaaS services — account management, platform access (Art. 6(1)(b) GDPR — performance of a contract).
- Billing and accounting — issuing VAT invoices, archiving accounting documents (Art. 6(1)(c) GDPR — legal obligation).
- Marketing of own services — with consent, withdrawable at any time (Art. 6(1)(a) GDPR).
5. Data Hosting
Data is hosted on servers in Germany (EU) with Hetzner Online GmbH. Payments are processed by Stripe, Inc. (transfer based on Standard Contractual Clauses; EU-U.S. Data Privacy Framework certified). Anonymous analytics by Plausible Analytics (EU server). Database: Supabase Inc. (EU region, Frankfurt; transfer based on SCC).
6. Retention Periods
- Contact data / correspondence: up to 3 years from last contact.
- Contract and billing data: 5 years from the end of the tax year in which the obligation arose.
- User account data: until account deletion, no longer than 2 years after subscription expiry.
7. Your Rights
Under GDPR you have the following rights:
- Right of access — obtain a copy of your data.
- Right to rectification — request correction of inaccurate data.
- Right to erasure — "right to be forgotten".
- Right to restriction — request restricted processing in certain cases.
- Right to data portability — receive your data in a structured format.
- Right to object — object to processing based on legitimate interests.
- Right to withdraw consent — without affecting the lawfulness of prior processing.
- Right to lodge a complaint — with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You may also lodge a complaint with the supervisory authority in your country of residence.
To exercise any of these rights, write to privacy@v5v.pl. We will respond within 30 days.
8. Contact for Data Protection Matters
- Email: privacy@v5v.pl
- Postal address: [Company name], [address, Poland]
We will notify you of material changes to this policy by email with at least 14 days' notice. Date of last update: 2026-04-26.