This Privacy Policy explains how we process personal data when you use the Project_Vesta website, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Polish law.
What data we process
We process only the following categories of data:
- Inquiry data you submit through the INQUIRE form: full name, company name, email address, and optional project / message text. This data is sent to us by email so we can respond.
- Security / anti-abuse data: the IP address of a request to our inquiry endpoint, used only in short-lived memory to limit abuse (rate limiting). We do not store this IP in a database, attach it to your inquiry email, or use it for marketing or profiling.
We do not intentionally collect browser type, device fingerprints, analytics profiles, marketing cookies, or similar tracking data through this website.
Separately, our hosting, DNS, and email infrastructure providers may process standard server and network logs (for example IP address, timestamp, and request metadata) as needed to deliver and secure their services. Those logs are controlled under those providers' systems and policies; we do not operate a separate analytics product on this site.
Legal basis and purpose
- Inquiry data - Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and, where needed, Art. 6(1)(f) (legitimate interest in responding to business inquiries).
- Rate limiting / security - Art. 6(1)(f) GDPR (legitimate interest in protecting the website and email channel from abuse).
- Legal obligations - Art. 6(1)(c) GDPR where we must retain or disclose data under applicable law.
Providing inquiry data is voluntary, but without it we cannot receive or answer your message.
Recipients and processors
We use service providers that process data on our behalf or as independent operators of infrastructure, including:
- Resend - delivery of inquiry emails (message content and related email metadata).
- Vercel - website hosting and related infrastructure (including standard access / security logs).
- OVH - domain / DNS and related infrastructure services where applicable.
Some providers may process data outside the European Economic Area (including the United States). Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses and related transfer mechanisms offered by those providers.
We do not sell personal data and do not share inquiry content with third parties for their own marketing.
Cookies and local storage
This website does not use advertising or analytics cookies. We may use strictly technical browser storage (for example session storage) only for site functionality such as loading state or scroll position. These are not used to identify you across sites or for marketing.
Retention
Inquiry emails are retained for as long as needed to handle your request and related correspondence, and ordinarily no longer than 24 months from the last relevant exchange, unless a longer period is required for ongoing discussions, legal claims, or mandatory retention rules.
IP addresses used for rate limiting are held only transiently in server memory (short time window) and are not kept as a lasting inquiry record.
Your rights
Under the GDPR you may request to:
- access your personal data
- rectify inaccurate data
- erase data (where applicable)
- restrict or object to processing (where applicable)
- receive data portability (where applicable)
You may also lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland, or with another competent EU supervisory authority.
We do not use automated decision-making that produces legal or similarly significant effects concerning you.
Changes
We may update this Privacy Policy when our processing or providers change. The current version is always published on this page.