Privacy & Cookie Policy

This Privacy Policy sets out the rules for the processing of personal data by Vullpo sp. z o.o. with its registered office in Warsaw (hereinafter: the "Controller" or "Vullpo"). This Policy applies to personal data processed in connection with our business activities, including relations with contractors, clients, suppliers, collaborators, and visitors to the website www.vullpo.com.

The Controller makes every effort to ensure that personal data is processed in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter: the "GDPR") and other applicable legislation.

1. Data Controller

The data controller is Vullpo sp. z o.o. with its registered office in Warsaw, ul. Marcelego Handelsmana 7/46, 02-972 Warsaw, Poland, entered in the Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw, 13th Commercial Division of the National Court Register, under KRS number: 0001202381, Tax ID (NIP): PL9512633026, Statistical ID (REGON): 543092734, share capital PLN 100,000.00.

For matters relating to the protection of personal data, the Controller may be contacted by email at: [email protected] or by post at the registered office address.

2. Scope of Personal Data Processed

The Controller processes personal data provided in particular by:

1. contact persons of contractors, clients, and suppliers (within B2B business relationships);
2. persons using contact forms on the website www.vullpo.com;
3. persons participating in business meetings, trade fairs, and industry events;
4. job candidates.

The scope of data processed may include in particular:

1. first and last name;
2. job title;
3. company or organisation name;
4. email address;
5. telephone number;
6. mailing or delivery address;
7. data required for invoicing (Tax ID, registered office address);
8. in the case of job candidates: data contained in CVs and cover letters.

3. Purposes and Legal Bases for Processing

The Controller processes personal data for the following purposes:

Performance of contracts – processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

Compliance with legal obligations – processing results from obligations imposed on the Controller by law, in particular tax and accounting regulations (Article 6(1)(c) GDPR).

Legitimate interests of the Controller – processing is necessary for the purposes of the legitimate interests pursued by the Controller, such as: pursuit of claims, direct marketing of own products and services, maintaining business relationships, ensuring IT system security (Article 6(1)(f) GDPR).

Consent – where processing is not covered by the above legal bases, the Controller processes data on the basis of the data subject's voluntary consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

4. Data Retention Period

Personal data is retained for the period necessary to fulfil the purposes for which it was collected:

1. data related to the performance of contracts – for the duration of the contract and until the expiry of the limitation period for claims related to the contract, unless a longer processing period is required, in particular due to archiving obligations or other legal requirements;
2. accounting and tax data – for 5 years from the end of the tax year in which the tax obligation arose, or another period required by law;
3. data processed on the basis of legitimate interest – until that interest ceases (e.g. expiry of civil law limitation periods) or until the data subject lodges an effective objection to further processing, in situations where such objection is available under the law;
4. data processed on the basis of consent – until consent is withdrawn;
5. job candidate data – for 3 months after the end of the recruitment process, unless the candidate consents to processing for future recruitment.

5. Rights of Data Subjects

Every data subject has the following rights:

1. the right of access to their personal data (Article 15 GDPR);
2. the right to rectification of data (Article 16 GDPR);
3. the right to erasure of data (Article 17 GDPR);
4. the right to restriction of processing (Article 18 GDPR);
5. the right to data portability (Article 20 GDPR);
6. the right to object to processing based on the Controller's legitimate interest (Article 21 GDPR);
7. the right not to be subject to a decision based solely on automated processing, including profiling of personal data (Article 22 GDPR);
8. the right to withdraw consent at any time (Article 7(3) GDPR).

To exercise the above rights, please contact the Controller at: [email protected].

Every person also has the right to lodge a complaint with a supervisory authority – the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

6. Disclosure of Personal Data

The Controller may share personal data with the following categories of recipients:

1. entities providing services to the Controller (e.g. IT service providers, postal operators and couriers, accounting firms, law firms);
2. state authorities or other entities authorised under the law;
3. trading partners – solely to the extent necessary for the performance of the Agreement.

The Controller does not sell personal data nor make it available to third parties for commercial purposes unrelated to the performance of the Agreement.

7. Transfer of Data Outside the European Economic Area

In connection with operating on international markets, personal data may be transferred to countries outside the European Economic Area (EEA). In such cases, the Controller ensures an adequate level of data protection by applying one of the following mechanisms:

1. Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR);
2. a European Commission adequacy decision confirming an adequate level of data protection in a third country (Article 45 GDPR);
3. other appropriate safeguards provided for by the GDPR.

Detailed information on safeguards applied to international transfers can be obtained by contacting the Controller.

8. Protection of Personal Data

The Controller applies appropriate technical and organisational measures to protect the personal data processed, in particular by safeguarding data against unauthorised access, loss, destruction, or unlawful disclosure. These measures include, in particular: information system security, access control, employee training on data protection, and requiring persons with access to data to maintain confidentiality.

9. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy. The current version of the Policy is available on the website www.vullpo.com. In the event of material changes, the Controller will notify users prominently on the website.

10. Contact Details