Privacy policy

The controller of personal data is the entity operating the PPWR24 application.

To be completed[TO BE COMPLETED: full legal name, registered address, tax identification number, company register number, and the details of the data protection officer if one has been appointed]

For any matter concerning personal data, write to kontakt@ppwr24.eu.

Account data

email address, user name, password stored as a cryptographic hash, language and notification settings.

Company data

entity name, address, tax identification number, producer register number, and the name and position of the person signing declarations.

Invoicing data

buyer details, EU VAT number, billing address, and the history of payments and invoices.

Documents uploaded by the user

files received from suppliers — statements, test reports, technical data sheets, material declarations — together with the data extracted from them.

Portfolio data

descriptions of packaging, components, materials, masses and supplier names entered by the user.

Technical data

IP address, browser information and event logs kept for security purposes.

Documents uploaded to the application concern packaging materials and as a rule contain no personal data beyond the contact details of people representing suppliers. We do not ask for special categories of data and they should not be uploaded.

Providing the service

running the account and portfolio and issuing documents — Article 6(1)(b) GDPR, performance of a contract.

Billing and invoices

issuing and keeping accounting documents — Article 6(1)(c) GDPR, legal obligation.

Handling enquiries

answering messages from the contact form and further correspondence — Article 6(1)(f) GDPR, the legitimate interest of communicating with interested parties.

Security

detecting abuse, keeping event logs and backups — Article 6(1)(f) GDPR.

Claims

establishing, pursuing and defending claims — Article 6(1)(f) GDPR.

Providing data is voluntary but necessary to use the application. Without company data a declaration cannot be issued, because that data goes onto the document itself.

All data, including documents uploaded by users and backups, is stored on servers located within the European Union.

We do not transfer data to third countries for storage. Should any processor in future process data outside the European Economic Area, we will state so in this document and put appropriate safeguards in place, in particular standard contractual clauses.

To be completed[TO BE COMPLETED: name and address of the hosting provider and the member state where the data centre is located]

We entrust data only to those parties we need in order to provide the service, under data processing agreements:

Payment operator

Stripe Payments Europe, Ltd. — card payments and invoicing. Stripe is a separate controller for the transaction data required under payment services law.

Hosting provider

server infrastructure and backups within the European Union.

Transactional email provider

delivery of system messages: confirmations, invoices and notifications.

Language model provider

extracting data from documents uploaded by the user, solely in order to fill in that user's portfolio.

To be completed[TO BE COMPLETED: names of the processors — hosting, transactional email, model provider — with processing locations and the current sub-processor list]

Data may be disclosed to public authorities only where a legal obligation requires it and only to the extent of a request supported by a legal basis.

Documents uploaded by users are not used to train or fine-tune artificial intelligence models. They are not shared with other users of the application and are not used for any purpose other than filling in the portfolio of the user who uploaded them.

The content of a document is processed automatically in order to read its number, date, material designation and concentration values. The result goes into the user's portfolio together with a reference to its place in the source file, so that it can be verified.

Agreements with model providers exclude the use of transmitted content for training and require its prompt deletion once processing is complete.

Account and portfolio data

for the term of the agreement and afterwards for as long as the user uses the free archive access, until deletion is requested.

Issued declarations and evidence

for the term of the subscription, then 90 days read-only and a further 90 days frozen, after which they are deleted. Export is available throughout. The declaration and the technical documentation must be retained as the Regulation requires.

Billing data and invoices

5 years from the end of the calendar year in which the tax payment fell due.

Correspondence and enquiries

up to 24 months from the last message in the matter.

Event logs

up to 12 months.

Backups

up to 30 days; data deleted from production is removed from backups once that period elapses.

In relation to personal data you have the following rights:

• the right of access and to obtain a copy of your data;
• the right to rectification of inaccurate data and completion of incomplete data;
• the right to erasure, unless a legal obligation prevents it, for example the retention of invoices;
• the right to restriction of processing;
• the right to data portability — in the application this is exercised directly through the archive export and the CSV and XLSX files, available in read-only mode as well;
• the right to object to processing based on a legitimate interest;
• the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

We act on requests without undue delay and no later than one month from receipt. Requests are accepted at kontakt@ppwr24.eu.

We use only cookies that are strictly necessary for the website and the application to work. We run no behavioural analytics, use no advertising pixels and do not profile visitors. That is why the site shows no consent banner — there is no consent to ask for.

Session cookie

keeps you signed in to the application. Removed on sign-out or when the session expires.

Language cookie

remembers the language version of the site you chose.

Security cookie

protects forms against abuse, including requests from other sites.

Cookies can be removed in your browser settings. Removing the session cookie signs you out of the application.

A message sent through the form contains your name, email address, optionally a company name, and the text of your question. We use it solely to answer that question and to continue the correspondence about it.

We do not add addresses from the form to any mailing list and do not use them to send commercial information without separate consent. The sender's IP address is processed briefly in order to limit the number of submissions from a single source.

• connections to the site and the application are encrypted with TLS;
• passwords are stored only as cryptographic hashes;
• access to production data is limited to those who need it, under individual permissions;
• backups are made daily and kept within the European Union;
• every issued document carries a SHA-256 checksum, which allows its integrity to be demonstrated.

Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, we will inform the data subjects and the supervisory authority within the deadlines set by the GDPR.

We update this policy when the scope of processing, the list of processors or the law changes. The date of the last update is shown at the top of the document. Changes that matter to users of the application are announced by email.