Privacy policy

1. Controller

The controller of your personal data is MOISS sp. z o.o., registered office in Wrocław, ul. Stanisława Leszczyńskiego 4/25, 50-078 Wrocław, KRS 0001254975, NIP 8971976015, REGON 545269929 ("we"). For anything concerning personal data, write to us at contact@velmois.com or to our registered office.

We have not appointed a data protection officer, because the law does not require us to.

2. In short

• We collect only the data the Website and Accounts need.
• We use no analytics or advertising cookies and do not sell data.
• The Website runs on a server in Poland that we manage ourselves, with no external hosting. Emails are sent through Amazon Web Services from servers in Frankfurt.
• Account data is kept until the Account is deleted. Technical data is deleted automatically after the periods in section 3.

3. Purposes, legal bases and retention

Purpose	Data	Legal basis	How long
Registering with an email address, until the Account is activated	email address, full name, password hash, language, accepted Terms version, time of registration	GDPR Art. 6(1)(b): steps taken at your request before entering into a contract	until the Account is activated, at most 24 hours after the last activation link was sent; deleted within an hour after that
Running the Account	email address, full name, password hash (we never know the password itself), language, Google account identifier (if you sign in with Google), Terms version accepted and time of acceptance	GDPR Art. 6(1)(b): performance of the Account contract	until the Account is deleted
Address book in the Account	first and last name, company name (optional), phone number, address	GDPR Art. 6(1)(b)	until the address or the Account is deleted
Account emails: activation link, setting a new password, changing the email address, notices of a changed password or email address	email address, language	GDPR Art. 6(1)(b)	links are single-use and expire after 1 hour (new password) or 24 hours (activation, email change); deleted within an hour of expiry; we do not keep the emails' content
Notice of an attempt to register an address that already has an Account	email address	GDPR Art. 6(1)(f): our legitimate interest in protecting the Account holder	not stored
Keeping you signed in	session identifier (only its hash is stored), browser and operating system name (user agent), session expiry	GDPR Art. 6(1)(b); for the browser name, Art. 6(1)(f) (Account security)	until you sign out, change or reset your password, or the session expires, at most 30 days after it was last used; deleted within an hour of expiry
Preventing abuse (limits on attempts to sign in, register, set a password and change Account details)	IP address, email address entered in the form, Account identifier, number of attempts	GDPR Art. 6(1)(f): security of the Website and Accounts	up to 25 hours
Server logs	IP address, date and time, page address, response code and size, referring page, browser and operating system name	GDPR Art. 6(1)(f): security of the Website, detecting attacks and fixing errors	30 days
Correspondence with us	email address, the message and any data you include in it	GDPR Art. 6(1)(f): replying to you; where it concerns your Account, Art. 6(1)(b)	3 years after the matter is closed, or until the dispute ends if a related claim is raised in that time
Establishing, exercising or defending legal claims	data needed for the dispute	GDPR Art. 6(1)(f)	until the dispute ends

Deleting an Account immediately deletes all data stored in it: sessions, addresses, unused links and the link to a Google account.

4. Do you have to provide data?

An email address, full name and password (or Google sign-in) and accepting the Terms are required to create an Account; without them we cannot create one. Saving addresses is optional. Your IP address and browser details reach us automatically, because a page cannot be displayed without them.

5. Data from Google

If you sign in with Google, Google gives us your Google account identifier, verified email address and full name. It also sends the address of your profile photo, which we do not store. We never receive your Google password or access to any other data in your Google account.

6. Who receives data

1. Amazon Web Services EMEA SARL (Luxembourg) sends the Website's emails on our behalf from servers in Frankfurt (Amazon SES). It processes the email address and the message only to deliver it. AWS keeps addresses that could not be reached or that marked our emails as spam on a suppression list, so that nothing is sent to them again.
2. Google Ireland Limited (Ireland):
   1. runs our mailbox (Google Workspace), so it processes your correspondence with us on our behalf;
   2. for Google sign-in, acts as a separate controller of your Google account data. When you click "Continue with Google" on the sign-in or registration page, your browser loads Google's sign-in script from Google's servers. Google then receives your IP address and browser details and may read its own cookies to show your Google account in the button. Google's processing is described in Google's privacy policy.
3. Legal and accounting advisers, when needed. They are bound by professional secrecy or a processing agreement.
4. Public authorities, only where the law requires it.

We use no external hosting, external fonts, analytics tools or advertising networks.

7. Transfers outside the European Economic Area

Amazon and Google belong to groups based in the United States, so although the data is stored in the EU, access from the US (for example for technical support) cannot be ruled out. Such transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, in which both participate, and otherwise on standard contractual clauses approved by the European Commission. On request we will give you information about these safeguards.

8. Your rights

You have the right to:

1. access your data and receive a copy;
2. have your data corrected; you can change your name, email address and saved addresses yourself in your Account;
3. have your data erased;
4. restrict processing;
5. data portability for data we process to perform a contract;
6. object, on grounds relating to your particular situation, to processing based on our legitimate interest;
7. lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl).

To exercise your rights, write to contact@velmois.com, preferably from your Account's email address. We reply within one month. If we cannot be sure the request comes from you, we will ask you to confirm your identity.

We do not process data on the basis of consent. We do not profile you or make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Temporarily blocking further sign-in attempts after a limit is exceeded (section 3) is a security measure, not such a decision.

9. Security

Connections to the Website are encrypted (HTTPS). Passwords are stored only as hashes (Argon2id), and session identifiers and links sent by email as SHA-256 hashes. Links are single-use and short-lived. The database cannot be reached from the Internet, and only authorised people have access to the server.

10. Cookies

Cookies are small text files a website stores in your browser. The Website sets two cookies of its own, and Google's script sets a third if you choose to sign in with Google. All are strictly necessary for the service:

Name	Purpose	Set when	Lifetime
__Host-session	keeps you signed in to your Account	you sign in	30 days, renewed while you use the Website; deleted when you sign out
locale	remembers the Website's language	you change the language or open a page in a language other than your browser's	1 year
g_state	set by Google's sign-in script; stores the Google button's state, when it was shown and a random identifier	you click "Continue with Google"	about 6 months

We set __Host-session and locale ourselves; g_state is set by Google's script, which we load only once you choose to sign in with Google. They serve only to provide the service you ask for, so under Article 399(3) of the Polish Electronic Communications Law they need no consent. We use no analytics, advertising or social media cookies, which is why the Website shows no consent banner. If we ever start using them, we will ask for your consent first and update this policy.

After you click "Continue with Google", Google may also use its own cookies (section 6(2)). They are described in Google's cookie policy.

You can view and delete cookies in your browser settings. If you block the __Host-session cookie, you cannot sign in.

11. Changes to this policy

Each version of this policy states the date from which it applies. We email Account holders about significant changes before they take effect.