Privacy Policy | Virtline

Data controller

The controller is Virtline Sp. z o.o., Wadowicka 8A, 30-415 Krakow, Poland, KRS 0000502030, NIP 6751499701, REGON 123070229. For privacy matters and data-subject requests, contact [email protected], +48 12 200 27 10 or use the contact form.

Contact the controller: The form, e-mail and telephone are used to handle inquiries, commercial and technical conversations and data-related matters.
Data categories: We process data provided voluntarily, e.g. name, company, e-mail address, telephone number, subject of the conversation and description of the case.
Information security: Virtline's information security management system is certified to PN-EN ISO/IEC 27001:2023-08, supporting a structured approach to information protection.

What data can we process?

The scope of data depends on the method of contact and the purpose of the case. We do not ask for sensitive data in the form. If the project requires technical information or documents, we determine the scope and method of delivery separately.

Identification and contact details: name, surname, company, position, e-mail, telephone number.
Content of the inquiry: description of the problem, planned project, number of users, location or decision date.
Technical data of the website: basic server logs, form security and information needed to prevent abuse.
Cooperation data: offer arrangements, scope of work, correspondence, project documentation and settlement information, if an agreement is reached.

Service request form and quotation handling

The service request form records your requirements so that a quotation can be prepared. It includes company details and the Polish tax identifier (NIP), contact name, email, a required telephone number, selected service, requester role and a description of your needs; KSB 315 requests also include the number of servers. When an auditor requests a KSB 315 audit, the form records the ordering company's name and Polish tax identifier (NIP) separately from the name and NIP of the audited entity. To arrange the audit, the auditor's telephone number and the audited entity's contact person's full name and telephone number are required. We record acknowledgement of the privacy information and a submission identifier. The data is passed to Nexus, the system used to handle requests and quotations. We use it for your request under the purposes and legal bases explained below. This form does not collect marketing consent. After you click Send, we record the entered form details and privacy acknowledgement status in a separate encrypted register, including when acknowledgement is unchecked or spam protection rejects the attempt. The register is used to investigate submission problems and protect forms against abuse. Recording an attempt does not grant consent, accept an enquiry, conclude a contract or trigger an offer. We do not record typing or leaving the page in this way. Local website form data and submission attempt records are retained for one calendar month from creation. This retention also covers managed backups of these website registers; it does not replace the separate periods for correspondence, offers and contracts.

Purposes and legal bases of processing

The legal basis depends on the purpose and context. We handle enquiries and ongoing business relations under Virtline's legitimate interests in communication, preparing offers, website security and establishing or defending claims (Article 6(1)(f) GDPR). Steps requested before entering into a contract and performance of a contract rely on Article 6(1)(b), while accounting or tax obligations rely on Article 6(1)(c). Where optional analytics is used, the basis is consent under Article 6(1)(a). Submission-attempt records support diagnosis and abuse prevention under Article 6(1)(f) GDPR. Acknowledging the policy is not marketing consent. Optional advertising measurement, like analytics, requires prior consent that can be withdrawn in privacy settings.

Enquiry handling: Response to the message, clarification of needs, preparation of consultation and further communication.
Cooperation with the client: Service implementation, operational arrangements, technical contact, documentation, settlements and support.
Website security: Form protection, anti-abuse, basic technical logs and maintaining website availability.

Data storage time

We retain data no longer than required by the purpose, legal basis and applicable time limits. Where one date cannot be stated, we use criteria including closure of the correspondence or contract, mandatory retention periods, limitation periods for claims, validity of consent and the time reasonably needed to secure the website.

Local website-form data and the submission-attempt register: one calendar month from record creation, as described in the forms section above. Further correspondence about the enquiry: until the matter is closed and then for the period justified by establishing or defending claims.
Offers and commercial talks: for the period of negotiations, validity of the offer and possible pursuit of claims.
Contracts and settlements: for the duration of cooperation and then for the period required by accounting, tax and civil regulations.
Technical logs: local nginx web-server logs are rotated daily, with 14 archives retained and compression enabled, corresponding to approximately 14 days of history. This period describes local nginx rotation, not the retention of all copies held off the server.

User rights

Within the conditions set by the GDPR, a data subject may request access, rectification, erasure, restriction and portability, and may object to processing based on legitimate interests. Consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal. A complaint may be lodged with the President of the Polish Personal Data Protection Office (UODO, uodo.gov.pl).

Data request: In matters of rights arising from the GDPR, you can contact Virtline via the form, e-mail or telephone.
Objection and consent withdrawal: You may object to processing based on legitimate interests or withdraw consent previously given.
Limited access: Access to the data is available to people and systems needed to handle the query, cooperate or provide website security.

Data sharing and supporting entities

We host the website and contact-form service on Virtline servers. We handle enquiries using Virtline's mail infrastructure and configured mail providers. Providers of office tools, accounting or technical support may process data on our behalf. Cloudflare processes technical signals for Turnstile protection. Google may process analytics data after the required consent to Google Analytics. Depending on the circumstances, transfers outside the EEA rely on an adequacy decision, the Data Privacy Framework or Standard Contractual Clauses. To ask about the safeguards, email [email protected].

Authorised Virtline staff who manage the website, mail and customer enquiries.
Accounting, legal or administrative entities when required by law or contract performance.
Technical partners involved in the client's project, only to the extent agreed during the cooperation.
Public authorities, if the obligation to disclose results from the law.
Cloudflare provides Turnstile protection when you use the form. We verify the token before accepting a request. The provider processes technical signals, including IP addresses, TLS fingerprints, User-Agent information and the page origin, to protect forms and improve bot detection. For details, see: https://www.cloudflare.com/turnstile-privacy-policy/ .
Google as the optional analytics provider only when Google Analytics is enabled and the user has given the required consent.
Cloudflare as a delivery and abuse-protection provider when traffic passes through its network. It may process IP addresses, device and request information and use necessary security cookies.
Google Ads, Meta (Facebook and Instagram) and LinkedIn as optional ad-measurement providers, only when the relevant integration is configured and the user has given separate marketing consent. Active providers are listed in privacy settings. Analytics consent or submitting a form does not replace this consent.
After separate marketing consent, platforms may receive technical visit information and an accepted-enquiry event with a random identifier used for deduplication. These events do not include names, email addresses, phone numbers, tax IDs or enquiry contents. Privacy settings allow consent to be withdrawn; ad scripts do not run after consent is refused.

Cookies and website technical data

The website may use technical mechanisms necessary for operation, security, consent handling and the contact form. Optional analytics is activated only after consent. Refusing analytics does not restrict access to core content. Consent can be withdrawn without affecting processing carried out lawfully before withdrawal.

Necessary mechanisms maintain the session, remember privacy choices, protect forms and help detect abuse. Our analytics and ad-measurement choices stored in localStorage have no automatic expiry. They remain until browser data is cleared or the choice is changed; withdrawing consent records a refusal. A change in analytics scope or ad-measurement recipient configuration may require fresh consent.
Optional Google Analytics 4 measures website use and helps improve content after consent has been obtained. In the GA4 property we use, event-data and user-data retention are set to 14 months. The user-data retention period resets on new user activity. These settings apply to data in GA4 and do not define the lifetime of providers’ cookies.
When enquiry attribution is enabled and analytics consent has been given, we record the source, medium, campaign tag, landing page, referring domain and measurement time. Attribution history and a random browser identifier are stored in the browser for up to 30 days. We attach source data to the enquiry to follow its outcome in Nexus. Refusing consent disables this history and does not prevent contact or a service enquiry.
Analytics consent and acknowledging the information beside the form do not constitute consent to newsletters, remarketing or sharing advertising identifiers with ad platforms. Handling an enquiry and measuring its source are separate purposes. Analytics settings allow consent to be withdrawn and attribution history to be removed from the browser.
Browser settings can remove or block cookies, although blocking necessary mechanisms may limit some functions.

Required data and automated decisions

Providing data in an enquiry is voluntary, but without contact details or enough context we may be unable to respond. The contact and service request forms require a telephone number; they cannot be submitted without it. You can also contact us directly by email or telephone. Data needed to enter into or perform a contract and for statutory accounting is required to the extent set by the contract or law; failure to provide it may prevent cooperation. For this website and enquiry handling, we do not make solely automated decisions that produce legal or similarly significant effects, and we do not use profiling for such decisions.

Enquiry: We need a return contact and enough information to understand the request.
Contract and accounting: Mandatory data depends on the service, contract and applicable accounting or tax rules.
Human handling: Enquiries are reviewed with human involvement; website analytics does not decide a user's rights.

Privacy request handling

If you want to exercise your GDPR rights, clarify the scope of processed data or ask about the contact form, use the same official contact path as for other Virtline matters.

Submit the request: Send a request through the contact form, e-mail or telephone and indicate whether it concerns access, rectification, deletion, restriction, portability, objection or another GDPR right.
Confirm identity and scope: We may ask for information needed to confirm the requester and identify the data or case, so the response is provided to the right person and covers the correct processing context.
Response time: Requests are handled within the time limits required by GDPR, usually within one month unless the matter is complex or the law allows an extension.
Complaint path: If you disagree with the response or believe the GDPR has been violated, you may contact Virtline again or lodge a complaint with the President of the Personal Data Protection Office (UODO).

Questions and answers

Who is the personal data controller?

The controller is Virtline Sp. z o.o., Wadowicka 8A, 30-415 Krakow, Poland, KRS 0000502030, NIP 6751499701, REGON 123070229. Contact [email protected], +48 12 200 27 10 or use the contact form.

What data does the contact form process?

The form may include name and surname, company name, email address, telephone number, topic of conversation and description of the case. We do not ask for sensitive data or information unnecessary to handle the inquiry.

For what purpose does Virtline process the query data?

We use it to handle enquiries and business relations under legitimate interests, for requested pre-contract steps or contract performance, to comply with legal duties and, after consent, for optional analytics.

How can you exercise your rights under the GDPR?

Contact Virtline to request access, rectification, erasure, restriction or portability where applicable, to object or withdraw consent. You may also lodge a complaint with the President of the Polish UODO.

Privacy contact

Do you have a question about privacy or personal data?

Email [email protected] or call +48 12 200 27 10. We will route the request to the appropriate person and respond within the applicable GDPR time limit.

Email [email protected] Phone +48 12 200 27 10

Go to contact