This Privacy Policy describes the rules for processing personal data of persons using the website available at vaiap.io, including persons contacting us via forms, chat, email, persons subscribing to the newsletter, persons interested in Ecologic’s offer, and persons visiting our website.

This Policy also contains information on the use of cookies and similar technologies.

Data Controller

The controller of your personal data is:

Netmart System Sp. z o.o.
address: Krakowiaków 36, 02-255 Warsaw, Poland
contact email: contact@ecologic.io
Tax Identification Number / NIP: 7010361080

In this Privacy Policy, we use the terms “Controller”, “we”, “us” or “Ecologic”.

For matters concerning the protection of personal data, you may contact us at: contact@ecologic.io.

What data we process

Depending on how you use the website, we may process the following categories of data:

identification data, e.g. first name and surname;
contact details, e.g. email address, telephone number;
data concerning the organization you represent, e.g. company name, position, industry, fleet size;
data provided in the contact form, demo request form, recruitment form or in a message sent to us;
data related to communication, e.g. content of correspondence, contact history, information about the inquiry;
technical data, e.g. IP address, cookie identifiers, data about the device, browser, operating system, approximate location, date and time of visit, visited subpages;
data concerning marketing and cookie consents, e.g. date of consent, scope of consent, date of withdrawal;
analytical data concerning the use of the website;
data of job candidates, if you apply for a position through a form, email or another indicated contact path.

We do not require you to provide special categories of personal data, such as health data, political opinions, religious beliefs or trade union membership. Please do not provide such data via forms or correspondence unless it is necessary in a specific matter.

Purposes, legal bases and data retention periods

We process personal data only when we have a legal basis to do so. Below, we describe the main purposes of data processing.

3.1. Handling the contact form and correspondence

Purpose of processing:
handling inquiries sent via the contact form, email, telephone or other communication channels, providing replies and conducting further correspondence.

Scope of data:
first name and surname, email address, telephone number, company name, position, message content, other data provided voluntarily.

Legal basis:
Article 6(1)(f) GDPR — the Controller’s legitimate interest consisting in conducting communication and responding to inquiries;
Article 6(1)(b) GDPR — if the contact is aimed at concluding a contract or concerns the performance of a contract.

Retention period:
for the time necessary to handle the inquiry and conduct correspondence, and then for the period necessary to secure any potential claims, no longer than until the expiry of their limitation period.

3.2. Presenting the offer, handling sales inquiries and product demos

Purpose of processing:
presenting the Ecologic offer, arranging a system presentation, handling the sales process, analyzing the needs of a potential customer.

Scope of data:
first name and surname, email, telephone number, company name, position, information about the fleet or business needs, contact history.

Legal basis:
Article 6(1)(f) GDPR — the Controller’s legitimate interest consisting in conducting sales activities and handling B2B inquiries;
Article 6(1)(b) GDPR — if the processing is necessary to take steps prior to entering into a contract.

Retention period:
for the duration of sales discussions, and then for the period necessary to secure any potential claims or until an effective objection is raised against the processing of data for direct marketing purposes.

3.3. Newsletter and marketing communication

Purpose of processing:
sending the newsletter, marketing information, information about Ecologic’s products, services, events, educational materials or updates.

Scope of data:
email address, first name, company name, position — if provided, information about the consent given, subscription date, mailing history and activity in messages, e.g. opening a message or clicking a link, if we use such mechanisms.

Legal basis:
Article 6(1)(a) GDPR — consent of the data subject;
Article 6(1)(f) GDPR — the Controller’s legitimate interest consisting in demonstrating that consent was given and in pursuing or defending against claims.

The newsletter is sent only after the user has actively subscribed, i.e. in the opt-in model. We do not subscribe users to the newsletter by default.

Retention period:
until consent is withdrawn or the user unsubscribes from the newsletter, and then for the period necessary to demonstrate the correctness of obtaining consent and to defend against any potential claims.

How to withdraw consent:
consent may be withdrawn at any time by clicking the unsubscribe link available in each newsletter message or by contacting us at contact@ecologic.io.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

3.4. Maintaining an account or access to the Ecologic portal

If the user uses the Ecologic portal or system, data may be processed for the purpose of creating an account, authenticating the user, managing access to the system, ensuring security and providing services.

Scope of data:
user identification data, login data, email address, user identifier, data concerning activity in the system, technical logs, data necessary to provide the service.

Legal basis:
Article 6(1)(b) GDPR — performance of a contract or taking steps prior to entering into a contract;
Article 6(1)(f) GDPR — the Controller’s legitimate interest consisting in ensuring system security, access control and accountability of activities.

Retention period:
for the period of using the account or the duration of the contract, and then for the period required by law or necessary to pursue, establish or defend claims. We store technical logs for a period of 36 months, unless longer storage is necessary for security reasons or in connection with claims.

3.5. Recruitment

If you apply for a job at Ecologic, we process data for the purpose of conducting the recruitment process.

Scope of data:
data contained in the CV, cover letter, recruitment form, correspondence and other data voluntarily provided by the candidate.

Legal basis:
Article 6(1)(c) GDPR — compliance with obligations arising from labor law provisions with respect to data required by law;
Article 6(1)(a) GDPR — consent with respect to data provided voluntarily beyond the scope required by law;
Article 6(1)(f) GDPR — the Controller’s legitimate interest consisting in conducting recruitment and defending against potential claims;
Article 6(1)(a) GDPR — consent to participate in future recruitment processes, if such consent has been given.

Retention period:
for the duration of the recruitment process, and then for the period necessary to secure any potential claims.

3.6. Ensuring website security and maintaining logs

Purpose of processing:
ensuring website security, detecting abuse, diagnosing errors, protecting against cyberattacks, administering the website.

Scope of data:
IP address, date and time of connection, information about the browser and operating system, URL address, error information, server logs.

Legal basis:
Article 6(1)(f) GDPR — the Controller’s legitimate interest consisting in ensuring the security, continuity of operation and protection of the website.

Retention period:
we store server logs for a period of 12 months, unless longer storage is necessary for security reasons, incident detection or pursuing claims.

3.7. Web analytics

Purpose of processing:
analyzing the use of the website, creating statistics, measuring the effectiveness of marketing activities, improving website functionality.

Scope of data:
cookie identifiers, IP address or its shortened/anonymized form, data about the device, browser, visited subpages, source of entry to the website, visit duration and interactions on the website.

Legal basis:
Article 6(1)(a) GDPR — user consent expressed via the cookie banner, if the analytical tools are not necessary for the operation of the website.

Retention period:
in accordance with the settings of the given analytical tool and the validity period of the relevant cookies, no longer than 12 months, unless you withdraw your consent earlier.

3.8. Online marketing and remarketing

Purpose of processing:
conducting marketing, remarketing and measurement activities, including displaying ads to persons who have visited our website and measuring campaign effectiveness.

Scope of data:
cookie identifiers and identifiers of similar technologies, data about website visits, clicks, traffic sources and interactions with advertisements.

Legal basis:
Article 6(1)(a) GDPR — user consent expressed via the cookie banner.

Retention period:
in accordance with the settings of the given marketing tool and the validity period of the relevant cookies, no longer than 12 months, unless you withdraw your consent earlier.

3.9. Establishing, pursuing or defending claims

Purpose of processing:
securing the legal interests of the Controller, handling complaints, pursuing claims, defending against claims.

Scope of data:
data necessary to demonstrate specific facts, including contact details, correspondence history, information about services, contracts, submissions, consents and activities.

Legal basis:
Article 6(1)(f) GDPR — the Controller’s legitimate interest consisting in pursuing, establishing or defending claims.

Retention period:
for the limitation period of claims resulting from applicable laws.

Voluntary provision of data

Providing data is voluntary, but in some cases necessary to achieve a specific purpose.

For example:

without providing contact details, we will not be able to respond to an inquiry;
without providing an email address, we will not be able to send the newsletter;
without providing data required in the recruitment process, we will not be able to consider the application;
lack of consent to analytical or marketing cookies does not prevent the use of the website, but may limit our ability to conduct analytics or adjust marketing communication.

Data recipients

We may transfer personal data to the following categories of recipients:

providers of hosting and IT infrastructure services;
providers of email, communication and office tools;
providers of CRM systems, sales tools and customer service tools;
providers of newsletter tools;
providers of online chat tools;
providers of analytical and marketing tools, including cookie tools;
providers of IT security services, technical monitoring and website administration;
entities providing legal, accounting, tax, audit or consulting services;
authorized employees and associates of the Controller;
entities authorized to obtain data under applicable laws.

Currently, we may use in particular the following tools or providers:

Google Analytics — web analytics;
Meta Pixel / Facebook Pixel — marketing and remarketing activities;
MailerLite Limited — newsletter tool.

Transfer of data outside the European Economic Area

Some providers of tools we use may process personal data outside the European Economic Area, in particular in the United States, or may allow access to data from third countries.

This may apply in particular to providers of analytical, marketing, communication, CRM, cloud or newsletter tools.

If we transfer data outside the European Economic Area, this is done only using appropriate legal mechanisms provided for by the GDPR, such as:

an adequacy decision of the European Commission;
standard contractual clauses approved by the European Commission;
additional safeguards, if required;
other mechanisms provided for by law.

Detailed information about the safeguards used may be obtained by contacting us at: contact@ecologic.io.

Automated decision-making and profiling

We do not make decisions concerning users based solely on automated data processing that would produce legal effects concerning them or similarly significantly affect them.

However, we may use analytical and marketing tools that help us analyze how the website is used, measure campaign effectiveness or direct marketing communication to specific groups of recipients. Such activities are carried out only to the extent permitted by law and, where required, on the basis of the user’s consent expressed via the cookie banner.

Your rights

In connection with the processing of personal data, you have the following rights:

the right of access to data;
the right to receive a copy of the data;
the right to rectify data;
the right to erase data;
the right to restrict processing;
the right to data portability;
the right to object to data processing;
the right to withdraw consent at any time, if data is processed on the basis of consent;
the right to lodge a complaint with a supervisory authority.

Requests concerning the exercise of rights may be sent to: contact@ecologic.io.

If processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office.

The current contact details of the supervisory authority are available on the UODO website. As of the date of update of this Policy, the address of UODO is:

Personal Data Protection Office
ul. Stanisława Moniuszki 1A
00-014 Warsaw, Poland

Right to object

If we process your data on the basis of our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation.

If we process data for direct marketing purposes, you may object at any time. After such an objection is submitted, we will no longer process your data for this purpose.

The objection may be sent to: contact@ecologic.io.

Cookies and similar technologies

The website uses cookies and similar technologies, such as marketing pixels, online identifiers and local browser storage mechanisms.

Cookies are small files saved on the user’s device when using a website. They may be read by our website or by third parties whose tools are used on the website.

Cookies may be:

session cookies — deleted after closing the browser;
persistent cookies — stored for a specified period or until deleted by the user;
first-party cookies — set by our website;
third-party cookies — set by providers of external tools.

Categories of cookies

On the website, we may use the following categories of cookies:

11.1. Necessary cookies

They are necessary for the proper functioning of the website, ensuring security, remembering privacy preferences or enabling the use of basic website functions.

These cookies do not require user consent.

Example purposes:
remembering cookie consent settings, ensuring security, session handling, proper display of the website.

Retention period:
in accordance with the parameters of the given cookie, up to a maximum of 12 months.

11.2. Analytical cookies

They help us understand how users use the website, which subpages are visited, where the traffic comes from and how we can improve the website.

We use analytical cookies only after obtaining your consent, unless the given tool operates in a way that does not require consent under applicable laws.

11.3. Marketing cookies

They are used to conduct marketing activities, remarketing, measure the effectiveness of advertisements and tailor marketing communication.

We use marketing cookies only after obtaining your consent.

Retention period:
in accordance with the settings of the given tool, up to a maximum of 12 months.

11.4. Functional cookies

They enable the use of additional website functions, such as remembering user preferences, operating an online chat or integrating with external services.

We use functional cookies when they are necessary for the service you request or on the basis of your consent if they are not necessary.

Managing cookie consents

During your first visit to the website, we display a cookie banner that allows you to:

accept all cookies;
reject all cookies except necessary cookies;
customize cookie settings by category.

You may change your cookie settings or withdraw your consent at any time using the consent management panel available on the website.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

You may also manage cookies from your web browser. Restricting or blocking cookies may affect some website functions.

Instructions for managing cookies in the most popular browsers are available on the websites of their providers:

Google Chrome;
Mozilla Firefox;
Microsoft Edge;
Safari;
Opera.

Cookie list

Below is a list of cookies that may be used on the website.

Links to external websites

The website may contain links to external websites, including websites of partners, customers, service providers, social media platforms or recruitment services.

We are not responsible for the privacy rules applied by external websites. After visiting another website, we recommend reading its privacy policy.

Social media

If you visit our social media profiles or contact us through them, your data may be processed both by us and by the operator of the given social media platform.

We may process data for the purpose of:

maintaining a social media profile;
communicating with users;
replying to messages and comments;
promoting our services;
analyzing activity on the profile.

Legal basis:
Article 6(1)(f) GDPR — the Controller’s legitimate interest consisting in conducting communication and promotional activities in social media;
Article 6(1)(a) GDPR — consent, if required for specific activities.

Social media platform operators may process data according to their own rules described in their privacy policies.

Data security

We apply technical and organizational measures aimed at ensuring the protection of personal data appropriate to the risks related to their processing.

In particular, we use measures such as:

encryption of data transmission using an SSL/TLS certificate;
access control to systems;
granting access only to authorized persons;
use of passwords and authentication mechanisms;
creating backups;
updating software;
monitoring system security;
applying procedures for handling incidents and personal data breaches.

The scope of the measures used may vary depending on the type of data and the processing process.

Changes to the Privacy Policy

We may update this Privacy Policy, in particular in the event of:

changes in legal regulations;
changes in the scope or method of data processing;
changes in providers of tools used on the website;
changes in website functionality;
changes in the Controller’s data.