Privacy Policy

The controller of your personal data is [COMPANY DETAILS: name, address, tax ID]. Contact for data matters: hello@vintrhall.com.

• Account data — e-mail address, name, password (stored encrypted).
• Organization data — company name, details of team members invited to collaborate.
• Warehouse operational data — products, stock, locations, operation history. You enter it yourself or import it via integrations (BaseLinker, PrestaShop, wFirma).
• Technical data — IP address, server logs, session identifier. Collected automatically to keep the service secure and stable.

• Providing the service and managing your account — Art. 6(1)(b) GDPR (performance of a contract).
• Billing and tax obligations — Art. 6(1)(c) GDPR (legal obligation).
• Security, abuse prevention, technical logs — Art. 6(1)(f) GDPR (legitimate interest).
• Service-related communication (e.g. change notifications) — Art. 6(1)(b) and (f) GDPR.

If order data containing your customers’ personal data reaches Vintrhall through integrations (e.g. BaseLinker), you remain its controller and we process it solely on your behalf as a processor — to the extent necessary to operate the service. A data processing agreement is available on request: hello@vintrhall.com.

We use infrastructure providers. Data may be shared with:

• Hetzner Online GmbH (Germany, EU) — server and database hosting.
• Cloudflare, Inc. — DDoS protection and CDN; possible transfer outside the EEA under standard contractual clauses.
• An e-mail service provider — transactional messages (e.g. invitations, password reset).

• Account and organization data — for the duration of the contract and 30 days after account deletion.
• Backups — up to 30 days from creation.
• Billing data — for the period required by tax law (5 years).
• Technical logs — up to 90 days.

We only use cookies strictly necessary for the service to work: login session, selected language and interface theme. We do not use marketing or tracking cookies.

You have the right to:

• access your data and receive a copy of it,
• rectify your data,
• erase your data (the “right to be forgotten”),
• restrict processing,
• data portability (full export on request),
• object to processing based on legitimate interest,
• lodge a complaint with your supervisory authority (in Poland: PUODO).

We will notify you of material changes to this policy by e-mail to the address linked to your account, at least 14 days before they take effect.