Privacy Policy

1. Data Controller

The data controller is IVM FIRMA HANDLOWA SP. Z O.O., al. Tadeusza Kościuszki 101, 90-441 Łódź, Poland, NIP (Tax ID): 7272865829, KRS: 0001012820. Contact: kontakt@intrafakt.pl, tel. +48 888 976 159.

2. Data We Collect

As part of the intrafakt.pl service, we collect the following categories of data:

• Account registration data: email address, password (stored encrypted), company name, NIP (Tax ID), REGON, registered address.
• Contact form data: company name, NIP, email address, full name, message content.
• Invoice and trade document data: invoice contents, contractor details, CN codes, transaction values — imported from connected systems (BaseLinker, Comarch Optima, Subiekt GT, enova365) or uploaded manually (CSV/Excel).
• External system credentials: API tokens, logins and passwords for integrations (e.g. BaseLinker, PUESC) — stored encrypted (AES-256).
• Intrastat declaration data: generated declarations, reference numbers, PUESC submission statuses.
• Payment data: Autopay transaction identifier, payment history. We do not store payment card details.
• Technical data: IP address, browser type, timestamps, panel activity logs.

3. Purpose and Legal Basis

• Art. 6(1)(b) GDPR — contract performance: providing the intrafakt.pl service, including generating and filing Intrastat declarations, managing user accounts, handling subscriptions and payments.
• Art. 6(1)(c) GDPR — legal obligation: maintaining accounting and tax documentation as required by Polish law.
• Art. 6(1)(f) GDPR — legitimate interest of the controller: analytics, service security, support requests, direct marketing of own services.
• Art. 6(1)(a) GDPR — consent: analytics and marketing cookies (Google Analytics 4, Google Ads conversion measurement), used only after consent is given in the cookie banner; consent can be withdrawn at any time.

4. Data Recipients

Data may be shared with the following processors acting on behalf of the controller:

• Vercel Inc. (application hosting) — USA, Standard Contractual Clauses
• Supabase Inc. (database, authentication) — USA, Standard Contractual Clauses
• Resend Inc. (email delivery) — USA, Standard Contractual Clauses
• Autopay S.A., ul. Powstańców Warszawy 6, 81-718 Sopot, Poland (payment processing) — Poland/EU
• Polish Customs Electronic Services Platform (PUESC) — Poland, to the extent necessary for filing Intrastat declarations on behalf of the user under a granted Power of Attorney
• Google Ireland Ltd. (Google Analytics 4, Google Ads — conversion measurement) — EU/USA, Data Privacy Framework / Standard Contractual Clauses; only with the user's consent given in the cookie banner

5. Data Retention

• Account data: for the duration of the agreement and 30 days after account deletion.
• Invoice and declaration data: 5 years from the end of the calendar year in which the declaration was filed (Polish Tax Ordinance requirement).
• Integration credentials: until the integration is removed by the user.
• Contact form data: until a deletion request is received or 3 years from last contact.
• Server logs: 14 days.
• Autopay payment data: in accordance with Autopay’s retention policy and accounting requirements (5 years).

6. Data Subject Rights

You have the right to:

• access your data (Art. 15 GDPR),
• rectify your data (Art. 16 GDPR),
• erase your data (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing (Art. 21 GDPR).

To exercise these rights, please contact: kontakt@intrafakt.pl.

7. Right to Complain

You have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

8. Data Security

External system credentials (API tokens, integration passwords, PUESC access data) are encrypted at rest using AES-256. All communication with the application is conducted exclusively over encrypted HTTPS connections. Database access is restricted using Row Level Security.

9. Cookies

The website uses three categories of cookies. First, functional cookies necessary for the application to work (user session, language preferences, remembering the consent decision) — always used, no consent required. The same first-party category includes a single entry named "intrafakt_attr" in your browser's local storage (localStorage), kept for 90 days: it records only how you arrived at our site — campaign parameters from the URL (utm_*), the referring domain, and the page you entered on — contains no user identifier and cannot be read by any other website. This data is sent to our server only when you choose to submit the contact or registration form, and we use it to learn which of our content is useful; you can delete the entry at any time by clearing site data in your browser. Second, Vercel Analytics — performance measurement without cookies and without user tracking. Third, analytics and marketing cookies, which we may use only with the user's consent given in the cookie banner: Google Analytics 4 (the _ga and _ga_* cookies, stored for about 13 months) and Google Ads conversion measurement (the _gcl_* cookies). Without consent these cookies are not set and the Google tools are not loaded at all. Consent can be withdrawn at any time by clearing the stored choice (site data / localStorage in the browser settings) — the consent banner then appears again and the cookies are not used until consent is given anew.

10. Whether providing data is required, and contact

Providing data is voluntary but necessary to conclude and perform the contract: without the company details (name, tax number, address) and an email address an account cannot be created and no Intrastat declaration can be filed on the Organisation’s behalf. Providing the data required by tax and customs law is a statutory obligation. The controller has not appointed a data protection officer; for any matter concerning personal data write to kontakt@intrafakt.pl. The data is not used for automated decision-making producing legal effects. Only with the user's consent do we use advertising effectiveness measurement (Google Analytics 4, Google Ads), which may involve simple profiling for measurement purposes — it produces no legal effects and does not similarly significantly affect the user.

11. Changes to this policy

The controller reserves the right to update this privacy policy. Registered users will be notified of significant changes by email. Changes take effect upon publication on the website.