Privacy Policy

The controller of your personal data is VantaStack (the “Controller”, “we”, “us”).

For any matter relating to personal data, contact us at sales@vantastack.com. The Controller has not appointed a data protection officer, as it is not required to do so.

The data we process depends on how you use the website:

• Contact form: full name, company name (optional), email address, project topic and estimated budget, and the content of your message.
• Email correspondence: the data contained in messages you send us, including your email address and signature.
• Technical data: IP address, browser type and version, operating system, request time and the page requested, recorded automatically in server logs.
• Spam protection: technical browser and device signals analysed by Cloudflare Turnstile to tell humans from automated traffic.
• Visit statistics: aggregated, anonymous information about page views, referrer, country, device type and browser. These statistics use no cookies and do not allow us to identify you.

Please do not include special categories of data (e.g. health data) or data unrelated to your enquiry. If you share data about other people (e.g. colleagues), you are responsible for having a legal basis to do so.

This website is intended for businesses. We do not knowingly collect data from persons under 16.

We process data only for specific purposes and on the following legal bases:

• Responding to your enquiry and pre-contractual discussions where you act on your own behalf: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).
• Responding to your enquiry and business communication where you act on behalf of a company or other organisation: Art. 6(1)(f) GDPR (our legitimate interest in communicating with business partners and prospective clients).
• Keeping the website secure and protecting it from spam and abuse (server logs, Cloudflare Turnstile): Art. 6(1)(f) GDPR (our legitimate interest in the security and integrity of our services).
• Anonymous visit statistics used to improve the website: Art. 6(1)(f) GDPR (our legitimate interest in understanding how the website performs).
• Establishing, exercising or defending legal claims: Art. 6(1)(f) GDPR.
• Complying with legal obligations, e.g. tax and accounting, if a contract is concluded: Art. 6(1)(c) GDPR.

We do not sell personal data, share it with third parties for their marketing, or use it for profiling.

This policy does not cover data we process while providing services to clients (e.g. data in systems we build or audit). Such processing is governed by separate agreements, including data processing agreements.

We use trusted providers that process data on our behalf (processors), strictly under contract and on our instructions:

• Vercel Inc.: website hosting, server logs and anonymous visit statistics (Vercel Web Analytics).
• Resend: delivering messages sent through the contact form to our mailbox.
• Cloudflare, Inc.: spam protection for the contact form (Cloudflare Turnstile).
• Our email service provider, used for correspondence.

Data may also be disclosed to our advisers (e.g. legal or accounting) who are bound by confidentiality, and to public authorities where required by law.

Some of our providers are based in the United States or use infrastructure outside the European Economic Area. In such cases data is transferred only with appropriate safeguards under Chapter V GDPR, in particular:

• the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for certified recipients, or
• standard contractual clauses approved by the European Commission.

You can request a copy of the applicable safeguards by contacting us at sales@vantastack.com.

• Enquiries and correspondence: for as long as needed to respond and hold discussions and, if no contract is concluded, no longer than the limitation period for potential claims (generally 3 years from the last contact, Art. 118 of the Polish Civil Code).
• If a contract is concluded: for its duration and then for the period required by law (in particular tax law, generally 5 years from the end of the calendar year) or until claims become time-barred.
• Server logs: for a short period set by our hosting provider, and longer only where needed to investigate a security incident.
• Turnstile verification: we do not store verification results; Cloudflare processes data in line with its privacy policy.
• Visit statistics: only in aggregated form that does not identify individuals.
• Language cookie: 12 months or until you delete it in your browser.

After these periods, data is deleted or anonymised. Retention may be extended where necessary to establish, exercise or defend legal claims, or where required by law.

We do not use advertising, marketing or analytics cookies, and we do not track you across websites. Only information strictly necessary for the website to work may be stored on your device:

• NEXT_LOCALE: a cookie set only when you switch the website language yourself, to remember your choice. It is strictly necessary to provide a feature you explicitly request and is not used for tracking.
• Cloudflare Turnstile may read or store technical information on your device that is strictly necessary to perform the spam check on the contact form. This is necessary to keep the service secure.

Vercel Web Analytics uses no cookies or other identifiers stored on your device. Visits are recognised only through a hash of request data that changes every day.

Under the Polish Electronic Communications Law, storing or accessing information that is strictly necessary to provide a service explicitly requested by the user does not require consent. For this reason, the website does not display a cookie consent banner. If we ever start using tools that require consent, we will ask for it before enabling them.

You can delete or block cookies in your browser settings at any time. The website will keep working but will not remember your chosen language.

You have the right to:

• access your data and receive a copy (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• portability of data processed under a contract (Art. 20 GDPR),
• object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR).

To exercise these rights, email sales@vantastack.com. We will respond without undue delay and within one month at the latest. Where justified, this period may be extended by two further months, and we will let you know. We may ask for additional information to confirm your identity.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

Providing data in the contact form is voluntary but necessary for us to respond to your enquiry. Fields marked as required must be completed to send the message.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Cloudflare Turnstile automatically assesses whether the form is being submitted by a human. This is purely a technical safeguard; if verification fails, you can contact us directly at sales@vantastack.com.

We use appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction, including encrypted connections (HTTPS/TLS), limiting access to those who need it, and working with providers that maintain high security standards.

No method of transmission over the Internet is completely secure, so we cannot guarantee the absolute security of information sent to us electronically.

This website may link to services operated by others. We are not responsible for their privacy practices and encourage you to read their privacy policies.

We may update this policy, in particular following changes in law, technology or how the website works. The current version, with its last-updated date, is always available on this page. We will flag material changes visibly on the website.