Privacy policy

1. Controller

PHU Artcom ŁUKASZ ZIEMIAŃSKI, proprietor inż. Łukasz Ziemiański, ul. Kolejowa 9A, 59-921 Sieniawka, Polska. Contact: artcom04@o2.pl, +48 508 578 424.

For buyer, recipient and contact data entered or imported by a merchant, the merchant is normally the controller. PHU Artcom processes such data as processor under the DPA.

2. Hosting and server logs

The application is hosted on infrastructure operated by Hetzner Online GmbH. Security and error logs may contain IP address, date and time, requested address, HTTP status, transferred volume, referrer and browser identifier.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure, stable and abuse-resistant operation. Logs are kept only as long as needed for operation and incident investigation, normally no longer than 30 days unless an incident or legal duty requires more.

3. Account, sign-in and security

For registration and sign-in we process username, business email, password hash, verification status, sign-in times, IP address and security records. The bases are Art. 6(1)(b) GDPR for pre-contractual and contractual steps and Art. 6(1)(f) GDPR for preventing abuse.

Google sign-in is optional and starts only after your click. Google then processes authentication and account data under its own privacy terms. VersandFaktur receives in particular a verified email address, Google account ID and, where available, display name.

4. Company and VAT data

For B2B verification we process company name, address, contact and register data and EU VAT ID. VAT IDs are checked through VIES and, for Polish entities where applicable, official Polish tax registers. The bases are Art. 6(1)(b), (c) and (f) GDPR.

To prevent repeated free trials, the normalised VAT ID is permanently linked to the first verified company account. Our legitimate interest is preventing misuse of the trial.

5. eBay, DHL and shipment data

After a user deliberately connects an account, VersandFaktur processes eBay authorisation tokens, seller ID, order, buyer, item and transaction data. For DHL we process the merchant’s business credentials, sender data, recipient addresses, labels, shipment numbers and tracking events.

Transfers to eBay and DHL follow the merchant’s instruction for contract performance under Art. 6(1)(b) GDPR or as processing under Art. 28 GDPR.

6. Invoices and email delivery

VersandFaktur processes invoice, buyer, payment and delivery data and creates PDF/ZUGFeRD documents. Invoices may be sent as attachments or through a time-limited random download link. We use Mailgun Technologies, Inc. or Sinch Email in the EU region for transactional email.

Sender and recipient addresses, subject, message content, attachments or the secure download link and delivery, opening, error and abuse-prevention data may be processed. Processing is required for contract performance and, for buyer data, follows the merchant’s documented instruction.

Only hashes of download tokens are stored. Links can be revoked and expire. Delivery and download events are logged for evidence and abuse prevention.

7. PayPal payments

When buying a fixed access period, you are redirected to PayPal at your request. We process PayPal order, payment, capture and status identifiers together with amount, currency and plan. PayPal processes payment data as an independent controller. Our basis is Art. 6(1)(b) GDPR and, for legally required records, Art. 6(1)(c) GDPR.

8. QZ Tray and local printing

QZ Tray runs locally on the merchant’s computer. VersandFaktur signs print requests; printer selection and printing take place locally. Private signing key material remains on the VersandFaktur server.

9. Cookies

We use only technically necessary cookies for the secure session, the expressly chosen language and acknowledgement of the cookie notice. We do not use analytics, advertising or profiling cookies. Details are provided in the cookie policy.

10. Recipients and processors

Recipients may include Hetzner Online GmbH (hosting), Mailgun/Sinch Email (transactional email in the EU region), jsDelivr and cdnjs/Cloudflare (technical libraries in the signed-in interface) and, on the user’s instruction, eBay, DHL, Google, PayPal, VIES and Polish official registers.

Providers acting as processors are engaged under Art. 28 GDPR. Authorities receive data only where required by law.

11. International transfers

Google, eBay and PayPal and members or sub-processors of the Sinch/Mailgun group may process data outside the EEA. Selecting Mailgun’s EU region therefore does not mean that all group and support access is exclusively European. International transfers take place only under applicable safeguards, particularly an adequacy decision or standard contractual clauses.

12. Retention

Account data is retained for the contract term. Contract, acceptance, invoice and payment evidence is retained for applicable tax and commercial periods. Operational buyer and shipment data is deleted or anonymised on the merchant’s instruction, account deletion or expiry of necessary backup and evidence periods, unless a legal duty requires retention.

13. Data subject rights

Subject to the GDPR, individuals have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn for the future at any time. Requests may be sent to artcom04@o2.pl.

You may also complain to the President of the Polish Personal Data Protection Office (UODO) or another competent supervisory authority.

14. Security and updates

We apply technical and organisational measures including TLS, access controls, separated credentials, ownership checks, backups and security-oriented logging. This notice will be updated when processing, providers or the legal framework materially changes.