1. Data Controller
The controller of your personal data is BTA SYSTEMS SP. Z O.O., Tax ID (NIP) 5862402265, with its registered office at Ul. Korzenna 3B/16, 81-587 Gdynia, Poland.
For any data protection inquiries, please contact us at [email protected].
2. Data We Collect
We collect the following categories of personal data:
- Account data — email address, username, profile information provided during registration.
- Workspace and store data — organization names, connected store details, catalog content, and documents created within the Service.
- Payment data — billing information processed securely through Stripe. We do not store full credit card numbers.
- Technical data — IP address, browser type, operating system, and activity data collected automatically during use of the Service.
- Communication data — messages, feedback, and support inquiries sent to us.
3. Purposes of Processing
We process your personal data for the following purposes:
- Providing the Service — account management, authentication, and delivering platform features (legal basis: GDPR Art. 6(1)(b) — contract performance).
- Payment processing — managing subscriptions and billing through Stripe (legal basis: GDPR Art. 6(1)(b) — contract performance).
- Service communication — sending transactional emails, security alerts, and important updates (legal basis: GDPR Art. 6(1)(b) — contract performance).
- Analytics and improvement — analyzing usage patterns to improve the Service (legal basis: GDPR Art. 6(1)(f) — legitimate interest).
- Legal obligations — fulfilling regulatory and legal requirements (legal basis: GDPR Art. 6(1)(c)).
4. Cookies
The Service uses cookies for the following purposes:
- Essential cookies — necessary for the Service to function correctly (session management, authentication, CSRF protection).
- Analytical cookies — used to collect usage data and improve the Service. These are only enabled with your explicit consent.
You can manage your cookie preferences via the cookie consent banner displayed on first visit, or through your browser settings.
5. Data Retention
- Account data — retained for the duration of your Account, plus 30 days after Account deletion.
- Payment records — retained as required by applicable tax and accounting regulations.
- Technical data — retained for up to 26 months for analytics and security purposes.
6. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access — obtain a copy of your personal data.
- Right to rectification — correct inaccurate or incomplete data.
- Right to erasure — request deletion of your personal data.
- Right to restrict processing — limit how we use your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interest.
- Right to withdraw consent — withdraw consent at any time where processing is based on consent.
To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with Poland's supervisory authority (UODO).
7. Data Sharing
Personal data may be shared with third-party service providers acting on behalf of the Controller, only as necessary to provide the Service. These include:
- Supabase — authentication and database services.
- Stripe — payment processing.
- AI service providers — for AI-powered features within the platform.
We do not sell your personal data to third parties.
8. International Data Transfers
Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or transfers to countries with an adequacy decision.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption in transit (SSL/TLS).
- Encryption at rest.
- Access controls and role-based permissions.
- Regular security reviews and monitoring.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-service notification. The current version is always available at https://panel.emerce.store/privacy.