This Privacy Policy explains how Qualecta ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our website at qualecta.com and our platform at app.qualecta.com. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and applicable Polish data protection law.

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

We collect the following categories of personal data:

2.1 Data you provide directly

• Account data: name, email address, company name, job title when you register or contact us.
• Communication data: messages you send us via email or contact forms.
• Meeting booking data: name, email, and any information submitted through our Calendly scheduling form.

2.2 Data collected automatically

• Usage data: pages visited, features used, session duration, clicks.
• Technical data: IP address, browser type and version, operating system, device type.
• Cookies and similar technologies: as described in Section 7.

2.3 Data you upload to the platform

When using the Qualecta platform, you may upload business data (e.g. sales files, database connections). This data is processed on your behalf and we act as a data processor for such content. You remain the data controller for any personal data within your uploaded files.

3. Legal Basis for Processing

• Performance of a contract (Art. 6(1)(b) GDPR): to provide, maintain, and improve our services.
• Legitimate interests (Art. 6(1)(f) GDPR): to analyse usage, improve security, and communicate service updates.
• Consent (Art. 6(1)(a) GDPR): for non-essential cookies and marketing communications where required.
• Legal obligation (Art. 6(1)(c) GDPR): where required by applicable law.

4. How We Use Your Data

• Providing and operating the Qualecta platform and services.
• Creating and managing your account.
• Responding to your enquiries and support requests.
• Sending transactional communications (e.g. account notifications).
• Improving and developing our product based on usage analysis.
• Ensuring the security and integrity of our systems.
• Complying with legal obligations.

5. Data Sharing and Third Parties

We do not sell your personal data. We may share data with trusted third-party service providers who help us operate our services, including:

• Cloud infrastructure providers (EU-hosted) for data storage and processing.
• Calendly for meeting scheduling (subject to Calendly's own privacy policy).
• Analytics tools for understanding how our website is used.

All third-party processors are bound by data processing agreements and are required to handle your data in accordance with GDPR.

We may also disclose data where required by law, court order, or regulatory authority.

6. Data Retention

• Account data: retained for the duration of your account plus 2 years after closure.
• Usage and technical data: retained for up to 12 months.
• Communication data: retained for up to 3 years.
• Uploaded business data: deleted within 30 days of account closure or upon request.

Data may be retained longer where required by legal obligation.

7. Cookies

We use the following types of cookies:

• Essential cookies: necessary for the website and platform to function (e.g. session management, language preference). These cannot be disabled.
• Analytics cookies: help us understand how visitors use our site. Only used with your consent.

You can manage your cookie preferences at any time via the cookie banner or your browser settings.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (TLS) and at rest.
• Anonymisation of personally identifiable information (PII) where possible.
• Access controls and authentication requirements.
• Regular security audits and penetration testing.
• EU Cloud and AI compliance.

9. International Transfers

Your data is stored and processed within the European Union. If any transfer outside the EEA is required, we ensure adequate safeguards are in place (e.g. Standard Contractual Clauses).

10. Your Rights

Under GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data we hold.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your data.
• Right to restriction of processing: limit how we use your data in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at sales@qualecta.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Polish data protection authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

11. Children's Privacy

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and notify users of material changes via email or in-app notification. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions or requests, please contact us at:
sales@qualecta.com