How we protect your personal data

Last updated: 22 October 2026

1. Data controller

This policy explains how personal data collected through the norvelto.com website and our contact channels is processed. The data controller is Norvelto, aleja Grunwaldzka 494/4a, 80-309 Gdańsk. You can reach us at marketing@norvelto.com.

Your personal data is processed in accordance with the EU General Data Protection Regulation (GDPR; RODO in Poland) and Polish data protection law.

2. Which data we collect

We process only the data we need when you contact us or use our services:

• Contact form: full name, email address, phone number (optional), the service you are interested in and your message.
• Email, phone and WhatsApp correspondence: the information you share with us and the content of that correspondence.
• Client files: identity, address, company and document details required by the service.
• Technical data: when you view the site, our hosting provider keeps server logs with data such as IP address, browser type and time of access for a short period.
• Abuse protection: form submissions are verified with Cloudflare Turnstile (browser data is processed by Cloudflare during the check) and your IP address is used only for rate limiting.

Cookies: our website uses Google Analytics (Google Ireland Ltd.) cookies only if you accept the cookie notice. They produce aggregate statistics such as the number of visits, the pages viewed and the device used; your IP address is truncated by Google and never linked to your identity. If you decline or make no choice, no analytics cookie is set. You can change your choice at any time through the "Cookie settings" link at the bottom of the page; Analytics data is kept for at most 14 months.

3. Purposes and legal bases

• Responding to your request and preparing a proposal: steps prior to entering into a contract (Art. 6(1)(b) GDPR).
• Keeping up correspondence, documenting your requests and defending our rights in the event of a dispute: legitimate interest (Art. 6(1)(f) GDPR).
• If you become a client: performance of the contract and compliance with accounting and tax obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
• Website usage statistics (Google Analytics): your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Your data is not used for automated decision-making or profiling.

4. Who we share data with

Your data is never sold. It is passed on to third parties only in the following cases:

• Our service providers: web hosting, email and form infrastructure providers. They process data only on our instructions.
• Our partners: lawyers, sworn translators and auditors for court representation, sworn translations or audit work; only where your case requires it and with your knowledge.
• Public authorities: where your application requires it or where we are legally obliged.
• Google (Google Analytics): only if you accept the cookie notice. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework.

As a rule, your data is processed within the European Economic Area. If a transfer outside the EEA is necessary, it takes place with the safeguards provided for by the GDPR, such as standard contractual clauses.

5. Retention

• Contact form and correspondence: up to 2 years after your request has been dealt with and the correspondence has ended.
• Client files: for the duration of the contract and afterwards for the statutory retention periods (5 years for accounting records) and the limitation period of possible claims.
• Server logs: for security purposes, for the short standard retention period of the hosting provider.

6. Your rights

Under the GDPR you have the right to:

• Access your data and obtain a copy
• Have inaccurate or incomplete data corrected
• Have your data erased or its processing restricted
• Data portability
• Object to processing based on legitimate interest
• Withdraw consent at any time, where processing is based on consent

To exercise your rights, simply write to marketing@norvelto.com; we reply within one month at the latest.

If you believe your data is processed unlawfully, you may lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

7. Is providing data mandatory?

Sharing your data is voluntary; however, without your name, email and message we cannot respond to your request. If the data required for a service contract is not provided, we cannot deliver the service.

8. Changes

We update this policy when needed; the current version is always published on this page and the date of the last update is shown at the top.