Privacy notice

Updated 2 October 2026

Who is responsible

The data controller is Denys Lytvynenko, a sole trader registered in Poland, trading as Qualivect. Business address: ul. Michała Kleofasa Ogińskiego 11/9, 03-318 Warszawa, Poland. NIP: 5243006399; REGON: 528606981. The business owner is also the contact responsible for privacy requests. Contact us about personal data at contact@qualivect.com. See our legal notice for registry information.

Business enquiries

When you email us or submit the website form, we process your contact details and the information you choose to share to understand your enquiry and respond. The form asks for your name, email, optional company, service interest and message. Do not send passwords, sensitive personal information or confidential client material.

Where you contact us about entering into a contract yourself, the relevant basis is taking steps at your request before entering a contract (GDPR Article 6(1)(b)). For other business correspondence, including messages from company representatives, we rely on our legitimate interest in responding to enquiries and managing business communications (Article 6(1)(f)). Information needed for a legal obligation is processed under Article 6(1)(c), where applicable.

Providing enquiry information is voluntary, but we need a reply address and enough context to respond. We do not subscribe enquirers to newsletters, use their enquiry details for remarketing, or make decisions with legal or similarly significant effects solely through automated processing.

Where enquiries are stored and for how long

Email correspondence is handled through Google Workspace. Non-client correspondence is retained for up to 12 months after the last contact, then deleted as part of our mailbox review process. Client contracts, accounting records and any records needed for legal claims are handled separately under the applicable requirements and purposes.

Website enquiries are first saved in Cloudflare D1 so they remain available if email delivery fails. An on-screen confirmation means the enquiry has been saved; it does not certify email delivery. The active technical copy is scheduled for deletion 30 days after our system confirms that the notification is present in the contact mailbox’s inbox. If delivery is not confirmed, it is retained for no more than 90 days from submission. Delivery issues are retried and flagged for operator review.

Cloudflare D1 recovery history may retain deleted records for a further 7 days on the Free plan or 30 days on the Paid plan. Google Workspace may retain restricted recovery copies under its applicable recovery and deletion periods. We do not use recovery copies for ordinary business activity. If data is restored, the relevant deletion requirements must be reapplied.

Hosting and security

Cloudflare hosts the site and processes technical request information, such as network address, browser information and request timing, to deliver and protect it. Our basis for necessary security processing is our legitimate interest in operating a reliable, secure website (Article 6(1)(f)). The form uses Cloudflare Turnstile to check for automated abuse. The enquiry record itself does not store your IP address.

Optional analytics

We load the following optional analytics only after you give consent (Article 6(1)(a)):

• Google Analytics 4: page visits, service interest and enquiry-related events. We do not intentionally send names, email addresses or message contents in analytics events. Advertising personalisation and Google signals are disabled in our site configuration.
• Cloudflare Web Analytics: page visits and browser performance measurements. It uses a browser script; we apply an opt-in choice even though this analytics product does not use analytics cookies.

Each service can be enabled or rejected separately in cookie preferences. Withdrawing consent prevents subsequent loading, but does not retrospectively undo processing already performed. Your choice is stored locally for up to 180 days. We do not use remarketing pixels.

Google Analytics user-level and event-level data are retained for 2 months, without resetting that period when you return. This setting does not limit the retention of standard aggregated reports. Analytics cookies set by our configuration have a maximum lifetime of 180 days without automatic extension.

Who has access

Enquiries are handled by the business owner. We do not provide enquiry access to partners or a sales team. Cloudflare and Google process data to provide their respective hosting, security, email and, where enabled, analytics services. Professional advisers or public authorities may receive information where necessary for a legal obligation or the establishment, exercise or defence of legal claims. We do not sell enquiry data.

International processing

Google and Cloudflare operate internationally, so processing may take place outside your country or the European Economic Area. Their applicable data processing terms describe transfer arrangements, including standard contractual clauses where relevant. A database location setting alone does not mean all website and email processing takes place in the EU. Contact us for information about the arrangements applicable to your data.

Provider information: Cloudflare privacy policy, Cloudflare data processing addendum, Google privacy policy and Google Cloud Data Processing Addendum, and Google Analytics Data Processing Terms.

Your rights

Subject to the conditions in applicable law, you may request access, correction, erasure, restriction or portability of your data. You may object to processing based on legitimate interests and withdraw consent at any time without affecting the lawfulness of earlier processing. We may request proportionate information to verify your identity before acting on a request.

Contact contact@qualivect.com. You may also complain to a competent data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO). Rights and complaint routes available under other applicable local laws remain unaffected.

Visitors outside the European Economic Area

You can use the same privacy contact to ask about your information wherever you are located. Where local law applies, we will handle applicable access, correction, deletion, consent and complaint rights under that law. We do not sell personal information or share it for cross-context behavioural advertising, and do not penalise you for exercising privacy rights. You may ask us to review a decision about your request.

Changes to this notice

We update this notice when our services or data practices change. The date above identifies the current version.