This policy explains how Xentavi Spółka z ograniczoną odpowiedzialnością handles personal data across this website and related services. Our services are directed at businesses, not consumers.
Who we are
The data controller for this website and all related services is:
Xentavi Spółka z ograniczoną odpowiedzialnościąul. Domaniewska 47/406
02-672 Warszawa, Poland
KRS: 0001258350 · NIP: 5214175567
hm@xentavi.com · xentavi.com
What data we collect and why
We collect only what we need to operate and improve our services.
| Purpose | Data collected | Legal basis |
|---|---|---|
| Respond to enquiries / contact form | Name, email, company name, message content | Art. 6(1)(b) GDPR — steps prior to entering a contract |
| Deliver client services (retainers, projects) | Name, email, job title, billing details, campaign data you share with us | Art. 6(1)(b) GDPR — performance of a contract |
| Website analytics | Anonymized IP, pages visited, session duration, device/browser type | Art. 6(1)(f) GDPR — legitimate interest in understanding site usage |
| Marketing emails / newsletter | Email address | Art. 6(1)(a) GDPR — consent; Art. 10 UŚUDE (Polish Electronic Services Act) |
| Security and fraud prevention | Log data, IP address | Art. 6(1)(f) GDPR — legitimate interest |
| Legal and accounting obligations | Invoicing and contract data | Art. 6(1)(c) GDPR — legal obligation |
We do not collect special-category data (health, ethnicity, biometrics, etc.).
Cookies
We use:
- Strictly necessary cookies — required for the site to function. No consent needed.
- Analytics cookies — anonymized traffic data via a privacy-first analytics tool. Set only with your consent via our cookie banner.
You can withdraw cookie consent at any time through your browser settings or our cookie preference tool.
Who we share your data with
We do not sell your data. We share it only where necessary:
- Service providers acting as data processors — hosting, email delivery, CRM and analytics tools — each bound by a data processing agreement.
- Professional advisers — accountants and lawyers — where legally required.
- Authorities — if required by law or to protect our legal rights.
Where any provider is based outside the EEA, we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) or an EU adequacy decision.
How long we keep your data
| Data type | Retention period |
|---|---|
| Client contract and billing data | 5 years from contract end (Polish accounting law requirement) |
| Enquiry / contact data (no contract formed) | 12 months from last contact |
| Marketing consent and communications | Until you unsubscribe or withdraw consent |
| Analytics data (anonymized) | 13 months rolling |
| Website logs (security) | 90 days |
Your rights
Under GDPR (RODO), you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data ("right to be forgotten"), subject to our legal obligations
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests
- Data portability for data processed by consent or contract
- Withdraw consent at any time (this does not affect the lawfulness of prior processing)
To exercise any of these rights, email us at hm@xentavi.com. We will respond within one month.
You also have the right to lodge a complaint with the Polish supervisory authority:
Urząd Ochrony Danych Osobowych (UODO)ul. Stawki 2, 00-193 Warszawa
www.uodo.gov.pl
Data security
We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss or destruction. Access to personal data is restricted to those who need it to perform their duties.
Changes to this policy
We may update this policy as our services evolve. Material changes will be communicated via email (to active clients) or a notice on our website, with at least 14 days' notice before they take effect. The current version is always available at xentavi.com/privacy.
Contact
Questions about this policy or how we handle your data:
hm@xentavi.com