Privacy notice

V77 Trust is operated by Vertex77 spółka z ograniczoną odpowiedzialnością (Vertex77 sp. z o.o., "we", "us"), with its registered seat at ul. Świeradowska 47, 02-662 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register maintained by Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIII Wydział Gospodarczy KRS under KRS 0001217415, NIP 5214148501, VAT-UE PL5214148501, REGON 543742675. This Privacy Notice explains how we process personal data in accordance with Regulation (EU) 2016/679 (GDPR / RODO) when you visit v77trust.com, request a pilot, or use the V77 Trust platform.

1. Data Controller vs. Data Processor roles

• Vertex77 sp. z o.o. as Data Controller (GDPR Art. 4(7)): We act as the Data Controller for account registration, billing and VAT invoicing, pilot/commercial enquiries, security audit logs, and website operations.
• Vertex77 sp. z o.o. as Data Processor (GDPR Art. 4(8) & Art. 28): For customer workspace content (AI system inventory records, FRIA/DPIA assessments, uploaded evidence files, and vendor questionnaire responses), your organisation is the Data Controller and Vertex77 sp. z o.o. processes that data solely on your documented instructions under our GDPR Article 28 Data Processing Agreement (DPA / umowa powierzenia przetwarzania danych, available on request at privacy@v77trust.com).

2. Categories of personal data & GDPR Art. 6 legal bases

• Workspace account & authentication data (name, work email, organisation membership, RBAC role, hashed password, session identifiers) — processed to perform our contract with your organisation (GDPR Art. 6(1)(b)). Providing this data is necessary to create and maintain an account.
• Billing, payment & EU VAT invoicing records (billing contact, company address, EU VAT / VIES ID, Stripe customer/subscription identifiers, invoice history) — processed for contract performance (GDPR Art. 6(1)(b)) and compliance with Polish and EU tax and accounting laws, including the Polish Accounting Act (Ustawa o rachunkowości) and VAT Act (GDPR Art. 6(1)(c)).
• Pilot & B2B sales enquiries (name, work email, organisation, role title, message) — processed to take steps at your request prior to entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in responding to B2B enquiries (GDPR Art. 6(1)(f)). We do not send unsolicited marketing from pilot submissions.
• Security, rate-limiting & audit logs (IP address, request timestamps, CSRF tokens, hash-chained activity records) — processed under our legitimate interest in platform security, abuse prevention, and NIS2 / ISO/IEC 27001-aligned auditability (GDPR Art. 6(1)(f)).
• Cookies & local storage — strictly necessary cookies (v77_session, v77_csrf, v77_locale) and consent state (v77_cookie_consent) operate under ePrivacy Art. 5(3) / Polish PKE Art. 399 exemptions for essential service delivery; any optional analytics require prior opt-in consent (GDPR Art. 6(1)(a)), which can be withdrawn at any time via "Cookie settings" in the footer.

3. Sub-processors & recipients

We do not sell personal data. We engage the following infrastructure and service sub-processors:

• Cloudflare, Inc. / Cloudflare Germany GmbH — application compute (Workers), relational database (D1), and encrypted evidence object storage (R2) with EU/EEA data locality controls.
• Stripe Payments Europe, Limited (Dublin, Ireland) — native EUR payment processing (3DS2 Cards and SEPA Direct Debit), EU VAT / VIES validation, and subscription invoicing.
• Resend, Inc. — transactional system emails (workspace invitations, password resets, payment receipts, and governance reminders).
• Optional AI evaluation providers — disabled by default (V77_ENABLE_REAL_PROVIDERS=false). When explicitly enabled by a customer, prompts pass through automated PII redaction (redactPii) before reaching the selected provider (Cloudflare Workers AI, Azure OpenAI EU, OpenAI, or Anthropic).

4. International data transfers

Where a sub-processor processes data outside the European Economic Area (EEA), transfers are safeguarded by the EU-U.S. Data Privacy Framework (DPF) adequacy decision and/or the European Commission's Standard Contractual Clauses (SCCs, Commission Implementing Decision (EU) 2021/914) alongside supplementary encryption and PII minimisation measures.

5. Retention periods

• Workspace & account data: retained for the duration of the subscription or trial plus up to 30 days prior to permanent deletion (or exported immediately upon request).
• Billing & tax invoices: retained for 5 years from the end of the calendar year in which the tax deadline expired, as required by Polish tax and accounting law (Art. 74 of the Polish Accounting Act / Art. 86 § 1 Ordynacja podatkowa).
• Pilot & contact enquiries: retained for up to 12 months from last interaction if no commercial agreement is concluded.
• Security & technical logs: retained for up to 90 days unless required longer for incident investigation.

6. Your GDPR rights & Supervisory Authority (PUODO)

Under GDPR Articles 15–22, you have the right to request access to your personal data, rectification, erasure ("right to be forgotten"), restriction of processing, data portability (Article 20), and to object to processing based on legitimate interests (Article 21). Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with the Polish data protection supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl), or with the supervisory authority in the EU Member State of your habitual residence or place of work.

7. Contact & Privacy enquiries

Vertex77 spółka z ograniczoną odpowiedzialnością (Vertex77 sp. z o.o.)
ul. Świeradowska 47, 02-662 Warszawa, Poland
KRS: 0001217415 · NIP: 5214148501 · VAT-UE: PL5214148501 · REGON: 543742675
Privacy & GDPR requests: privacy@v77trust.com · General: contact@v77trust.com · vertex77.com