Privacy Policy

Last updated: February 25, 2026

1. Data Controller

The controller of your personal data is Vintom sp. z o.o., registered in Warsaw at ul. Skrzetuskiego 25A, 02-726 Warsaw, Poland (KRS: 0000500804, NIP: 7010415226, REGON: 147134264). This Privacy Policy applies to the Vintom Planner system (hereinafter: the "System"). For matters related to personal data protection, you may contact the controller at: iod@vintom.com.

2. Purpose and Legal Basis for Data Processing

We process your personal data for the following purposes:

Purpose of Processing	Legal Basis (GDPR)
Providing the service – project, task, and schedule management	Art. 6(1)(b) – performance of a contract
User account and permissions management	Art. 6(1)(b) – performance of a contract
Sending project-related notifications and digests	Art. 6(1)(f) – legitimate interest
Maintaining change history and audit trail (timeline history)	Art. 6(1)(f) – legitimate interest (security and accountability)
Recording GDPR consent and its withdrawal	Art. 7 GDPR – documenting consent

3. Scope of Processed Data

When using the System, we process the following categories of data:

Identification data: full name, email address.
Account configuration data: preferred language, date format, notification settings.
Activity data: task comments, decisions, status changes, schedule history.
Project membership data: assigned projects and roles.
Technical data: system logs necessary to ensure the security and stability of the System.

4. Data Recipients

Your data may only be shared with data processors acting on behalf of the controller (e.g., cloud infrastructure providers, database hosting) based on appropriate data processing agreements in accordance with Art. 28 GDPR. We do not sell or share personal data with third parties for marketing purposes.

5. Data Transfers Outside the EEA

As a rule, data is processed within the European Economic Area (EEA). When using service providers outside the EEA, we apply appropriate safeguards (standard contractual clauses approved by the European Commission).

6. Data Retention Period

User account data – for the duration of the agreement with the organization and for the period required by law after its termination.
Change history and audit data – for the period necessary for accountability purposes, no longer than 5 years after the project ends.
System logs – up to 12 months.

7. Your Rights

Under the GDPR, you have the following rights:

Right of access to your data (Art. 15 GDPR).
Right to rectification of inaccurate data (Art. 16 GDPR).
Right to erasure ("right to be forgotten") (Art. 17 GDPR).
Right to restriction of processing (Art. 18 GDPR).
Right to data portability (Art. 20 GDPR).
Right to object to processing based on legitimate interest (Art. 21 GDPR).
Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
Right to lodge a complaint with a supervisory authority – the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

To exercise any of the above rights, contact the controller or use the options available in your account settings in the System.

8. Consent and Its Withdrawal

Using the System requires consent to the processing of personal data in accordance with this Privacy Policy. You may withdraw your consent at any time in the Settings → Privacy & GDPR section. Withdrawing consent will prevent you from using the System until consent is given again.

9. Cookies and Tracking Technologies

The System may use essential (session) cookies solely to ensure the proper functioning of the application. We do not use analytical or marketing cookies without your explicit consent.

10. Data Security

We apply appropriate technical and organizational measures to protect data against unauthorized access, loss, or destruction, including data transmission encryption (TLS), role-based access control (RBAC), and regular backups.

11. Changes to the Privacy Policy

We reserve the right to amend this Privacy Policy. We will inform you of significant changes via the System or by email. The date of the last update is always visible at the top of this document.

12. Contact

For matters related to personal data protection, contact the controller at iod@vintom.com.