Privacy policy

Controller

The controller is:

Emel.tech – Patryk Czarnota
Altanka 26J
96-500 Altanka, Poland
Polish tax ID: 8371783845
EU VAT number: PL8371783845
Email: patryk@emel.tech

No data protection officer has been appointed.

Scope

This Policy covers data processed through:

• emel.tech;
• EU B2B checkout orders and individual order requests;
• contact and support;
• returns and complaints;
• newsletter;
• analytics and consent management;
• YouTube media;
• self-hosted Wallpanel OS error diagnostics;
• OTA update checks.

Data categories

Depending on the interaction, we may process:

• IP address, date, URL, browser, device and server logs;
• name, company, email, phone and message;
• EU VAT number, billing and delivery address;
• product model, color, quantity, price and order correspondence;
• payment and shipping status;
• invoice data;
• complaint information, photos, logs and optional MAC address;
• newsletter subscription and double opt-in records;
• consent-category choices stored in a first-party emel.tech cookie;
• analytics data after consent;
• technical Wallpanel OS error data;
• OTA request data containing model and system version.

Purposes and legal bases

We process data:

• to take steps before and perform a contract — Article 6(1)(b) GDPR;
• to comply with tax, accounting, consumer, safety and legal duties — Article 6(1)(c);
• to communicate, secure services, prevent abuse, diagnose errors and handle claims — Article 6(1)(f);
• to send the newsletter — consent under Article 6(1)(a) and applicable electronic communications rules;
• to use analytics, non-essential cookies and third-party media — consent under Article 6(1)(a) and applicable cookies law.

Recipients

Data may be processed by:

• ING Bank Śląski S.A. / ING Pay;
• Furgonetka and the selected carrier;
• OVHcloud for email and domain services, including delivery of contact-form messages to the Controller’s mailbox;
• EmailOctopus, a service provided by UK-based Three Hearts Digital Ltd, only for subscriber-list management and newsletter delivery;
• Google Ireland Limited for GA4 and YouTube after consent;
• public authorities, tax authorities and KSeF where legally required;
• IT or professional providers where necessary.

The website server, self-hosted Sentry and OTA service are operated by the Controller in Poland.

International transfers

EmailOctopus states that its application and contact data are hosted in an EU AWS region. The service is provided by a UK company and may use further processors. Global providers, particularly Google and subprocessors used by the relevant services, may process data outside the EEA. Where this happens, an appropriate legal mechanism is used, such as an adequacy decision, EU–US Data Privacy Framework where applicable, or Standard Contractual Clauses.

Retention

• order and accounting data: for statutory tax/accounting periods;
• contract data: for performance and limitation periods;
• complaints and returns: until completion and expiry of claims;
• ordinary correspondence: generally up to 12 months after closure;
• newsletter: until withdrawal, with consent evidence retained as needed;
• website and OTA technical logs: generally no longer than 30 days unless an incident requires longer;
• self-hosted Sentry events: generally no longer than 90 days, subject to final configuration verification;
• consent records and analytics: according to the relevant settings and legal need.

Rights

You may have the right to:

• access;
• rectification;
• erasure;
• restriction;
• portability;
• object to legitimate-interest processing;
• withdraw consent;
• lodge a complaint with the Polish supervisory authority — President of the Personal Data Protection Office.

Contact: use the contact form.

Automated decisions

We do not use solely automated decisions that produce legal or similarly significant effects. We do not automatically personalise product prices based on profiling.

Contact form and newsletter

Ordinary contact-form messages are sent by the website server to the Controller’s OVHcloud mailbox and are not intentionally stored in WordPress or in a separate form database. The resulting correspondence remains in the mailbox for the retention period appropriate to its purpose, as described above.

English EU B2B checkout orders and requests are stored in the Controller’s WooCommerce order database. They contain the selected products, quantities, company and contact data, EU VAT number, invoice and delivery addresses, customer note and technical order identifiers. An individual request submitted through the Astro form is transferred to WooCommerce server-to-server.

For a standard EU B2B checkout order, WooCommerce first records the submitted order with VAT verification pending. The EU VAT number is then checked through VIES during order processing. Until an automatically quoted order is verified and accepted, or an individually priced delivery offer is prepared, no payment instructions are issued and no stock is reserved. Receiving an individual offer does not itself conclude a contract; its prepayment terms are accepted only when the full amount is credited by the stated deadline. A temporary VIES outage does not require the customer to submit the same order again.

When a cart contains more than 3 devices, the same WooCommerce checkout records a non-binding large-order request. It collects the same company, invoice and delivery data as the standard EU checkout, but no carrier or payment method is selected at this stage. The request does not itself reserve stock, initiate carrier booking or payment, create an invoice or conclude a sales contract. As with a standard order, its EU VAT verification may remain pending after a temporary VIES outage and must be completed before an individual offer can be sent.

The optional manual-payment recovery form may use a short-lived, non-personal cart snapshot in WordPress. The snapshot is available under a random token for no longer than 30 minutes, contains no customer contact or address data, is removed after successful form delivery and always expires automatically.

Newsletter subscriptions are sent server-side by the emel.tech form to EmailOctopus, a service provided by UK-based Three Hearts Digital Ltd. EmailOctopus processes the data on the Controller’s behalf as an email-marketing service provider. The Controller maintains appropriate contractual and data-processing arrangements, including the current data-processing terms, and takes the provider’s further processors into account.

Double opt-in is used. The subscription starts only after the address owner clicks the confirmation link. Subscribers can withdraw consent through the unsubscribe link in each message or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. Newsletter data is not used for solely automated decisions producing legal or similarly significant effects.

Cookies

Consent is managed through a self-hosted settings panel. The choice is stored in the first-party emel_cookie_consent cookie for up to 180 days, without a separate server-side consent log in the current MVP.

• essential technologies operate where necessary;
• GA4/GTM are blocked until analytics consent under Basic Consent Mode;
• YouTube is click-to-load using youtube-nocookie.com where possible.

See the Cookie Policy for details.

Wallpanel OS diagnostics

Self-hosted Sentry may process device model, OS/app version, error content, stack trace, environment and an installation/session identifier. Depending on configuration, IP addresses may occur in server or diagnostic data.

We do not intend to collect Home Assistant credentials or dashboard content.

OTA

The OTA request contains the model and system version. The service returns update availability and a download link. No application-level user database is maintained. Short-term server logs may contain IP address, time and requested URL.

Security

We use HTTPS, access controls, backups, updates, data minimisation, anti-abuse controls and diagnostic monitoring appropriate to the risk.

Changes

We may update this Policy following changes in law, services or providers. The current version is published on emel.tech.