Privacy policy

Controller

The controller is:

Emel.tech – Patryk Czarnota
Altanka 26J
96-500 Altanka, Poland
Polish tax ID: 8371783845
EU VAT number: PL8371783845
Email: patryk@emel.tech

No data protection officer has been appointed.

Scope

This Policy covers data processed through:

• emel.tech;
• email-based EU B2B ordering;
• contact and support;
• returns and complaints;
• newsletter;
• analytics and consent management;
• YouTube media;
• self-hosted Wallpanel OS error diagnostics;
• OTA update checks.

Data categories

Depending on the interaction, we may process:

• IP address, date, URL, browser, device and server logs;
• name, company, email, phone and message;
• EU VAT number, billing and delivery address;
• product model, color, quantity, price and order correspondence;
• payment and shipping status;
• invoice data;
• complaint information, photos, logs and optional MAC address;
• newsletter subscription and double opt-in records;
• consent-category choices stored in a first-party emel.tech cookie;
• analytics data after consent;
• technical Wallpanel OS error data;
• OTA request data containing model and system version.

Purposes and legal bases

We process data:

• to take steps before and perform a contract — Article 6(1)(b) GDPR;
• to comply with tax, accounting, consumer, safety and legal duties — Article 6(1)(c);
• to communicate, secure services, prevent abuse, diagnose errors and handle claims — Article 6(1)(f);
• to send the newsletter — consent under Article 6(1)(a) and applicable electronic communications rules;
• to use analytics, non-essential cookies and third-party media — consent under Article 6(1)(a) and applicable cookies law.

Recipients

Data may be processed by:

• ING Bank Śląski S.A. / ING Pay;
• Furgonetka and the selected carrier;
• OVHcloud for email and domain services, including delivery of contact-form messages to the Controller’s mailbox;
• EmailOctopus, a service provided by UK-based Three Hearts Digital Ltd, only for subscriber-list management and newsletter delivery;
• Google Ireland Limited for GA4 and YouTube after consent;
• public authorities, tax authorities and KSeF where legally required;
• IT or professional providers where necessary.

The website server, self-hosted Sentry and OTA service are operated by the Controller in Poland.

International transfers

EmailOctopus states that its application and contact data are hosted in an EU AWS region. The service is provided by a UK company and may use further processors. Global providers, particularly Google and subprocessors used by the relevant services, may process data outside the EEA. Where this happens, an appropriate legal mechanism is used, such as an adequacy decision, EU–US Data Privacy Framework where applicable, or Standard Contractual Clauses.

Retention

• order and accounting data: for statutory tax/accounting periods;
• contract data: for performance and limitation periods;
• complaints and returns: until completion and expiry of claims;
• ordinary correspondence: generally up to 12 months after closure;
• newsletter: until withdrawal, with consent evidence retained as needed;
• website and OTA technical logs: generally no longer than 30 days unless an incident requires longer;
• self-hosted Sentry events: generally no longer than 90 days, subject to final configuration verification;
• consent records and analytics: according to the relevant settings and legal need.

Rights

You may have the right to:

• access;
• rectification;
• erasure;
• restriction;
• portability;
• object to legitimate-interest processing;
• withdraw consent;
• lodge a complaint with the Polish supervisory authority — President of the Personal Data Protection Office.

Contact: patryk@emel.tech.

Automated decisions

We do not use solely automated decisions that produce legal or similarly significant effects. We do not automatically personalise product prices based on profiling.

Contact form and newsletter

Contact-form messages are sent by the website server to the Controller’s OVHcloud mailbox. The submission is not intentionally stored in WordPress or in a separate form database. The resulting correspondence remains in the mailbox for the retention period appropriate to its purpose, as described above.

Newsletter subscriptions are sent server-side by the emel.tech form to EmailOctopus, a service provided by UK-based Three Hearts Digital Ltd. EmailOctopus processes the data on the Controller’s behalf as an email-marketing service provider. The Controller maintains appropriate contractual and data-processing arrangements, including the current data-processing terms, and takes the provider’s further processors into account.

Double opt-in is used. The subscription starts only after the address owner clicks the confirmation link. Subscribers can withdraw consent through the unsubscribe link in each message or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. Newsletter data is not used for solely automated decisions producing legal or similarly significant effects.

Cookies

Consent is managed through a self-hosted settings panel. The choice is stored in the first-party emel_cookie_consent cookie for up to 180 days, without a separate server-side consent log in the current MVP.

• essential technologies operate where necessary;
• GA4/GTM are blocked until analytics consent under Basic Consent Mode;
• YouTube is click-to-load using youtube-nocookie.com where possible.

See the Cookie Policy for details.

Wallpanel OS diagnostics

Self-hosted Sentry may process device model, OS/app version, error content, stack trace, environment and an installation/session identifier. Depending on configuration, IP addresses may occur in server or diagnostic data.

We do not intend to collect Home Assistant credentials or dashboard content.

OTA

The OTA request contains the model and system version. The service returns update availability and a download link. No application-level user database is maintained. Short-term server logs may contain IP address, time and requested URL.

Security

We use HTTPS, access controls, backups, updates, data minimisation, anti-abuse controls and diagnostic monitoring appropriate to the risk.

Changes

We may update this Policy following changes in law, services or providers. The current version is published on emel.tech.