Legal · Information Notice
Privacy Policy
1. Controller
The controller of personal data processed in connection with this website (cvms.uk) is:
CVMS sp. z o.o.
ul. Puławska 405 lok. 2, 02-801 Warszawa, Poland
KRS 0001231129 · NIP PL9512647459 · REGON on request
Share capital: 5 000,00 PLN (paid in full)
E-mail: contact@cvms.uk
Tel.: +48 509 691 531
The controller has not appointed a Data Protection Officer; appointment is not required under Article 37 GDPR. All privacy enquiries should be sent to contact@cvms.uk with the subject line "Data protection request".
2. Categories of data we process
| Source | Data | How collected |
|---|---|---|
Contact form (/send.php) |
E-mail address, organisation name, free-text message, submission timestamp. | Provided voluntarily by the visitor when submitting the form. |
| Web server logs | IP address, User-Agent string, requested URL, HTTP status, byte count, referer. | Recorded automatically by the OVH web server for the duration set out in §6. |
| Anti-abuse throttle | SHA-256 hash of the visitor's IP address (no plaintext IP stored), held for 30 seconds. | Created server-side to prevent contact-form flooding. |
| E-mail correspondence | The contents of any message you send us and our reply. | You initiate; processed in our OVH-hosted mailboxes. |
We do not use web analytics, advertising trackers, profiling cookies or any third-party fingerprinting technology. Details are set out in our Cookie Notice.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your enquiry, preparing a quote or briefing. | Art. 6(1)(b) — steps prior to entering into a contract at your request. |
| Maintaining a record of business correspondence and following up on sales leads. | Art. 6(1)(f) — legitimate interest of CVMS sp. z o.o. in operating its B2B sales pipeline. |
| Operating the website securely (logs, throttling, abuse defence). | Art. 6(1)(f) — legitimate interest in protecting the integrity of the service. |
| Complying with statutory obligations (tax, accounting, regulatory enquiries). | Art. 6(1)(c) — legal obligation under Polish law. |
4. Recipients and processors
Personal data is disclosed only to the following categories of recipient, each acting under a written processing agreement (Art. 28 GDPR) where required:
-
OVH SAS (2 rue Kellermann, 59100 Roubaix, France) — provides the
virtual server, web hosting, mail relay (MX Plan) and the IP transit on which
cvms.ukruns. Processing takes place in OVH data centres located in the European Economic Area. - Our accountants and external legal advisers, where strictly necessary to fulfil tax, accounting or regulatory obligations.
- Public authorities, only where compelled by Polish or EU law following a valid request.
We do not sell, rent or trade personal data, and we do not use it for automated decision-making within the meaning of Art. 22 GDPR.
5. Transfers outside the EEA
We do not routinely transfer personal data outside the European Economic Area. Should a future processor be located in a third country, we will rely on an adequacy decision (Art. 45 GDPR) or, failing that, on Standard Contractual Clauses (Art. 46 GDPR) and supplementary measures, and we will update this notice accordingly.
6. Retention periods
- Contact-form submissions: 12 months from the date of last meaningful contact, after which the message and associated metadata are deleted from our mailbox and CRM.
- Throttle hashes: deleted automatically after 30 seconds.
- Web server logs: 30 days, then rotated and overwritten.
- Records relevant to tax or accounting obligations: 5 years from the end of the calendar year in which the relevant event occurred (Art. 74 ust. 2 of the Polish Accounting Act).
- Records relevant to claims: until the relevant limitation period under Polish civil law expires (typically 6 years for ordinary claims, 3 years for claims connected to economic activity).
7. Your rights
Under the GDPR you have the right to:
- access your personal data and obtain a copy (Art. 15);
- request rectification of inaccurate or incomplete data (Art. 16);
- request erasure ("right to be forgotten") in the cases listed in Art. 17;
- request restriction of processing (Art. 18);
- receive your data in a structured, machine-readable format and have it transmitted to another controller (Art. 20), where the legal basis is contract or consent;
- object to processing based on our legitimate interest (Art. 21), including objection for direct-marketing purposes — which we will always honour;
- withdraw consent at any time, where consent was the legal basis (Art. 7), without affecting the lawfulness of prior processing.
To exercise any of these rights, write to contact@cvms.uk. We will respond within one calendar month (Art. 12(3) GDPR), extendable by two further months for complex requests.
You also have the right to lodge a complaint with the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or with the supervisory authority of your habitual residence.
8. Is providing data mandatory?
Providing personal data through the contact form is voluntary, but without a valid e-mail address and a description of your enquiry we are unable to reply. We therefore mark the e-mail, organisation and message fields as required.
9. Security
The website is served exclusively over HTTPS with TLS 1.2+ and HSTS. The contact-form endpoint is rate-limited, validates origin and referer headers, rejects oversize payloads and uses a honeypot field to silently discard automated submissions. Outbound mail is delivered over SMTP over implicit TLS to OVH's MX Plan with peer-name verification. Access to the underlying server is restricted to a small allow-list of administrative IP addresses and requires SSH key authentication.
10. Changes to this notice
We may update this Privacy Policy to reflect changes in our processing or in applicable law. The "Effective date" at the top will always show when the most recent version came into force. Material changes will be highlighted on the home page for at least 30 days.