Privacy Policy

This policy explains how APSLO Sp. z o.o. handles personal data in the QuoteCarta application and on quotecarta.com, in line with Regulation (EU) 2016/679 (GDPR).

1. Who is responsible

The controller of your personal data is APSLO Sp. z o.o., ul. Wolbromska 18/1b, 53-148 Wrocław, Poland, VAT ID (NIP): 8992980737. You can reach us about anything in this policy at [email protected].

2. Our two roles

For visitors to this website and for account holders, we are the data controller: we decide how and why the data is processed.

For the people your proposals are addressed to (your clients), you are the controller and we are the processor: we handle their data only to operate the service on your behalf. Section 7 explains what this means if you are one of those recipients.

3. What we collect

Account data: your name, email address, company name and password when you register, and the users you invite.

Content you store: proposals and their stages, uploaded documents and images, messages, the names and email addresses of the recipients you address proposals to, and signature images drawn when a stage is approved in the client portal.

Technical data: IP address, browser and device information, and server logs created when you use the service.

Analytics data: described in section 5.

Contact form data: your name, email address and message when you use the contact form on the landing page.

4. Why we process it and on what legal basis

To provide the service, including hosting your content, sending proposal emails you choose to send, and sending transactional emails such as verification and notifications: performance of a contract, Article 6(1)(b) GDPR.

To keep the service secure, prevent abuse, and understand aggregate usage through cookieless analytics: our legitimate interest, Article 6(1)(f) GDPR.

To measure visits with Google Analytics and to record how the interface is used (session recordings): your consent, Article 6(1)(a) GDPR, given through the cookie banner. You can withdraw it at any time through the Cookies link in the page footer; withdrawing has no effect on processing that happened before.

To meet legal obligations, such as accounting and tax rules: Article 6(1)(c) GDPR.

5. Cookies and analytics

Strictly necessary cookies keep you signed in, protect forms against cross-site request forgery, and remember your cookie choice. They do not need consent.

We run self-hosted, privacy-friendly analytics that use no cookies and collect aggregate statistics only. This runs on the basis of our legitimate interest in knowing how the service is used.

Only if you accept in the cookie banner, we additionally load Google Analytics 4, which sets cookies and is provided by Google Ireland Limited, and a session recording script that captures how the interface is used. Google may transfer data to the United States; such transfers rely on the EU-US Data Privacy Framework and standard contractual clauses. If you decline, neither loads, and the service works exactly the same.

6. Who we share data with

We use service providers to run QuoteCarta: hosting located in Poland, email delivery, and the analytics providers named in section 5. They process data only on our instructions. We disclose data to public authorities only where the law requires it. We never sell personal data.

Apart from Google Analytics as described above, we do not transfer personal data outside the European Economic Area.

7. If you received a proposal

If someone sent you a QuoteCarta proposal link, the sender is the controller of your data and we process it on their behalf. Your email address is used to confirm it is you opening the proposal. If you approve a stage and draw a signature, that signature image is stored as part of the approval record. Messages you write in the portal are visible to the sender. To exercise your rights over this data, contact the sender first; we will assist them. You can also always contact us directly.

8. How long we keep data

Account data is kept while your account is active and removed within 30 days of account deletion. A proposal deleted in the application is permanently erased after 30 days, including files and signatures. Server logs are kept for up to 12 months. Contact form messages are kept for up to 12 months. Data we must keep under accounting or tax law is kept for the period that law requires.

9. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time where processing is based on consent. To exercise any of these, write to [email protected].

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

10. Security

Data is encrypted in transit, stored in data centres in the European Union, and protected by access controls. Uploaded files and signatures are stored outside the public web root and served only through authorised requests.

11. Automated decision-making

We do not use your data for automated decision-making or profiling that produces legal effects for you.

12. Changes to this policy

We may update this policy as the service evolves. The date at the top tells you when it last changed. For significant changes we will tell account holders by email or in the application.

13. Contact

Anything about privacy: [email protected], or by post to APSLO Sp. z o.o., ul. Wolbromska 18/1b, 53-148 Wrocław, Poland.