Privacy Policy

This Privacy Policy explains how Stelleo Sp. z o.o. (“Stelleo”, “we”, “us”) processes personal data collected through https://www.stelleo.eu (the “Website”). It is provided in accordance with Regulation (EU) 2016/679 (“GDPR” / “RODO”) and the Polish Personal Data Protection Act of 10 May 2018.

1. Data controller

The controller of your personal data is:

• Stelleo Sp. z o.o.
• Słoneczna 32/9, 33-100 Tarnów, Poland
• KRS 0001222852 · NIP 8733306934 · REGON 543957140
• Email: contact@stelleo.eu

We have not appointed a Data Protection Officer (DPO); for any data-protection-related question, please write to the email above with the subject line “Privacy”.

2. What personal data we collect

We only process personal data that you actively provide to us:

• Contact-form submissions: name, email address, and (optionally) company name, the topic of your enquiry, and the content of your message.
• Direct communication: if you write to us by email or call us directly, the contents of your message and the contact details you choose to share.

We use a privacy-respecting, cookieless analytics tool (Umami) to understand aggregate site usage — see section 5 below. We do not use cookies, advertising pixels, social media trackers, fingerprinting, or any tool that identifies individual visitors. See our Cookie Policy for details.

3. Purposes and legal bases

We process your personal data for the following purposes:

• To respond to your enquiry and take pre-contractual steps (e.g. providing information about ASPIS, OptiFlow, ForeSat, or a partnership) — legal basis: Article 6(1)(b) GDPR (steps taken at the data subject’s request prior to entering into a contract) and Article 6(1)(f) GDPR (our legitimate interest in conducting business correspondence).
• To keep records of correspondence for accountability and to defend against potential legal claims — legal basis: Article 6(1)(f) GDPR (legitimate interest).
• To comply with legal obligations where applicable (e.g. tax, accounting, supervisory requests) — legal basis: Article 6(1)(c) GDPR.

4. How long we keep your data

• Enquiries that do not lead to a business relationship: up to 24 months from the last correspondence, then deleted.
• Enquiries that lead to an offer or contract: for the duration of the relationship and for as long as required by applicable law (in particular tax and accounting law in Poland — typically 5 years from the end of the calendar year in which the obligation arose).
• Form submissions stored at Formspree: retained on Formspree’s infrastructure for as long as your inbox is active there; we can delete individual submissions at your request.

5. Recipients and international transfers

We do not sell or rent your personal data. We share it only with service providers strictly necessary to operate this Website and to respond to you:

• Formspree, Inc. (United States) — processes contact form submissions on our behalf. Submitting the form transfers your data outside the European Economic Area to the United States. The transfer is safeguarded by Formspree’s certification under the EU–U.S. Data Privacy Framework and, as a fallback, by Standard Contractual Clauses adopted by the European Commission. Formspree’s privacy notice is available at formspree.io/legal/privacy-policy.
• Umami Software, Inc. (United States, via Umami Cloud) — provides aggregated, privacy-respecting analytics. Umami does not use cookies, does not store IP addresses, and does not track users across websites. The data processed is limited to: the page URL visited, referrer, browser type, operating system, device type, screen size, and country (derived from IP on the fly; the IP itself is discarded). This data is processed in aggregate form only and cannot be used to identify individual visitors. The transfer to the United States is safeguarded by the Standard Contractual Clauses adopted by the European Commission; Umami’s privacy notice is available at umami.is/privacy.
• Seohost.pl (Poland) — hosts the static files of this Website. Server access logs may contain technical metadata (IP address, user agent, request time) for security and operational purposes; logs are retained according to Seohost’s policies.
• Google LLC (Google Fonts) — when you load the Website, your browser fetches font files from fonts.googleapis.com and fonts.gstatic.com. This transfer includes your IP address. Google states that Google Fonts does not use cookies or track end users for advertising; see Google Fonts & privacy.
• Public authorities — where we are legally required to disclose information (e.g. a court order or tax authority request).

6. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy (Art. 15);
• request rectification of inaccurate or incomplete data (Art. 16);
• request erasure of your data (the “right to be forgotten”) where one of the grounds in Art. 17 applies;
• request restriction of processing in the cases listed in Art. 18;
• object to processing based on legitimate interest, including direct marketing (Art. 21);
• data portability — to receive your data in a structured, commonly used, machine-readable format (Art. 20), where applicable;
• withdraw consent at any time, where processing is based on consent — withdrawal does not affect the lawfulness of prior processing (Art. 7(3)).

To exercise any of these rights, email contact@stelleo.eu. We will respond within one month (extendable by two further months for complex requests, as permitted by Art. 12(3) GDPR).

You also have the right to lodge a complaint with the supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO) (ul. Stawki 2, 00-193 Warsaw, Poland).

7. Is providing your data required?

Providing personal data through the contact form is voluntary, but without at least your name, email address, and a message we cannot process your enquiry.

8. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.

9. Children

This Website is intended for business audiences and is not directed at children. We do not knowingly collect personal data from individuals under 16.

10. Cookies

This Website does not set its own cookies. See the Cookie Policy for details on the third-party services that may be involved when you interact with the site.

11. Security

The Website is served over HTTPS and uses standard transport encryption. We apply reasonable technical and organisational measures to protect the data we hold; however, no transmission over the internet can be guaranteed 100% secure.

12. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always the one published at https://www.stelleo.eu/privacy/, with the effective date shown at the top.

13. Contact

For any question about this policy or how we handle your personal data, write to contact@stelleo.eu with the subject line “Privacy”.