Privacy Policy
This document is published in Polish (binding) and English. The English version is shown below.
01Data controller
The controller of personal data processed in connection with the cavor.eu website is Kamil Truszkowski (natural person), correspondence address: Zalewowa 5, 96-500 Sochaczew.
For data protection matters, write to: kontakt@cavor.eu.
Data processed after you sign in to CAVOR Desk, including reports submitted by residents through a QR code, is described in a separate privacy policy: CAVOR Desk privacy policy
02What data we process
Site visitors
The site is served by a hosting provider (Vercel). Each time a page is displayed, its servers process technical request data: IP address, date and time, the address of the requested resource, and browser data (the User-Agent header). This is needed to deliver the page and protect it from abuse. The site does not store this data in its own database and contains no analytics or third-party scripts.
People using the contact form
In the form you provide your name, email address, company name, a range for the number of properties you maintain, and the message. The message goes to our email inbox; the site does not store it in its own database and does not log its content.
To limit abuse, the form counts submissions per IP address (up to 3 within 10 minutes). The counter is kept only in the memory of the running server instance, is not written to a database or disk, and disappears at the latest when that instance restarts.
If you write to us directly by email, we process the sender's address and the content of the correspondence.
People signing in
When you sign in through the form on cavor.eu, we pass your email address and password to the Supabase authentication service, which checks them and issues a session. We do not store or log the password. After sign-in we check which CAVOR modules your organisation has access to and show the module picker. The session is maintained by the cookies described in the section “Cookies and tracking technologies”.
03Purposes and legal bases
| Purpose | Data category | GDPR basis | Retention |
|---|---|---|---|
| Replying to a message from the contact form or an email | name, email address, company, number of properties, message | Art. 6(1)(b) (steps prior to entering into a contract) and (f) (handling correspondence) | until the correspondence ends |
| Signing in and maintaining the session | email address, password (for authentication only), account identifier, session token | Art. 6(1)(b) (providing the service to the account holder) | account data: for as long as the account exists; session cookie: up to 400 days, removed on sign-out |
| Security and operation of the site: technical request data, limiting form abuse | IP address, date and time of the request, resource address, User-Agent | Art. 6(1)(f) (security and continuity of the site) | technical data at the hosting provider: under its policies, we do not copy it; form counter: in memory, at most until the instance restarts |
| Remembering chosen settings (module, language, theme, view) | setting identifiers stored in cookies | Art. 6(1)(f) (user convenience, consistent interface) | periods given in the cookie tables below |
04Recipients and sub-processors
We pass data only to providers whose services this site actually uses:
| Entity | Role | Data concerned | Seat and transfer basis |
|---|---|---|---|
| Vercel Inc. | hosting of the site and server functions, including the form handler | technical request data; form content in transit | USA; standard contractual clauses (SCC) |
| Supabase Pte. Ltd. | user authentication (sign-in) | email address, password, account data, session | Singapore; standard contractual clauses (SCC) |
| Resend (Plus Five Five, Inc.) | sending contact-form messages to our inbox | content of the form submission | USA; standard contractual clauses (SCC) and the EU-U.S. Data Privacy Framework |
| Email service provider | operating the inbox that receives form messages and correspondence | message content, sender address | Switzerland; European Commission adequacy decision |
The providers used by CAVOR Desk are listed on a separate page: CAVOR Desk sub-processors
05Transfers outside the EEA
Vercel Inc. and Resend (Plus Five Five, Inc.) are based in the USA and Supabase Pte. Ltd. in Singapore. Passing data to them is a transfer outside the European Economic Area within the meaning of Chapter V GDPR, regardless of the region in which the servers operate.
The basis for the transfer is the standard contractual clauses approved by the European Commission (SCC); for Resend, additionally the EU-U.S. Data Privacy Framework. The email service provider is based in Switzerland, for which the European Commission has found an adequate level of data protection.
On request we will tell you which safeguards apply to a specific provider. Write to the address given in the “Data controller” section.
06Data subject rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on a legitimate interest (Articles 15–21 GDPR) — to the extent the law provides them for the given purpose.
Send requests to the email address given in the “Data controller” section. We reply without undue delay and at the latest within one month of receiving the request (Article 12(3) GDPR).
If you believe we process data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (PUODO).
Providing data in the contact form is voluntary, but without a name, email address, company name, a range for the number of properties and a message we cannot accept the submission.
07Cookies and tracking technologies
Just reading this site sets no cookies. Cookies appear only after you sign in and while you use CAVOR Desk. Below is the complete list of what the code of this site and of CAVOR Desk sets.
Set by cavor.eu
| Name | What it is for | When it is created | How long |
|---|---|---|---|
| sb-…-auth-token (sometimes ending in .0 or .1) | Keeps you signed in. It is necessary for sign-in to work. We store it on the .cavor.eu domain, so the same cookie serves cavor.eu and Desk. | After you sign in | Up to 400 days; removed when you sign out |
| cavor_module | Remembers the module you chose with "Always open …" after sign-in. It grants no access — we check access to the module every time. | Only if you tick that box and click a module | 1 year; "Change module" removes it |
| cavor_recovery | Confirms that you reached the new-password form through the link sent to your email. Without it we neither show the form nor change the password. Necessary for the password reset; it gives no access to any module. | After you click the password-reset link | 15 minutes; removed once the password is changed |
Set by CAVOR Desk (desk.cavor.eu)
| Name | What it is for | When it is created | How long |
|---|---|---|---|
| cavor_theme | Remembers the colour theme you chose. | After you pick a theme | 1 year |
| desk_tech_view | Remembers the view mode in the technician panel. | After you switch the view mode | 1 year |
| NEXT_LOCALE | Remembers the interface language. | When a language is chosen or detected | Until you close the browser |
Browser storage (not cookies)
CAVOR Desk also stores data in the browser outside cookies: a resident's report draft (until the tab is closed) and the offline queue of reports for technicians.
What is not there
The code of this site and of CAVOR Desk contains no analytics or advertising cookies and no third-party scripts that would set them. If you go to another company's site, that company's own rules apply.
08Security
The data isolation architecture is described on the home page. This document makes no security claims of its own — it refers to that description. Priority #0 — data isolation
09Changes to this policy, effective date, contact
We publish changes to this policy on this page and mark them with the date of last update in the header. The changed version applies from the moment it is published.
Contact for personal data matters: kontakt@cavor.eu.