1. Who we are
This Privacy Policy explains how Vindrose sp. z o.o. (a Polish limited liability company, spółka z ograniczoną odpowiedzialnością, registered at ul. Piękna 58c, 50-506 Wrocław, Poland; entered in the National Court Register under KRS No. 0001261581; tax ID (NIP) 8993066384) (“Vindrose”, “we”, “us”) handles personal data on the Vindrose website and in the Vindrose service for recording and transcribing two-way radio traffic (the “Service”).
Questions about this Policy or your data: [email protected].
2. Our two roles
Vindrose processes personal data in two different roles:
- Controller for data about our website visitors, people who request a demo or a quote, and the business contacts and users of our customers (accounts, billing, support). This Policy describes that processing.
- Processor for radio recordings, transcripts and related data that our customers record with the Service. For that data the customer is the controller and decides why and how its radio traffic is recorded. We process it only on the customer’s instructions under a data processing agreement (see our DPA template). If you spoke on a radio channel recorded with Vindrose, please contact the organisation that runs that radio network; we will forward requests we receive to it.
3. Data we collect as controller
Demo and quote requests
When you fill in the form on our website: company name, industry, your name, work email, phone number (optional), number of channels, radio details and notes you provide, the plan or estimate you selected, and the campaign parameters (UTM) of the link that brought you to us.
Customer accounts
Names, work email addresses, roles and access rights of users, login and security logs (including IP address and audit records of playback and export), and settings.
Billing and contracts
Company details, billing contacts, invoices, payment status and delivery address for gateways. Customers pay by bank transfer or by card through Stripe (Stripe Payments Europe, Ltd., Ireland); we do not store full card numbers.
Website usage
Technical data such as IP address, browser and device type, pages viewed and referring pages. Analytics and advertising measurement run only with your consent (see section 8).
Communications
Emails and messages you send us and records of service emails we send you.
4. Why we use it and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your demo or quote request and preparing an offer | Steps at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Providing the Service, user accounts, support, shipping gateways | Performance of the contract with our customer (Art. 6(1)(b)) and legitimate interest in operating it for the customer’s users (Art. 6(1)(f)) |
| Invoicing, accounting and tax | Legal obligation (Art. 6(1)(c)) |
| Security, audit logs, preventing misuse | Legitimate interest (Art. 6(1)(f)) |
| Product updates and marketing emails to business contacts | Legitimate interest or consent where required by law; you can opt out at any time |
| Website analytics and advertising measurement | Consent (Art. 6(1)(a)) |
| Establishing or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
5. How radio recordings are processed
This section describes the Service so that customers and their staff understand where data goes. For this data Vindrose acts as processor.
- On site. The Vindrose gateway installed at the customer’s site records radio transmissions, transcribes speech on the device and stores a local copy on the gateway.
- In the cloud. The gateway uploads audio, transcripts and metadata (time, channel, radio ID or callsign) to the Vindrose cloud in the European Union. Search, keyword alarms, incident reports and access for authorised users run there.
- Retention. The cloud archive is kept for the period set by the customer’s plan (90 days on Start, 1 year on Pro, up to 5 years on Enterprise) or a shorter period the customer chooses, then permanently deleted. Enterprise customers can choose to keep audio only on site.
- No people scoring. The Service does not analyse emotions or stress and does not rate employees.
6. Who we share data with
We do not sell personal data. We share it only with service providers acting on our instructions and bound by data processing agreements:
- Hetzner Online GmbH (Germany) — hosting and storage of the Service in data centres in the European Union;
- Brevo (Sendinblue SAS, France) — sending service and account emails;
- FormSubmit (formsubmit.co) — forwarding requests from the website form to our email;
- Stripe (Stripe Payments Europe, Ltd., Ireland) — card payments and subscription billing; our bank — bank transfers;
- Google (Google Analytics 4) and Microsoft (Microsoft Clarity) — website analytics, only with your consent;
- couriers — delivering gateways to the address you give us;
- accountants, legal advisers, and authorities or courts where the law requires it.
Radio recordings and transcripts are shared only with sub-processors listed in the customer’s DPA.
7. International transfers
The Service and customer recordings are hosted in the European Union. If a provider processes data outside the European Economic Area, we rely on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission’s Standard Contractual Clauses. Details are available on request at [email protected].
8. Cookies and analytics
Our website uses cookies and similar technologies that are strictly necessary for it to work. Analytics technologies (Google Analytics 4 and Microsoft Clarity) are loaded only after you consent, and you can withdraw consent at any time. The legal basis is your consent under Art. 6(1)(a) GDPR and the national implementation of the ePrivacy Directive.
9. How long we keep data
- Demo and quote requests: up to 24 months after our last contact, unless they lead to a contract.
- Customer account and contract data: for the duration of the contract and afterwards as long as needed for legal claims and accounting.
- Invoices and accounting records: for the period required by Polish tax law (generally 5 years from the end of the year in which the tax became due).
- Audit and security logs: up to 12 months, unless needed to investigate an incident.
- Radio recordings and transcripts: as set by the customer’s plan and settings (see section 5).
10. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Write to [email protected]; we respond within the time limits set by law.
You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in your country.
11. Security
We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access control by role and site, logging of every playback and export, and separation of customer data. No system is completely secure; we notify customers and authorities of personal data breaches where the law requires it.
12. Changes to this Policy
We may update this Policy when the law or the Service changes. We inform customers of material changes by email or in the Service. The date at the top shows when the current version took effect.
13. Contact
Vindrose sp. z o.o.ul. Piękna 58c, 50-506 Wrocław, Poland
Email: [email protected]