Privacy and cookie policy
Effective from: 18.10.2026
This document explains which personal data the PIP.VERTRIX platform available at https://vertrix.space processes, for what purpose and for how long, and what rights data subjects have. It is the information required by Articles 13 and 14 GDPR (Regulation (EU) 2016/679).
1. Controller
The controller of personal data is TMS GROUP EUROPE Spółka z ograniczoną odpowiedzialnością, ul. Metalowców 13, 41-500 Chorzów, Poland, National Court Register (KRS) 0000284962, tax ID (NIP) 6342647535, REGON 240625211 (the “Controller”).
You can contact the Controller about personal data in writing at the registered office address: ul. Metalowców 13, 41-500 Chorzów.
2. Whose data we process
- Users — people given access to PIP.VERTRIX by their organization (employees and contractors).
- Contacts of customers and partners — people entered in the customer records or appearing in correspondence and documents saved in projects.
- Visitors of the sign-in page — technical data needed to display it.
3. Which data, why and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| name, e-mail address, role, profile picture (if added), preferred language | creating and running the account, sign-in, task assignment and e-mail notifications | Art. 6(1)(b) GDPR (contract, including performing work duties) and Art. 6(1)(f) (legitimate interest — organizing work) |
| project timeline entries, tasks, decisions, notes from calls and meetings, briefing outcomes | running projects and accountability | Art. 6(1)(f) GDPR (organizing and documenting work) |
| audit log (who changed what and when), IP address and sign-in information | security, accountability, abuse detection, limiting sign-in attempts | Art. 6(1)(f) GDPR (system security and protection against claims) |
| presence in the application (who is signed in and which view they work in), attendance at briefings | coordinating team work and documenting briefings | Art. 6(1)(f) GDPR (organizing work) |
| e-mail correspondence saved to a project (sender, recipients, subject, date, content and attachments — stored as project documents; programs, scripts and files over 25 MB are skipped) | documenting project communication | Art. 6(1)(f) GDPR (running projects and establishing or defending claims) |
| customer contact data (name, e-mail, phone, position) | customer relations and project delivery | Art. 6(1)(f) GDPR (business contact) |
| documents added to projects | project documentation | Art. 6(1)(f) GDPR |
| phone notification identifier (push token), system type (Android/iOS) — mobile app only | notifications about assigned tasks and reminders | Art. 6(1)(f) GDPR (organizing work); notifications can be turned off in the phone settings |
Correspondence reaches PIP.VERTRIX only when a user saves it with the mail add-in or sends a copy to the organization mailbox. PIP.VERTRIX does not browse users' mailboxes.
Contact data comes from users who entered it in connection with projects, or from the correspondence of these people.
Providing data is a condition of using the platform. The Controller does not take decisions based solely on automated processing, including profiling. Signals and recommendations in the application are suggestions based on explicit rules — decisions are taken by people.
4. Recipients
Project data is available to the project team and authorized administrators of the organization. We entrust data to providers who process it only on our instructions:
- IONOS SE (Germany) — the server running the application and its database,
- home.pl S.A. (Poland) — e-mail sent and received through the organization mailbox,
- Microsoft Ireland Operations Ltd. (Ireland) — Microsoft account sign-in (Entra ID) and the Outlook add-in, if used,
- Google Ireland Ltd. (Ireland) — delivering push notifications to the mobile app (Firebase Cloud Messaging) and the Gmail add-on, if used,
- Apple Distribution International Ltd. (Ireland) — delivering notifications to iPhones (Apple Push Notification service).
Data may be disclosed to public authorities where required by law.
5. Transfers outside the EEA
The application and its data are stored on a server in the European Union. If, in connection with Microsoft or Google services, data could be transferred outside the European Economic Area, this is based on a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
6. Retention
- account data — while the person has access to the platform, and after removal for the limitation period of possible claims; history and audit entries remain signed with the author's name because they form project documentation,
- project data, correspondence and documents — for the duration of the project and the archiving of its documentation; the organization can set automatic deletion of older messages and documents (retention rules),
- backups — made daily and kept for 7 days, then deleted automatically,
- technical data and server logs — for as long as needed to keep the service secure,
- phone notification identifier — until sign-out in the app; inactive identifiers are removed automatically.
7. Your rights
Everyone has the right to:
- access their data and receive a copy,
- rectify their data,
- erasure or restriction of processing — in the cases provided for in the GDPR,
- object to processing based on legitimate interest,
- data portability — for data processed on the basis of a contract,
- lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
To exercise your rights, contact the Controller (section 1).
8. Security
Connections to the platform are encrypted (HTTPS). Only the project team can access a project. Every change is recorded in the audit log. Passwords are stored only as cryptographic hashes; integration passwords and keys are stored encrypted. The organization can require two-step verification. Documents are shared via links valid for 5 minutes.
9. Cookies and browser storage
PIP.VERTRIX does not use analytics, advertising or tracking cookies and uses no third-party traffic measurement tools. We only use mechanisms strictly necessary for the service, so no consent is required (Art. 399(3) of the Polish Electronic Communications Law):
| Name | Type | Purpose | Duration |
|---|---|---|---|
pip-language |
cookie | remembers the chosen language (PL/EN) | 1 year |
.AspNetCore.Antiforgery.* |
cookie | protects forms against CSRF attacks | until the browser is closed |
| Microsoft sign-in cookie | cookie | secures the return from Microsoft sign-in | a few minutes |
pip-auth-token |
browser storage (localStorage) | keeps the user signed in | until sign-out or session expiry |
pip-language |
browser storage (localStorage) | remembers the chosen language | until browser data is cleared |
The PIP.VERTRIX mobile app keeps the session token in the system's secure storage (Keychain on iOS, Keystore on Android) and the chosen language. If the user turns on quick sign-in, the same storage holds a hash of the PIN and, after a password sign-in, the credentials, used only to renew the PIP session; biometric data (fingerprint, face) is checked by the phone's system and never reaches the app or PIP. Signing out or 5 wrong PINs delete this data from the phone. The app contains no analytics or advertising tools.
You can change cookie settings in your browser. Blocking strictly necessary cookies or browser storage makes signing in impossible.
10. Changes
We will inform users about significant changes to this policy in the application or by e-mail. The current version is always available at https://vertrix.space/polityka-prywatnosci.