Privacy Policy

1. Who is responsible

The controller of your personal data is Velmundi Group Jakub Karakulski, ul. Hawajska 6/17, 02-776 Warszawa, Poland, VAT ID PL9512148443, REGON 142157214 (“NormXL”, “we”, “us”). NormXL is the brand under which we publish the software and this website.

For anything about your data, email info@normxl.com or write to the address above. We have not appointed a data protection officer, because the law does not require one for our processing; your message reaches the person responsible for this policy.

2. Your workbook is never received

NormXL reads your spreadsheet only inside your own browser. The file, its contents, its name, its size and its SHA-256 fingerprint are never transmitted to us or to anyone else, and the Dossier is generated on your machine and saved to your own drive. The free fingerprint check and quick count on this website work the same way: they run in your browser, and neither the file nor anything they compute is sent to us or to anyone else. We therefore process no personal data that may be contained in your workbook. The Annual Quality Register keeps fingerprints, version records and Dossier records only, never the contents of your workbooks. The Security & 0 KB Upload page explains the architecture and how to verify it yourself.

3. What we collect, why, and for how long

Order and reservation form

• Data: full name, organisation name, business email, the standard and package you choose, and the optional marketing tick box. We also record the reference number, the date and time, the page and button you ordered from, the active standard tab, the currency and the version of the order button shown to you, whether your address is a free webmail address, and, if the address of the page you order from carries campaign parameters from an advertising or campaign link, those parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content and the Google click identifier gclid). They are read from the page address when you send the form; nothing is stored in your browser for this.
• Why: to record your order or reservation, confirm it by email, notify you when NormXL 7.0 is released, complete the order if you decide to, and issue your invoice. The page, button and campaign details tell us which pages and campaigns lead to orders; they are stored with your order and are not passed from our records to Google or any other advertising service.
• Legal basis: steps taken at your request before entering into a contract, and performance of that contract (Art. 6(1)(b) GDPR and UK GDPR). The page, button and campaign details: our legitimate interest in measuring which of our pages and campaigns work (Art. 6(1)(f)).
• How long: we delete these details 30 days after the release notification, unless you complete your order. We delete them sooner if you reply “delete” to any of our emails, and we delete every reservation if we decide not to release on the timeline we gave you; if you then reply “keep me informed”, we keep only your email address, to send you a single email should we release in future. If you complete your order, the data needed for your invoice and your licence are kept for as long as the contract runs, until claims under it are time-barred, and as long as tax law requires (in Poland, five years from the end of the year in which the tax payment deadline fell).

Optional product news

• Data: your email address, only if you tick “Also send me occasional NormXL product news”.
• Legal basis: your consent (Art. 6(1)(a)). The box is never pre-ticked, and ordering does not depend on it.
• How long: until you unsubscribe or withdraw your consent, which you can do at any time by replying “unsubscribe” or “delete”. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Optional survey after a reservation

• Data: your answers to up to three multiple-choice questions, linked to your reservation reference.
• Why and legal basis: to plan the release around what customers need; our legitimate interest (Art. 6(1)(f)). Answering is optional.
• How long: deleted together with your reservation.

Sample Dossier request

• Data: your work email, the page you asked from, and whether it is a free webmail address.
• Why and legal basis: to send you the sample you asked for (Art. 6(1)(b)). We send one email with the sample and nothing else.
• How long: deleted 30 days after the sample has been sent, or sooner on a “delete” reply.

Contact form and emails to us

• Data: your name, email, optional organisation, the topic you choose, your message, and anything you write to us by email or tell us by phone.
• Why and legal basis: to answer you and handle your request; steps at your request before a contract or performance of a contract (Art. 6(1)(b)), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f)).
• How long: up to 12 months after your enquiry is closed, unless it becomes part of an order, in which case the order periods above apply.

Protection against abuse

• Data: when you submit any form, your IP address is used to limit the number of submissions to five in ten minutes. It is stored only as a salted one-way hash, kept for 24 hours and then deleted automatically at the next form submission. To avoid duplicate orders we keep a one-way hash of your email address and package on the same terms.
• Legal basis: our legitimate interest in keeping the forms working and free of spam (Art. 6(1)(f)).

Server logs

Like every website, our hosting server records technical access logs (IP address, date and time, the page requested, browser type) to deliver the site and keep it secure. They are kept by our hosting provider for a limited period and are not used to identify you. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f)).

4. Cookies, analytics and browser storage

This website currently uses no analytics, advertising or tracking cookies, and loads no code from Google or any other third party.

The site also keeps a few values in your browser’s storage. They are not sent to anyone unless stated:

• The announcement-bar setting (session storage): remembers for the current tab that you closed the announcement; deleted when you close the tab.

5. Who receives your data

• Our hosting and email provider, VIPserv (Poland), which runs this website and our mailboxes on servers in the European Union, as our processor.
• A payment provider, once payments open. It will be named in the order flow before you enter any payment details; it processes payment data under its own terms. During pre-release no payment data are collected.
• Our accountants and the tax authorities, for invoices, as required by law.

We do not sell or rent personal data, and we do not use it for automated decisions or profiling that affects you.

6. Transfers outside the EEA

We store and process your data in the European Union. We make no transfers outside the European Economic Area. If you are in the United Kingdom, the EU is covered by a UK adequacy regulation, so transfers from the UK to us need no further safeguards.

7. Your rights

Under the GDPR and the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent at any time. To use any of these rights, email info@normxl.com or reply to any of our emails.

Your right to object: where we rely on our legitimate interests (section 3), you may object at any time on grounds relating to your particular situation; we then stop, unless we have compelling legitimate grounds that override your interests.

The quickest way to be erased: reply “delete” to any email from us. We remove your record within five working days and send you a one-line confirmation. Copies in backups are overwritten in their normal cycle.

You may also complain to a data protection authority: in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl); in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); or the authority in the country where you live or work.

8. Do you have to give us your data?

No. Without your name, organisation and business email we cannot record an order, because they appear on your invoice and your Dossier. Everything marked optional really is optional.

9. Changes to this policy

If we change how we use personal data, we update this page and the date at the top. If a change affects an order or reservation you have with us, we tell you by email before it applies.