Privacy Policy and Cookies

This is one policy, common to all ViewPro websites, brands and services. We publish it on each of our websites. We write it plainly and in the simplest possible language, because we want you to genuinely know what we do with your data.

1 Who is responsible for your data

The controller of your personal data is Tomasz Mróz and Justyna Mróz, jointly running a business as ViewPro s.c. T. Mróz, J. Mróz, ul. Skoroszewska 2B/34, 02-495 Warszawa, Poland, NIP (tax ID) 5223019335, REGON 147452308 (hereinafter: "ViewPro", "we").
Office and warehouse address: ul. Skoroszewska 2B/37, 02-495 Warszawa.
For any matter concerning personal data, write to info@viewpro.pl or by post to the registered address. You can also use the contact address of the brand you are using (section 2); they all lead to us.
We have not appointed a data protection officer. In data matters you contact us directly.

2 Which websites and services this policy covers

The policy applies to all ViewPro websites: - viewpro.pl and viewpro.eu, online shop (contact: info@viewpro.pl, for the English-language shop viewpro.eu also contact@viewpro.eu, tel. +48 578 439 776), - fotillo.com together with the subdomains builder.fotillo.com, editor.fotillo.com and cloud.fotillo.com, the shop and services of the Fotillo software (contact: contact@fotillo.com), - sesjaparty.pl, photo booth rental and the related photo sharing service (contact: info@sesjaparty.pl, tel. +48 66 688 18 07), - pocztowkomat.pl and postcard-kiosk.eu, postcard kiosks and the related sharing service (contact: info@pocztowkomat.pl), - mycheckr.pl and mycheckr.eu, information about MyCheckr age verification devices, - skillsmasters.pl, advisory services of the Skills Masters brand (contact: info@skillsmasters.pl).
The policy also covers data processing outside our websites: order handling, correspondence, meetings, advisory and hosting services, and the operation of our devices (photo booths and postcard kiosks).
Only the Polish-language version of this policy is legally binding. Translations are provided for information purposes.

3 Our roles: when we are the controller and when we process data on behalf of others

We act in several roles at the same time, and this is the most important thing to understand in this policy.

We are the controller of data that reaches us in connection with our own business: purchases in our shops, customer accounts, correspondence, the newsletter, the Fotillo Builder configurator, reviews, marketing, meetings, and photos taken with our own devices (SesjaParty photo booths, postcard kiosks).
We are a processor (within the meaning of Art. 28 GDPR) when we store data on behalf of our customers. This applies to: - the Fotillo Cloud service: the controller of photos and other content is the operator of the device running the Fotillo software, and we store that content on the operator's behalf under a data processing agreement (DPA) accepted at purchase, at software download or at activation, - hosting provided to clients under individual agreements, - managing clients' social media channels as part of Skills Masters advisory services.
If your photo was taken in a photo booth or another device that does not belong to us, the controller of your data is the operator of that device. Address your requests to the operator. We assist operators in handling them, and we let anyone delete a photo themselves directly on the sharing page (section 5.8).

4 Where your data comes from

Most often directly from you: from forms, orders, messages and conversations. In our device-based services, data (photos) is created while you use the device. In the Fotillo Cloud service, content is submitted by the device operator or by people using the device. In advisory and hosting services, materials are provided by our clients. From payment providers we receive only the transaction status, never your card details.

5 What we process, why, and on what legal basis

5.1 Purchases in our shops (viewpro.pl, viewpro.eu, fotillo.com)

To fulfil an order we process: name or company name, address, e-mail, phone number, tax ID (for invoices), order and payment details (without card data).
Legal bases: performance of a contract (Art. 6(1)(b) GDPR), tax and accounting obligations (point (c)), establishing and pursuing claims (point (f)).
Payments are handled by external providers who are independent controllers of your transaction data. In the viewpro.pl and viewpro.eu shop: IdoPayments sp. z o.o. (the IdoPay gateway: BLIK, cards, fast transfers), Stripe (including Apple Pay and Google Pay), PayPal and PayPo. In the fotillo.com shop: Paynow (mBank S.A.), Przelewy24 (PayPro S.A.), Autopay S.A. (card payments), PayPal and PayPo. We do not receive or store payment card data.
For delivery, we pass the recipient's data to carriers (DPD, GLS, InPost), also via courier brokers (the Broker service within the IdoSell platform, settled by IAI S.A., and Alsendo). Some orders are shipped directly by our supplier in a dropshipping model, to whom we pass the data needed to dispatch the parcel.
The viewpro.pl and viewpro.eu shop runs on the IdoSell platform provided by IAI S.A., which processes shop data on our behalf.

5.2 Customer account

We maintain your account at your request (Art. 6(1)(b) GDPR): profile data, order history, addresses.
Inactive accounts are deleted or anonymised according to the clock described in section 8, always after prior notice sent by e-mail 30 days in advance. Deleting an account does not delete order and invoice data, which have their own statutory retention periods.
In the viewpro.pl and viewpro.eu shop you can also log in via the IdoAccounts service, i.e. with an account created in another shop running on the IdoSell platform. The service is provided by IAI S.A. under its own terms; we receive only the data needed to log you in and handle your order.

5.3 Complaints, returns and withdrawal from the contract

We process the data of the request, the correspondence and the refund settlement. Legal bases: performance of a contract and legal obligations towards consumers (Art. 6(1)(b) and (c) GDPR) and defence against claims (point (f)).
You can withdraw from a contract, among other ways, using the button available on the shop's website and in the message confirming order fulfilment.

5.4 Invoices and accounting

We process invoice and accounting data because the law requires it (Art. 6(1)(c) GDPR).
We issue structured invoices in the National e-Invoicing System (KSeF), operated by the Polish tax administration.
We entrust bookkeeping to an external accounting office under a data processing agreement.

5.5 Contact: forms, e-mail, phone

When you write or call, we process your contact details and the content of the correspondence in order to respond and handle the matter (legitimate interest, Art. 6(1)(f) GDPR, and where the matter concerns a contract, also point (b)).
Forms on our websites go to the mailboxes of the relevant brand. Our e-mail is hosted by a Polish hosting provider under a data processing agreement.
Our telephony runs on a mobile network operator, which, as an independent controller, processes call and SMS data in accordance with telecommunications law.

5.6 Newsletter

We send the newsletter only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time, including via the link in the footer of every message.
We use MailerLite to handle mailings, and in the viewpro.pl and viewpro.eu shop the newsletter feature of the IdoSell platform (IAI S.A.). Both providers process subscriber data on our behalf.

5.7 Fotillo Builder and Template Editor

Builder is a free configurator of Fotillo software packages (builder.fotillo.com). To download a package you provide an e-mail address, to which we send an individual download link, valid for a limited time and with a download limit. Legal basis: a contract for the supply of digital content (Art. 6(1)(b) GDPR).
We record the IP address and a log of issued packages to protect the service against abuse and to demonstrate to whom and when we provided the software (Art. 6(1)(f) GDPR).
Enquiries sent through the Builder form are handled like correspondence (5.5). Signing up for the newsletter in Builder is voluntary and separate (5.6).
When you download a package that includes online features (Fotillo Cloud), we require the operator's details and acceptance of the Fotillo Cloud Terms of Service together with the data processing agreement (DPA).
The Fotillo Template Editor (editor.fotillo.com) works without registration or login; we collect no personal data there beyond standard server logs (section 12).

5.8 Fotillo Cloud (cloud.fotillo.com and instances under our service brands)

Fotillo Cloud is a service for storing and sharing photos and other content submitted from devices running the Fotillo software (e.g. sharing a photo via a link or QR code, sending a photo from a phone for printing). The service is hosting in nature: we store content submitted at users' request.
The controller of the content is the operator of the device it comes from. We act as a processor under a data processing agreement (DPA). The exception is our own devices (section 5.9), for which we are the controller ourselves.
Content is deleted automatically 2 years after submission. Backups at our hosting provider are overwritten in a cycle of up to 7 days, so deletion becomes fully effective at the latest after that time.
Two paths are available on the sharing page: - "Delete photo": anyone holding the link can delete the content immediately and on a self-service basis, without any assessment on our side, - "Report abuse": reports of illegal content or content violating the terms are reviewed by us; the content remains available pending the decision, and in justified cases we may preserve it as evidence. A report includes the reporter's name (or entity name) and e-mail address, to which we send the decision; the exception is reports concerning child sexual abuse material, which may be submitted anonymously. Legal basis: our legal obligations as a hosting provider and legitimate interest (Art. 6(1)(c) and (f) GDPR).
When content is submitted, we require acceptance of the terms and record a consent log covering: device identifier, IP address, the version of the accepted terms, the list of submitted files, browser information and the time. We do not link this log to anyone's identity and we use it for nothing other than demonstrating compliance and keeping the service secure (Art. 6(1)(f) GDPR). We keep the log for 2 years.
We are also the controller of the records of acceptance of the Terms and the DPA (time, document versions) and of licence activation and subscription data. We process them to demonstrate that contracts were concluded and to service licences (Art. 6(1)(b) and (f) GDPR), for the period indicated in section 8 for commercial records.
The sharing and upload pages contain no external tracking tools.

5.9 SesjaParty photo booths and postcard kiosks

SesjaParty photo booths and our postcard kiosks (pocztowkomat.pl, postcard-kiosk.eu) are our own services. We are the controller of photos taken with these devices and of the data created when they are shared.
Information about the terms and this policy is displayed on every device. Legal bases: a contract with the person using the device (Art. 6(1)(b) GDPR), and towards other people visible in the photo, our legitimate interest in performing the service ordered by the person using the device (point (f)).
We store photos for 2 years, after which they are deleted automatically. You can delete a photo earlier yourself with the "Delete photo" button on the sharing page.
If you share a link to a photo, you are responsible for who you give it to.
We publish photos of people using our services in our marketing materials and social media channels only with those people's consent.

5.10 Hosting for clients

We provide hosting under individual agreements. With regard to data placed by the client on hosted websites, we act as a processor under a data processing agreement, and the infrastructure is provided by our hosting provider as a sub-processor.

5.11 Skills Masters advisory services

As part of our advisory services (strategy, marketing, technology, operations) we process clients' contact details and the materials they provide to us, in order to deliver the service (Art. 6(1)(b) and (f) GDPR).
Where we manage a client's social media channels or publish content on their behalf, we do so on their instructions. For planning and publishing we use the Metricool tool, which then acts as a sub-processor.
For our work we use the corporate Google Workspace and Microsoft 365 environments and the tools described in section 5.15.

5.12 Online meetings and their recordings

We hold meetings via Google Meet. Some meetings are recorded and transcribed with the Fireflies tool so that we can prepare notes and reliably follow up on what was agreed (Art. 6(1)(f) GDPR).
We always announce recording at the start of a meeting. You may object, in which case the meeting is not recorded.
We keep recordings and transcripts for 12 months, because we often act on meeting outcomes in cycles longer than six months. Fireflies processes them on our behalf under a data processing agreement.

5.13 Product reviews

We accept only purchase-verified reviews, so you can be sure they come from real customers. We do not edit or modify review content; we only block reviews that are vulgar or contain prohibited content. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). In the viewpro.pl and viewpro.eu shop we collect and display reviews using the Zaufane Opinie / Trusted Reviews service (smile.pl), whose provider processes data on our behalf; after a purchase you may receive an e-mail invitation to leave a review.

5.14 Social media

We run our brands' profiles on Facebook, Instagram, YouTube, LinkedIn, X and Google Business Profile. When you interact with them, we process the data visible within the given platform (Art. 6(1)(f) GDPR).
With regard to page statistics, the platform operators (e.g. Meta) are joint controllers, under the rules described in their own policies.
For planning and publishing posts we use the Metricool tool acting on our behalf.

5.15 AI tools in our work

We say this openly: in our daily work we use AI assistants, including for handling correspondence and preparing documents and content. We use only business plans with data processing agreements in place: ChatGPT (OpenAI) and Claude (Anthropic). Under these plans the providers do not use the data we submit to train their models. Decisions in your matters are always made by a human.

6 Who we share data with

We do not sell data. We share it only where necessary for our services to work, in two categories.

Processors acting on our behalf (under data processing agreements): - IAI S.A. (the IdoSell shop platform and courier broker), - home.pl S.A. (e-mail and hosting of some websites), - SEOHOST sp. z o.o., ul. Obornicka 330, Poznań (hosting of websites and Cloud services), - MailerLite (newsletter), - Fireflies.ai (meeting recordings and transcripts), - OpenAI and Anthropic (AI assistants on business plans), - Metricool (planning and publishing social media content), - the provider of the Zaufane Opinie / Trusted Reviews service, smile.pl (collecting and displaying reviews in the viewpro shop), - our accounting office (bookkeeping), - Alsendo (parcel dispatch intermediary, mainly for service shipments), - the supplier shipping some orders in the dropshipping model, - Google (Google Workspace) and Microsoft (Microsoft 365) as providers of our corporate work environments.
Independent controllers to whom we disclose data in connection with our services: - payment providers: IdoPayments sp. z o.o., Stripe, PayPal, Paynow (mBank S.A.), PayPro S.A. (Przelewy24), Autopay S.A., PayPo, and banks, - carriers: DPD, GLS, InPost, - the telecommunications operator handling our telephony, - social media platform operators, - public authorities where the law requires it (including the tax administration within KSeF).

7 Transfers outside the European Economic Area

As a rule, we process data within the EEA.
Some of our providers (Stripe, PayPal, Google, Microsoft, OpenAI, Anthropic, Fireflies) may transfer data to the USA. This takes place on the basis of the adequacy decision for the Data Privacy Framework, and where a provider is not covered by it, on the basis of Standard Contractual Clauses (SCC). Information about the safeguards is available on request.
If in the future we decide to store Cloud service content in infrastructure outside the EEA, we will do so only with SCC safeguards in place and we will update this policy.

8 How long we keep data

Data	Period
Invoices and accounting records	6 years from the end of the calendar year
Order and contract data	6 years from the end of the calendar year
Complaints, returns, correspondence	6 years from the end of the calendar year
Inactive customer account	deletion or anonymisation 6 years from the end of the year of the last activity, after e-mail notice 30 days in advance
Photos and content in our services (Fotillo Cloud, SesjaParty, Pocztówkomat)	2 years from submission or creation
Consent log for content submissions	2 years
Abuse reports	2 years from resolution
Builder records (download links, issue log)	2 years
Meeting recordings and transcripts	12 months
Newsletter	until consent is withdrawn
Cookies	as set out in the tables in section 13

Backups at our hosting providers are overwritten in a cycle of up to 7 days, so deleted data disappears from backups at the latest after that time. These periods may be extended only for the duration of an ongoing dispute or proceedings.

9 Your rights

You have the right to: access your data and obtain a copy of it, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time (without affecting the lawfulness of processing carried out before the withdrawal).
Send requests to info@viewpro.pl or to the contact address of the brand you are using. We respond within one month at the latest.
You can delete a photo shared in our services yourself, immediately, using the "Delete photo" button on the sharing page, without contacting us.
If the controller of your data is a device operator (section 3), your requests will be handled by the operator; we provide the operator with the necessary assistance on their instructions.
You have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.

10 Do you have to provide data

Providing data is voluntary, but without it we cannot fulfil an order, reply to a message or perform a service. Required fields are marked in our forms.

11 Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. We plan to introduce automatic preliminary filtering of prohibited content in our Cloud services; the decision to remove content will always be made by a human, and we will announce the roll-out in an update to this policy.

12 How we protect data

We encrypt data in transit (TLS). Our servers keep standard logs (IP address, time and type of request), necessary for security and diagnostics. Access to data is limited to people who need it for their work, bound by contracts and confidentiality obligations. We conclude data processing agreements with our service providers. Work computers have encrypted drives, and we work on client data only in our corporate environments. Content in the Cloud services is accessible only via individual, hard-to-guess links, and the pages of these services contain no tracking tools.

13 Cookies

13.1 Common rules

Cookies are small files stored on your device. We use two categories: - necessary and functional (required): needed for the site to work (session, cart, login, security, payment handling, remembering your settings and consent decision). They do not require consent and are always active, - analytics and advertising: they help us understand how our sites are used and tailor content (including Google Analytics, conversion tracking, product recommendations). They run only with your consent given in the banner.
The consent banner operates on: viewpro.pl, viewpro.eu, fotillo.com, sesjaparty.pl, pocztowkomat.pl and postcard-kiosk.eu. You give consent actively and you can change or withdraw it at any time in the banner settings on the given site.
Our remaining websites (the sharing and upload pages of the Cloud services, mycheckr.pl, mycheckr.eu, skillsmasters.pl) use only necessary cookies and do not display a banner.
Our sites embed elements of external services (e.g. Google maps, reCAPTCHA, videos, payment modules). The providers of these services may set and read their own cookies in their own domains (e.g. google.com), in accordance with their own privacy policies, over which we have no control.
You can also restrict or delete cookies in your browser settings. Blocking necessary cookies may prevent some features from working, e.g. the cart.
We process data from analytics tools in statistical form, to assess and improve how our sites work (Art. 6(1)(a) GDPR in conjunction with the Polish Electronic Communications Act).

13.2 Cookie list: viewpro.pl and viewpro.eu

The list reflects the shop's configuration on the IdoSell platform. An automatically generated version of this list, updated whenever shop functionality changes, is also available in the shop.

Functional cookies (required)

Name	Provider	Purpose	Period
monit_token	shop (IdoSell)	identifies the shop's customer	365 days
shop_monit_token	shop (IdoSell)	identifies the shop's customer	30 minutes
client	shop (IdoSell)	identifies the logged-in customer / cart of a non-logged-in customer	1 day
affiliate	shop (IdoSell)	ID of the partner from which the shop was entered	90 days
ordersDocuments	shop (IdoSell)	document print status	session
__idsui	shop (IdoSell)	so-called lightweight login on the site	1095 days
__idsual	shop (IdoSell)	so-called lightweight login on the site	1095 days
__IAI_SRC	shop (IdoSell)	source from which the page was accessed	90 days
login	shop (IdoSell)	whether the user has logged in	session
CPA	shop (IdoSell)	variables for CPA/CPS programmes	28 days
cpa_currency	shop (IdoSell)	currency for CPA/CPS programmes	60 minutes
IAIRSABTVARIANT	shop (IdoSell)	A/B test variant of the IdoSell RS engine	30 days
IAIABT	shop (IdoSell)	A/B test identifier	30 days
IAIABTSHOP	shop (IdoSell)	identifier of the shop taking part in an A/B test	30 days
IAIABTVARIANT	shop (IdoSell)	variant drawn in the ongoing A/B test	30 days
basket_id	shop (IdoSell)	cart identifier	365 days
basket_products_count	shop (IdoSell)	number of products in the cart	session
wishes_products_count	shop (IdoSell)	number of products on the favourites list	session
page_counter	shop (IdoSell)	counter of visited pages	1 day
LANGID	shop (IdoSell)	selected language	180 days
REGID	shop (IdoSell)	user's region	180 days
CURRID	shop (IdoSell)	selected currency	180 days
HOMELANDID	shop (IdoSell)	visitor's country	180 days
samedayZipcode	shop (IdoSell)	postcode for SameDay deliveries	90 days
applePayAvailability	shop (IdoSell)	availability of Apple Pay	30 days
paypalMerchant	shop (IdoSell)	PayPal account ID	1 day
paypalAvailability_	IdoSell	availability of PayPal	1 day
toplayerwidgetcounter[]	shop (IdoSell)	number of pop-up message displays	session
toplayerNextShowTime_	shop (IdoSell)	time of the next pop-up display	session
toplayerwidgetcounterclosedX_	shop (IdoSell)	closing of a pop-up message	session
rabateCode_clicked	shop (IdoSell)	closing of the active discount bar	1 day
freeeshipping_clicked	shop (IdoSell)	closing of the free delivery bar	1 day
redirection	shop (IdoSell)	closing of the suggested-language message	session
filterHidden	shop (IdoSell)	remembering collapsed product list filters	365 days
remembered_shop_mfa	shop (IdoSell)	remembering multi-factor login	365 days
platform_id	IdoSell	whether the page is displayed in the mobile app	session
ck_cook	IdoSell	remembering the cookie consent decision	3 days
iai_accounts_toplayer	IAI S.A.	message about the IdoAccounts login service	30 days
accounts_terms	IdoAccounts	acceptance of the IdoAccounts service	365 days
express_checkout_login	IdoAccounts	express checkout login	365 days
NID	Google	user preferences; required for Google Pay	180 days
_GRECAPTCHA	Google reCAPTCHA	protects forms against spam	1095 days
ts, x-pp-s, nsid	PayPal	operation and security of PayPal payments	session
ts_c	PayPal	fraud prevention	1095 days
tsrce	PayPal	operation of PayPal payments	3 days
enforce_policy	PayPal	operation of PayPal payments	365 days
l7_az	PayPal	PayPal login function	60 minutes
LANG	PayPal	operation of PayPal payments	1 day

Analytics cookies (with consent)

Name	Provider	Purpose	Period
_ga	Google	Google Analytics, distinguishing users	2 years
ga*	Google	Google Analytics 4, measurement session state (the name suffix is the property identifier)	2 years
__IAI_AC2	IAI S.A.	conversion tracking and order source history (last click attribution)	45 days
SID	Google Maps	encrypted Google account identifier; together with HSID protects against attacks	3650 days

We use Google Tag Manager to manage scripts on the site. It does not set cookies itself, but it launches analytics tools only after consent is given in the banner.

Advertising cookies (with consent)

Name	Provider	Purpose	Period
RSSID	shop (IdoSell RS)	product recommendations tailored to the user	180 days
IAIRSUSER	shop (IdoSell RS)	product recommendations tailored to the user	60 minutes

13.3 Cookie list: fotillo.com

Necessary and functional cookies (required)

Name	Purpose	Period
shop session cookies	session and cart handling	session
firstvisit	remembering the first visit	365 days
banner consent cookie	remembering your cookie decision	12 months