Privacy notice
Information about the processing of personal data, under Article 13 of Regulation (EU) 2016/679 (GDPR). Version 1.0, effective 2 August 2026.
1. Who the controller is
The controller of your personal data is Piotr Gajownik - ExpandIt, ul. Paryska 20B, 44-240 Żory, Poland, tax identification number (NIP) 5321875710 (EU VAT: PL5321875710), referred to below as "we" or "the controller".
For anything concerning personal data, write to support@vallus.eu.
We have not appointed a data protection officer; we are not required to. All matters are handled at the address above.
2. What we collect, and where it comes from
We collect only what you type into one of the three forms on this site: the demo booking form, the free licence request and the contact form. We do not buy data, do not obtain it from external databases, and do not profile visitors.
| Data | Demo booking | Licence request | Contact form |
|---|---|---|---|
| Name | required | - | optional |
| Work e-mail address | required | required | required |
| Company name | optional | required | - |
| Phone number | optional | - | - |
| Number of people who would use the product | optional | - | - |
| Topic or subject | optional | - | optional |
| Message | optional | - | required |
| Preferred meeting slot | optional | - | - |
The licence request is the one place where a company name is required. It is written into the licence key itself, which is issued to a named licensee, so a key cannot be produced without it. If you ask us to erase that data the free licence ends: the key may no longer be used, and we will confirm its removal on request.
The licence form also carries an optional tick box for product updates by e-mail. It is off by default, it has no bearing on whether you get a licence, and you can withdraw it at any time by writing to the address in section 1.
If the booking service is temporarily unavailable, the form opens your own e-mail client with the request filled in. In that case nothing leaves your device until you send the message yourself.
3. Why we process it, and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Arranging and holding a product demonstration, answering your enquiry | Art. 6(1)(b) GDPR - steps taken at your request before entering into a contract | 6 months from the last contact |
| Sales contact and keeping in touch with a prospective customer | Art. 6(1)(f) GDPR - our legitimate interest in selling our own product | until you object, and no longer than 6 months from the last contact |
| Entering into and performing a licence agreement, invoicing | Art. 6(1)(b) and (c) GDPR - tax and accounting obligations | the period required by law, as a rule 5 years from the end of the tax year |
| Sending product updates by e-mail, where you have ticked the box | Art. 6(1)(a) GDPR - your consent | until you withdraw consent |
| Establishing or defending legal claims | Art. 6(1)(f) GDPR | until the claims become time-barred |
Providing the data is voluntary, but each form has a minimum without which we cannot act: a name and an e-mail address to arrange a meeting, an e-mail address and a message to reply to an enquiry, and a company name with an e-mail address to issue a licence key. Every other field may be left empty.
4. Who else sees the data
We do not sell data and do not share it for marketing purposes. We do use providers who process it on our behalf, under data processing agreements concluded in accordance with Article 28 GDPR:
| Provider | Country | Scope |
|---|---|---|
| BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana | Slovenia (EU) | hosting of the site and of the service that receives bookings |
| Infomaniak Network SA | Switzerland | the calendar the meeting is created in, e-mail, and the internal chat that contact form messages are delivered to |
Switzerland is covered by a European Commission adequacy decision (Art. 45 GDPR), and Infomaniak stores the data exclusively in Switzerland. We do not transfer data to countries without such a decision, in particular not to the United States.
Data may also be disclosed to public authorities where they are entitled to request it by law.
5. Cookies and anything stored in your browser
This site sets no cookies. We use no analytics, embed nothing from third-party services, and make no requests outside our own infrastructure. Typefaces are served from the site itself rather than fetched from an external server.
The only thing we store in your browser is a note that you have dismissed the privacy message, so that it is not shown on every visit. It is kept in local storage, is not a cookie, does not identify you, and you can remove it at any time by clearing site data in your browser settings.
If we ever add tools that require your consent, we will ask for it separately, before anything is loaded.
6. Your rights
In relation to this processing you have the right to:
- access your data and obtain a copy of it,
- have inaccurate data corrected and incomplete data completed,
- have your data erased,
- restrict the processing,
- port your data to another controller,
- object to processing based on our legitimate interest - including to sales contact.
To exercise any of these, write to support@vallus.eu. We reply without undue delay and within one month at the latest.
You also have the right to lodge a complaint with a supervisory authority. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
7. Automated decisions and profiling
We take no automated decisions about you and do not profile you. The meeting slots you see in the form come solely from what is free in our calendar - they do not depend on who you are or where you are visiting from.
8. Changes to this notice
If we change how we process data, we will update this document and the effective date shown at the top. Where the change is significant, we will tell the people we are in contact with.