PRIVACY POLICY

This Privacy Policy describes how Ortvest ("Company", "we", "us") collects, uses, stores, and protects personal data of users ("you") who visit or interact with ortvest.com ("Website").

We process personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
• Polish Act of 10 May 2018 on the Protection of Personal Data
• Polish Telecommunications Law

The controller of your personal data is:

Ortvest
Website: ortvest.com
Contact email: contact@ortvest.com

For all matters related to personal data protection, you may contact us at the email address above.

When you submit the contact form or review form on our Website, we collect the following data:

3.1 Data you provide directly (contact form & review form)

Contact form:

• Name – your first and/or last name
• Email address – used to reply to your inquiry
• Project type (optional) – one of the following categories you select: P2P, Community, Hospitality, Conversion Site, Sporttech, Logistics, Agritech, Other
• Budget (optional) – selected budget range: Small task / consult, €1k–5k, €5k–15k, €15k+
• Consultation type – type of session requested: Discovery Call (Free) or Strategy Session (€199)
• Message (optional) – a free-text description of your project and timeline

3.2 Data you provide via the Review Form

• Name – your first and/or last name
• Role – your job title or position
• Company – the name of your organisation
• Rating – a numeric or star rating of your experience
• Review text – a free-text description of your experience working with us

3.3 Data collected automatically

• IP address
• Browser type and version
• Pages visited and time of visit
• Referral source (how you found the Website)

This data is collected via analytics tools (e.g., Google Analytics) to improve Website performance and user experience.

We do NOT collect sensitive personal data (health, political views, religious beliefs, financial details, etc.).

We process your data for the following purposes:

4.1 Responding to inquiries (contact form)

Legal basis: Art. 6(1)(b) GDPR – processing is necessary for taking steps at the request of the data subject prior to entering into a contract.

4.2 Direct marketing of our services (B2B)

Legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Company (marketing own services to business clients).

4.3 Analytics and Website improvement

Legal basis: Art. 6(1)(f) GDPR – legitimate interest in understanding how the Website is used and improving user experience.

4.4 Legal obligations

Legal basis: Art. 6(1)(c) GDPR – compliance with applicable legal obligations (e.g., accounting, tax records).

4.5 Publishing and displaying client reviews

We process review form data to publish client testimonials on our Website, subject to moderation.

Legal basis: Art. 6(1)(a) GDPR – consent. By submitting the review form, you voluntarily provide data intended for public display. You may withdraw consent at any time by contacting contact@ortvest.com, and we will remove your review.

Our Website uses cookies and similar technologies. Cookies are small text files stored on your device.

We use:

• Necessary cookies – required for the proper functioning of the Website
• Analytics cookies – e.g., Google Analytics (to analyse traffic and usage patterns)
• Marketing cookies – only if you have given explicit consent

You can manage cookie preferences through your browser settings or via our cookie consent banner. Refusing analytics or marketing cookies will not affect access to the Website.

We do not sell your personal data. We may share data with trusted third parties only to the extent necessary:

• IT service providers and hosting companies (data processors under GDPR)
• Email and CRM platforms (e.g., for managing inquiries)
• Analytics providers (e.g., Google Analytics)
• Legal, tax, or financial advisors, where required

All third-party processors are bound by data processing agreements in compliance with GDPR Art. 28.

Due to the international nature of our business, personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States and Ukraine. We ensure that all such transfers are carried out with appropriate safeguards as required by Chapter V of GDPR:

7.1 Transfers to the United States

Transfers to the US may occur via service providers (e.g., Google, cloud platforms). These transfers are carried out under Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Decision 2021/914), and where applicable, supplementary technical and organisational measures to ensure an equivalent level of data protection.

7.2 Transfers to Ukraine

Ukraine is not listed among countries recognised by the European Commission as providing an adequate level of data protection. Where personal data is transferred to Ukraine (e.g., for development or operational purposes), we rely on Standard Contractual Clauses (Art. 46(2)(c) GDPR) and implement additional safeguards including data minimisation, encryption in transit and at rest, and access controls. Where required, we will seek your explicit consent for such transfers (Art. 49(1)(a) GDPR).

You may request a copy of the safeguards applied to international transfers by contacting us at contact@ortvest.com.

We retain your personal data for as long as necessary:

• Inquiry data: up to 3 years from the last contact, or until you request deletion
• Client data (if a contract is concluded): 5 years from the end of the business relationship (tax and accounting requirements)
• Analytics data: as per the settings of the analytics provider (typically up to 26 months)
• Review data: retained for as long as the review is published on the Website, or until you request deletion by contacting contact@ortvest.com

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) – obtain a copy of your data
• Right to rectification (Art. 16 GDPR) – correct inaccurate data
• Right to erasure / "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR) – including direct marketing
• Right to withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at: contact@ortvest.com
We will respond within 30 days as required by GDPR Art. 12.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Polish supervisory authority:

Urzad Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warsaw, Poland
Website: uodo.gov.pl
Phone: +48 22 531 03 00

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure, or destruction. These include:

• Encrypted data transmission (SSL/TLS)
• Access controls and authentication
• Regular security reviews

Our Website may contain links to external websites. We are not responsible for the privacy practices of third-party websites and encourage you to review their privacy policies separately.

We reserve the right to update this Privacy Policy at any time. The current version will always be available on this page with the "Last updated" date. Continued use of the Website after changes constitutes acceptance of the updated Policy.

For any questions about this Privacy Policy or personal data processing, please contact us:
Email: contact@ortvest.com
Website: ortvest.com