Draft — this document is under legal review and not yet binding.

Privacy policy

Last updated 2026-10-24

This policy explains what personal data the AVRELAY website at https://avrelay.eu processes, why, and what rights you have under the GDPR (Regulation (EU) 2016/679).

1. Controller

The controller of your personal data is Newron Sp. z o.o., ul. ks. Szramka 13, 42-700 Lubliniec, Poland, NIP (VAT ID) [to be completed], KRS [to be completed]. Contact for all data protection matters: przemek@systemav.pl.

2. What we process and why

• Orders. When you buy a licence: e-mail address, company name, VAT ID, billing address and country, the processor MAC address, the optional project name, the language of the page you ordered from, the time of your consent to immediate delivery, the order amounts, the card brand and last four digits (from Stripe) and the IP address of the order. Purpose: concluding and performing the contract — art. 6(1)(b) GDPR.
• Subscription reminders. If you hold a subscription licence, we e-mail you 30 and 7 days before it ends, with a link to renew it for the same processor. Purpose: performing the contract (telling you that the subscription you bought is ending) — art. 6(1)(b) GDPR.
• Accounting. Invoices and order records, kept for as long as tax law requires: at least 5 years from the end of the year of the sale, and 10 years for sales to consumers in other EU countries settled under the OSS scheme. Purpose: tax and accounting obligations — art. 6(1)(c) GDPR.
• Security. IP addresses in server logs (which also record the address each order or licence e-mail was sent to) and in short-lived rate-limit counters, used to keep the store and the admin panel safe and to check that e-mails were delivered; log lines are deleted after 180 days, counters within a day. Purpose: our legitimate interest in protecting the service — art. 6(1)(f) GDPR.
• Enquiries. What you write to przemek@systemav.pl, to answer you — art. 6(1)(f) GDPR (or art. 6(1)(b) when it concerns an order).
• My drivers. Signing in to My drivers uses the e-mail, VAT ID or order number and MAC address you type; we only compare them with existing orders.

Apart from order, licence and subscription e-mails we send no newsletters or marketing e-mails. We do not use analytics, advertising or tracking cookies, and we do not sell or share data for marketing.

3. Recipients

• Hosting: Hostinger, which stores the website and the order database for us.
• Payments: Stripe, which processes the payment, including the cardholder name and card details you enter on its payment page. For fraud prevention and its own legal obligations Stripe is also a separate controller under its own privacy policy. Stripe may process data in the United States; transfers rely on the EU–US Data Privacy Framework and standard contractual clauses.
• E-mail: our mail provider, which delivers order and licence e-mails.
• Accounting: our accounting office and invoicing system, including the Polish national e-invoicing system (KSeF), which receive the data needed for the invoice.
• Authorities, when the law requires it.

4. Cookies and local storage

The site uses only strictly necessary cookies, which need no consent:

• avr_my — keeps you signed in to My drivers, for 24 hours;
• avr_store_owner — the store owner's preview mode, 7 days, set only in the owner's browser;
• the admin session cookie — only for the site administrator.

Your browser's local storage keeps two small entries, both only on your device: avr_lang_hint remembers that you closed the "Polska wersja" language hint, and on some driver pages lang remembers the language you picked.

5. Content from other services

• Fonts are served from our own server; no third party sees your visit to load them.
• Videos are embedded from youtube-nocookie.com and play only after you click. Before that the page shows the video's preview image, which your browser loads from YouTube (i.ytimg.com), sending its IP address to Google.
• Links to distributors carry a tag (for example utm_source=avrelay) so that they know the visit came from us; we do not send them your personal data.

6. How long we keep data

Order data for as long as the contract lasts and then for the accounting period (section 2); licence data for as long as a licence can be used, so that we can resend keys; log lines 180 days; e-mail correspondence for as long as needed to answer and for the limitation period of claims.

7. Your rights

You have the right of access to your data, to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on our legitimate interest. Write to przemek@systemav.pl. You also have the right to lodge a complaint with the supervisory authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warszawa.

Giving data at checkout is voluntary but necessary to conclude the contract: without an e-mail address and a MAC address we cannot deliver a licence. We do not make decisions based solely on automated processing, including profiling.