← stanto.pl

Privacy policy

Last updated: 2026-10-12

1. Who is responsible for your data

The data controller is KAPOKWEB Tomasz Kampe, ul. Młyńska 18/40, 32-005 Niepołomice, NIP PL6831997329, REGON 123214875 ("we", "Stanto"). Contact: [email protected].

This policy covers the stanto.pl website, the stanto.app web application and the Stanto Android app.

2. Two roles: controller and processor

Account data (the person who creates the account, panel users) and billing data are processed by us as the controller.

Data a customer company enters into Stanto about its staff and operations (users, scanner operators, products, inventories, deliveries, carts) is processed by us on that company's behalf as a processor, under a data processing agreement. For that data, the controller is your employer or principal.

3. What data we process

  • Account: name, e-mail address, password (only as a hash), language, role and assigned locations; with Google or company SSO sign-in — the account identifier at that provider.
  • Scanner identification: a hash of the badge (QR code) and of the PIN — never in clear text.
  • Company data: name, tax ID, address, contact person — for invoices and billing.
  • Operational data: scans, quantities, serial numbers, deliveries, carts, product photos, with who recorded them, on which device and when.
  • Devices: name, hardware identifier assigned at activation, app version, last sync time, app error logs.
  • Technical data: IP address and browser data in server logs (security, diagnostics).
  • Payments: sales documents and payment status; card or bank details are processed only by the payment provider.
  • stanto.pl statistics: anonymised visit statistics (no cookies) and — with consent — cookie data of Google and LinkedIn tools.

4. Purposes and legal bases

  • Providing the service and the account — Art. 6(1)(b) GDPR (contract).
  • Billing, invoices, keeping accounting records — Art. 6(1)(c) GDPR (legal obligation).
  • Security, abuse prevention, legal claims, error diagnostics — Art. 6(1)(f) GDPR (legitimate interest).
  • E-mails the service needs (address confirmation, password reset, invitations, payment notices) — Art. 6(1)(b) GDPR.
  • Ad measurement and analytics using cookies — Art. 6(1)(a) GDPR (consent you can withdraw at any time).

5. Who we share data with

We use providers that process data on our behalf:

  • Google Cloud (servers and database, EU region — Belgium),
  • Cloudflare (delivery of stanto.pl and DNS),
  • Fakturownia (invoices and pro formas),
  • Przelewy24 (online payments),
  • an e-mail delivery provider (messages from the service),
  • Umami (cookieless visit statistics for stanto.pl),
  • Google (Sign in with Google; with consent: Google Tag Manager, Google Analytics, Google Ads) and LinkedIn (with consent: LinkedIn Insight Tag),
  • integrations a customer turns on itself (e.g. SAP, Comarch Optima, BaseLinker, an FTP server) — data goes there on the customer's instruction.

Some of these providers are based outside the European Economic Area (USA). Transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. We do not sell data.

6. How long we keep data

  • Account and operational data — while the service is used; after a company account is deleted — up to 30 days (backups up to 14 days longer).
  • Billing records — 5 years from the end of the tax year.
  • Server logs — up to 30 days; app error logs — up to 90 days.
  • Cookie data — until consent is withdrawn or the cookie expires (at most 13 months).

7. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object, and to withdraw consent at any time (without affecting earlier processing). Write to [email protected]. If the company you work for entered your data into Stanto, its account administrator can help fastest — we will forward any request to them as well.

You may lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or the authority of your country.

8. Cookies

stanto.pl and the stanto.app sign-in pages show a consent banner. Without consent only essential storage runs (your banner choice, theme, the panel session); visit statistics are then collected without cookies. With consent, Google and LinkedIn ad measurement tools load. To change your choice, clear the site's cookies in the browser and the banner shows again.

Inside the panel (after signing in) no third-party advertising or analytics tools are loaded.

9. Mobile app

  • Camera — only to scan barcodes, activation codes and badges; images are neither stored nor sent anywhere.
  • Device storage — what offline work needs (catalog, product photos, the queue of scans to sync), removed when the device is signed out.
  • The app does not use location, contacts or the microphone and contains no ads.

10. Security

Connections are encrypted (HTTPS). Passwords, PINs and badges are stored only as cryptographic hashes, customers' integration credentials encrypted. Access to data in the panel is limited by the roles and locations the company assigns.

11. Children

Stanto is a business tool and is not intended for people under 16.

12. Changes

We will announce material changes by e-mail or a notice in the panel. The date of the last update is at the top of this page.