Privacy policy 1 Privacy Policy Data Controller Personal data provided by users of the Vestango website (vestango.com) and subscribers of the Vestango Regulatory Intelligence Platform are processed by: Vestango Sp. z o.o. ul. Promienna 35/1, 05-090 Falenty Nowe, Warsaw, Poland contact@vestango.com Data is processed in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR). Vestango Sp. z o.o. has not appointed a Data Protection Officer, as the nature and scale of our processing activities do not meet the thresholds requiring such appointment under Article 37 GDPR. For all data protection enquiries, please contact us at contact@vestango.com. 2 Data Processing What Personal Data We Collect and Why 2.1 — Website visitors (vestango.com) Vestango collects personal data submitted by website users through electronic contact forms. This data is used to respond to enquiries and, where you have given explicit consent, to provide information about Vestango’s products and services. Purpose Legal basis Responding to enquiries via contact forms Legitimate interest in communicating with prospective clients (Article 6(1)(f) GDPR) Sending marketing communications by email Your prior consent (Article 6(1)(a) GDPR) Website analytics (Google Analytics) Your prior consent via cookie banner (Article 6(1)(a) GDPR) You may withdraw your consent to marketing communications at any time by contacting us at contact@vestango.com or by clicking the unsubscribe link in any marketing email. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Data submitted via online forms is protected by SSL encryption. 2.2 — Subscribers of the Vestango Regulatory Intelligence Platform When you subscribe to the Vestango Regulatory Intelligence Platform (the “Platform”), we collect and process the following personal data: Data type Purpose Legal basis Email address API key delivery, subscription status communications, technical support Performance of a contract — Article 6(1)(b) GDPR Payment & billing data Processing subscription payments via Stripe, Inc. We do not store card details. Performance of a contract — Article 6(1)(b) GDPR API key Granting access to the Platform. Only a SHA-256 hash is stored — plaintext key is never retained after delivery. Performance of a contract — Article 6(1)(b) GDPR Usage logs Monitoring platform availability, detecting abuse, aggregate usage analytics. Not shared with third parties. Legitimate interest — Article 6(1)(f) GDPR For usage log processing, we have assessed that our legitimate interest in operating a secure and reliable platform is not overridden by the interests or fundamental rights of our subscribers. Automated decision-making: We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you. 3 Third Parties Disclosure of Personal Data Personal data collected by Vestango may be transferred only to entities authorised by law, or to the data processors listed below who process data on our behalf under data processing agreements. Collected personal data will not be disclosed to any other persons or entities unless required by law. Processor Role Location Stripe, Inc. Payment processing and subscription management USA (EU-US Data Privacy Framework) Fly.io, Inc. Cloud infrastructure hosting for the Platform’s API and MCP servers United Kingdom (London region) home.pl S.A. Transactional email delivery for API key and subscription notifications Poland Google LLC Website analytics via Google Analytics (where consent is given) USA (EU-US Data Privacy Framework) 4 Storage Data Retention Data type Retention period Website contact form data Duration necessary to handle the enquiry, then deleted unless a longer period is required by law Marketing consent records Until consent is withdrawn, then deleted within 30 days Subscriber email and subscription status Duration of active subscription + 12 months after cancellation or expiry API key hash Duration of active subscription + 12 months after cancellation or expiry Platform usage logs 12 months from the date of each log entry Payment records 5 years from the transaction date (accounting obligations under Polish law) 5 International International Data Transfers Platform infrastructure is hosted in the United Kingdom (Fly.io, London region), which the European Commission has recognised as providing an adequate level of data protection (adequacy decision of 28 June 2021). Payment data is processed by Stripe, Inc. and website analytics by Google LLC, both of which participate in the EU-US Data Privacy Framework (adequacy decision of 10 July 2023), providing equivalent safeguards for transfers of personal data to the United States. 6 GDPR Your Rights Right of access — Article 15 You may request a copy of the personal data we hold about you. Right to rectification — Article 16 You may request correction of inaccurate or incomplete data. Right to erasure — Article 17 You may request deletion of your data, subject to our legal retention obligations. Right to restriction of processing — Article 18 You may request that we limit how we use your data in certain circumstances. Right to data portability — Article 20 Where processing is based on your consent or on a contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format. Right to object — Article 21 You may object at any time to processing based on legitimate interest, including for direct marketing. Where you object to direct marketing processing, we will cease immediately. For other legitimate interest processing, we will cease unless we can demonstrate compelling legitimate grounds that override your interests. Right to withdraw consent — Article 7(3) Where processing is based on consent (e.g. marketing communications, analytics cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing. Right not to be subject to automated decision-making — Article 22 You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Vestango does not carry out such processing. To exercise any of these rights, contact us at contact@vestango.com. We will respond within one month of receiving your request. You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw — uodo.gov.pl 7 Security Security Measures We implement appropriate technical and organisational measures to protect your personal data, including: TLS encryption for all data in transit, SHA-256 hashing of API keys (plaintext keys are never stored after delivery), SSL protection for website forms, and access controls limiting data access to authorised personnel only. 8 Tracking Cookies What are cookies? Cookies are small text files stored by your web browser when you visit a website. They are divided into session cookies (stored until the browser is closed) and persistent cookies (stored for a specified period). Disabling cookies may cause some website functions to stop working. Your consent We use cookies that are not strictly necessary — in particular analytics and advertising cookies — only where you have given your prior consent via our cookie consent banner. You may withdraw or adjust your consent at any time by clicking the cookie settings link in the footer of our website, or by adjusting your browser settings. Strictly necessary cookies, which are essential for the website to function, do not require your consent and are used regardless of your preferences. Google Analytics Where you have consented, this website uses Google Analytics (provided by Google LLC) to analyse how users interact with it. Google Analytics uses cookies to collect information about your use of the website, including your IP address, which is transmitted to and stored by Google on servers in the United States. You can opt out at any time via the Google Analytics Opt-out Browser Add-on or by withdrawing consent through our cookie banner. Types of cookies used Cookie type Purpose Consent required? Strictly necessary Essential website functionality No Session cookies Maintained during a single browser session Depends on purpose Persistent cookies Stored for a defined period after the session ends Depends on purpose Analytics cookies (incl. Google Analytics) Anonymous statistical analysis of website usage Yes Advertising / tracking cookies Customising advertisements based on browsing behaviour Yes You can disable or limit cookies by adjusting settings in your browser (Chrome, Firefox, Safari, Edge, or other). 9 External Links to Other Websites This website may contain links to other websites with their own privacy policies. Vestango does not bear responsibility for the privacy practices of those websites. We recommend reviewing each site’s privacy policy independently. 10 Updates Changes to This Policy We may update this Privacy Policy as our services evolve. Changes will be published on this page with an updated date. We will notify subscribers of the Regulatory Intelligence Platform of material changes by email with at least 14 days’ notice before the changes take effect. Changes that affect the legal basis of processing will require your express acknowledgement before taking effect. Last updated — July 2026
