What we do with personal data.

The controller is WIL TRADE sp. z o.o., and one address reaches it.

The controller of your personal data is WIL TRADE sp. z o.o., ul. Szosa Ełcka 13, 15-690 Białystok, Poland — the company set out in full in the block above. Quantika Commerce is a trading name, not a separate legal person, so writing to Quantika is writing to WIL TRADE.

Reach us at vitali@quantika.org. That is the only contact channel this site offers: there is no form on any page, no chat widget and no telephone number, so nothing reaches us unless you choose to write. Mail is answered by the person who runs the company, within one working day.

We have appointed no representative under Article 27 of the Regulation. Whether one is needed for the United Kingdom is an open question, listed at the end of this page; we assert neither answer here.

Source: Regulation (EU) 2016/679, Article 13(1)(a) — legislation.gov.uk/eur/2016/679/article/13/adopted.

There is no data protection officer, so there is no DPO address to give you.

We have not appointed a data protection officer. Article 13(1)(b) asks for the officer's contact details "where applicable", and here they are not applicable, because the post does not exist. We would rather tell you that plainly than print a mailbox and call it a DPO.

Questions about your data therefore go to the same place as everything else, vitali@quantika.org, and are handled by the person who runs the company rather than by a department.

Whether the company is obliged to appoint an officer has not been assessed. That assessment is one of the open points at the end of this page, not something this section settles by silence.

Source: Regulation (EU) 2016/679, Article 13(1)(b) — legislation.gov.uk/eur/2016/679/article/13/adopted.

Four purposes, and the ground each one stands on.

We use personal data for these purposes and no others.

• To answer you, and to quote. If you write about a store check or a build, we read what you sent, reply, and work out a scope and a price. Where you are the counterparty, the basis is Article 6(1)(b) of the Regulation — steps taken at your request before entering a contract. Where you write for a company and are not personally the counterparty, the basis is Article 6(1)(f), our legitimate interest in answering a business enquiry.
• To do the work we agreed. Running the check, building what was quoted, reporting on it. Basis: Article 6(1)(b), performance of the contract.
• To invoice and to keep the books. Issuing invoices and retaining them with what supports them. Basis: Article 6(1)(c), compliance with a legal obligation — specifically the accounting act of 29 September 1994 (ustawa o rachunkowości) art. 74, the Tax Ordinance (Ordynacja podatkowa) art. 86 § 1 read with art. 70 § 1, and the VAT act art. 112 and art. 112a ust. 1. What each of those requires, and for how long, is set out under Article 13(2)(a) below.
• To keep the site up. Serving these pages and keeping them free of abuse. Basis: Article 6(1)(f).

We do not use your data to advertise to you, we build no profile of you, and we sell nothing about you to anyone.

Sources: Regulation (EU) 2016/679, Article 13(1)(c), which requires the purposes and the legal basis, read with the grounds in Article 6(1) named above — legislation.gov.uk/eur/2016/679/article/13/adopted. For the legal obligation behind the third purpose: ustawa z 29.09.1994 o rachunkowości art. 74, consolidated text Dz.U. 2026 poz. 522 (api.sejm.gov.pl, Dz.U. 2026 poz. 522); Ordynacja podatkowa art. 86 § 1 and art. 70 § 1, Dz.U. 2026 poz. 622 (api.sejm.gov.pl, Dz.U. 2026 poz. 622); ustawa o podatku od towarów i usług art. 112 and art. 112a ust. 1, Dz.U. 2025 poz. 775 (api.sejm.gov.pl, Dz.U. 2025 poz. 775).

Where we lean on legitimate interest, here is the interest, in words.

Article 6(1)(f) appears twice above, and the Regulation says that when it does we must tell you what the interest actually is. Ours are small and ordinary. The first: being able to reply to a business enquiry written by a person who is not personally our client — a finance manager or a developer writing on behalf of a shop — because refusing to answer until a contract exists would make the enquiry pointless.

The second: keeping this website available and free of abuse. That is the interest behind hosting it, and behind counting page views in aggregate with the counter described below, switched on 17 September 2026.

We have not written a documented balancing test for either interest. That is a real gap and it is listed at the end of this page. Whatever such a test would conclude, the practical answer is the same: if you tell us to stop, we stop.

Source: Regulation (EU) 2016/679, Article 13(1)(d), read with Article 6(1)(f) — legislation.gov.uk/eur/2016/679/article/13/adopted.

Five recipients, and each is here because it is actually on the path.

We name what this site actually calls and what actually carries your mail, read out of the page source and out of how we have set our own mail up, rather than a generic list of trusted partners.

• Google Fonts. These pages request their typefaces from fonts.googleapis.com and fonts.gstatic.com. Your browser makes that request directly, so those servers see your IP address and the fact that you loaded a page here.
• Cloudflare, Inc., which serves this site. The site is deployed on Cloudflare Workers as static assets: the whole of one directory of finished files handed to Cloudflare, with no code of ours running there. We put no file count in that sentence on purpose — files get added and removed, and a number here would quietly go stale while the sentence went on looking checkable. So Cloudflare serves every page you read here and sees the request for it, your IP address included. This is a description of the arrangement as it stands, not of a plan — the pages you are reading came from Cloudflare a moment ago.
• Cloudflare Web Analytics. An aggregate page view counter, switched on 17 September 2026. Its tag sits in the source of two pages, the English home page and its Russian copy, and runs on everyone who opens either of them.
• Cloudflare Email Routing — this one reads your mail before we do. Mail addressed to quantika.org is handled by Cloudflare Email Routing: we have pointed the domain's MX records there, and Email Routing is what stands behind them. It is a forwarder, so every email you send to vitali@quantika.org — headers, body and attachments — passes through Cloudflare, Inc. on its way to the mailbox it is forwarded to. You should assume Cloudflare sees the content of anything you write to us.
• Google, as the provider of the mailbox that mail is forwarded into. The forwarding described above ends at a Gmail mailbox, so Google holds your message where it comes to rest — that is where we read it and where the thread is stored while we keep it, for the periods set out under Article 13(2)(a) below.

That is the whole path of an email you send us: your message reaches quantika.org, Cloudflare Email Routing forwards it, and a Google mailbox receives it and holds it. Nothing else stands in the way, and no step of it is hidden from you here.

The way back is shorter, and Cloudflare is not on it. Our reply — and, for a client, any document we deliver — is written on our own machine and sent from that same Google mailbox, so Google holds it from the moment we send it. Cloudflare is not on that leg: Email Routing receives mail addressed to our domain and forwards it, it gives us no mailbox and nothing can be sent from it, so it stands on the way in only. Cloudflare stays the registrar and DNS operator for the domain, which tells other servers where our mail belongs without carrying what a message contains. We would rather name one company where only one is on that leg than pad the list to look thorough.

One thing about that leg you should hear from us rather than not at all, because the domain itself looks busier than our arrangements are. quantika.org also carries sender records we inherited with the domain for three other mail providers — Amazon SES, Resend and Zoho. Sender records are what let a company send as a domain, so a reader who looked them up would reasonably wonder. From quantika.org we send from the Google mailbox and from nothing else: none of those three is used by us. That is our statement about our own arrangements, and it is what we are answerable for here. It is not a statement that those records have been taken out of the domain's DNS — they have not been, and what is published in DNS is a different fact from what we use.

There is no customer database, no CRM and no email sequencer behind the enquiries this site produces or behind mail to quantika.org. That is not an omission from this list: on this path no such system exists, so there is nothing further to name on it. If one is ever introduced here, it goes here before it is switched on.

Letters we write first, to people who have not written to us, go another way: from a separate domain, quantikahq.com, through its own Google mailbox and the Smartlead sending service, and replies to them arrive there rather than here. That path and everyone on it are set out in the notice to people we contact, not in this one.

Source: Regulation (EU) 2016/679, Article 13(1)(e) — legislation.gov.uk/eur/2016/679/article/13/adopted. Who stands on each direction of the mail is our own statement about our own arrangements, made on our own responsibility and not resting on anybody else's document: we have mail addressed to the domain received and forwarded by Cloudflare Email Routing, it comes to rest in a Google mailbox, and that mailbox is what our reply and anything we deliver are sent from. Cloudflare gives us no mailbox and nothing can be sent from Email Routing, so it is not on the way out; Cloudflare's own documentation describes the product the same way, and it is a document you can open: "Route incoming emails to custom addresses, Workers, or external destinations" (developers.cloudflare.com/email-routing), with outbound sending listed there as a separate product, checked 07.09.2026. That we send from quantika.org through the Google mailbox and no other provider, the inherited Amazon SES, Resend and Zoho sender records included, is a statement of the same kind and made on 08.09.2026: it is about what we use, and it is not a claim that those records are gone from the domain's DNS. What remains open is which contracting entity a given request reaches, and that is listed at the end of this page.

We keep nothing abroad ourselves, but the mail is handled abroad in both directions. The recipients above are American companies, and there is an adequacy decision that covers them.

We keep no copy of your correspondence outside the European Economic Area on our own account: we run no overseas customer database and we hand your messages to nobody beyond the recipients named above. What we cannot say is that nothing of yours is handled abroad, because the mail itself is, in both directions, and the next paragraph is about that rather than around it.

The recipients named above are global networks whose parent companies are established in the United States, so a request from your browser, an email routed to us, or a reply we send you from the Google mailbox, may well be handled outside the EEA. For the United States there is an adequacy decision: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 finds an adequate level of protection for personal data transferred to organisations that appear on the Data Privacy Framework List kept and published by the U.S. Department of Commerce. Where a transfer goes to an organisation on that list, it needs no further safeguard under Article 46 or 47 and no derogation under Article 49, and there is no separate copy of safeguards for us to give you.

We checked the list on 7 September 2026. On that date Google LLC was recorded as EU-U.S. DPF Active and Cloudflare, Inc. was recorded as EU-U.S. DPF Active. You can repeat that check yourself at the address in the sources below; we do not ask you to take our word for it.

One limit on what we have just told you, because it matters. That list records companies, not individual transfers. It does not tell you which contracting entity a particular request actually runs through — Google's services in the EEA are frequently contracted through Google Ireland Limited rather than Google LLC, in which case the data may not leave the EEA at all. So the honest statement is the narrow one: these two American entities are on the list. Which entity each specific request reaches is still an open point at the end of this page.

Sources: Regulation (EU) 2016/679, Article 13(1)(f) — legislation.gov.uk/eur/2016/679/article/13/adopted. Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 on the adequate level of protection of personal data under the EU-US Data Privacy Framework, OJ L 231, 20.9.2023, p. 118 (eur-lex.europa.eu, CELEX 32023D1795). The Data Privacy Framework List (dataprivacyframework.gov/list), checked 07.09.2026.

As long as the conversation or the obligation lasts, and no longer.

Where we can give a period we give it; where we can only give the criteria, we give those, which is what Article 13(2)(a) allows.

• An enquiry that goes nowhere. Kept while the conversation is live. When it is plain that nothing will come of it, the thread is deleted.
• A client engagement. Correspondence is kept for as long as the engagement runs and while any question arising out of it is still open.
• Invoices, accounting records and what supports them. Five years — but under two separate obligations whose clocks start on different days, so we set both out rather than flatten them into one number.

The accounting clock. The accounting act keeps the books (księgi rachunkowe) for five years and the remaining accounting vouchers and reports for five years, counted from the beginning of the year following the financial year the record concerns. An approved annual financial statement is kept at least five years, counted from the beginning of the year after the one in which it was approved.

The tax clock. The Tax Ordinance keeps books and the documents connected with them until the tax liability becomes time-barred, and fixes that bar at five years counted from the end of the calendar year in which the payment deadline fell. Invoices are kept to the same point under the VAT act.

So an invoice we issue to you in, say, March is held under both clocks at once, and the later of the two is the one that actually governs when it goes. Beyond those obligations we keep nothing merely because it might one day be useful.

Sources: Regulation (EU) 2016/679, Article 13(2)(a) — legislation.gov.uk/eur/2016/679/article/13/adopted. ustawa z 29.09.1994 o rachunkowości art. 74. ust. 2 pkt 1 and pkt 8 (five years), ust. 3 (when that period starts) and ust. 1 (the approved annual statement), consolidated text Dz.U. 2026 poz. 522 (api.sejm.gov.pl, Dz.U. 2026 poz. 522). Ordynacja podatkowa art. 86 § 1 (keep until the liability is time-barred) and art. 70 § 1 (five years from the end of the calendar year in which the payment deadline fell), Dz.U. 2026 poz. 622 (api.sejm.gov.pl, Dz.U. 2026 poz. 622). ustawa o podatku od towarów i usług art. 112 and art. 112a ust. 1, Dz.U. 2025 poz. 775 (api.sejm.gov.pl, Dz.U. 2025 poz. 775).

Six rights, one address, no form.

You may ask us for access to the data we hold about you, for it to be corrected if it is wrong, for it to be erased, for our use of it to be restricted, and for a copy in a portable form. You may object to any use that rests on our legitimate interest — the two interests named under Article 13(1)(d) above.

Write to vitali@quantika.org and say which of these you want. There is no form to complete and no account to create, and we charge nothing for it. We will ask only for what we need in order to find your data and to be reasonably sure the request is yours.

In practice, what we hold about an enquirer is usually one email thread, and most of these requests come down to reading it back to you or deleting it.

Source: Regulation (EU) 2016/679, Article 13(2)(b) — legislation.gov.uk/eur/2016/679/article/13/adopted.

We ask for no consent, so there is nothing for you to withdraw.

None of the four purposes above rests on your consent. There is no newsletter sign-up on this site, no cookie banner, no tracking pixel and no marketing list fed by these pages. The pages set no cookie and use no browser storage at all — that is checkable in the source, and it is why you were not asked to agree to anything on arrival.

One thing about that you should hear from us rather than discover, because your browser may tell a different story from our source. A browser that has been to quantika.org may already be carrying two Google Analytics cookies for this domain, named _ga and _ga_W2FV8L22PH. Ours was: we read both names out of it on 8 September 2026, and you can read yours the same way. Nothing we serve sets them, reads them, or reports to the property they belong to. The only third-party script on any page here is the page view counter described below, which is not Google Analytics, and the measurement identifier inside the second cookie's name sits in no analytics tag on any page here, and in no version of this site we wrote before this paragraph. It is printed a few lines above, so searching this page for it will of course find it; what it is not in is anything that reports to anybody. So a browser arriving here for the first time today picks up nothing of the sort from us.

Who set those cookies we have not established, and this notice is not going to guess. What we can show you is what we checked: no page of this site carries a Google Analytics tag. What stood at this domain before these pages did is not something we can prove to you either way, and we would rather leave it at that than tell you a tidy story. Google documents the default lifetime of both cookies as two years, and the same page records that browsers cut that short for a visitor who does not return — a maximum of 400 days in Chrome and 7 days in Safari — so a browser that has been here can go on carrying them long after whatever set them stopped running. You can delete them today in your browser's own settings for this site, without asking us and without losing anything here; nothing we serve will put them back.

The consent rule for anything stored on or read from your device is Polish now, not the old telecommunications act: the 2004 Prawo telekomunikacyjne was repealed and the act in force is the electronic communications law of 12 July 2024, applying from 10 November 2024. Its art. 399 requires prior clear information and your consent before information is stored in your terminal equipment or read back out of it; consent can be expressed through your software settings; and the rule does not apply where the storage or access is necessary to transmit a message or to deliver a service you asked for. Nothing on these pages stores or reads anything, so on that test there is nothing here to consent to.

One thing we will not pretend is settled. We run an aggregate page view counter, and it sets no cookies. Whether a script that neither stores nor reads anything on your device falls inside art. 399 at all is not obvious from the text — the article is triggered by storing or reading, and says nothing about a script that does neither — and we found no publication of the Polish authority answering it. The nearest guidance is the EDPB's guidelines on the technical scope of Article 5(3) of the ePrivacy Directive. We leave the conclusion open at the end of this page rather than assert it.

If anything is ever added that does need your agreement, you will be asked for it, and withdrawing it will be one email, effective from then on rather than backwards.

Sources: Regulation (EU) 2016/679, Article 13(2)(c) — legislation.gov.uk/eur/2016/679/article/13/adopted. ustawa z 12.07.2024 – Prawo komunikacji elektronicznej art. 399 and art. 400, Dz.U. 2024 poz. 1221 (api.sejm.gov.pl, Dz.U. 2024 poz. 1221); the 2004 Prawo telekomunikacyjne was repealed by art. 68 ust. 1 of Dz.U. 2024 poz. 1222 (api.sejm.gov.pl, Dz.U. 2024 poz. 1222). EDPB, Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, version 2.0 (edpb.europa.eu, Guidelines 2/2023 v2.0). For the two cookies already on this domain: their names are our own reading of a browser that had visited quantika.org, taken on 08.09.2026 and repeatable in yours; that no page here sets or reads anything is our own reading of the source of every file we serve, of the same date. The lifetime and the browser limits that cut it short are Google's own, from its cookie documentation for Google Analytics 4 — "Browsers enforce limitations on the lifespan of first-party cookies if a user does not make a return visit (maximum of 400 days for Chrome and 7 days for Safari)" (support.google.com/analytics/answer/11397207), checked 08.09.2026.

You can complain to a supervisory authority, and you need not ask us first.

If you think we have handled your data wrongly, you have the right to lodge a complaint with a data protection supervisory authority. The Regulation gives you that right directly, and it lets you exercise it in particular in the Member State where you habitually live, where you work, or where you say the infringement happened.

Our seat is in Poland, so the authority competent for us is the President of the Personal Data Protection Office — Prezes Urzędu Ochrony Danych Osobowych. The Polish data protection act makes the President the competent authority in matters of personal data protection and puts the conduct of the proceeding in the President's hands.

Authority

Urząd Ochrony Danych Osobowych

Address

ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland

Email

kancelaria@uodo.gov.pl

e-Doręczenia

AE:PL-67085-31860-RWFHC-35

These are the details the authority itself publishes, taken from its own contact page on 7 September 2026. A complaint goes in writing to that address or through e-Doręczenia. If you have seen the older ul. Stawki 2 address quoted elsewhere, it is out of date — do not send anything there.

The authority's own guidance suggests raising the matter with the controller first, and we would rather you did: write to us and give us the chance to put it right. But nothing in this notice makes that a condition of complaining, and it is not one in law either.

Sources: Regulation (EU) 2016/679, Article 13(2)(d), and Article 77, which is the right itself — the right to lodge a complaint with a supervisory authority, in particular in the Member State of habitual residence, place of work or place of the alleged infringement (legislation.gov.uk/eur/2016/679/article/13/adopted, legislation.gov.uk/eur/2016/679/article/77/adopted). For who the Polish authority is: ustawa z 10.05.2018 o ochronie danych osobowych art. 34 ust. 1–2 and art. 60 (api.sejm.gov.pl, Dz.U. 2019 poz. 1781). Address and complaint routes as published by the authority (uodo.gov.pl/pl/p/kontakt, uodo.gov.pl/pl/526/2464), checked 07.09.2026.

Nothing on this site obliges you to give us data. A contract needs an invoice, and an invoice needs details.

No law requires you to give us your personal data, and this site could not make you: there is no form on any page, so the only way to reach us is an email you compose yourself, containing exactly what you decide to put in it. If you write and tell us nothing but a first name, we will still answer.

If we go on to work together, the billing details we need in order to issue you an invoice become a requirement of contracting with us — a condition of doing business, not a duty the law lays on you personally. The consequence of declining is simply that we cannot invoice and therefore cannot take the work on. Once issued, that invoice is then held under the retention obligations set out under Article 13(2)(a) above, and that part is a legal requirement on us.

Which particulars a Polish VAT invoice must carry by law is a separate question, and we have not verified the provision that fixes them. It is listed at the end of this page. What is written above is what we need in practice, not a recitation of a statute we have not read.

Source: Regulation (EU) 2016/679, Article 13(2)(e) — legislation.gov.uk/eur/2016/679/article/13/adopted. The retention obligation referred to is sourced under Article 13(2)(a) above.

There are none. A person reads your mail and a person writes the check.

We take no automated decision about you, with or without profiling, and nothing here produces a legal effect for you or anything similarly significant. Because there is no logic to describe, there is no significance and no consequence to set out either.

Enquiries are read and answered by a person. The check is written by the people who will do the work — the site puts it as "whoever quotes it, builds it" — and no model decides whether we take a client on. We do not score, rank or segment visitors to this site, and could not: all the pages collect is an aggregate count of page views.

If we ever introduce such a decision, this section will set out the logic involved, what it means for you and where it leads, before it is switched on.

Source: Regulation (EU) 2016/679, Article 13(2)(f) — legislation.gov.uk/eur/2016/679/article/13/adopted.