Skip to content

New release“From ChatGPT to a digital team” — read the first chapter free.Read an excerpt

VANTIORBOOKS

Legal

Vantior Books Privacy Policy

Version
2026-11-05
In force since
2026-11-05
Content revision
r-17d6d4144347

Language versions. This is a translation of the Polish original and is provided for information. The binding version is the Polish one: /pl/legal/privacy. That precedence does not deprive a consumer of any right under mandatory provisions of law — including the mandatory provisions of the law of the country of their habitual residence, where the applicable conflict-of-law rules give them that protection — and it does not limit anyone's rights against the party responsible in a given situation (§17.2 and §19.3 of the Terms).

1. Controller

The controller of the personal data processed within the Vantior Books website is Vantior Group Dawid Pągowski, a sole trader entered in the Polish Central Register and Information on Economic Activity (CEIDG), address: ul. Świętego Mikołaja 8/11/208, 50-125 Wrocław, Poland, tax identification number (NIP) 5263970951, contact: contact@vantiorbooks.com, telephone +48 511 811 635, hereinafter "Vantior".

If Vantior appoints a Data Protection Officer, their contact details will be published in this policy and in the relevant contact channels.

2. Scope of this policy

The policy describes processing by Vantior. Entities acting as independent controllers, in particular Paddle in respect of Merchant of Record transactions, publish their own privacy information.

3. Customer and user data

3.1 Account

Data: e-mail, account identifier, authentication data in technical form (passwords stored solely in a secure hashed form), verification status, security events, selected settings.

Purposes/bases:

  • creating and maintaining the Account and performing the contract/service — Article 6(1)(b) GDPR;
  • security, preventing abuse, establishing and defending claims — Article 6(1)(f) GDPR;
  • legal obligations — Article 6(1)(c), where they arise.

3.2 Purchases, orders and entitlements

Data: order/transaction identifiers, product, formats, amounts and statuses, data passed on by the MoR that is necessary for handling, entitlement, refund/chargeback state.

Vantior should not store full payment card data. Payment is handled by an external MoR/operator.

Purposes: supplying the Product, handling consumer rights, security, settlements with authors/partners, establishing and defending claims.

3.3 Library, reading and listening

Data: entitlements held, formats, last position/locator, progress percentage, technical history necessary for synchronisation, device data to the extent necessary to provide the service.

Purpose: providing the Library functions, synchronising progress and supplying the content — Article 6(1)(b).

A Guest may use progress stored locally in the browser, where the system works that way; after assignment to a verified Account, the account data is linked to a permanent user identifier.

3.4 Sending to an e-reader/device

Data: the verified device address, the device type, the sending status and technical errors.

Purpose: performing the requested service. The data is used solely for authorised channels/domains and may not create an open e-mail relay.

4. Purchase as a guest

Vantior may process a guest token/identifier, order data and the information needed later to assign the purchase securely to a verified Account. A guest token should be time-limited and may not serve to disclose another person's data.

5. Authors, contributors and partners

The data may include: identification and contact data, pen name, biography, contract data, information about rights, tax residence, settlements, bank account, royalties, statements, submissions and correspondence.

The bases depend on the relationship:

  • taking steps before a contract and performing the contract — Article 6(1)(b);
  • tax/accounting obligations — Article 6(1)(c);
  • rights management, audit, claims and security — Article 6(1)(f).

6. Manuscript submissions

Data: the submitter's data, manuscript files and metadata, assessment notes, status history.

Purpose: considering the submission at the person's request and possibly preparing a contract — Article 6(1)(b); security/claims — point (f).

Vantior does not use private manuscripts to train generative AI models and does not send them to an external AI provider, unless in the future the author gives separate, informed consent or another express legal basis exists and this is communicated separately.

7. Contact, complaints and consumer rights

Data: the content of the correspondence, contact details, the order and evidential material.

Purpose: handling the request/contract (Article 6(1)(b)), legal obligations (point (c)), claims and service quality (point (f)).

8. Newsletter and marketing

Vantior sends electronic marketing only after obtaining the consent required for the use of the given channel. The basis for processing marketing data may be consent under Article 6(1)(a) GDPR and the channel consent required by the Electronic Communications Law.

Consent may be withdrawn at any time, without affecting the lawfulness of earlier processing.

9. Studio and personnel

Vantior processes operator account data, roles, audit logs and security events in order to manage permissions, protect the website and ensure accountability. The basis is, as applicable, the contract / a legal obligation / a legitimate interest.

10. Google OAuth

Where Google sign-in is active, Vantior receives from Google the provider identifier and the data covered by the authorisation scope (at least the data required to identify the Account). Vantior does not automatically merge identities solely on the basis of a similar e-mail address where the architecture requires a stable provider identifier.

11. Paddle

On purchase, Paddle acts as Merchant of Record / authorised reseller and processes the buyer's data on its own bases as a separate controller in respect of the transaction. Paddle may pass on to Vantior the data needed to supply the Product, handle support and settle accounts.

Vantior does not describe Paddle as an ordinary processor where Paddle's current terms indicate the role of an independent seller/controller.

12. Hosting, database, storage, e-mail, monitoring

Categories of recipients/processors, with the providers currently performing the service:

  • application and background-task hosting: Vercel Inc. (USA), functions run in the Dublin region (Ireland, EU), next to the database;
  • PostgreSQL database: Supabase Inc. (USA), database in an EU region;
  • private file storage (S3): Cloudflare, Inc. (USA), the R2 service with data stored in the EU;
  • the shop's e-mail (mailboxes of the vantiorbooks.com domain, including messages sent by the service): Spaceship, Inc. (USA), Spacemail service; backup mailbox of the vantior.eu domain: Microsoft Ireland Operations Limited (Ireland), Microsoft 365 / Outlook;
  • monitoring/logs: technical logs are kept by the hosting provider; there is no separate monitoring provider;
  • AI translation: none — the module is switched off; we will complete this list before it is switched on;
  • visit statistics (only with consent to analytics cookies): Vercel Inc. (USA), the Web Analytics and Speed Insights services — the address of the page visited without its parameters, the referring page, the country, the type of device and browser, loading times and selected actions in the shop, without cookies; and PostHog Inc. (USA), cloud in the EU region — the data is passed on by our server, without the IP address; basis: consent (Article 6(1)(a) GDPR), details in the Cookies Policy.

We will record a change of provider in a category in this policy; the current list can also be obtained on request: contact@vantiorbooks.com.

13. AI Translation

If the AI Translation module is switched on:

  • only approved categories of public editorial content may be sent to the provider;
  • customer, order, contract, CRM, manuscript and private content data are excluded by default;
  • Vantior requires human review before a translation is published;
  • before being switched on in production, the provider must pass a GDPR assessment, a processing agreement / allocation of roles and a transfer assessment.

14. Recipients

The data may be disclosed to:

  • processors providing the infrastructure;
  • Paddle and other independent controllers in respect of their services;
  • legal/accounting advisers, subject to confidentiality;
  • public authorities, where a legal basis exists;
  • authors/partners only in the form of aggregated or anonymised data, unless the law/contract requires otherwise.

The Author Portal and the Partner Portal should not disclose buyers or full order numbers, unless this is legally necessary.

15. Transfers outside the EEA

Where a recipient is located outside the EEA, a transfer takes place only if the GDPR requirements are met, e.g. an adequacy decision or standard contractual clauses with a transfer assessment where one is required.

A statement of the actual transfers:

  • Vercel Inc., Supabase Inc., Cloudflare, Inc., PostHog Inc. and Spaceship, Inc. (USA) and the Microsoft group companies in the USA used by Microsoft Ireland: the data may be accessible from the USA. Basis: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US Data Privacy Framework) — for the companies that have joined that framework — and otherwise the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Article 46(2)(c) GDPR), included in those providers' processing agreements;
  • Paddle.com Market Limited (United Kingdom), a separate controller: transaction data passed between Vantior and Paddle. Basis: the Commission's decision finding an adequate level of data protection in the United Kingdom (Article 45 GDPR), in force until 27 December 2031.

A copy of the safeguards (the contractual clauses) can be obtained on request: contact@vantiorbooks.com.

16. Retention periods

Vantior applies the storage limitation principle. Retention periods:

  • Account: for the duration of the Account; after it is closed we delete the login data and settings, and keep the data needed for security/claims for up to 6 years (the limitation period for claims, Article 118 of the Civil Code, ending at the end of a calendar year);
  • orders/entitlements: for the period necessary to perform the contract and defend rights + the periods required by law;
  • accounting data / author settlements: in accordance with tax/accounting obligations — 5 years from the end of the calendar year in which the tax payment deadline passed (Article 86 § 1 of the Tax Ordinance); contracts with authors — also for the limitation period for claims under the contract, where that is longer;
  • complaints: for up to 6 years after the matter is closed (the limitation period for claims, ending at the end of a calendar year);
  • rejected/withdrawn submissions: we delete the manuscript files within 90 days of the final decision to reject or within 30 days of the withdrawal of the submission; the submitter's data, the decision and the correspondence are kept for up to 6 years for the defence of claims;
  • security logs: up to 12 months; the audit trail of operations on orders, entitlements and settlements — for as long as the data it concerns is kept;
  • marketing: until consent is withdrawn/an objection is raised, then the minimum evidential data (the address, the wording and version of the consent, the date and manner of giving and withdrawing it) for 6 years after consent is withdrawn or the objection is raised (the limitation period for claims);
  • AI translations/usage: not applicable — the module is switched off and its records contain no personal data.

17. Rights of the data subject

Depending on the basis, a person may request: access, a copy, rectification, erasure, restriction, data portability, objection, withdrawal of consent, and information about automated decision-making where it occurs.

Requests: contact@vantiorbooks.com.

Vantior replies without undue delay, as a rule within one month; in the cases provided for by the GDPR the period may be extended, subject to the information obligations.

18. Complaint

A person may lodge a complaint with the President of the Personal Data Protection Office: https://uodo.gov.pl/

19. Automated decisions

Vantior does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning a person or similarly significantly affect them (Article 22 GDPR). Paddle, as a separate controller, may assess the risk of fraud automatically at payment — Paddle's privacy policy describes how.

If price personalisation or another such mechanism is implemented, this section must be updated before it is launched.

20. Security

Vantior applies measures appropriate to the risk, including access control, separation of customer and staff accounts, encrypted connections, secure password hashing, private storage, access auditing, backups and recovery mechanisms.

21. Changes

Changes to the Policy follow from the law, from changes of providers or of functions. The version and the date of entry into force should be archived where the policy has evidential significance.

Main legal sources

Previous versions

  • 2026-11-05 — in force since 2026-11-05 — version in force
  • 2026-10-20 — in force since 2026-10-20
  • r-f61b810e9fbe