VeletaBack to home

Privacy Policy

Last updated: 5 October 2026

1. Who We Are

Veleta (“we”, “us”, or “our”) operates the veleta.pro compliance management platform. This Privacy Policy explains how we collect, use, store, and protect personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

For privacy-related enquiries, contact our Data Protection contact at: privacy@veleta.pro.

Veleta is based in Warsaw, Poland.

2. Data We Collect

We collect and process the following categories of personal data:

  • Account data: name, email address, job title, company name, and password (hashed).
  • Usage data: pages visited, features used, session duration, IP address, browser type, and device information.
  • Content data: documents, risk assessments, questionnaire responses, and other compliance content you upload or generate within the platform.
  • Billing data: subscription status and transaction references. New purchase payments are handled through Whop’s hosted checkout; existing Paddle subscription payments continue through Paddle. Veleta does not store payment card details on its servers.
  • Communications data: emails and support messages you send to us.

3. Legal Basis for Processing

We process personal data on the following legal bases:

  • Contract performance: to provide the Service you have subscribed to.
  • Legitimate interests: to improve the Service, prevent fraud, and ensure security.
  • Legal obligation: to comply with applicable laws and regulations.
  • Consent: for optional analytics or marketing communications where required by law.

4. How We Use Your Data

  • Providing, maintaining, and improving the Veleta platform;
  • Authenticating users and managing sessions;
  • Processing new purchase payments through Whop and continuing to support existing Paddle subscriptions;
  • Sending service-related notifications (account events, subscription updates);
  • Responding to support enquiries;
  • Monitoring platform security and preventing abuse;
  • Complying with legal obligations.

5. Data Sharing & Third Parties

We do not sell your personal data. We may share data with:

  • Whop — hosted checkout and payment processing for new purchases;
  • Paddle.com — billing and payment processing for existing Paddle subscriptions;
  • LiveChat (Text) — optional human support chat on our homepage. It loads only after you choose to continue to LiveChat, not merely by visiting the page. It processes messages and contact details you provide, and technical data such as your IP address, browser/device information and page information, and may set cookies needed for chat. We do not populate it with your Veleta account, company, scan or assessment data. Processing may include the United States. See the provider’s privacy policy. You can use our contact form instead.
  • Cloud infrastructure providers (e.g. hosting, databases) acting as data processors under Data Processing Agreements;
  • Analytics providers (e.g. PostHog) where you have consented or where we have a legitimate interest;
  • Law enforcement or regulatory authorities when required by applicable law.

6. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place — such as Standard Contractual Clauses (SCCs) — to protect your data to EEA standards.

7. Data Retention

We retain personal data for as long as necessary to provide the Service and fulfil legal obligations. Account data is retained for the duration of your subscription and for up to 12 months after account closure, unless a longer retention period is required by law or you request earlier deletion.

Support chat history is also held by LiveChat under the service’s account settings and retention terms, separately from Veleta account data. To request access or deletion of a chat, contact privacy@veleta.pro. Closing or disconnecting the widget stops the session; it does not itself erase the conversation already sent.

8. Your Rights

Under GDPR you have the following rights regarding your personal data:

  • Right of access — request a copy of all personal data we hold about you;
  • Right to rectification — request correction of inaccurate or incomplete data;
  • Right to erasure (“right to be forgotten”) — request deletion of your personal data;
  • Right to data portability — receive your data in a structured, machine-readable format;
  • Right to restriction — request that we limit the processing of your data;
  • Right to object — object to processing based on legitimate interests;
  • Right to withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email privacy@veleta.pro. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Security

We implement industry-standard technical and organisational security measures, including encryption in transit (TLS), encryption at rest, role-based access controls, and regular security assessments. Despite these measures, no system is completely secure; you use the Service at your own risk.

10. Cookies

We use strictly necessary cookies for session management and authentication. Optional analytics cookies may be set with your consent. You can manage cookie preferences through your browser settings.

Optional LiveChat support is activated separately by your explicit choice in the chat panel. Analytics acceptance does not activate it, and refusing analytics does not prevent you from contacting us. Use “Disconnect chat” to stop a loaded chat session, or use the contact form without loading LiveChat.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 30 days before the changes take effect.

12. Contact Us

For privacy enquiries or to exercise your rights, contact us at privacy@veleta.pro or write to us at our registered address.