Privacy policy
What data we collect, and why.
The data you give us is mainly used to answer your logistics enquiry. We use no analytics and no advertising cookies. This page sets out who processes your data, on what basis, for how long, and what rights you have.
Policy text
Controller and contact
The controller of your personal data is BSV-SLOT sp. z o.o., the company that operates the ShipRevo brand, registered at ul. Szczęśliwa 10A/6, 53-446 Wrocław, Poland, KRS 0001085175, tax ID (NIP) 8943228844. Full company details are in the legal notice.
For anything about your personal data, email office@shiprevo.pl, call +48 609 847 548 or write to: BSV-SLOT sp. z o.o., ul. Szczęśliwa 10A/6, 53-446 Wrocław, Poland.
How your data reaches us
- The quote form. You enter it yourself, usually as someone acting for a company.
- Email or phone. When you write or call, we receive what you tell us along with your email address or phone number.
- The company you represent. A colleague may name you as the contact person. We then receive your name, work contact details and your role. We will tell you where we got them when we first contact you.
- Your browser. When you open the site, our server writes a shortened technical log. At the last step of the form, the Cloudflare Turnstile widget receives the technical data described below.
What data we process
- Contact data: full name, company, country of registration, work email and, if you give them, work phone and website.
- Enquiry data: services selected, industry, shipping destinations, ranges for orders, SKUs, returns and stock, sales platform, current WMS or ERP, and your notes.
- Correspondence: the content of messages and what was agreed in conversations about your enquiry.
- Record of the submission and your statements: confirmation that you read this policy, your choice on marketing consent, the policy version, time and language of the submission, the page it was sent from, and the reference number.
- Technical data: IP address, TLS fingerprint, User-Agent header, widget key and site address (sent to Cloudflare), and a random value that Turnstile stores in your browser, described on the Cookies page. In our server log: shortened IP address, time, page address and response code.
We do not ask for special categories of data. Please leave end-customer data out of the form: a quote does not need it.
Purposes, legal bases and retention
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Answering your enquiry and preparing a quote, where you act for a company | Contact, enquiry, correspondence | Art. 6(1)(f) GDPR, our legitimate interest | 12 months from last contact if we do not go on to work together |
| Answering your enquiry and preparing a quote, where you would be the contracting party yourself, for example as a sole trader | Contact, enquiry, correspondence | Art. 6(1)(b) GDPR, steps taken at your request before a contract | 12 months from last contact if we do not go on to work together |
| Commercial information by email, only if you tick the separate consent | Full name, email, record of consent | Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law, your consent | Until you withdraw consent |
| Protecting the form from bots, spam and abuse | Technical data, single-use Turnstile token, salted hash of the IP address | Art. 6(1)(f) GDPR, our legitimate interest | IP hash: usually about one minute, in server memory only. Data at Cloudflare: Cloudflare gives no period in its Turnstile addendum |
| Running and securing the server | Log: shortened IP address, time, page address, response code | Art. 6(1)(f) GDPR, our legitimate interest | 14 days |
| Establishing, exercising or defending legal claims, and showing that consent was given | Correspondence, record of the submission and your statements | Art. 6(1)(f) GDPR, our legitimate interest | Where a claim has been raised or is realistically possible, and for the consent record after withdrawal: until the limitation period ends |
If we go on to work together, the data needed to conclude and perform the contract and to meet accounting and tax duties continues to be processed under the contract and the law. We will give you the details when the contract is concluded.
Our legitimate interests
- Answering companies that ask about our services, and holding commercial talks with the people who represent them.
- Protecting the form and the server from bots, spam, abuse and failures.
- Establishing, exercising or defending legal claims, and demonstrating compliance.
Cloudflare also uses Turnstile data in its own interest, to improve bot detection. For that purpose it acts as an independent controller.
Marketing consent
The marketing consent box is separate and unticked by default. A quote does not depend on it, and without it we will not send you commercial information. You can withdraw consent at any time by writing to the address above. This does not affect the lawfulness of earlier processing.
Recipients
| Recipient | Role | What data |
|---|---|---|
| Cloudflare, Inc., 101 Townsend St., San Francisco, USA | Turnstile service. Processor when providing the service, independent controller when improving bot detection, according to its Turnstile addendum | Technical data from your browser. Our server also passes on the token and IP address for verification. The form content does not go to Cloudflare |
| Hosting provider (VPS) | Processor. The site runs on this server and your submission passes through it. We will give the name of the provider and the country of the server here before the site goes live | Submission content in transit, server logs |
| Email sending (SMTP) and mailbox provider | Processor. Your submission reaches us as an email and is stored there. We will name the provider here once chosen | Full submission and correspondence |
| Legal and accounting advisers, where needed | Independent controllers or processors, depending on the engagement | Only what the matter requires |
| Authorities and others entitled by law | Independent controllers | Data they can lawfully require |
Transfers outside the EEA
Cloudflare, Inc. is based in the USA and runs a global network, so technical data may be processed outside the European Economic Area. In its privacy policy Cloudflare states that it complies with the EU-US Data Privacy Framework, which is covered by a European Commission adequacy decision (Implementing Decision (EU) 2023/1795). If its certification lapses or is invalidated, and for other transfers, Cloudflare uses the standard data protection clauses set out in its data processing addendum. You can find a copy of these safeguards at that address or ask us for one.
The country of the server and the email provider are not settled yet, so we cannot say for now whether a transfer also applies to hosting and email. If data is to leave the EEA, we will state the country and the transfer basis here before that happens.
Do you have to provide data?
No. Providing data is voluntary: neither the law nor a contract requires it. Without the fields marked as required, we cannot accept your submission through the form or reply to it. The form also cannot be sent without the Turnstile check. If you would rather not use it, write or call: email and phone work without Turnstile.
Your rights
- Access to your data and a copy of it (Art. 15 GDPR).
- Rectification of inaccurate data (Art. 16).
- Erasure where the conditions of Art. 17 are met.
- Restriction of processing in the cases set out in Art. 18.
- Portability of data processed by automated means on the basis of consent or contract (Art. 20).
- Withdrawal of consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3)).
To use these rights, write to office@shiprevo.pl or to the company's postal address. We will reply without undue delay and within one month at the latest. For complex requests this may extend by a further two months: we will tell you in advance and give the reason. As a rule there is no charge. If we have reasonable doubts about who is making the request, we may ask for further information.
You also have the right to lodge a complaint with a supervisory authority. Ours is the President of the Personal Data Protection Office (UODO), ul. Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl. If you live or work in another EU country, you may also go to the authority there.
Automated decisions and profiling
We do not take decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you. We do not profile you for marketing. Turnstile assesses automatically whether a request comes from a person, and our server rejects the submission if the check fails. You can then send your enquiry by email or phone.
Security
- The site and the form run over an encrypted HTTPS connection. The server sends your submission to the email provider over a TLS connection.
- We keep no database of submissions on the web server. Form content does not enter the logs. The submission is passed by email to the mailbox where we store it.
- The server log holds a shortened IP address, and the form attempt counter works on a salted hash, not on the address itself.
No safeguard gives complete certainty, and ordinary email can pass through servers outside our control. So please do not send us data that a quote does not need.
Cookies
The site itself sets no cookies. What Turnstile stores at the last step of the form is described on the Cookies page.
Changes to this policy
When the way we process data changes, for example once provider details are added, we will update this page and its version date. Each form submission records the policy version in force when it was sent.
Version: 2026-11-01 (1 November 2026). The rules for using the site are in the terms of use.
Updated: 2026-11-01