Who the controller is
The controller of your personal data is Truverta Sp. z o.o., ul. Jana Blatona 4/45, 01-494 Warszawa, Poland, KRS 0000966509, VAT ID PL7252318426, the operator of the Expova brand. For data matters, write to [email protected].
What we collect
From the quotation form: your name, e-mail address and the content of your enquiry. Optionally, if you provide them: company name, phone number, event date, quantity, delivery point and a link to your files. We do not ask for data we do not need in order to prepare a quotation, and the form is not a channel for sensitive data.
From server logs: IP address, timestamp, request method and path, response code and browser header. Logs are written automatically for every request and serve only site maintenance, abuse detection and diagnostics.
From traffic measurement, only with your consent: Google Analytics 4, the Google Ads tag and the OpenAI Ads pixel, described under “Traffic and advertising measurement”. Unless you click “Accept” on the bar at the bottom of the page, none of these scripts runs and no request leaves your browser for Google or OpenAI.
What we do not do: we do not build marketing profiles, we do not link form data with measurement data and we do not sell either to anyone. The only profiling is the order in which we contact companies, described under “B2B contacts”.
Legal basis and purpose
Form data is processed on the basis of your consent and in order to take steps prior to entering into a contract, that is, to prepare a quotation (Art. 6(1)(a) and (b) GDPR). Server logs are processed on the basis of our legitimate interest in the security and maintenance of the service (Art. 6(1)(f) GDPR).
How long we keep it
Quotation enquiries stay in our mailbox for as long as the case needs and, if the enquiry leads to an order, for the period required by accounting law. Server logs are rotated and deleted after 14 days.
Who processes it for us
The site runs on a hosting provider inside the European Union. E-mail is handled by a mail service provider. Both act under data processing agreements and only to the extent needed to deliver the service. We do not sell data.
If you choose to write to us over WhatsApp, the conversation and your phone number pass through the infrastructure of WhatsApp Ireland Limited (a Meta company), which may involve a transfer to the United States under the European Commission’s adequacy decision (EU-US Data Privacy Framework). Apart from those cases, we do not transfer data outside the European Economic Area.
The site is served through the Cloudflare network, which relays every request and sees your IP address and browser headers in the process. The same provider runs the anti-bot check on the form (Turnstile). Cloudflare, Inc. is based in the United States and acts under a data processing agreement and the European Commission’s standard contractual clauses.
Contacting us over WhatsApp is entirely optional and simply a more convenient route. The same number takes ordinary phone calls, and you can also send your enquiry by e-mail or through the quotation form: none of those paths goes through the messenger.
Form protection
The form is protected by a hidden trap field, a fill-time measurement, a limit on the number of submissions from one IP address and a Cloudflare Turnstile check. These mechanisms collect no additional data about you: they exist only to reject automated submissions.
Turnstile scores signals from your browser and sets no puzzles to solve. It stores no cookies in our domain. It does require JavaScript: with scripts disabled the form will not accept a submission and will show a phone number and an e-mail address as the alternative route.
Traffic and advertising measurement
With your consent we run two tools from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): Google Analytics 4, which measures where visitors come from and which pages lead to a quotation request, and the Google Ads tag, which attributes a submitted request to a click on our advert. Both run through Google Tag Manager, loaded from our own domain only after consent.
The legal basis is your consent (Art. 6(1)(a) GDPR and the ePrivacy rules as implemented in Art. 399 of the Polish Electronic Communications Law). Consent lasts 12 months and can be withdrawn at any time with the “Cookie settings” button in the footer: the bar reappears and “Necessary only” stops measurement immediately. Withdrawal does not affect the lawfulness of measurement before it.
Google receives: a pseudonymous cookie identifier, the page address, the traffic source, an approximate location derived from the IP address (Google truncates the IP before storage), device and browser type, and these events: form submission (with the quotation topic, without the message or any field content), a click on the phone number, WhatsApp or e-mail address, and use of the deadline calculator. We do not enable Google Signals or ad personalisation, so this data is not used to build an advertising profile. Google Analytics data is deleted after 14 months. Google Ireland processes it under a data processing agreement (Google Ads Data Processing Terms); some processing may take place in the United States under the European Commission adequacy decision (EU-US Data Privacy Framework).
OpenAI Ads (ads in ChatGPT)
Under the same consent we run the OpenAI Ads pixel from OpenAI Ireland Ltd (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland). It attributes a quotation request to a click on our advert in ChatGPT. The pixel loads only after you click “Accept” and sends OpenAI: the page visit, the form submission (with the quotation topic, without the message or any field content) and a click on the phone number or WhatsApp. Once the pixel has set its cookies, which happens only after consent, our server sends OpenAI the same request a second way (Conversions API) together with SHA-256 hashes of your e-mail address, phone number and name. A hash cannot be reversed; OpenAI only matches it against hashes of its own users’ data. Without consent nothing goes to OpenAI. Some processing may take place in the United States under the EU-US Data Privacy Framework.
Cookies and browser storage
Without consent the site sets no cookies. In your browser’s local storage we keep: the ex-lang key when you choose a language version yourself, the ex-consent key with your measurement decision and its date, and three session keys (one stops the language redirect from looping, another stops one request from being counted twice, the third remembers where the visit came from: campaign parameters, the referring domain and the first page visited, which we attach to a submitted quotation request). After consent, Google Analytics sets the _ga and _ga_* cookies (2 years) and Google Ads sets _gcl_aw (90 days), which links a request to an ad click. The OpenAI pixel sets __oppref (30 days, the ad click identifier), __obref (12 months, a random browser identifier) and __oaiq_consent (the consent record). You can delete all of them at any time in your browser settings and the site will keep working.
Your rights
You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability and to object. You may withdraw consent at any time, which does not affect the lawfulness of processing before withdrawal. You may also lodge a complaint with the Polish data protection authority.
B2B contacts
This part covers the people we write to about business before they contact us.
What data. Name, job title, business e-mail and phone, company name, tax ID and address from public registers, the trade shows the company exhibits at, and the history of our contact.
Where it comes from. Public exhibitor lists of trade shows and events, the Polish CEIDG and KRS registers, and company websites. We name the specific source in our first message.
Why and on what basis. To ask whether you agree to receive commercial information from Expova by e-mail: our legitimate interest in starting business cooperation (Art. 6(1)(f) GDPR). Once you agree, we send our offer and correspond with you (Art. 6(1)(f) GDPR together with Art. 398 of the Polish Electronic Communications Law). To respect an objection and not write again, we keep only the address on a suppression list (Art. 6(1)(f) GDPR). Accounting for an order: legal obligation (Art. 6(1)(c) GDPR).
Order of contact. Company data (country, trade show, date, industry) decides whom we write to first. This profiling has no legal effect on you; you may object to it.
How long. Contact data: 12 months from the last contact without a reply. Consent and correspondence: until you withdraw consent, then for the limitation period of claims. Suppression list: indefinitely, address only.
Recipients. Google Ireland Ltd (Google Workspace mail), the providers of the AI tools we use to prepare messages (Anthropic), and our accounting office. Transfers outside the European Economic Area rely on the Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
Your rights. Access, rectification, erasure, restriction, portability, withdrawing consent at any time (without affecting earlier processing) and a complaint to a supervisory authority; in Poland, the President of the Personal Data Protection Office (UODO). Providing data is not required: we use data published by the company or a register.
Right to object. You can object at any time to the use of your data for business contact. Just reply “no” to our message or write to [email protected]. We will not write again.