Privacy Policy
Effective date: 01.09.2026
1. Who we are
This Privacy Policy explains how Asortio Sp. z o.o. (“we”, “us”, “Provider”) collects, uses and protects personal data in connection with the website https://aforio.com/ (the “Website”) and the Aforio CRM service (the “Service”).
Registered address: ul. Piotrkowska 116 / 52, 90-006 Łódź, Poland
Registration number (KRS): 0001042571
Phone: +48 780 595 155
Email: info@aforio.com
For questions about this Policy or your personal data, contact us at info@aforio.com.
2. Two roles we play
2.1. When you visit the Website, create an Account, or otherwise interact with us directly (for example, contacting support or subscribing to a newsletter), we act as the data controller of your personal data. This Policy describes that processing.
2.2. When a Customer uses the Service to store its own contacts, leads and other records (“Customer Data”), we act as a data processor on that Customer's behalf, and the Customer is the controller of that data. If you are an individual whose data appears in someone else's CRM account (for example, as a contact or lead), please direct data protection questions to that Customer; our processing of Customer Data is governed by our Terms and Conditions and Data Processing Agreement, available on request.
3. What personal data we collect
3.1. Website visitors. When you browse the Website, we may collect: IP address, browser and device information, pages visited, referring website, and cookie identifiers (see section 6).
3.2. Account holders. When you register for or use the Service, we collect: name, email address, phone number (optional), company name, billing address, payment details processed via our card payment provider (we do not store full card numbers ourselves), and Account activity (login times, usage of features).
3.3. Communications. If you contact us by email, phone or a contact form, we collect the information you provide, such as your name, contact details and the content of your message.
3.4. Job applicants (if applicable). If you apply for a role with us, we collect the information contained in your application (CV, cover letter, contact details).
4. How we use personal data and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your Account, providing the Service | Performance of a contract |
| Processing payments and issuing invoices | Performance of a contract; legal obligation (tax/accounting law) |
| Responding to support requests and enquiries | Performance of a contract / legitimate interest |
| Sending Service-related notices (e.g. price changes, security notices) | Legal obligation / legitimate interest |
| Sending marketing communications | Consent (you may opt out at any time) |
| Website analytics and improving the Website | Legitimate interest, or consent where required for non-essential cookies |
| Preventing fraud and misuse, enforcing our Terms | Legitimate interest |
| Complying with legal, tax and accounting obligations | Legal obligation |
5. Cookies
5.1. The Website uses cookies and similar technologies. Essential cookies (needed for login sessions, security and basic functionality) are used without requiring consent, as permitted by law. Non-essential cookies (analytics, preference, marketing) are used only with your consent, given through our cookie banner, which you may withdraw at any time.
5.2. You can also control cookies through your browser settings. Blocking essential cookies may affect the Website's functionality.
5.3. Categories of cookies we may use: strictly necessary, performance/analytics, and functionality. [List of specific cookies and their duration: to be published on the Website's cookie settings page.]
6. Sharing your personal data
6.1. We share personal data with:
- Sub-processors who provide hosting, email delivery, card payment processing, customer support tooling and analytics on our behalf. A current list of Sub-processors is available on request.
- Professional advisers (accountants, auditors, lawyers) where necessary for our business operations.
- Public authorities, where required by law (for example, tax authorities, law enforcement upon a valid legal request).
- A successor business, in the event of a merger, acquisition or asset sale, subject to the same protections described in this Policy.
6.2. We do not sell personal data to third parties.
7. International data transfers
Where a Sub-processor is located outside the European Economic Area, we ensure the transfer is protected by an appropriate legal mechanism recognised under GDPR, such as an adequacy decision or Standard Contractual Clauses. Details are available on request.
8. How long we keep personal data
8.1. Account and billing data: for the duration of the Subscription and for 5 years afterwards, to meet Polish tax and accounting retention obligations.
8.2. Website analytics data: typically retained for up to 26 months, or as configured in our analytics tool.
8.3. Support communications: retained for as long as needed to resolve the matter and for a reasonable period afterwards for record-keeping, typically up to 3 years.
8.4. Marketing consent records: retained until you withdraw consent, plus a reasonable period to demonstrate compliance.
8.5. We may retain data longer where required by law or to establish, exercise or defend legal claims.
9. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or destruction, including encryption in transit, access controls and regular review of our security practices. No system is completely secure, and we encourage you to use strong passwords and keep your Account credentials confidential.
10. Your rights
Subject to conditions under applicable law, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data (“right to be forgotten”), subject to legal retention obligations;
- Restrict or object to certain processing, including direct marketing;
- Data portability — receive your data in a structured, machine-readable format;
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- Lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, or with the supervisory authority in your own EU country of residence.
To exercise these rights, contact us at info@aforio.com. We will respond within the timeframes required by applicable law.
11. Children's privacy
The Service and Website are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will take appropriate steps to delete it.
12. Changes to this Policy
We may update this Privacy Policy from time to time, for example to reflect changes in law or in our data practices. We will post the updated Policy on the Website with a new effective date, and where changes are material, we will notify Account holders by email or through the Account at least 14 days before they take effect.
13. Contact us
Asortio Sp. z o.o.
ul. Piotrkowska 116 / 52, 90-006 Łódź, Poland
Email: info@aforio.com
Phone: +48 780 595 155