Mivare Space privacy policy. Your data, our obligations.

1. Data controller

The controller of the personal data described in this Policy is MIVARE GROUP PROSTA SPÓŁKA AKCYJNA, with its registered office in Krasnobród (22-440 Krasnobród; the full registered office address is disclosed in the National Court Register (KRS)), entered in the Register of Entrepreneurs maintained by Sąd Rejonowy Lublin-Wschód w Lublinie z siedzibą w Świdniku, VI Wydział Gospodarczy KRS, under KRS number 0001268091, NIP 9223092251, REGON 545767254, operating under the Mivare Space brand, hereinafter “Mivare”.

Contact for personal data matters: hello@mivaregroup.com or in writing to the registered office address disclosed in the National Court Register (KRS). A Data Protection Officer has not been appointed.

2. Scope of the Policy

This Policy concerns data whose purposes and means of processing are determined by Mivare in connection with the Mivare Space service: data of persons who set up a Company Account and use the Application (Users), persons designated for billing, persons contacting customer support, and technical data connected with use of the Application.

This Policy does not concern data that the company (the Customer) enters into the Application about its clients, their flats and houses, employees, subcontractors, architects, partners and other persons (including photographs of interiors, floor plans, and attendance records together with the device's position at the start and end of work), nor data provided by the company's clients, architects and partners through the public functions of the Application (client portal, architect portal, partner portal, project status, acceptances). The controller of that data is the company, and Mivare processes it solely on the company's behalf, on the basis of the Mivare Space Data Processing Agreement (MSP-LEG-003). Data subjects concerned by that data should direct their requests to the company; if a request reaches Mivare, Mivare will forward it to the company.

Capitalised terms have the meanings given to them in the Mivare Space Terms of Service (MSP-LEG-001).

3. Purposes, legal bases and retention periods

• Registration, maintenance of the Company Account and provision of the service (first name and surname, e-mail address, telephone number if provided, position, language, account settings): Article 6(1)(b) GDPR in respect of the person entering into the Contract, and in respect of the other Users Article 6(1)(f) GDPR (the legitimate interest in providing the service to the Customer). We retain the data for the term of the Contract and until deletion of the Company Account on the terms of the Terms of Service.
• Authentication and security (password in hashed form, two-factor authentication data, trusted devices, history of logins and failed login attempts, IP address, activity log in the Application): Article 6(1)(f) GDPR (the legitimate interest in protecting the Application and the data). The activity log is retained for the period set by the Customer, from 30 to 180 days (90 days by default); the other data is retained until deletion of the User's account.
• “Recently opened” list (type and identifier of the records recently opened by the User and the time they were opened, without the content of the records): Article 6(1)(f) GDPR (legitimate interest in making it easy to return to current work). The list is visible only to that User; each entry is deleted 90 days after the record was last opened, and the whole list is deleted immediately together with the Company Account.
• Record of acceptance of documents (person, company, document and its version, date, IP address): Article 6(1)(c) and (f) GDPR (demonstrating conclusion of the Contract). We retain it for the duration of the Contract and, after the Company Account is deleted, in an archive for 5 years.
• Billing, payments and invoices (details of the company, EU VAT number and the result of its verification in the VIES system, e-mail address for billing, payment history): Article 6(1)(b) and (c) GDPR. We retain billing documents for the period required by tax and accounting legislation, as a rule 5 years from the end of the calendar year in which the tax payment deadline expired.
• Handling of requests, complaints and correspondence: Article 6(1)(b) and (f) GDPR. We retain the data until the matter is closed and then until expiry of the limitation period for claims, no longer than 3 years from the last contact.
• Service messages concerning the service (security, changes to documents, payments, technical interruptions): Article 6(1)(b) and (f) GDPR. We do not send commercial information to Users without separate consent.
• Establishment, pursuit or defence of claims: Article 6(1)(f) GDPR, until expiry of the limitation period.

Providing data is voluntary but necessary to set up an account and use the service. The data of Users other than the person setting up the account is provided by the Account Administrator.

4. Recipients of data

• Contabo GmbH (Germany): the Application server, database, file store and backups (Object Storage), data centres in the European Union; we encrypt files and backups before they are written; acts as a processor.
• OVH Sp. z o.o. (OVHcloud group): e-mail, Mivare's domains and websites, data centres in the European Union; acts as a processor.
• Mistral AI SAS (France, Paris): preparation of summaries, answers and document drafts by the Mivi assistant, only in Company Accounts in which the Account Administrator has enabled it, and only for Users who have enabled it for their own account; acts as a processor; queries are processed and stored in the European Union and are not used to train models; Mistral AI retains them for no more than 30 days solely for the purpose of detecting abuse, after which it deletes them.
• Stripe Payments Europe, Limited (Ireland): processing of Subscription payments. Stripe receives the company name, the billing e-mail address, the country, the language and a technical account identifier; the Account Administrator enters the card details directly on the Stripe page, and Mivare does not receive or store them. With regard to payment data, fraud prevention and its own legal obligations, Stripe acts as a separate controller on the basis of its own privacy policy, and otherwise as a processor. Stripe does not receive Customer Data.
• European Commission (VIES system): verification of the EU VAT number of a Customer from another Member State of the European Union, in order to determine the tax treatment.
• Minister of Finance of the Republic of Poland (National e-Invoicing System, KSeF): invoices issued by Mivare for the service, to the extent required by the provisions on value added tax; acts as a separate controller.
• Professional advisers (legal, tax, accounting) bound by a duty of confidentiality: to the extent necessary to handle billing and legal matters.
• Public authorities: only where an obligation to disclose data arises from the law.

Mivare does not sell personal data and does not disclose it for marketing purposes.

5. External services

The Application does not load any resources in the User's browser from servers other than those of Mivare, with the exception of the Stripe payment page opened by the Account Administrator when making a payment. Maps of projects are drawn from data stored on the Mivare server, without external map services. The Application's fonts, icons and libraries are loaded from the Mivare server.

In the employee application, the “Navigate” button opens, only once the User has clicked it, the Google Maps service with the address or position of the project as the route destination. From that moment, use of Google Maps takes place on Google's terms; the Application does not transmit any other data to Google.

The Application retrieves exchange rates on the server side from the public tables of the National Bank of Poland and directly from the European Central Bank (reference rates); the queries contain no personal data and no company data.

The Application does not use any analytics, advertising or tracking tools. Data is sent to the artificial intelligence service (Mistral AI) only where the Mivi assistant has been enabled by the Account Administrator for the company and by the User for their own account, and only data to which that User has access. Each User decides for themselves whether to use the assistant and may disable it at any time in their account settings; the scope of the data transferred is described in the Data Processing Agreement. In the Mivi+ module, the User's history of conversations with the assistant is stored in the Application for 90 days, and the User may delete it at any time.

6. Cookies and browser storage

The Application uses only cookies necessary for its operation, which do not require consent:

• the Application's session cookie (name beginning with “MIVARE”): maintaining the logged-in session; deleted when the browser is closed or on logging out; inaccessible to scripts, transmitted only over an encrypted connection;
• the public pages' session cookie (name beginning with “MIVARE” and ending with “PUBSESSID”): maintaining access to the client, architect or partner portal, the project status or an acceptance after verification, for 30 minutes; deleted when the browser is closed;
• mw_td: remembering a trusted device after two-factor authentication, at the User's request; valid for 30 days;
• mw_viewport: screen width, allowing the layout of the Application to be adapted to the device; valid for 12 months; contains no identifying data.

In the browser storage (localStorage), the Application saves only the expanded or collapsed state of the side menu; it is not transmitted to the server.

Cookies can be deleted in the browser settings; blocking them makes it impossible to log in to the Application and to use the public functions.

7. Device location and photographs

The Application uses the device's location only on the attendance records screen in the employee application, after the User has given permission in the browser, in order to check whether the User is at the place of work. A single location is saved at the start and a single location at the end of work; after that screen is closed the Application does not use the location, and between these actions it does not save it. This data is Customer Data and falls within the scope of the Data Processing Agreement.

The Application removes metadata from uploaded photographs, including the location, date and device data stored in them.

8. Transfers of data outside the European Economic Area

Mivare processes the data described in this Policy on servers in the European Union. Stripe, as the payment operator, may transfer billing data to entities of its group, including Stripe, Inc. in the United States, on the basis of the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) and standard contractual clauses. Any other transfer of data outside the European Economic Area will take place only using a mechanism compliant with Chapter V GDPR, after this Policy has been updated beforehand.

9. Data-subject rights

You have the right of access to your data, the right to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal.

Please direct requests to hello@mivaregroup.com. We respond without undue delay and no later than one month after receipt of the request; in justified cases this period may be extended in accordance with the GDPR, of which we will inform you.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw), or with the supervisory authority in the Member State of the European Union of your habitual residence, place of work or place of the alleged infringement.

10. Automated decisions

Mivare does not take decisions concerning Users based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them. Automatic suspension of access following unsuccessful payment attempts results from the Payment Terms and concerns the Customer as an entrepreneur; the decision may be clarified with customer support at any time.

11. Security

Mivare applies technical and organisational measures appropriate to the risk, in particular encryption of connections, storage of passwords solely in the form of a cryptographic hash, two-factor authentication, logical separation of each company's data, event logging, encryption of files before they are written to the file store, and encrypted backups kept in the European Union separately from the Application server. Data deleted from the Application remains in backups for no more than 30 days and is then deleted as the backups rotate. A detailed description is contained in the Data Processing Agreement (MSP-LEG-003).

12. Changes to the Policy

This Policy is updated whenever there is a change in the manner of data processing, the recipients or the legislation. We inform Account Administrators of material changes by e-mail and in the Application. The current version is available at https://mivaregroup.com/en/legal/space/privacy/

This Policy is made available in seven language versions; in the event of any discrepancy, the Polish version prevails. This Policy is effective from 30 October 2026.