Privacy policy of the Enertia.pl website

1. General information

1. This policy applies to the Website operating at the URL: enertia.pl
2. The operator of the website and the Administrator of personal data is: ENERTIA sp. z o.o. with its registered office in Świdnica, ul. Kolejowa 8, 58-100 Świdnica (KRS 0001092909, NIP 884-282-49-58, REGON 528014766)
3. Contact e-mail address of the operator: kontakt@enertia.pl
4. The Operator is the Administrator of your personal data with respect to the data provided voluntarily on the Website.
5. The Website uses personal data for the following purposes:
   • Handling inquiries via the form
   • Sending commercial information (offers, promotions) by e-mail or SMS - solely on the basis of separate, voluntary consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time
   • SMS or e-mail notifications about planned power outages for the specified address - based on consent, with the option to unsubscribe at any time
   • Execution of ordered services
   • Presentation of offers or information
6. The Website performs the functions of obtaining information about users and their behaviour in the following way:
   1. Through data voluntarily entered in the forms, which are entered into the Operator's systems.
   2. By saving cookies on terminal devices.

2. Selected data protection methods used by the Operator

1. Places of logging in and entering personal data are protected in the transmission layer (SSL certificate). Thanks to this, personal data and login data entered on the website are encrypted on the user's computer and can only be read on the destination server.
2. Personal data stored in the database is encrypted in such a way that only the Operator holding the key can read it. Thanks to this, the data is protected in the event of the database being stolen from the server.
3. User passwords are stored in a hashed form. The hashing function works one-way - it is not possible to reverse its operation, which is currently the modern standard in the field of storing user passwords.
4. Two-factor authentication is used on the website, which constitutes an additional form of protection for logging into the Website.
5. The Operator periodically changes their administrative passwords.
6. To protect data, the Operator regularly performs security backups.
7. An essential element of data protection is the regular updating of all software used by the Operator to process personal data, which in particular means regular updates of programming components.

3. Hosting

1. The website is hosted (technically maintained) on a virtual server leased from an infrastructure provider (processor based on a data processing agreement) and administered by the Operator
2. The Operator, using the provider's infrastructure, maintains server-level logs to ensure technical reliability. The following may be recorded:
   • resources specified by the URL identifier (addresses of requested resources - pages, files),
   • the time the request arrived,
   • the time the response was sent,
   • the name of the client station - identification carried out by the HTTP protocol,
   • information about errors that occurred during the execution of the HTTP transaction,
   • the URL address of the page previously visited by the user (referrer link) - if the transition to the Website occurred via a link,
   • information about the user's browser,
   • information about the IP address,
   • diagnostic information related to the process of self-ordering services through registrars on the website,
   • information related to the handling of electronic mail addressed to the Operator and sent by the Operator.

4. Your rights and additional information on how data is used

1. In some situations, the Administrator has the right to transfer your personal data to other recipients if it is necessary to perform the contract concluded with you or to fulfill the obligations incumbent on the Administrator. This applies to the following groups of recipients:
   • the hosting company on the basis of entrustment
   • couriers
   • postal operators
   • insurers
   • law firms and debt collectors
   • banks
   • payment operators
   • authorized employees and associates who use the data to achieve the purpose of the website's operation
   • companies providing marketing services to the Administrator
2. Your personal data is processed by the Administrator for no longer than is necessary to perform the related activities specified by separate regulations (e.g. on accounting). With regard to marketing data, the data will not be processed for longer than 3 years.
3. You have the right to request from the Administrator:
   • access to personal data concerning you,
   • its rectification,
   • erasure,
   • restriction of processing,
   • and data portability.
4. You have the right to object to the processing of personal data for the purpose of performing legitimate interests pursued by the Administrator, including profiling, whereby the right to object cannot be exercised if there are valid legitimate grounds for processing that override your interests, rights and freedoms, in particular the establishment, exercise or defence of claims.
5. A complaint against the actions of the Administrator may be lodged with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa.
6. Providing personal data is voluntary, but necessary to operate the Website.
7. Automated decision-making, including profiling, may be undertaken in relation to you for the purpose of providing services under the concluded contract and for the purpose of direct marketing conducted by the Administrator.
8. As a rule, we do not transfer personal data to third countries within the meaning of personal data protection regulations. The exceptions are: (1) Google tools described in Chapter 7, run only after consent is given in the banner, and (2) Google services used in preparing quotes and handling reports (calculating travel distance based on the address provided, supporting the analysis of the report description) - to the extent necessary to perform the contract. In both cases, data may be processed outside the European Economic Area under the rules set out in Chapter 7 (EU-US Data Privacy Framework, standard contractual clauses).

5. Information in forms

1. The website collects information provided voluntarily by the user, including personal data, provided that they are supplied.
2. The website may record information about connection parameters (timestamp, IP address).
3. In some cases, the website may store information that facilitates linking the data in the form with the email address of the user filling out the form. In such a case, the user's email address appears inside the URL of the page containing the form.
4. The data provided in the form is processed for the purpose resulting from the function of the specific form, e.g. to perform the service request handling process or commercial contact, registration of services, etc. Each time, the context and description of the form clearly inform what it is used for.

6. Administrator Logs

1. Information on user behaviour on the website may be subject to logging. This data is used for the purpose of administering the website.

7. Website statistics and marketing techniques

1. First-party statistics, without cookies. The Operator keeps anonymous visit statistics using its own measurement mechanism, operating entirely within the Operator's infrastructure in the EU. The mechanism does not save or read any information on the user's device (it does not use cookies, localStorage or similar technologies), does not collect personal data and does not create user profiles. Only technical events are recorded (e.g. page view, clicking a contact button) along with the subpage address, source of entry and device type. In order to count the number of visitors, the IP address is one-way converted (a hash function with a key changed daily and then deleted) and is not saved anywhere - the resulting identifier expires at the end of the day and does not allow for user recognition between days or for their identification. The basis for processing is the legitimate interest of the Operator (Art. 6(1)(f) GDPR) consisting in measuring and improving the operation of the Website. The mechanism honours the Global Privacy Control signal (when the signal is enabled, it does not send any data).
2. Google Analytics 4 (with consent). With the user's prior consent, the Website uses Google Analytics 4 (provider: Google Ireland Limited) for audience statistics. The tool operates in the Google Consent Mode v2 model: until consent is given, it remains blocked and does not save cookies. Consent is expressed in the banner displayed upon entering the page, in which the "Accept" and "Reject" options are equivalent; the decision can be changed at any time (link in the footer of the page). The basis is the user's consent (Art. 6(1)(a) GDPR and Art. 173 of the Prawo telekomunikacyjne (Polish Telecommunications Law)). First-party statistics described in point 1 operate independently and without cookies.
3. Google Signals (with consent). The Google Signals feature is enabled in the Google Analytics 4 service. If the user is logged into a Google account and has ad personalisation enabled in the settings of this account, Google may associate data about their visit to the Website with information assigned to the account. Thanks to this, the Operator receives approximate demographic data (age range, gender) and interest categories in reports, as well as information that visits from different devices come from the same user (cross-device reporting). The Operator does not gain access to the user's Google account or to data allowing their identification - reports are presented only in aggregate, and Google blocks their display when the number of users is too small to rule out the recognition of an individual person (data thresholding). The function starts only after expressing consent in the banner and stops working upon its withdrawal; the basis for processing is the user's consent (Art. 6(1)(a) GDPR). Regardless of the Website settings, the user can disable ad personalisation in their own Google account (myadcenter.google.com) - then Google Signals will not cover their visits.
4. Data provided by users (enhanced conversions). The Google Analytics 4 service has support for user-provided data enabled, which serves to more accurately attribute conversions to the source of entry. The mechanism works in such a way that contact details provided independently by the user in the form (primarily email address, in some cases also phone number, first name, last name or address) are converted in the browser using the one-way SHA-256 hash function and transferred to Google only in this irreversible form; Google does not receive them in plain text, and the Operator does not receive any new information about the user in return. Automatic detection of contact details on pages is disabled: transfer takes place only from forms directly intended for this purpose and only after expressing consent in the banner. The basis for processing is the user's consent (Art. 6(1)(a) GDPR), and its withdrawal is effective for the future. Transferring data in this mode is not a condition for handling the request - the form will be processed regardless of the decision expressed in the banner.
5. Google Tag Manager. The Website uses Google Tag Manager solely as a tool for managing the above tags; in itself, it does not save cookies for profiling purposes. Tags requiring consent are triggered only after it has been given (Consent Mode).
6. Advertising and remarketing. The Google Analytics 4 service is linked to the Operator's Google Ads account, which is used to measure campaign effectiveness. In the settings of this connection, ad personalisation is disabled: data from the Website does not feed ad audience lists, nor is it used to target remarketing ads to the user. The Website does not use the Meta/Facebook pixel. Google advertising tags are subject to the same consent mechanism as statistical ones (Consent Mode v2) and are not activated without consent; until consent is given, an additional restriction on advertising data (ads_data_redaction) is also active. In the event that remarketing is launched, the policy will be updated prior to its implementation.
7. Transfer of data outside the EEA. Within the framework of the Google tools described above, data may also be processed outside the European Economic Area, including in the United States. This takes place on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework, in which Google LLC is a certified entity) and standard contractual clauses. Apart from these tools, the Operator does not transfer personal data to third countries.
8. The Operator may send e-mail messages related to the handling of the user's inquiries and bookings; commercial correspondence is sent only after obtaining separate consent.

8. Information about cookies

1. The information pages of the Website do not store cookies without the user's consent. Necessary cookies (session, security) are used in the part of the Website that handles bookings, payments and the customer panel. Google Analytics cookies - statistical, as well as those supporting the functions described in Chapter 7 (Google Signals, conversion measurement) - are stored only after consent is given in the banner; until then, they are not stored. The Operator's own statistics do not use cookies.
2. Cookies (so-called "cookies") constitute IT data, in particular text files, which are stored on the end device of the Website User and are intended for using the Website's pages. Cookies usually contain the name of the website they come from, the storage time on the end device and a unique number.
3. The entity placing cookies on the end device of the Website User and obtaining access to them is the Operator of the Website.
4. Cookies are used for the following purposes:
   1. maintaining the session of the Website user (after logging in), thanks to which the user does not have to re-enter their login and password on each subpage of the Website;
   2. carrying out the purposes specified above in Chapter 7 "Website statistics and marketing techniques";
5. Two main types of cookies are used within the Website: "session" cookies and "persistent" cookies. "Session" cookies are temporary files that are stored on the User's end device until logging out, leaving the website or turning off the software (web browser). "Persistent" cookies are stored on the User's end device for the time specified in the cookie parameters or until they are deleted by the User.
6. Web browsing software (web browser) usually allows the storage of cookies on the User's end device by default. Users of the Website can change the settings in this regard. The web browser allows you to delete cookies. It is also possible to automatically block cookies. Detailed information on this subject is contained in the help or documentation of the web browser.
7. Restrictions on the use of cookies may affect some of the functionalities available on the Website's pages.
8. Through the Website, solely after the user has given consent, cookies may be placed by Google (Google Analytics 4, Google Ireland Limited) for statistical and conversion measurement purposes. The identifiers stored in them may - in the case of a user logged into a Google account with ad personalisation enabled - be linked by Google with the data of this account for the purposes of demographic and cross-device reports (the Google Signals function described in Chapter 7). Without consent, these cookies are not stored. Consent can be withdrawn at any time (via the "Privacy settings" link in the footer).

9. Cookie management - how to give and withdraw consent in practice?

1. If the user does not want to receive cookies, they can change their browser settings. We reserve that disabling cookies necessary for authentication, security, and maintaining user preferences may make it difficult, and in extreme cases may make it impossible, to use the websites
2. In order to manage cookie settings, select the web browser you use from the list below and follow the instructions:
   • Edge
   • Chrome
   • Safari
   • Firefox
   • Opera

   Mobile devices:

   • Android
   • Safari (iOS)

10. Recruitment

1. The administrator of the personal data of persons applying for a job or cooperation (candidates) is the Operator. Candidates' data (including CVs and message content) are received solely from the candidates themselves - by e-mail or by phone, as described on the Kariera page.
2. We process data for recruitment purposes: in the case of employment under an employment contract - within the scope of data required by labour law - based on Art. 6(1)(c) GDPR in connection with Art. 22¹ of the Kodeks pracy (Polish Labour Code); in the case of cooperation on another basis (e.g. civil law contract, B2B cooperation) - based on Art. 6(1)(b) GDPR (actions prior to entering into a contract). Data exceeding this scope, provided on the candidate's initiative, is processed based on consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time.
3. We store the application for 3 months from its receipt; if we start recruitment interviews with the candidate - until their completion and 3 months thereafter. If the candidate has consented to participate in future recruitments, we store the data for up to 12 months from the date of consent.
4. The candidate is entitled to the rights described in Chapter 4: the right to access, rectify, erase and restrict the processing of data, the right to withdraw consent (in respect of data processed on its basis) and the right to lodge a complaint with the President of the UODO. Providing data is voluntary but necessary to participate in the recruitment process.