Privacy Policy for Enertia.pl website

1. General Information

1. This policy applies to the Website operating at the URL: enertia.pl
2. The website operator and personal data administrator is: Enertia Sp. z O.O Kolejowa 8, 58-100 Świdnica
3. The operator's contact email address is: kontakt@enertia.pl
4. The Operator is the Administrator of your personal data in relation to data voluntarily provided on the Website.
5. The Website uses personal data for the following purposes:
   • Newsletter management
   • Handling enquiries via the form
   • Preparation, packaging, and dispatch of goods
   • Fulfilment of ordered services
   • Presentation of offers or information
6. The Website performs functions of acquiring information about users and their behaviour in the following ways:
   1. Through data voluntarily entered into forms, which is then entered into the Operator's systems.
   2. By saving cookie files (so-called "cookies") on end devices.

2. Selected data protection methods used by the Operator

1. Login and personal data entry points are protected at the transmission layer (SSL certificate). This means that personal data and login data entered on the website are encrypted on the user's computer and can only be read on the target server.
2. Personal data stored in the database is encrypted in such a way that only the Operator possessing the key can read it. This protects the data in case of database theft from the server.
3. User passwords are stored in hashed form. The hashing function works unidirectionally - it is not possible to reverse its operation, which is currently a modern standard for storing user passwords.
4. The website uses two-factor authentication, which provides an additional form of login protection for the Website.
5. The Operator periodically changes its administrative passwords.
6. To protect data, the Operator regularly performs backup copies.
7. An important element of data protection is the regular updating of all software used by the Operator for processing personal data, which in particular means regular updates of programming components.

3. Hosting

1. The Website is hosted (technically maintained) on the servers of the operator: smarthost.pl
2. To ensure technical reliability, the hosting company maintains server-level logs. The following may be recorded:
   • resources specified by URL identifier (addresses of requested resources - pages, files),
   • time of query arrival,
   • time of response dispatch,
   • client station name - identification performed by the HTTP protocol,
   • information about errors that occurred during HTTP transaction execution,
   • URL of the page previously visited by the user (referer link) - if the transition to the Website occurred via a link,
   • information about the user's browser,
   • information about the IP address,
   • diagnostic information related to the self-ordering process of services via registrars on the website,
   • information related to the handling of email directed to and sent by the Operator.

4. Your rights and additional information on data usage

1. In some situations, the Administrator has the right to transfer your personal data to other recipients if it is necessary for the performance of a contract concluded with you or to fulfil obligations incumbent on the Administrator. This applies to the following groups of recipients:
   • hosting company on the basis of entrustment
   • couriers
   • postal operators
   • insurers
   • law firms and debt collectors
   • banks
   • payment operators
   • authorised employees and associates who use the data to achieve the purpose of the website's operation
   • companies providing marketing services to the Administrator
2. Your personal data processed by the Administrator will not be stored longer than necessary to perform related activities specified by separate regulations (e.g., accounting). For marketing data, data will not be processed for longer than 3 years.
3. You have the right to request from the Administrator:
   • access to your personal data,
   • rectification of your personal data,
   • erasure of your personal data,
   • restriction of processing,
   • and data portability.
4. You have the right to object to the processing indicated in point 3.2 regarding the processing of personal data for the purpose of pursuing the legitimate interests of the Administrator, including profiling. However, the right to object cannot be exercised if there are compelling legitimate grounds for processing, overriding your interests, rights, and freedoms, in particular for the establishment, exercise, or defence of legal claims.
5. You have the right to lodge a complaint against the Administrator's actions with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa.
6. Providing personal data is voluntary but necessary for the operation of the Service.
7. Automated decision-making, including profiling, may be carried out in relation to you for the purpose of providing services under the concluded agreement and for the Administrator's direct marketing activities.
8. As a rule, we do not transfer personal data to third countries within the meaning of personal data protection regulations. The exception is the Google tools described in Chapter 7, which are activated only after consent is given in the banner - within their scope, data may be processed outside the European Economic Area under the terms specified in that chapter.

5. Information in forms

1. The Service collects information voluntarily provided by the user, including personal data, if provided.
2. The Service may save information about connection parameters (time stamp, IP address).
3. In some cases, the Service may save information that facilitates linking data in the form with the email address of the user filling out the form. In such a case, the user's email address appears within the URL of the page containing the form.
4. Data provided in the form is processed for the purpose resulting from the function of the specific form, e.g., for processing a service request or commercial contact, registering services, etc. Each time, the context and description of the form clearly indicate its purpose.

6. Administrator's Logs

1. Information about user behaviour on the service may be logged. This data is used for service administration.

7. Website statistics and marketing techniques

1. Own statistics (first-party), without cookies. The Operator maintains anonymous visit statistics using its own measurement mechanism, operating entirely within the Operator's infrastructure in the EU. The mechanism does not save or read any information on the user's device (it does not use cookies, localStorage or similar technologies), does not collect personal data and does not create user profiles. Only technical events are recorded (e.g. page view, clicking a contact button) along with the subpage address, source of entry and device type. In order to count the number of visitors, the IP address is one-way converted (a hash function with a key changed daily and then deleted) and is not saved anywhere - the resulting identifier expires at the end of the day and does not allow for user recognition between days or for their identification. The basis for processing is the legitimate interest of the Operator (Art. 6(1)(f) GDPR) consisting in measuring and improving the operation of the Website. The mechanism honors the Global Privacy Control signal (when the signal is enabled, it does not send any data).
2. Google Analytics 4 (with consent). With the user's prior consent, the Website uses Google Analytics 4 (provider: Google Ireland Limited) for audience statistics. The tool operates under the Google Consent Mode v2 model: until consent is given, it remains blocked and does not save cookies. Consent is given in the banner displayed upon entering the website, where the "Accept" and "Decline" options are equivalent; the decision can be changed at any time (link in the website footer). The basis is the user's consent (Article 6(1)(a) of the GDPR and Article 173 of the Telecommunications Law). The first-party statistics described in point 1 operate independently and without cookies.
3. Google Signals (with consent). The Google Signals feature is enabled in the Google Analytics 4 service. If the user is logged into a Google account and has ad personalisation enabled in that account's settings, Google may associate data about their visit to the Website with information assigned to the account. This allows the Operator to receive approximate demographic data (age range, gender) and interest categories in reports, as well as information that visits from different devices come from the same user (cross-device reporting). The Operator does not gain access to the user's Google account or to data allowing their identification - reports are presented solely in aggregate, and Google blocks their display when the number of users is too small to rule out the identification of an individual (data thresholding). The feature is activated only after consent is given in the banner and stops working when it is withdrawn; the basis for processing is the user's consent (Article 6(1)(a) of the GDPR). Regardless of the Website's settings, the user can disable ad personalisation in their own Google account (myadcenter.google.com) - then Google Signals will not cover their visits.
4. User-provided data (enhanced conversions). The Google Analytics 4 service has user-provided data support enabled, which serves to more accurately attribute conversions to the traffic source. The mechanism works in such a way that contact details provided voluntarily by the user in a form (primarily email address, in some cases also phone number, first name, last name or address) are converted in the browser using the SHA-256 one-way hash function and transferred to Google only in this irreversible form; Google does not receive them in plain text, and the Operator does not receive any new information about the user in return. Automatic detection of contact details on pages is disabled: transfer takes place only from forms directly intended for this purpose and only after consent is given in the banner. The basis for processing is the user's consent (Article 6(1)(a) of the GDPR), and its withdrawal is effective for the future. Providing data in this mode is not a condition for processing the inquiry - the form will be handled regardless of the decision expressed in the banner.
5. Google Tag Manager. The Website uses Google Tag Manager solely as a tool to manage the aforementioned tags; it does not store cookies for profiling purposes on its own. Tags requiring consent are only triggered after consent has been granted (Consent Mode).
6. Advertising and remarketing. The Google Analytics 4 service is linked to the Operator's Google Ads account, which serves to measure campaign effectiveness. In the settings of this connection, ad personalisation is disabled: data from the Website does not feed ad audience lists and is not used to target remarketing ads to the user. The Website does not use the Meta/Facebook pixel. Google advertising tags are subject to the same consent mechanism as statistical ones (Consent Mode v2) and are not activated without consent; until consent is given, the restriction of advertising data (ads_data_redaction) also applies. In the event of launching remarketing, the policy will be updated before its implementation.
7. Transfer of data outside the EEA. Within the scope of the Google tools described above, data may also be processed outside the European Economic Area, including in the United States. This takes place on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework, in which Google LLC is a certified entity) and standard contractual clauses. Apart from these tools, the Operator does not transfer personal data to third countries.
8. The Operator may send e-mail messages related to the handling of the user's inquiries and bookings; commercial correspondence is sent only after obtaining separate consent.

8. Information about cookies

1. The information pages of the Website do not save cookies without the user's consent. Necessary cookies (session, security) are used in the part of the Website handling reservations, payments and the customer panel. Google Analytics cookies - statistical, as well as those supporting the functions described in Chapter 7 (Google Signals, conversion measurement) - are saved only after consent is given in the banner; until then, they are not saved. The Operator's first-party statistics do not use cookies.
2. Cookies (so-called "ciasteczka") are IT data, in particular text files, which are stored on the end device of the Service User and are intended for using the Service's websites. Cookies usually contain the name of the website from which they originate, their storage time on the end device, and a unique number.
3. The entity placing cookies on the Service User's end device and accessing them is the Service operator.
4. Cookies are used for the following purposes:
   1. maintaining the Service user's session (after logging in), thanks to which the user does not have to re-enter their login and password on each subpage of the Service;
   2. fulfilling the purposes specified above in Chapter 7 "Website statistics and marketing techniques";
5. Within the Service, two main types of cookies are used: "session" cookies and "persistent" cookies. "Session" cookies are temporary files that are stored on the User's end device until logging out, leaving the website, or turning off the software (web browser). "Persistent" cookies are stored on the User's end device for the time specified in the cookie parameters or until they are deleted by the User.
6. Web browsing software (web browser) usually allows the storage of cookies on the User's end device by default. Service Users can change these settings. The web browser allows cookies to be deleted. It is also possible to automatically block cookies. Detailed information on this topic can be found in the help or documentation of the web browser.
7. Restrictions on the use of cookies may affect some functionalities available on the Service's websites.
8. Through the Website, only after the user has given consent, cookies may be placed by Google (Google Analytics 4, Google Ireland Limited) for statistical and conversion measurement purposes. The identifiers saved in them may - in the case of a user logged into a Google account with ad personalisation enabled - be associated by Google with the data of that account for the purposes of demographic and cross-device reports (the Google Signals feature described in Chapter 7). Without consent, these cookies are not saved. Consent can be withdrawn at any time ("Privacy settings" link in the footer).

9. Managing cookies - how to practically express and withdraw consent?

1. If the user does not want to receive cookies, they can change their browser settings. We reserve that disabling cookies necessary for authentication processes, security, and maintaining user preferences may hinder, and in extreme cases may prevent, the use of websites.
2. To manage cookie settings, select the web browser you are using from the list below and follow the instructions:
   • Edge
   • Internet Explorer
   • Chrome
   • Safari
   • Firefox
   • Opera

   Mobile devices:

   • Android
   • Safari (iOS)
   • Windows Phone