Privacy Policy
1. Who processes your data
The controller of your personal data is:
Kordonek Joanna Łysoń-Owczarz ul. Turystyczna 26, 34-120 Sułkowice Tax ID: 5512649924 Email: kontakt@eppwr.pl Telephone: +48 572 892 922
We have not appointed a data protection officer. For all matters concerning personal data, please contact us at the email address above.
2. Our two roles
This distinction is important for understanding the entire Policy.
As a controller, we process the data of people who contact us through the website, use its features or represent our clients and contractors. Sections 3–9 apply to this data.
As a processor, we handle data entered by our client into its EPPWR application instance — including the data of its suppliers’ representatives. The client is the controller of this data, and we process it solely on its documented instructions under a data processing agreement. Section 10 applies to this.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to a contact form enquiry, callback request or email | Article 6(1)(f) GDPR — our legitimate interest in conducting correspondence | until the correspondence ends and then for 12 months |
| Booking and conducting an application demonstration | Article 6(1)(b) GDPR — steps taken prior to entering into a contract | up to 12 months from the demonstration date |
| Completing the preliminary PPWR obligations assessment questionnaire | Article 6(1)(f) GDPR — providing and improving the website feature | up to 12 months |
| Entering into and performing the licence agreement and maintaining the instance | Article 6(1)(b) GDPR — performance of a contract; for client representatives, Article 6(1)(f) GDPR | for the term of the agreement |
| Issuing and retaining accounting documents | Article 6(1)(c) GDPR — legal obligation under tax and accounting legislation | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Handling complaints | Article 6(1)(c) and (f) GDPR | up to 12 months after the complaint procedure ends |
| Establishing, pursuing or defending claims | Article 6(1)(f) GDPR | until the expiry of the limitation period for claims |
| Website traffic analytics | Article 6(1)(a) GDPR — your consent | until consent is withdrawn, but no longer than the period specified in Section 7 |
| Marketing using advertising tools | Article 6(1)(a) GDPR — your consent | until consent is withdrawn |
| Ensuring security and preventing abuse, including server logs | Article 6(1)(f) GDPR | 90 days |
4. What data we collect
From the contact form: full name, email address, optionally telephone number and company name, message content and a file if you choose to attach one.
From a callback request: telephone number and preferred contact time.
From a demonstration booking: full name, email address, company name and selected date.
From the PPWR questionnaire: your answers and — if you request the result — your email address.
Automatically: IP address, browser and operating system information, date and time of the visit, addresses of visited pages and referring page address.
From clients: company registration details, contact details of persons authorised to use the application and billing details.
Providing data is voluntary but necessary to use a given feature or enter into an agreement. Required fields are marked in the forms.
5. Who we share data with
Data may be shared with:
- IT infrastructure and service providers — hosting, analytics and advertising tools; a complete list, including processing locations, is provided in the List of Sub-processors available on the website; outgoing email is handled by the Service Provider’s server without any external intermediary;
- law firms and debt collection agencies — to the extent necessary to pursue claims;
- public authorities — where required by law.
We do not sell personal data or share it with third parties for marketing purposes.
6. Transfers of data outside the European Economic Area
The infrastructure on which the website and application instances operate is located in the Hetzner Online GmbH data centre in Falkenstein (Germany), within the European Economic Area.
The analytics and advertising tools described in section 7 involve transfers of data to providers established in the United States. Such transfers are based on the European Commission Implementing Decision of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU–US Data Privacy Framework and, where not covered by that decision, on standard contractual clauses approved by the European Commission.
These transfers take place only after you have given your consent to the relevant category of cookies.
7. Cookies and similar technologies
The legal basis for storing information on your device and accessing it is Article 398 of the Act of 12 July 2024 — Electronic Communications Law.
Essential cookies
Required for the website to operate. They do not require consent. They remember your selected language version, your decision to close the information bar and the language change suggestion, and protect forms.
| Name | Purpose | Lifetime |
|---|---|---|
ppwr_lang |
remembering the selected language version | 180 days |
ppwr_geo |
remembering the decision on the language change suggestion | 180 days |
ppwr_topbar |
remembering that the information bar was closed | 30 days |
Analytics cookies — consent required
Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). They are used to measure traffic, the number of visits and how users navigate the website. Data may be transferred to Google LLC in the United States. To opt out independently of our website: https://tools.google.com/dlpage/gaoptout
Marketing cookies — consent required
Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). It enables us to measure advertising effectiveness and target messages at people who have visited the website.
Managing consent
On your first visit, we display a panel where you can accept or reject individual cookie categories. You may change or withdraw your consent at any time using the ‘Cookie settings’ link in the footer of every page. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
You can also change cookie settings in your browser. Blocking essential cookies may prevent the website from operating correctly.
8. Your rights
You have the right to:
- access your data and receive a copy of it;
- rectify inaccurate data or complete incomplete data;
- erase data when it is no longer needed for the purposes for which it was collected, when you withdraw your consent or when you successfully object;
- restrict processing;
- data portability for data processed by automated means on the basis of consent or a contract;
- object to processing based on our legitimate interest, on grounds relating to your particular situation; you may object to processing for direct marketing purposes at any time without giving reasons;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise any of these rights, write to our email address. We will respond without undue delay and no later than within one month.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa.
9. Automated decision-making
We do not make decisions concerning you based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you.
The result of the preliminary PPWR obligations assessment questionnaire is for information purposes only and does not constitute a decision within the meaning of Article 22 GDPR.
10. Data in the EPPWR application
This section concerns data entered by our clients into their application instances.
- The client is the controller of this data. We process it as a processor, solely on the client’s documented instructions, under a data processing agreement concluded pursuant to Article 28 GDPR.
- Each client receives a separate instance of the application with its own database. Client data is neither combined nor processed jointly.
- We do not use client data for our own purposes — in particular for product development, statistical analysis or training machine learning models.
- Data subjects whose data has been entered into the application by the client should submit requests concerning their rights directly to the client as the controller. If we receive such a request, we will forward it to the client without undue delay.
- After termination of the agreement, we provide the client with a data export and then permanently delete the data — in accordance with the Terms and Conditions.
Artificial intelligence features
The application uses language models solely on the basis of an API key obtained and entered by the client.
This means that data sent to the model provider is transferred under an agreement between the client and that provider. We are not a party to this relationship, do not act as an intermediary and are neither a recipient nor a sub-processor within it. The terms governing processing, retention and any transfer of data outside the EEA are set out in the client’s agreement with the model provider — in particular OpenAI’s terms, if the client uses that provider.
As the controller, the client is responsible for establishing the legal basis for such a transfer and for complying with the obligation to provide information to data subjects.
11. Security
We apply technical and organisational measures appropriate to the risk, including:
- encryption of data in transit using TLS;
- separate instances and databases for each client;
- access control based on roles and permissions;
- regular backups;
- updates to server and application software;
- limiting the number of persons with access to data and requiring them to maintain confidentiality.
12. Changes to the Policy
We may amend the Policy, in particular due to changes in legislation, the scope of services or the tools used. The current version, together with its effective date and version number, is always available on the website. We notify clients of material changes by email at least 14 days in advance.
13. Language versions
The Policy has been drawn up in Polish. Versions in other languages are provided for the convenience of data subjects and are for information purposes only. In the event of any discrepancy between language versions, the Polish version shall prevail.
This does not limit any rights arising from the mandatory laws of the country in which you are located.
