PRIVACY POLICY the “ENERGYLANDIA” mobile application

PRIVACY POLICY the “ENERGYLANDIA” mobile application

Privacy principles

The Privacy Policy sets out the rules for processing and ensuring the security of your personal data (obtained through the mobile application “ENERGYLANDIA”; hereinafter referred to as the “Application”) -. in connection with your use of the functionalities or services available through the Application. In accordance with Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; referred to herein as: “GDPR”) personal data is any information about an identified or identifiable natural person (i.e. a specific adult or child), such as geolocation (spatial data).

The data controller explains that users’ data are processed in accordance with legal provisions, including:

• GDPR provisions;
• provisions of the Act of 16 July 2004 Telecommunications Law;
• provisions of the Data Protection Act of 10 May 2018;
• provisions of the Act of 18 July 2002 on the provision of services by electronic means.

taking into account, inter alia, the provisions of the Act of 23 April 1964 – Civil Code and the Act of 4 February 1994 on Copyright and Related Rights.

The Administrator shall ensure the protection of personal data by applying appropriate organisational and technical solutions to prevent third parties from interfering with users’ privacy.

The controller, bearing in mind the principles of Article 5 of the GDPR, shall apply the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation and integrity and confidentiality, and relevance to the purpose of processing when processing data.

Data Administrator

The administrator of your personal data is the company under the name Energylandia Goczał Family spółka komandytowa with its registered office in Zator, address: al. 3 Maja 2, 32-640 Zator, entered in the register of entrepreneurs kept by the District Court for Kraków-Śródmiescie in Krakow, XII Economic Division of the National Court Register, under KRS no.: 0000605098, REGON: 070883960, NIP: 5511735768, e-mail: info@energylandia.pl, phone: +48 (33) 486 15 00.

The Administrator shall exercise the utmost care to prevent a breach of personal data protection, which in the light of the GDPR is understood as a breach of security leading to the accidental or unlawful destruction, loss, modification, unauthorised disclosure of or unauthorised access to personal data transmitted, stored or otherwise processed.

Processing of personal data

Personal data is processed by the Administrator in accordance with the provisions of the law for the following relevant purposes – depending on which functionality of the Application or which service the data subject is using or has used (because the data is exclusively derived from the user’s activity on the Application and its extent depends on which services or functionalities the user has chosen to use and which services and functionalities were/are/will be available on the Application at the time of that user activity; whereby only relevant and appropriate data is processed, in accordance with the principles indicated at the outset, and linked exclusively to the User’s activity and not going beyond that activity), i.e. on the basis of Article 6(1)(a), (b), (c) and (f) respectively of the GDPR.

As noted above, data from users is linked to their activity on the Application, so any data from users of the Application is collected in two ways: information provided voluntarily by the user – such data may be provided by completing the relevant registration forms, contact forms, if available on the Application; where the provision of designated data is a condition for the conclusion of a contract, the category of such data (e.g. e-mail) is described accordingly;

• information obtained when using the Application – these may include:
• information in server logs – the Administrator’s server automatically records such data as the request sent by the user, the date and time of the request and the response sent, device data (e.g. hardware model), type of operating system,
• information collected by the tools in the process of monitoring statistics on the number of people using the Application,
• IP address – every piece of electronic equipment connected to the Internet is assigned a unique number, i.e. an IP address; based on this it is possible, for example, to identify the country from which a given user connects to the network,
• geolocalisation data,
• server logs – by collecting the Application’s server logs.

Recipients of data

Depending on the scope and purpose of the data processed, the data may be transferred – under the terms of the law – to other entities that will process them, within the scope of the respective processing purpose, respectively:

1. in each case to state authorities or other entities authorised by law, in order to fulfil the Administrator’s obligations imposed by law, e.g. the police, the public prosecutor’s office, the tax office;
2. marketing service providers – to support the Administrator in the promotion of goods, organisation of promotional activities, loyalty programmes and campaigns;
3. entities operating information and communication systems and providing IT services – to the extent of maintaining the correct operation of the Application, its updates, repairs, and the introduction or improvement of functionality;
4. legal assistance providers – to exercise their legal rights, secure their rights and enforce their contractual claims and handle complaints;
5. entities supporting the Administrator’s operations on behalf of the Administrator – including third party system providers – to support, improve or develop the Administrator’s operations;

insofar as the processing of personal data for a specific purpose takes place, taking into account what functionalities are (were) available in the Application, respecting the principles relating to the processing of data, and set out in the GDPR, as well as the period for which certain data may be stored.

Data shall only be made available to external parties under the terms and within the limits of the law.

Data retention period

Personal data shall be kept for no longer than is necessary for the purposes described above – including the proper functioning of the Administrator’s business, taking into account the time limitations for claims and the period justified by the need to keep accounting records in accordance with the legal provisions of the legislation obliging the Administrator to keep the documents (taking into account the period of the statute of limitations for tax liabilities) and while maintaining the principle of accountability. Thus:

1. data contained in contracts is stored until three months after the expiry of the limitation period for contractual claims;
2. data provided using the available forms on the Application is stored for a period of three years in order to maintain the principle of accountability (if any, in the relevant version of the Application);
3. documents relating to the complaint shall be retained for a period of one year after expiry of the warranty period or settlement of the complaint, whichever is the later, unless the period referred to in point ‘a’ expires earlier by reason of the limitation period;
4. data for marketing purposes – in the case of data processing on the basis of consent provided for by law – shall be stored until consent is withdrawn; in turn in the case of processing of such data on the basis of a legitimate purpose of the Administrator – until an objection is lodged or an equivalent declaration is made in this respect, unless the provisions of law entitle the Administrator to continue processing such personal data despite the lodging of such an objection.

The Administrator at the same time informs that according to Article 118 of the Civil Code: “Unless a special provision provides otherwise, the period of limitation is six years, and for claims for periodic benefits and claims related to the conduct of business activity – three years. However, the end of the limitation period shall fall on the last day of a calendar year, unless the limitation period is shorter than two years.”

Data processing rights

The Administrator shall further inform the data subject:

1. about the right to request from the Administrator access to, rectification, erasure or restriction of processing of personal data concerning the data subject, or the right to object to the processing, as well as the right to data portability,
2. that where processing is based on a statement of consent (legal basis: Article 6(1)(a) or Article 9(2)(a) respectively) – the person giving such consent has the right to withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal,
3. that the provision of data is voluntary. Failure to provide data necessary for the conclusion of a remote agreement, which is also necessary for the settlement of the Administrator’s business activity – i.e. failure to provide data marked as necessary for the conclusion of a remote agreement through the Application may prevent the conclusion of such an agreement (the provision of such data being a condition for the conclusion of the agreement). In other respects, failure to provide data (or an individual item of data) may hinder or prevent the proper performance of other functionalities or services available on the in the Application,
4. about the right to lodge a complaint with the supervisory authority, the President of the Office for Personal Data Protection;
5. that at the end of the retention period – in accordance with the law – the personal data will be deleted;
6. that it has appointed a Data Protection Officer, who can be contacted by writing to: iod@energylandia.pl or to the postal address of the Data Protection Inspector: IOD ENERGYLANDIA – al. Płk. Beliny Prażmowskiego 69/4, 31-514 Kraków. Data subjects may contact the Data Protection Officer on all matters related to the processing of their personal data and the exercise of their rights under the GDPR,
7. that personal data will not be processed by automated means (including profiling) in such a way that any decisions could be made in respect of the user as a result of such automated processing, that other legal effects would be produced or that users of the Application would otherwise be materially affected. The information collected in this way is used for, among other things: the management of the Application; the identification of possible security risks; the study of aggregated user traffic within the Services; and for statistical purposes,
8. that external links may be provided within the Application to allow its users to reach other websites directly, or that cookies from other parties may additionally be placed on your device when you use the Application, in order to allow you to use the functionalities of the Application integrated with these websites. The Administrator informs you that he/she does not accept any responsibility for the use of cookies. The Administrator informs that he/she has no influence on the privacy policy and the use of cookies applied by these providers. For security reasons, it is recommended that, before using the functionalities/resources offered by other websites or services, each user should read the regulations concerning privacy policy and the use of cookies of these entities, if they have been made available, and in the absence thereof, contact the operator of these websites or services in order to obtain the relevant information.

Cookies

The Administrator explains that the Application, in accordance with Article 173 of the Telecommunications Act, uses cookies which are IT data, in particular text files that are stored on the user’s terminal equipment. These files usually contain the name of the application from which they originate, the time they are stored on the terminal equipment and a unique number. They are used:

• to facilitate the use of the Application by the user;
• for subsequent association of the user when the Application is reconnected to the device on which they were stored;
• to create statistics to help us understand how users of the Applicaation use the websites, so that we can improve their structure and content;
• to adapt the content of the Application to your specific preferences and to optimise the use of the websites, tailored to your individual needs.

The Application – depending on its version – uses the following types of cookies: “session” – stored in the User’s terminal equipment until logging out, leaving the website or switching off the web browser; “permanent” – stored in the user’s terminal equipment for the time specified in the parameters of the cookies or until they are deleted by the user; “performance” – enable the collection of information on the manner of use of the Application; “essential” – enable the use of the services available within the Application; “functional” – enable the memory of the settings selected by the user and the personalisation of the user interface; “own” – posted by the Application; “external” – originating from a website external to the Application.

The extent of the information collected automatically depends on the user’s settings. It is therefore recommended that the user checks his/her own to find out what information is made available automatically by his/her device or to change these settings. To do so, the user can consult the “Help” or “Settings” of the device in use.

Devices usually allow cookies to be stored on the user’s terminal equipment by default. Users of the Application can therefore change their settings in this respect. Detailed information regarding cookies is contained in the settings or documentation of the device used by the user. It should be noted in this regard that disabling cookies that are necessary for authentication processes, security or maintaining user preferences, if any, on the Application, may make it difficult and, in extreme cases, impossible to use the Application (or the functionality of the Application).

Furthermore, the Administrator explains that the information of certain retained users is subject to logging at the server layer. This data is used exclusively for the administration of the Application and to ensure the most efficient operation of the hosting services provided. Resources viewed are identified by URLs. In addition, the following may be recorded: the public IP address of the device The following may also be recorded: the public IP address of the device from which the request came (this may be directly the user’s device); the name of the client’s station – identification via the http protocol, if possible; the user’s name given during the authentication process, the time of the request, the first line of the http request, the http response code, the number of bytes sent by the server, the URL address of the page previously visited by the user (referer link) – if the user accessed the Administrator’s site via a link, information about the user’s browser, information about errors that occurred during the HTTP transaction. The above data is not associated with specific users browsing the pages. The above data is used only for the purpose of server administration.

Control of Data Processing

The Administrator shall make every effort to ensure that all physical, technical and organisational measures are in place to protect personal data against accidental or wilful destruction, accidental loss, alteration, unauthorised disclosure, use or access, in accordance with all applicable legislation.

This Privacy Policy is effective as of 12 August 2022.