Privacy Policy

1. Data controller

The controller of personal data (the "Controller") is [pełna nazwa firmy / full company name], with its registered office at [adres siedziby / registered address], tax ID (NIP): [NIP / tax ID], KRS: [KRS].

For all matters concerning the processing of personal data, including the exercise of rights under the GDPR, you can contact us at [email protected].

The Controller has not appointed a Data Protection Officer (DPO); these duties are carried out directly by the Controller.

2. Scope and sources of data

The Controller processes the following categories of data:

• account data — email address, name or company name, and an encrypted password;
• Google sign-in data — account identifier, email address and profile picture provided by Google;
• company data — name, tax ID (NIP) and address details entered in the account settings;
• project data — installation designs, cabinets, circuits, cost estimates and documents created in the Service;
• technical data — IP address, device and browser information, cookie identifiers and data about how the Service is used.

3. Purposes and legal bases of processing

Data is processed for the following purposes and on the following legal bases:

• providing the service, maintaining the account and performing the contract — Art. 6(1)(b) GDPR (performance of a contract);
• handling complaints and establishing or defending claims — Art. 6(1)(f) GDPR (legitimate interest);
• ensuring security, preventing abuse and protecting against unauthorised access — Art. 6(1)(f) GDPR;
• traffic analysis, statistics and improving the Service — Art. 6(1)(f) GDPR, and for non-essential cookies — on the basis of consent, Art. 6(1)(a) GDPR;
• notifying you of changes and marketing contact — on the basis of consent (Art. 6(1)(a) GDPR) or legitimate interest (Art. 6(1)(f) GDPR).

4. Recipients of data

Data may be shared with entities that support the Controller in operating the Service, only to the extent necessary and under data processing agreements. Recipients may include in particular:

• hosting and cloud infrastructure providers;
• email and communication service providers;
• Google — for sign-in (Google Sign-In) and analytics (Google Analytics 4);
• accounting, legal and IT service providers;
• public authorities — where disclosure is required by law.

5. Transfers outside the EEA

As a result of using Google services, data may be transferred outside the European Economic Area, in particular to the United States. Such transfers are based on the Standard Contractual Clauses (SCCs) approved by the European Commission or on an adequacy decision (including the EU-US Data Privacy Framework).

6. Retention periods

Data is kept for as long as necessary to fulfil the purposes for which it was collected, including:

• account data and project data — for as long as the account is maintained, and after its deletion for the period necessary for settlement and to secure claims;
• billing and tax data — for the period required by law (as a rule 5 years);
• analytics data and cookies — in accordance with the settings of the analytics tools, no longer than 14 months;
• data processed on the basis of consent — until the consent is withdrawn.

7. Your rights

You have the following rights:

• the right of access to your data and to obtain a copy of it;
• the right to rectification (correction) of your data;
• the right to erasure of your data (the "right to be forgotten");
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing;
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

8. Exercising your rights and complaints

To exercise your rights, please send a request to [email protected]. The Controller responds to requests without undue delay and no later than one month from receipt.

You have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

9. Automated decisions and profiling

The Controller does not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.

10. Cookies and analytics

The Service uses cookies and similar technologies. Essential cookies ensure the Service works correctly and do not require consent. Analytics and marketing cookies are used on the basis of your consent.

For analytics the Controller uses Google Analytics 4, which collects data about how the Service is used in aggregate form.

You can manage cookies in your browser settings and withdraw consent at any time. Restricting cookies may affect some features of the Service.

The Service uses in particular the following cookies:

• smc_ref — an identifier attributing the visit to a source or campaign, stored for 180 days;
• session cookies — essential for signing in and keeping the User’s session;
• _ga and _ga_* — Google Analytics 4, used to analyse how the Service is used, stored for up to 14 months.

11. Data security

The Controller applies technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access control and securing of the infrastructure.

12. Changes to this Privacy Policy

The Controller may amend this Privacy Policy, in particular in connection with a change in the law or the development of the Service. The current version is always available on the Service.

13. Final provisions

Matters not governed by this Privacy Policy are subject to the GDPR and the Service Terms of Service.