Privacy policy
Last updated: 30 September 2026
This policy explains how Danske Gas S.A. processes personal data of users of danskegas.com in accordance with the GDPR, and how it uses cookies.
1.Data controller
The controller of your personal data is:
For data-protection matters you can contact us via our contact form.
We have appointed a Data Protection Officer, who can be contacted through the contact form.
2.What data we process
We process only the data needed for a specific purpose:
- Contact-form data – name, company, email address, telephone number (if provided) and message content. When the form is submitted, we record the sender’s IP address and the time of submission – to protect against misuse and to evidence that the enquiry was made; the IP address is kept for 12 months. A single PDF file of up to 5 MB (e.g. a CV) may be attached to the message; the file goes only to the company’s mailbox together with the message – the website does not store it, and the automatic acknowledgement of the enquiry does not include it.
- Technical data and server logs – IP address, browser type, date/time of visit, pages viewed (for security and diagnostics).
- Website usage data – see the section ‘Visit statistics and basic measurement’.
- Cookies and browser storage – see the ‘Cookie settings’ section.
3.Purposes and legal bases
We process data on the following bases (Art. 6(1) GDPR):
- handling enquiries – our legitimate interest (f) and steps prior to entering a contract (b);
- recruitment (job applications, e.g. a CV sent through the form) – steps taken at your request prior to entering a contract (b) and, for recruitment under a contract of employment, also a legal obligation (c) in conjunction with Article 22¹ of the Polish Labour Code (Kodeks pracy); data you provide on your own initiative beyond this scope (e.g. a photograph) – consent given by sending them (a; Article 22¹a of the Polish Labour Code), which you may withdraw at any time;
- site security – legitimate interest (f);
- recording the IP address and time of form submission – legitimate interest (f): protection against misuse and evidence that the enquiry was made;
- basic visit measurement – legitimate interest (f), with the right to object;
- Matomo statistics – legitimate interest (f), with the right to object; no cookies and nothing stored on your device.
5.Visit statistics and basic measurement
We perform basic measurement on the server, without cookies, to prepare aggregate reports on website traffic. It is complemented by the Matomo statistics described below. For each view of a public page, the server records the page address, language, referring source (e.g. a search engine, LinkedIn, another website, a direct visit, a campaign), device type, country and the approximate locality assigned to the IP address range, and – based on the autonomous system (AS) number to which the IP address belongs – the type of network (a company or institutional network, a telecommunications operator, a data centre). We record the organisation’s name only where the address range is registered to a legal person or an organisational unit; names indicating a natural person, including civil-law partnerships, are not recorded. For such networks we also establish the organisation’s internet domain: based on the name assigned to the IP address in the public DNS system (so-called reverse DNS), confirmed by a forward lookup, or, where that is unavailable, based on data on the owners of autonomous systems; we record only the organisation’s domain (e.g. example.com), not the full host name. The IP address is processed only in memory at the time of the request and is not stored; we pass it on only in the reverse DNS query for networks registered to organisations, which reaches the DNS servers of our hosting provider and of the entity managing that network. We do not check addresses of connections at telecommunications operators in this way, including home and mobile connections. To limit the number of queries we use a daily, irreversible hash of the network range. For recognised organisations we record the visit: the time to the nearest minute, the pages visited in sequence, the referring source, language, device type and approximate locality. We keep such records for 90 days, and thereafter only as a monthly summary without the time or sequence of page views (organisation, number of visits, pages, referring sources) for 13 months. The summaries contain no IP addresses or identifiers; we do not combine them with personal data, and we do not use them to establish visitors’ identities. Network and locality recognition is based on DB-IP data (IP Geolocation by DB-IP, db-ip.com, CC BY 4.0 licence), and the network owner’s domain – on IPinfo data (IP address data powered by IPinfo, ipinfo.io, CC BY-SA 4.0 licence). The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in measuring the audience of our own website and understanding which organisations take an interest in our offer. You may object at any time (Article 21 GDPR) – see ‘Contact’. We treat the Global Privacy Control or Do Not Track signal sent by your browser as an objection: none of the measurements described here is then performed.
For website usage statistics we use Matomo On-Premise, installed within the hosting infrastructure used by the controller. Matomo operates without cookies and without storing any information on your device; we assign no persistent visitor identifier. The purpose is to understand the popularity of our content and assess website usability. We analyse pages visited, page-view timestamps, downloaded documents and clicks on outbound links. The technical information involved is: device and browser type, screen resolution, referring source and approximate location (country, region) derived from the truncated IP address. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in measuring the audience of our own website; you have the right to object (Article 21 GDPR).
We do not send form contents, email addresses, login details or document numbers to analytics. We remove URL parameters that may contain user information. We do not record sessions, replay what you type or associate statistics with a portal account. We do not use measurement to establish visitors’ identities. The customer, investor and employee portal pages are excluded from both measurements.
Matomo stores no cookies in your browser. The server processes your IP address when handling a connection; in Matomo measurement the IP address is truncated by its last two bytes before storage, and location is derived from the truncated address. Truncating an IP address does not in itself mean that all data are anonymous.
You may object to measurement at any time in two ways: by enabling the Global Privacy Control or Do Not Track signal in your browser, or by ticking ‘Do not measure my visits’ under ‘Privacy settings’ in the website footer. In the second case we store in browser storage only the objection itself (dg_optout) – only after you tick it and solely so that it is honoured on subsequent page views; unticking it or clearing browser storage removes the entry. The objection covers basic measurement and Matomo statistics from the moment it is made; it does not remove earlier aggregate reports from which the activity of an individual cannot be reconstructed. You may also object by contacting the controller.
Hosting, recipients and processing location: the website, Matomo and basic measurement run on the servers of our hosting provider under a data-processing agreement. The servers are located in a country outside the European Economic Area that is covered by a European Commission adequacy decision (Article 45 GDPR). We do not sell statistical data, pass them to analytics vendors or combine them with data from other websites; we carry out no marketing measurement. Access to data is restricted to authorised persons responsible for the website and statistics.
- Basic measurement data: daily aggregates for 90 days; thereafter monthly aggregates only, containing no personal data.
- Detailed Matomo visit and event data: 90 days; aggregate reports: 13 months.
- Backups: up to 8 weeks from creation; they are used for disaster recovery, after which applicable deletions and retention periods are reapplied.
Subject to the conditions in the GDPR, you have the rights of access, rectification, erasure, restriction of processing and data portability, and the right to object where processing is based on legitimate interests. You may use the controller’s contact details in this policy and lodge a complaint with the President of the Polish Personal Data Protection Office or another competent supervisory authority. If we cannot attribute statistical data to you, we will explain this when handling your request, without collecting additional data solely to identify visitors. We do not use the analytics described here to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
6.Recipients
Data may be entrusted to processors only to the extent necessary to provide services to us, under data-processing agreements. The website and its statistics (Matomo and basic measurement) are hosted on the servers of our hosting provider; our email provider handles messages sent through the form. Access to statistical data is restricted to authorised persons responsible for the website.
7.Protection of the contact form and contact buttons
The contact form and the ‘Show contact’ buttons on the product pages are protected by ALTCHA – a short computational task solved by the browser and checked by our server. It runs entirely within our own infrastructure – on the same servers as the website (see ‘Transfers outside the EEA’) – with no third-party providers. To limit the number of attempts we process the IP address in hashed form. Once an employee’s contact details have been displayed, we record for 7 days the date, the card identifier and the hash of the IP address. Legal basis: the legitimate interests of the controller (Article 6(1)(f) GDPR) – the protection of employees’ data and of the website.
8.Retention
Correspondence, including attached files and job applications, is kept for as long as needed to handle the matter and for the limitation period of any claims. Server logs are kept as long as needed for security; portal sign-in logs (email address, IP address) – 12 months, the IP address of the contact-form sender – 12 months, and records of consents given and withdrawn – 3 years. Basic measurement: daily aggregates for 90 days, thereafter monthly aggregates only, containing no personal data. Matomo: detailed visit data 90 days, aggregate reports 13 months. Backups: up to 8 weeks from creation; they serve disaster recovery, after which the applicable retention periods are reapplied. The record of an objection to measurement remains in browser storage until you or your browser remove it.
9.Your rights
You have the right to: access your data, rectify it, erase it, restrict processing, data portability, object, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.
10.Transfers outside the EEA
The website and its statistics are hosted in a country outside the European Economic Area that is covered by a European Commission adequacy decision (Article 45 GDPR). We provide the name of the country and of the hosting provider at the request of the data subject. If we use other providers processing data outside the European Economic Area, this happens only with the appropriate safeguards required by the GDPR (e.g. Standard Contractual Clauses approved by the European Commission).
11.Contact
For any personal-data matters contact us via our contact form or by post to our registered office.
12.Changes
This policy may be updated. The current version is always available at this address, together with the last-updated date.