Privacy policy
Last updated: 10 October 2026
1.Data controller
The controller of your personal data is:
We have appointed a Data Protection Officer, who can be contacted through the contact form.
2.What data we process
- Contact-form data – name, company, email address, telephone number (if provided) and message content. When the form is submitted, we record the sender’s IP address and the time of submission. A single PDF file of up to 5 MB (e.g. a CV) may be attached to the message; the file goes only to the company’s mailbox together with the message – the website does not store it, and the automatic acknowledgement of the enquiry does not include it.
- Technical data and server logs – IP address, browser type, date/time of visit, pages viewed (for security and diagnostics).
- Website usage data – see the section ‘Visit statistics and basic measurement’.
- Cookies and browser storage – see the ‘Cookie settings’ section.
3.Purposes and legal bases
We process data on the following bases (Art. 6(1) GDPR):
- handling enquiries – our legitimate interest (f) and steps prior to entering a contract (b);
- recruitment (job applications, e.g. a CV sent through the form) – steps taken at your request prior to entering a contract (b) and, for recruitment under a contract of employment, also a legal obligation (c) in conjunction with Article 22¹ of the Polish Labour Code (Kodeks pracy); data you provide on your own initiative beyond this scope (e.g. a photograph) – consent given by sending them (a; Article 22¹a of the Polish Labour Code), which you may withdraw at any time;
- site security – legitimate interest (f);
- recording the IP address and time of form submission – legitimate interest (f): protection against misuse and evidence that the enquiry was made.
5.Visit statistics and basic measurement
We measure visits to the website in two ways: through basic measurement and using the Matomo software. Both measurements operate without cookies. We do not apply them to the customer, investor and employee portal pages.
We carry out basic measurement in order to prepare aggregate reports on website traffic. For each view of a public page, we record the page address, language, referring source (e.g. a search engine, LinkedIn, another website, a direct visit, a campaign) and device type. We also record the country, the approximate locality and the type of network (a company or institutional network, a telecommunications operator, a data centre), determined on the basis of the IP address.
We record the organisation’s name and its internet domain only where the IP address range is registered to a legal person or an organisational unit. We do not record names indicating a natural person, including the names of civil-law partnerships. We establish the domain on the basis of publicly available data on the IP address and the network owner. We record only the organisation’s domain (e.g. example.com), without any more specific details of its network.
In basic measurement, the IP address is processed only at the moment of the page view and is not stored. We pass it on solely to establish the domain, for address ranges registered to a legal person or an organisational unit. In that case, the IP address reaches the hosting provider and the entity managing the network concerned. For this purpose, we do not pass on the addresses of connections at telecommunications operators, including home and mobile connections.
For organisations recognised in this way, we record the following details of the visit: the time to the nearest minute, the pages visited in sequence, the referring source, language, device type and approximate locality. We keep these records for 90 days. Thereafter, for 13 months, we keep only monthly aggregates without the time or sequence of page views (organisation, number of visits, pages, referring sources). The aggregates contain no IP addresses or identifiers. We do not combine them with personal data and do not use them to establish visitors’ identities.
The source of information on the network and the approximate locality is DB-IP data (IP Geolocation by DB-IP, db-ip.com, CC BY 4.0 licence), and the source of the network owner’s domain is IPinfo data (IP address data powered by IPinfo, ipinfo.io, CC BY-SA 4.0 licence).
For website usage statistics we use the Matomo On-Premise software, which the controller maintains at the hosting provider. Matomo does not store any information on your device; we assign no persistent visitor identifier. The purpose is to assess the popularity of content and the usability of the website. We analyse the pages visited, the dates and times of page views, downloaded documents and clicks on outbound links, as well as device and browser type, screen resolution, referring source and approximate location (country, region). The IP address is truncated before storage, and the location is determined on the basis of the truncated address.
The legal basis for both measurements is our legitimate interest (Article 6(1)(f) GDPR) in measuring the audience of our own website. In basic measurement, this interest also covers establishing which organisations take an interest in our offer.
We do not send form contents, email addresses, login details or document numbers to analytics. We remove from page addresses any parameters that may contain your data. We do not record sessions, replay what you type or associate statistics with portal accounts.
You may object to visit measurement at any time:
- by enabling the Global Privacy Control or Do Not Track signal in your browser;
- by ticking ‘Do not measure my visits’ under ‘Privacy settings’ in the website footer;
- by contacting the controller (see the ‘Contact’ section).
The objection covers basic measurement and Matomo statistics from the moment it is made. When the Global Privacy Control or Do Not Track signal is enabled, we perform none of the measurements described above. The objection does not result in the deletion of earlier aggregate reports from which the activity of an individual cannot be reconstructed.
6.Recipients
The website and its statistics (Matomo and basic measurement) are hosted on the servers of our hosting provider; our email provider handles messages sent through the form.
7.Protection of the contact form and contact buttons
We protect the contact form and the ‘Show contact’ buttons on the website against the automated sending of messages and the automated retrieval of contact details. The protection operates entirely at the website’s hosting provider (see the ‘Transfers outside the EEA’ section), without the involvement of other providers. To limit the number of attempts, we process the IP address in a form that does not allow it to be read directly. Once an employee’s contact details have been displayed, we keep, for 7 days, the date, the contact card identifier and the IP address in that same form. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in the protection of employees’ data and the security of the website.
8.Retention
Correspondence, including attached files and job applications, is kept for as long as needed to handle the matter and for the limitation period of any claims. Server logs are kept as long as needed for security; portal sign-in logs (email address, IP address) – 12 months, the IP address of the contact-form sender – 12 months, and records of consents given and withdrawn – 3 years. Basic measurement: daily aggregates for 90 days, thereafter monthly aggregates only, containing no personal data. Matomo: detailed visit data – 90 days; aggregate reports, which contain no visitors’ personal data – without time limit. Backups: up to 8 weeks from creation; they serve disaster recovery, after which the applicable retention periods are reapplied.
9.Your rights
You have the right to: access your data, rectify it, erase it, restrict processing, data portability, object, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.
10.Transfers outside the EEA
The website and its statistics are hosted in a country outside the European Economic Area that is covered by a European Commission adequacy decision (Article 45 GDPR). We provide the name of the country and of the hosting provider at the request of the data subject.
11.Contact
For any personal-data matters contact us via our contact form or by post to our registered office.