Privacy policy
The confidentiality of data and the protection of our Users' privacy is a top priority for us. Therefore, in the interest of ensuring the security of your personal data, the Energy Market Agency S.A. has established a policy defining the principles regarding the processing of personal data.
We process your personal data in accordance with the Regulation of the European Parliament and of the Council (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter GDPR).
Data Controller
The controller of your personal data within the meaning of Article 4(7) of the GDPR is the Energy Market Agency S.A. with its registered office in Warsaw (00-728), at ul. Bobrowiecka 3, KRS: 0000021306, NIP: 5261757578, REGON: 012435148.
To ensure high security standards, the Data Protection Officer has been appointed at ARE S.A. – legal advisor Paulina Rojek.
To contact the Data Protection Officer, you can send a message to: iod@are.waw.pl or send a letter to the Company's registered office.
Source of Personal Data Collection
Personal data is collected directly from you or from third parties, e.g., the entity on behalf of which you are acting or our Partners, as well as from other publicly available registers or through cookies.
Scope of Processed Personal Data
In the event of contacting the Administrator via the website or contact details provided on the website, the Administrator processes the data you provide to establish contact, including your email address or phone number, the content of your question or issue raised, and possibly other data you have provided. In connection with the use of cookies for statistical purposes, the Administrator may process the following data: IP address, session duration, frequency of visits to the website.
Purpose and Legal Basis for Processing Personal Data
Purpose of Data Processing | Legal Basis |
Conclusion and execution of a contract – in the case that you are a party to the contract. | Data processing is necessary for the conclusion and execution of the contract – Article 6(1)(b) of the GDPR. |
Ensuring contacts necessary for the servicing and execution of the contract concluded with the entity on behalf of which you act, as well as maintaining business contacts. | Legitimate interest of the Administrator – Article 6(1)(f) of the GDPR. |
Considering any potential complaints, as well as establishing, pursuing, and defending against claims. | Legitimate interest of the Administrator – Article 6(1)(f) of the GDPR. |
Fulfillment of legal obligations imposed on the Administrator, including accounting and documentation obligations, as well as the exercise of rights of the data subjects. | Fulfillment of a legal obligation imposed on the Administrator – Article 6(1)(c) of the GDPR. |
Conducting direct marketing activities. | Legitimate interest of the Administrator – Article 6(1)(f) of the GDPR. |
Conducting the recruitment process and selecting the appropriate person for employment. | To the extent specified in Article 22(1) of the Labor Code, the legal basis is the legal obligation of the Administrator (Article 6(1)(c) of the GDPR). This applies to such data as: first name(s) and surname, date of birth, and contact details provided by the job candidate. If necessary for the performance of work of a specified type or at a specified position, this also includes information about education, professional qualifications, and the history of previous employment. The legal obligation of the Administrator also includes those data whose provision is necessary to realize the right or fulfill the obligation arising from legal regulations. If a job candidate provides personal data that exceeds the scope specified in labor law regulations, the legal basis for processing such data for the aforementioned purpose is the candidate's consent (Article 6(1)(a) of the GDPR). This concerns all data provided by the job candidate in the resume (CV), cover letter, or disclosed during job interviews. |
Collecting information about website traffic statistics. | Legitimate interest of the Administrator – Article 6(1)(f) of the GDPR. |
Profiling of Personal Data
Your personal data will not be used for automated decision-making, including profiling.
Recipients of Personal Data
- authorized personnel of the Administrator,
entities processing personal data on behalf of the Administrator to fulfill the purposes for which the data is collected. These entities must have access to the data to perform their duties. They will have access to personal data only to the extent necessary to perform their assigned tasks.
- public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for the purposes arising from applicable legal regulations.
Can Your Personal Data Be Transferred Outside the European Economic Area?
Given that the Administrator uses Google Analytics, personal data may be transferred outside the European Economic Area. In connection with the transfer of data outside the EEA, the Administrator ensures that it uses only suppliers that provide guarantees of a high level of personal data protection.
Retention Period for Personal Data
The period of data processing is related to the purposes and legal bases for their processing, therefore:
- data processed on the basis of legal requirements will be processed for the period during which the law requires data retention;
- data processed for the purpose of concluding and executing a contract will be processed for the period necessary for its execution and settlement, which may be extended in appropriate cases by the limitation period for civil law claims.
- data processed on the basis of the legitimate interest of the Administrator will be processed until an effective objection is raised or that interest ceases, e.g., data processed for the purpose of pursuing or defending against claims will be processed for the duration of the limitation period for those claims.
- data processed on the basis of consent will be processed until the consent is withdrawn.
- personal data processed for recruitment purposes will be stored until the end of the recruitment in which you are participating.
Is Providing Your Personal Data Mandatory?
Providing your personal data is voluntary, but necessary to achieve the purpose you wish to realize, including for example, using the website, concluding a contract, responding to your inquiry, or addressing the issue you raised.
The Administrator indicates that providing the personal data indicated in Article 22(1) of the Labor Code by a candidate is mandatory under applicable labor law regulations. Failure to provide such data will result in the inability to participate in the recruitment process. Providing personal data by a job candidate beyond that specified in Article 22(1) of the Labor Code is voluntary. The Administrator declares that failure to provide such data cannot be the basis for unfavorable treatment of the job applicant, nor can it lead to any negative consequences for them, especially it cannot constitute a reason for refusal of employment.
Rights Granted to You
You have the right to:
- request access to your personal data, its rectification, deletion, or restriction of processing, as well as the right to data portability,
- where the basis for processing personal data is the legitimate interest of the Administrator – the right to object at any time to the processing of personal data on grounds relating to your particular situation,
- where the legitimate interest consists of conducting direct marketing activities – the right to object at any time to the processing of personal data for marketing purposes, without the need to justify your decision,
- withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal,
- lodge a complaint with a supervisory authority, namely the President of the Personal Data Protection Office.
Requests to exercise your rights can be submitted to the contact details provided at the outset.
Privacy policy regarding social media
By using our social media accounts, you interact with us, for example, by subscribing to a fan page, leaving your reaction (likes, comments), or sending us a message. The information you provide about yourself may constitute personal data. This Privacy Policy (hereinafter referred to as the Policy) describes how we process personal data collected through accounts on the following social media platforms (hereinafter referred to as Social Media Platforms):
FACEBOOK: https://www.facebook.com/energetyka
LINKEDIN: https://pl.linkedin.com/company/agencja-rynku-energii-s-a-
We process your personal data in accordance with the Regulation of the European Parliament and of the Council (EU) 2016/679 of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR).
Data Controller
The data controller is the Agency for the Energy Market S.A. based in Warsaw (00-728), ul. Bobrowiecka 3 (hereinafter referred to as the Controller or we). You can contact us at the above address.
To ensure high security standards at ARE S.A., a Data Protection Officer has been appointed. To contact the Data Protection Officer, you can send a message to: iod@are.waw.pl or send a letter to the Company's registered office address.
Categories of individuals whose data is processed and the scope of processed data
We process data of individuals who:
have subscribed to the account by clicking the "Like" or "Follow" button,
have published their comment, shared it, or clicked the "Like" button on any of the posts published on the account.
We process the following types of personal data:
account identifier (usually containing first and last name or nickname),
profile picture,
other pictures (which may also depict an image),
the content of your comments,
statistical data regarding individuals visiting the fan page available through the "Facebook Insights" function, collected
through cookies.
We process data of individuals who:
have visited the Administrator's page,
have interacted with the Administrator,
have published or submitted data through services offered by the LinkedIn portal (e.g., filled out forms, responded to surveys).
We process the following types of personal data:
first name, last name, image, and other identifying information publicly provided by you on your profile created on the LinkedIn portal (including address data, contact information such as email address, phone number, as well as education, work experience, professional qualifications, and employment history),
statistical data regarding individuals visiting the account, collected through cookies.
YOUTUBE
We process data of individuals who:
have subscribed to the account by clicking the "Subscribe" button,
have published their comment under any of the videos posted on the account or reacted to the published videos.
We process the following types of personal data:
account identifier (usually containing first and last name or nickname),
profile picture,
the content of your comments,
statistical data regarding individuals visiting the account, collected through cookies.
Purposes and legal bases for processing
We process your personal data:
on the basis of a legitimate interest (Article 6(1)(f) GDPR) consisting of:
managing an account on the Social Media Platform, under the conditions and rules set by the operator of the Platform, and informing about our activity, promoting events and the brand, products, and services, building and maintaining a community with us (including monitoring content published by users), and for communication via the available functionalities of the Social Media Platform (comments, messages),
conducting statistics (through analyzing data about user activity on our account),
potentially establishing, pursuing, or defending against claims.
on the basis of separately granted consent in the scope and purpose specified in the content of the consent and for the duration until it is withdrawn (Article 6(1)(a) or Article 9(2)(a) GDPR),
based on statutory requirements to fulfill our legal obligations arising from legal regulations (Article 6(1)(c) GDPR).
In cases where we organize promotional campaigns through the Social Media Platform, we describe the rules for processing your personal data, including the purpose and legal basis for such processing, in the regulations of that campaign. Before participating in such a promotional campaign, please read its regulations.
Co-administration of personal data
In terms of processing personal data for statistical purposes, we act as joint controllers as defined in Article 26(1) of the GDPR, together with the social media platform operator that provides the statistics option. We undertake such actions as part of our legitimate interest (Article 6(1)(f) of the GDPR) described above.
More information on data processing for statistical purposes can be found at the following link:
In the case of the social media platforms Facebook and Instagram, the joint controller is Facebook Ireland Limited: https://www.facebook.com/legal/terms/information_about_page_insights_data
In the case of the social media platform LinkedIn, the joint controller is LinkedIn Ireland Unlimited Company: https://legal.linkedin.com/pages-joint-controller-addendum.
Data recipients
Access to your personal data will be granted to:
our authorized personnel and entities providing services on our behalf (including marketing services, IT services, and technical support), who must have access to the data to perform their duties,
other users of the social media platform (due to the fact that information about people following the account, likes, as well as comments, posts, and other information provided by users are public),
public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for the purposes arising from the provisions of generally applicable law,
the social media platform administrator under the principles described in the provided privacy policies.
Remember that social media platform operators are separate entities responsible for processing the data of individuals using the social media platforms, including data about you. These entities process your personal data for their own purposes based on the legal grounds they establish. In particular, they may, based on their own rules for the operation of the social media platform, collect and process information contained in cookies from visitors to our account. We have limited influence over the data processing by social media platform operators. Therefore, we ask you to familiarize yourself with their operational regulations and the privacy policies provided therein, which you can find here:
Facebook: https://www.facebook.com/about/privacy
LinkedIn: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
YouTube: https://policies.google.com/privacy?hl=pl&gl=pl#whycollect
Data transfer to third countries or international organizations
We do not transfer your personal data to a third country or an international organization.
Data retention period
The data retention period is related to the purposes and bases of processing; therefore:
data processed based on consent will be processed until the consent is withdrawn,
data processed based on statutory requirements will be processed for the duration specified by law,
data processed based on the legitimate interest of the Administrator will be processed until an effective objection is raised or this interest ceases, namely:
we typically process your data until we cease to maintain our account on the social media platform,
personal data obtained in the course of correspondence is retained for the time required to address the message sent to us,
data processed for the purpose of establishing, pursuing, or defending against claims is processed for a period equal to the limitation period of those claims.
You have the following rights:
the right to request access to your personal data, their rectification, deletion, or restriction of processing, as well as the right to data portability,
the right to object at any time to the processing of your data for direct marketing purposes,
the right to object to the processing of data based on your specific situation,
if the processing of your data is based on consent – the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal,
To exercise your rights, please contact us using the contact details provided in the introduction.
You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.
Information about the source of data and other information
We obtain your personal data directly from you through your interaction with our account on the social media platform and from your public profile.
Providing data is voluntary.
Personal data will not be subject to automated decision-making, including profiling.
External services
To analyze traffic and user behavior on our site, we use the following services:
Google Analytics
We use Google Analytics, which employs cookies and similar technologies to collect and analyze information about the use of our Services and to report on activities and trends. This service may also collect information regarding the use of other websites, applications, and online services. You can learn more about Google's practices by visiting
https://policies.google.com/privacy/google-partners, and opt-out by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.
Microsoft Clarity
We collaborate with Microsoft Clarity and Microsoft Advertising to collect information about how you use our website and how you interact with it through behavioral metrics, heatmaps, and session replays, which help us improve and promote our products/services. Data regarding website usage is collected using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for website optimization, security/fraud-related goals, and advertising. For more information on how Microsoft collects and uses your data, visit Microsoft Privacy Statement.
Cookie Policy
I. Key Information
Cookies are small files sent by a web server to your browser and stored on your computer. Cookies help us analyze web traffic and recognize which parts of our website have been visited. Our website also uses cookies to treat you individually, adapting our actions to your needs by collecting and remembering information about your preferences and enabling you to log into your account. This information is used solely for statistical analysis purposes and is subsequently deleted from our system.
Cookies do not allow us to access your computer or information about you, except for information on how you use our website and personal data that you choose to share with us (including personal data that you automatically provide us based on your browser settings).
To monitor and improve our website, we collect aggregated information about you when you browse our site, including details about your operating system, browser version, domain name, IP address, URL from which you accessed our site and to which you are heading, as well as which subpages of our website you visit. We may conduct general statistics, collect data regarding traffic on the website, and information about related sites, and share this aggregated data with third parties for marketing, advertising, or other promotional purposes; however, this aggregated data does not include any personal data. For the same reasons, we may collect information on how you use the internet by utilizing cookies stored on your computer’s hard drive. Cookies contain information that is transferred to your computer's hard drive. This helps us improve our website and offer better and more personalized services.
We use the following types of cookies:
Necessary Cookies. These cookies are essential for navigating our website and using its features, such as accessing secure areas of the site.
Performance Cookies. These cookies collect information about how users interact with our website, such as which pages are visited most often or whether error messages are displayed on certain pages. These cookies do not collect information that identifies a user. All information collected by these cookies is aggregated and therefore anonymous. They are used solely to improve the performance of our website.
Functional Cookies. These cookies remember users' choices on the website (such as username, language, or region) to enhance user-specific functionality. They also remember text size, font changes, and those functionalities of the website that can be customized. The information collected by these cookies is anonymous and cannot be used to track your activity on other websites.
II. Additional Information
Our website usually displays a message before information is saved on your computer in the form of cookies. We sometimes also use pop-ups or banners so that you can manage cookies. You can manage cookie settings through your browser (which allows you to disable acceptance of all or some cookies). Your browser may request confirmation to change settings. However, please note that enabling the blocking of all cookies may result in the inability to access certain parts of our website. It should be noted that third parties may also use cookies to analyze how you use their websites, and we have no influence over that. You can find more information about cookies here: www.allaboutcookies.org.