Elektrik-Star Privacy Policy.

General information

This privacy policy sets out the rules for processing personal data and using cookies in connection with the use of this website, operated by the data controller: Elektrik-Star Sp. z o.o., ul. Szczepanowska 2, 32-800 Brzesko, Poland, Tax ID (NIP): 8692005264, e-mail: biuro@elektrik-star.pl, phone: +48 889 698 261.

Scope and sources of data

The Controller may process personal data provided voluntarily by the user through the contact form, e-mail, phone, or other contact channels available on the website.

The scope of processed data may include, in particular: first and last name, company name, e-mail address, phone number, and other information contained in the message. For recruitment applications, the scope of data also includes the selected position and the data contained in the submitted CV.

The Controller may also process technical data related to the use of the website, such as IP address, device data, browser type, operating system, approximate location, date and time of the visit, and activity on the website, to the extent this results from cookies, analytics tools or the contact form's security safeguards.

Purposes and legal grounds for processing

Personal data is processed for the following purposes:

• handling enquiries submitted through the contact form, e-mail or phone, based on Art. 6(1)(f) GDPR — the Controller's legitimate interest in communicating with users
• taking steps prior to entering into a contract or performing a contract, based on Art. 6(1)(b) GDPR, if the contact concerns an offer, cooperation, or service delivery
• conducting recruitment, on the legal grounds set out in the "Recruitment" section
• fulfilling the Controller's legal obligations, based on Art. 6(1)(c) GDPR, in particular tax, accounting, or claims-related obligations
• protection against claims and pursuit of claims, based on Art. 6(1)(f) GDPR
• keeping statistics, analysing website traffic, and ensuring website security, including protecting the contact form against spam, based on Art. 6(1)(f) GDPR or on the user's consent, where required by the given tool or type of cookies

Recruitment

If the topic "Recruitment" is selected in the contact form, the Controller processes the candidate's personal data in order to conduct recruitment for the position indicated by the candidate. The candidate provides, in particular, first and last name, e-mail address, phone number, the selected position, the message, and a CV in PDF or DOCX format (maximum 4 MB). The legal grounds for processing the candidate's data are as follows:

• Art. 6(1)(c) GDPR in conjunction with Art. 22¹ of the Polish Labour Code, for data required by law: first name(s) and last name, date of birth, contact details, education, professional qualifications, and employment history
• Art. 6(1)(a) GDPR, i.e. the candidate's consent, for other data voluntarily included in the CV or message; this consent is required to submit the application and applies only to the recruitment the candidate is applying for
• Art. 6(1)(a) GDPR, i.e. a separate and optional consent of the candidate, for processing data for the purposes of future recruitments; not giving this consent does not affect participation in the current recruitment
• Art. 9(2)(a) GDPR, i.e. the candidate's explicit consent, if the candidate on their own initiative includes special categories of data in the CV, for example data concerning health

Please do not include special categories of data or a photo in the CV unless the candidate knowingly wishes to provide them. Providing them is entirely voluntary and has no effect on the course of the recruitment.

The CV is sent by the website's server function as an e-mail attachment, through the e-mail delivery service provider, directly to the Controller's mailbox. The CV is not stored on the website or in its storage. After submitting the application, the candidate may receive an automatic confirmation at the e-mail address provided.

The candidate's data is stored until the end of the recruitment for which the CV was sent. If the candidate has consented to participation in future recruitments, the data is stored for 12 months from the date the application was submitted or until the consent is withdrawn, whichever is earlier.

Any consent may be withdrawn at any time by sending a message to the Controller's e-mail address: biuro@elektrik-star.pl. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Providing data is voluntary but necessary to take part in the recruitment. The candidate's data is not subject to automated decision-making, including profiling.

The candidate has the rights described in the "User rights" section, including the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if they consider that the processing of their data infringes the GDPR.

Contact form and spam protection

The contact form allows the user to choose the topic of the message: "Request for quotation", "24/7 service", "Recruitment" or "Other". Regardless of the topic, the form collects first and last name, e-mail address and the message, as well as the company name and phone number if the user provides them. For the "Recruitment" topic, the form additionally collects the selected position, the CV file and information about the consents given, as described in the "Recruitment" section. Messages sent through the form are forwarded by the website's server function, through the e-mail delivery service provider, to the Controller's mailbox. To protect the form against spam and automated submissions, the website uses the following safeguards:

• ALTCHA, a proof-of-work verification mechanism in which the user's browser performs a short computation whose result is checked by the website's server function; the mechanism does not use an external captcha service, does not set cookies, and technical data is processed solely to verify the submission
• a hidden form field (a so-called honeypot), invisible to the user, which makes it possible to recognise automatically sent submissions
• a minimum time for filling in the form, below which the submission is not accepted
• a limit on the number of submissions sent from a single IP address within a given period

Technical data, including the IP address, is processed to ensure the security of the website and protect against abuse, based on Art. 6(1)(f) GDPR, i.e. the Controller's legitimate interest. This data is processed only for as long as necessary to carry out the verification and limit the number of submissions, after which it may remain only in the hosting provider's server logs, for the period resulting from that provider's log retention rules.

Voluntary provision of data

Providing data is voluntary, but in some cases may be necessary to respond, prepare an offer, conclude a contract, or deliver a service. Failure to provide data may result in the inability to handle the enquiry or perform the relevant action.

Recipients of data

Personal data may be shared with parties cooperating with the Controller, solely to the extent necessary to achieve the purposes of processing.

Recipients of data may include, in particular: the hosting provider, e-mail provider, e-mail delivery service provider, the company maintaining the website, analytics tool providers, a law firm, an accounting office, and providers of IT support. Visit statistics and page speed measurements are provided by Vercel Inc. through Vercel Web Analytics and Speed Insights, without cookies. After clicking “Show map” on the Contact page, data is also processed by Google LLC (Google Maps).

The website is hosted by Vercel Inc., which, as the hosting provider, processes technical data related to serving the website and running its server functions, including the IP address. Messages sent through the contact form, together with any CV sent as an attachment, are delivered to the Controller's mailbox via the Resend service, provided by Resend, Inc. as the e-mail delivery service provider; the automatic confirmation of receipt of a submission may also be sent via this service.

Vercel Inc. and Resend, Inc. are based in the United States, so data may be transferred outside the European Economic Area. Such transfers take place on the basis of a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the European Commission, depending on the mechanism used by the given provider.

The Contact page displays an embedded Google Maps map showing the office location. Loading it transmits the user's IP address to Google, and Google may set its own cookies; the map loads only after clicking “Show map”. The projects map on the Projects page uses CARTO map tiles (based on OpenStreetMap data) and NASA satellite imagery (NASA GIBS). It loads automatically when the page is opened; loading the tiles transmits the user's IP address to CARTO and NASA.

Data retention period

Data will be stored for the period necessary to achieve the purpose for which it was collected. For correspondence, data will be stored for as long as needed to handle the matter, and afterwards for the limitation period of any potential claims.

Data related to entering into and performing a contract may be stored for the duration of the contract, and afterwards for the period required by law and until any claims become time-barred.

Data processed on the basis of consent will be stored until the consent is withdrawn, without affecting the lawfulness of processing carried out before its withdrawal.

User rights

The data subject has the right to:

• access to data
• rectification of data
• erasure of data
• restriction of processing
• data portability, where the basis for processing is a contract or consent
• object to processing based on the Controller's legitimate interest
• withdraw consent at any time, where processing is based on consent
• lodge a complaint with the President of the Personal Data Protection Office (UODO)

Requests regarding the exercise of these rights can be sent to the Controller's e-mail address.

Cookies and browser storage

The website does not use analytics or marketing cookies and therefore does not display a consent banner. It stores on the user’s device only information that is strictly necessary for features the user is using, which does not require consent (Article 399(3) of the Polish Electronic Communications Law):

• NEXT_LOCALE cookie: remembers the language version of the website (Polish, English or German) so that further pages are shown in the same language; valid until the end of the browser session or until the language is changed
• es-theme entry in browser storage (localStorage): stores the light or dark theme, only if the user switches it; kept until browser data is deleted

The Google Maps map on the Contact page loads only after clicking “Show map”. From that moment Google receives the browser’s IP address and may set its own cookies (see “Google Maps on the Contact page”). YouTube videos are embedded in privacy-enhanced mode (youtube-nocookie.com). Map tiles for the projects map from CARTO servers and imagery from NASA servers do not set cookies; the servers receive the browser’s IP address.

Deleting this information in the browser settings does not affect the use of the website; on the next visit the website returns to its default settings.

Visit statistics (Vercel Web Analytics and Speed Insights)

We use Vercel Web Analytics for visit statistics and Vercel Speed Insights to measure page speed. Both services are provided by Vercel Inc. and work without cookies and without storing data in the browser. They do not track users across websites and do not create user profiles.

Aggregated data is collected: the page visited, the referring page, country, device type, browser and operating system, page load times, and the “form sent” event with the selected topic (without message content or personal data). According to Vercel’s documentation, visitors are distinguished only by a hash of the request data that changes daily.

The legal basis is Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in keeping statistics and improving the website. Data transfers to Vercel Inc. (USA) take place as described in “Recipients of data”.

Google Maps on the Contact page

On the Contact page the Google Maps map does not load automatically. Until “Show map” is clicked, the website does not connect to Google servers for the map.

After the click, the map is loaded from Google LLC, which receives the browser’s IP address and may set cookies in accordance with Google’s privacy policy (policies.google.com/privacy). The legal basis is consent given by the click (Article 6(1)(a) GDPR). Without clicking, the route link opens Google Maps in a new tab.