Privacy Policy, Summary (English)

1. Data controller

The controller of personal data of Users of the Platform TransakcjeOZE.pl is:

European Foundation For Energy Transformation
(*Fundacja „Europejska Fundacja Energetycznej Transformacji", EFET*)
ul. Łucka 18 lok. 4/L, 00-845 Warszawa, Poland
KRS: 0001164353, NIP: 5273158205
Represented by: Aleksandra Magda Lindner, President of the Management Board
Email: biuro@fundacjaefet.pl

For legal services rendered by a law firm chosen by the User (including HWW as standing legal advisor of the Platform), the law firm acts as a separate data controller under its own privacy notice.

2. Data Protection Officer

The Operator has not appointed a Data Protection Officer. Under Article 37 GDPR, the Operator does not meet the criteria requiring DPO appointment (not a public authority, not a large-scale monitoring controller, not a processor of special category data).

3. Categories of data, purposes, legal bases (Article 13 GDPR)

• Account data (name, email, phone, company, role): contract performance (Art. 6(1)(b) GDPR), for the duration of the account plus statute of limitations period.
• Offer data and data room documents: Art. 6(1)(b) and (f) GDPR (legitimate interest in transaction handling).
• Invoicing data: Art. 6(1)(c) GDPR (legal obligation), 5 years from end of relevant tax year.
• Communications and inquiries: Art. 6(1)(f) GDPR.
• Cookies and logs: Art. 6(1)(f) for essential and security; Art. 6(1)(a) for analytics and marketing, see Cookies Policy.

4. Recipients

Data may be entrusted to processors under data processing agreements: hosting and infrastructure providers, payment operator (PayPro S.A., Przelewy24), email service providers, analytics tools (Google Analytics 4, Google Ireland Limited).

5. International transfers

The Operator processes data primarily within the European Economic Area. Google Analytics and Google Ads may transfer data to the United States under the EU-US Data Privacy Framework (European Commission adequacy decision 2023/1795) supplemented by Standard Contractual Clauses. IP anonymization in GA4 and Consent Mode v2 applied.

6. Rights of data subjects

You have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), object to processing based on legitimate interest (Art. 21), and withdraw consent at any time (Art. 7(3) GDPR), without affecting lawfulness of processing before withdrawal.

To exercise rights, contact: biuro@fundacjaefet.pl. You also have the right to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

7. Voluntariness

Providing personal data is voluntary but necessary for account creation and service use. Invoicing data is required by Polish tax law.

8. No automated decision-making

The Operator does not make decisions affecting Users based solely on automated processing (including profiling) producing legal effects or similarly significant effects.

9. Data breach procedure (Art. 33-34 GDPR)

The Operator maintains an internal breach register. Breaches likely to risk rights or freedoms of natural persons are notified to the Polish supervisory authority within 72 hours of detection. Where breach is likely to result in high risk, affected Users are notified without undue delay.

10. Updates

The Operator may update this Privacy Policy. Significant changes are communicated via email or platform notification.

Reminder: the binding version of the Privacy Policy is the Polish version. Translation last updated: 26.05.2026.