TransakcjeOZE.pl
Draft English translation, noindex. This is a complete translation of the available Polish source effective 2026-09-03. Translation version: 2026-09-10-draft. The translation does not independently validate legal, technical, provider or product claims. Polish source. English Markdown source.
Technical version details

Source hash: sha256:8211752a7823105d7b9497f5970fda8712f3ae4812b81d3448289b5a068a8074.

Privacy Policy

This Policy applies from 3 September 2026.

Last updated: 2 September 2026.

This Privacy Policy is provided for information purposes. It sets out the rules and methods for collecting, processing and using information about users of https://transakcjeoze.pl/.

DEFINITIONS

Controller: the foundation Europejska Fundacja Energetycznej Transformacji, with its registered office in Warsaw at ul. Łucka 18 lok. 4/L, 00 - 845 Warszawa, entered in the register of associations, other social and professional organisations, foundations and independent public healthcare establishments of the National Court Register, maintained by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register, under KRS number 0001164353, NIP: 5273158205, REGON: 541288350, email: biuro@fundacjaefet.pl, website: fundacjaefet.pl.

Website Legal Adviser / Law Firm: HWW Hewelt Wojnowski Lindner i Wspólnicy sp.k., with its registered office in Warsaw at ul. Łucka 18 lok. 4/L, 00-845 Warszawa, entered in the register of entrepreneurs of the National Court Register by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register, under KRS number 0000713665, NIP 1132960039, REGON: 369257204. For legal assistance commissioned by a User from the Law Firm, the Law Firm is the controller of the User's personal data in connection with those activities. The Law Firm's personal data processing rules are available at https://hww.pl/polityka-prywatnosci/.

Website: the Controller's website, https://transakcjeoze.pl/.

Account: an individual User account created on the Website, enabling access to functions after signing in.

Listing: an advertisement concerning a transaction or project in the renewable energy sector, published by a User on the Website.

personal data: any information relating to an identified or identifiable individual through one or more factors specific to that individual's physical, physiological, genetic, mental, economic, cultural or social identity, including location data, a device's IP address, an online identifier and information collected through Cookies or similar technology.

Data room: a virtual document repository made available in connection with a Listing.

EoI (Expression of Interest): an expression of interest in a Listing submitted by a User.

PKE: the Electronic Communications Law of 12 July 2024 (Journal of Laws, item 1221, as amended).

Policy: this Privacy Policy.

Terms: the Website Terms governing use of the Website.

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

User: any person visiting the Website or using one or more services or functions made available through it.

1. Data controller

The controller of personal data of Users of the Website and the TransakcjeOZE.pl website is the foundation Europejska Fundacja Energetycznej Transformacji, with its registered office in Warsaw at ul. Łucka 18 lok. 4/L, 00 - 845 Warszawa, entered in the register of associations, other social and professional organisations, foundations and independent public healthcare establishments of the National Court Register, maintained by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register, under KRS number 0001164353, NIP: 5273158205, REGON: 541288350, email: biuro@fundacjaefet.pl, website: fundacjaefet.pl.

2. Contact about personal data

Users may contact biuro@fundacjaefet.pl about any matter concerning the Controller's processing of personal data. The Controller has not appointed a Data Protection Officer.

3. General bases for processing personal data

The Controller may process personal data where at least one of the following conditions is met:

Specific purposes, legal bases and retention periods are set out in section 4 below.

4. Purposes, legal bases and retention periods

Data category Processing purpose Legal basis (GDPR) Retention period
Account data (first name, surname, email, telephone, company, role) Creating and maintaining an Account, providing Website services, signing in and authenticating the User, providing Website services under the Terms Article 6(1)(b) (performance of an agreement) For the duration of the Account; after deletion, until applicable limitation periods for claims expire
Listing data and Data room documents Publishing a Listing and providing access to the Data room Article 6(1)(b) and (f) (legitimate interest in handling transactions) For the duration of Listing publication and handling of the matter; then until applicable limitation periods for claims expire
Data related to pre-publication Listing verification (“pending verification” status) Checking Listing content and documents against the Website Terms before assigning “published” status; contacting the User to complete or correct Listing data Article 6(1)(b) and (f) (legitimate interest in ensuring the reliability of Listings published on the Website) Until verification is completed; if the Listing is published, for the period applicable to Listing data
Payment and subscription data Processing Listing publication payments and subscription fees for access to Website functions under the Terms Article 6(1)(b) (performance of an agreement) For the subscription term or transaction settlement; then until applicable limitation periods for claims expire
Content of messages sent through the Website's communication functions (communication intermediation between Users) Providing communication intermediation, ensuring security and compliance with the Terms, preventing abuse, and establishing, pursuing or defending claims Article 6(1)(b) (performance of an agreement) and Article 6(1)(f) (the Controller's legitimate interest in enforcing the Terms and preventing circumvention of payment rules); message content is not used for marketing For the duration of the service; then until applicable limitation periods for claims expire
Invoice data Settling the publication fee and fulfilling tax obligations Article 6(1)(c) (legal obligation) 5 years from the end of the year in which the tax obligation arose
Correspondence and submissions (including the contact form, enquiries and complaints) Handling enquiries, complaints and support, and ensuring efficient and effective communication with the User Article 6(1)(a) (User consent) and Article 6(1)(f) (the Controller's legitimate interest in handling communications) 12 months from closure of the matter, no longer than until applicable limitation periods for claims expire
Email address provided in the “Register” window (email address, contact telephone) Sending notifications of new Listings, Website functions or commercial information about the Controller's services User consent (Article 6(1)(a)) and consent to receive commercial information electronically (Article 398(1) PKE) Until consent is withdrawn or the User unsubscribes from notifications
Transactional emails (email address) Notifications about Listing publication, EoI submissions and the status of a matter Article 6(1)(b) (performance of an agreement) For the duration of the Account
Invited team member data (first name, surname, email) Handling an invitation to the User's team Article 6(1)(f) (legitimate interest in enabling teamwork) Until the invitation process ends, then deletion
Cookie data and logs (IP address, browser type, Website activity data) Ensuring Website operation and security; statistics, analytics and adapting the Website to User needs; technical, administrative and system management purposes Article 6(1)(f) (necessary Cookies, security, analytics and statistical purposes); Article 6(1)(a) (analytics and marketing Cookies where consent is required) As set out in the Cookie Policy
Address query entered in Lokalizacja 360 Converting an address to coordinates through OpenStreetMap Nominatim, identifying the parcel and protecting the public service against repeated identical queries Article 6(1)(f) (the Controller's legitimate interest in providing the function requested by the User and protecting infrastructure) The normalised query and reduced geocoding result are cached for up to 30 days; they are not linked to the Account or analytics data
Data for pursuing and defending claims Establishing, pursuing or defending claims Article 6(1)(f) (the Controller's legitimate interest in protecting its rights) Until applicable limitation periods for claims expire
Data processed in connection with data protection obligations Fulfilling legal obligations under data protection legislation Article 6(1)(c) (legal obligation) For the period required by applicable law
Contact data from earlier submissions (first name, surname, email, telephone, company) Direct marketing of the Controller's own services Article 6(1)(f) (the Controller's legitimate interest in directly marketing its own services); where marketing uses electronic communications, User consent is also required (Article 6(1)(a) and Article 398(1) PKE) Until an objection to processing for marketing purposes is made or consent is withdrawn

5. Registration, sign-in and Account use

To create an Account and sign in to the Website, the User provides the data specified in the registration form (first name, surname and email address). Data are processed to provide Website services under Article 6(1)(b) GDPR.

Signing in and maintaining the User's session use Cookies necessary for correct Website operation. The Cookie Policy sets out detailed rules for their use.

Registration and sign-in data may be entrusted to the Website's infrastructure and hosting provider under the rules described in section 13 (Data recipients).

6. Listing publication and pre-publication verification

Every Listing submitted by a User to the Website is verified by the Controller before publication. Until verification is complete, the Listing has “pending verification” status and is not visible to other Website Users.

During verification, the Controller may contact the User to confirm, complete or correct Listing data and documents. Data processed for this purpose are processed under Article 6(1)(b) and (f) GDPR, as described in the “Data related to pre-publication Listing verification” row in section 4.

After verification, the Listing is published or rejected, and the User is informed by transactional email.

7. Payments and subscriptions

The Terms govern payments for Listing publication and subscriptions for paid access to Website functions. This Policy governs the associated personal data processing.

Payments, including payment by card, BLIK and Przelewy24, are processed through Stripe Payments Europe, Ltd., based in Ireland, and Klarna Bank AB (publ), based in Sweden. They act as separate data controllers for payment transactions. Stripe's processing rules are set out in its privacy policy at https://stripe.com/en-pl/privacy; Klarna's rules are available at https://www.klarna.com/pl/prywatnosc/. Payment data are processed under Article 6(1)(b) GDPR (performance of an agreement) and, to the extent required by tax legislation, Article 6(1)(c) GDPR.

8. Contact form

The Controller provides a contact form through which Users can contact the Controller. To use the form, the following data are provided: first name and surname or company name, email address and telephone number.

Personal data supplied through the contact form are processed on the basis of the User's consent under Article 6(1)(a) GDPR to handle the enquiry, and the Controller's legitimate interest in ensuring efficient and effective communication with the User. Data are also processed for analytics and statistical purposes based on the Controller's legitimate interest in keeping submission statistics to improve Website functions (Article 6(1)(f) GDPR).

9. “Report an issue” form

The Website provides a “Report an issue” form through which Users can report an irregularity, error or comment concerning Website operation or Listing content. An email address and the report text are required.

Data are processed on the basis of the User's consent to handle the report under Article 6(1)(a) GDPR and the Controller's legitimate interest in ensuring correct Website operation and the reliability of published Listings (Article 6(1)(f) GDPR). Where the User consents to processing for a broader purpose, that processing is based on the consent given. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

10. Sending commercial offers (“Register”)

The Website provides a “Register” form through which a User can create an Account. During registration, the User may voluntarily consent to receiving commercial offers and notifications of new Listings using the email address and telephone number provided.

Consent to receive marketing information is voluntary and is not a condition of creating an Account or using the Website. Personal data are processed to send commercial offers and notifications on the basis of the data subject's consent (Article 6(1)(a) GDPR and Article 398(1) PKE).

Consent to email contact and consent to telephone contact are separate and may be given independently. The User may unsubscribe from commercial offers and notifications at any time through the unsubscribe link in each message or by contacting the Controller.

11. Transactional emails and team invitations

The Controller sends Users transactional emails about Listing publication, EoI submissions and the status of a matter under Article 6(1)(b) GDPR for the duration of the Account.

A User may invite team members to cooperate through the Website by providing their first names, surnames and email addresses. These data are processed on the basis of the Controller's legitimate interest in enabling teamwork (Article 6(1)(f) GDPR) until the invitation process ends, and are then deleted.

12. Direct marketing of the Controller's own services

The Controller may process contact data to market its own services directly under Article 6(1)(f) GDPR (the Controller's legitimate interest). These data come from earlier listing submissions and enquiries sent to the Controller by the data subject. Where marketing uses electronic communications, including automated calling systems and telecommunications terminal equipment, in particular interpersonal communication services, User consent is required (Article 6(1)(a) GDPR and Article 398(1) PKE).

Data subjects may object at any time to processing for direct marketing (Article 21(2) GDPR) by contacting biuro@fundacjaefet.pl or replying to a received message. After an objection, the Controller stops processing data for this purpose.

13. Data recipients

The User's personal data may be disclosed or transferred only to:

The Controller uses only processors that provide sufficient guarantees of appropriate technical and organisational measures compliant with GDPR, particularly under data processing agreements.

14. Service Providers

The Website provides a directory of renewable energy Service Providers, including companies offering EPC/contracting, O&M/maintenance, technical advice, legal and tax advice, insurance and environmental services (EIA).

The Controller also cooperates with entities supporting service provision and transaction handling that process data as processors or separate controllers:

15. Transfers outside the European Economic Area

The Controller seeks to process data within the European Economic Area. Data may be transferred to third countries in the following cases:

Given the international nature of data flows within social media platforms, the entities operating those platforms may transfer data outside the European Economic Area. Users may obtain information about transfer safeguards by contacting the Controller at the addresses provided in this Policy.

16. Data subject rights

The User has the right to:

These rights may be exercised by contacting biuro@fundacjaefet.pl.

The User has the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warszawa.

17. Voluntary provision of data

Providing data is voluntary, but necessary to create an Account and use services requiring registration. Failure to provide data required for the contact form or “Report an issue” form prevents the submission. Providing invoice data is required by tax legislation.

18. Retention period

Specific retention periods are listed in the table in section 4. As a rule, data are processed for the time needed to answer an enquiry or perform a service or agreement, until consent is withdrawn, or until an effective objection is made where processing is based on the Controller's legitimate interests. Processing may be extended where necessary to establish, pursue or defend claims; after that period, only to the extent required by law. Once the processing period ends, data are irreversibly deleted or anonymised.

19. Profiling and automated decision-making

The Controller does not make decisions about Users based on automated processing, including profiling, as referred to in Article 22(1) and (4) GDPR.

20. Data security

The Controller uses technical and organisational measures that provide data protection appropriate to the risks.

21. Data from public registers and other publicly available sources

The Website provides tools displaying data from registers maintained by public authorities and other publicly available sources. These include registers maintained by the President of the Energy Regulatory Office (the register of energy producers in small installations, licence registers and lists of system operators), the National Court Register, the VAT taxpayer list and information published by authorities in the Public Information Bulletin. The Controller publishes a list of sources, their reuse terms and data as-of dates on the Sources and terms page.

Some entries in these registers concern individuals conducting business. Their data constitute personal data, obtained by the Controller from a public source rather than from the data subject. Article 14 GDPR therefore applies, and the information required by that provision is set out below.

Data categories

The Controller processes only data disclosed in the source: the entrepreneur's identification (first name and surname together with the business name), tax identification number, entry or decision number, type and scope of authorisation, its validity dates, installation data (type, capacity, locality, municipality, county and voivodeship) and a link to the source document. The Controller does not display individuals' residential or business addresses on the Website, and does not enrich register data with information about those individuals from other datasets.

Purpose and legal basis

Data are processed to operate energy market information tools that allow users to check market participants' authorisations and installations. The basis is Article 6(1)(f) GDPR: the legitimate interests of the Controller and data recipients. This interest consists in bringing together information that the legislature has made public precisely so that market participants can verify counterparties. It is pursued while observing the public-access rules governing each register.

Data source

Data come from the publicly available sources listed on the Sources and terms page, including the Energy Regulatory Office API and documents published by authorities. For each dataset, the Controller states its name, source address and retrieval date.

Data recipients

Data are publicly available on the Website. The entities listed in section 13, particularly the infrastructure and hosting provider, also have access.

Retention period

Data are displayed for as long as they remain disclosed in the public source and the Controller operates the relevant tool, but no longer than until an effective objection is made under section 22.

Data subject rights

The rights listed in section 16 apply, including access, rectification, restriction of processing and the right to complain to the President of the Personal Data Protection Office. As processing is based on legitimate interests, the right to object under Article 21(1) GDPR also applies. Section 22 explains how to exercise it.

How the information obligation is fulfilled

Individually notifying every person disclosed in the registers would require disproportionate effort within the meaning of Article 14(5)(b) GDPR. That provision requires information to be made publicly available in such circumstances. The Controller fulfils this obligation by publishing this section and the Sources and terms page.

22. Objection to the display of data from public registers

An individual whose data the Controller displays under Article 6(1)(f) GDPR may object to that processing at any time on grounds relating to their particular situation (Article 21(1) GDPR).

How to object

Send a message to biuro@fundacjaefet.pl or a letter to the Controller's registered office listed in section 1. Please provide the identification under which the data appear on the Website (first name and surname or business name, tax identification number or profile page address) and briefly describe the circumstances supporting the objection. This information is requested solely to locate the correct entry.

Time and method of consideration

The Controller considers the objection without undue delay, no later than one month after receipt, in accordance with Article 12(3) GDPR. If the matter is complex or there are many requests, this period may be extended by a further two months. The Controller informs the person concerned of the extension and its reason. The Controller records each request and how it was handled.

Effect of upholding an objection

The Controller stops displaying the person's data on the Website: within 7 days of upholding the objection, it removes the person's profile and entries from the presentation layer and lists provided to search engines. The Controller cannot remove the entry from the public register itself, which is maintained by the competent authority acting as a separate data controller. A request to amend or remove a register entry must be sent to that authority.

If an objection is not upheld

The Controller explains the reasons for refusal, the right to complain to the President of the Personal Data Protection Office and the right to seek a judicial remedy.

23. Changes to the Privacy Policy

The Controller may update this Privacy Policy. Changes are announced through a notification on the Website or an email to the User, and the current document is made available.

24. Contact details

Users may contact the Controller through the Website contact form, by email at biuro@fundacjaefet.pl, or in writing to Fundacja “Europejska Fundacja Energetycznej Transformacji”, ul. Łucka 18 lok. 4/L, 00-845 Warszawa.