Privacy and cookie policy

1. Data controller

The controller of personal data of users of the website https://varai.eu is Signal Group spółka z ograniczoną odpowiedzialnością with its registered office in Poznań (61-441), ul. 28 Czerwca 1956 r. 406, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000265195, VAT ID (NIP) 7781440038, REGON 300381375 (the “Controller” or the “Company”).

The Controller can be contacted by e-mail at kontakt@varai.eu or in writing at its registered address.

The Controller has appointed a Data Protection Officer who can be contacted by e-mail at inspektor@signalgroup.pl or in writing at the registered address with the note “To the Data Protection Officer”.

2. Scope and sources of data

We process data provided by the user in the contact form and the invoice analysis form, data resulting from correspondence, technical data related to the use of the website, and information stored in system logs and in cookies or similar technologies – to the extent that they are actually used on the website.

The scope of data may include in particular: first name and surname, company name, e-mail address, telephone number, message content, uploaded documents (e.g. an energy invoice), IP address, information about the device and browser, date and time of the visit, addresses of visited pages, technical error data and cookie preference settings.

3. Purposes and legal bases of processing

We process personal data in order to handle messages sent through the contact forms, conduct correspondence and reply to enquiries – on the basis of Article 6(1)(f) GDPR, and where the enquiry aims at concluding a contract or concerns steps taken at the request of the individual before entering into a contract – also on the basis of Article 6(1)(b) GDPR.

Data submitted together with an energy invoice is processed in order to prepare an analysis of reactive energy costs and an offer – on the basis of Article 6(1)(b) GDPR (pre-contractual steps at the request of the individual).

Technical data, server logs and security information are processed in order to ensure the correct operation of the website, detect abuse, maintain security and accountability – on the basis of Article 6(1)(f) GDPR.

Cookies or similar technologies that do not require consent are used only to the extent necessary to ensure the operation of the website, security, storage of privacy settings or other functions necessary to provide the service requested by the user.

Statistical, preference or marketing cookies (including analytics and advertising tools such as Google Analytics 4 or Google Tag Manager) are used only where they are actually implemented on the website and where the user has given prior consent – in accordance with applicable electronic communications and data protection law.

If a user’s message concerns the activity of a specific company of the Signal Group, the data may be transferred to that company in order to reply and further handle the matter. If such a company continues to handle the matter in its own name, it will provide the user with information about the processing of data no later than at the first contact.

4. Contact forms

Using the forms available on the website (contact form, partner form for installers, invoice analysis form) requires providing the data marked as mandatory. Failure to provide it makes it impossible to receive and handle the message.

Handling a message from a form does not require separate consent to the processing of personal data. If consent to receive commercial information or to direct marketing is implemented on the website, it will constitute separate, voluntary consent that can be withdrawn at any time.

5. Recipients of data

Personal data may be transferred to entities providing the Controller with services related to the maintenance and development of the website, hosting, e-mail, IT tools, technical support, IT security, legal and organisational advisory services, and to other processors acting under appropriate agreements.

Data may also be disclosed to authorised bodies or institutions where such an obligation results from law.

If the matter concerns a specific company of the Signal Group, the data may be transferred to that company to the extent necessary to reply and further handle the matter.

6. Transfers outside the EEA

Due to the Controller’s use of external hosting providers, technical infrastructure and analytics and marketing tools, personal data of website users may be transferred outside the European Economic Area, in particular to the United States.

The scope of data covered by such a transfer may include in particular technical data related to the use of the website, data stored in system logs, data submitted via forms and other data processed within the website infrastructure – to the extent necessary to provide hosting, maintenance, security, content delivery and technical support services.

Transfers take place with appropriate safeguards required by law, in particular on the basis of adequacy decisions, the recipient’s participation in the Data Privacy Framework, standard contractual clauses approved by the European Commission or other lawful transfer mechanisms.

7. Retention period

Data from forms and correspondence is stored for the period necessary to handle the matter and subsequently for the period required to demonstrate accountability, defend against claims or pursue claims.

Data processed for pre-contractual steps or the conclusion of a contract is stored for the period necessary for those steps and then – if a contract is concluded – for the period of its performance and for further periods resulting from law and limitation periods for claims.

Data stored in server logs and security systems is retained for the period necessary to administer the website and ensure security, taking into account periods resulting from backups, system logs and providers’ technical requirements.

8. Rights of data subjects

The data subject has the right to access their data, rectify it, erase it, restrict processing, and to data portability – in the cases provided for by law, as well as the right to object to processing based on Article 6(1)(f) GDPR.

Where processing is based on consent, the data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (Poland).

9. Voluntary nature of providing data

Providing data in the forms is voluntary, but for the data marked as required it is necessary in order to receive and handle the message.

Giving consent to cookies other than necessary ones, as well as any marketing consents, is voluntary.

10. Cookies and similar technologies

The website may use cookies and similar technologies, such as browser local storage or mechanisms used to remember user preferences, security and privacy settings.

The use of external hosting infrastructure and related services may involve the processing of technical data, logs and identifiers used for security, content availability and correct operation of the website. Not every such mechanism will be visible to the user as a separate cookie, but this information may constitute personal data within the meaning of the GDPR.

The use of statistical, preference or marketing cookies requires the user’s prior consent, unless a given mechanism is strictly necessary to provide the service explicitly requested by the user.

If the Controller implements analytics or advertising tools, embedded third-party content, maps, video players, marketing pixels or other similar solutions, detailed information about such technologies – including the provider’s name, purpose, storage period and any data transfer – will be made available to the user in the cookie settings panel and updated accordingly in this policy.

The website currently uses: the “varai_cookie_consent” cookie (necessary, stores your consent decision for 12 months), Google Tag Manager and Google Analytics 4 (statistics, provider: Google Ireland Limited), Microsoft Clarity (statistics, analysis of how the site is used, provider: Microsoft Ireland Operations Limited) and Google Ads (marketing, campaign measurement). Statistical and marketing tools are activated only after the relevant consent is given; the Microsoft Clarity script is not loaded at all without consent to statistics. Google and Microsoft may also process data outside the European Economic Area, based on standard contractual clauses and other mechanisms provided for in the GDPR.

11. Cookie categories

Necessary or functional cookies – used for the correct operation of the website, security, session maintenance, remembering privacy preferences and other technical settings. Their use does not require the user’s consent if they are strictly necessary to provide the service requested by the user.

Preference cookies – allow user settings to be remembered where they are not strictly necessary but improve convenience of use. Their use requires the user’s consent if they are not necessary.

Statistical cookies – used to create statistics and analyse website traffic. Their use requires the user’s prior consent if they use identifiers or similar tracking mechanisms.

Marketing cookies – used to tailor advertising content, conduct direct marketing, profiling or measure the effectiveness of promotional activities. Their use requires the user’s prior consent.

12. Managing cookies

The user can manage their preferences through browser settings and the “Cookie settings” panel where it is made available on the website.

Restricting cookies may affect some website functionalities, in particular those that require user settings to be remembered.

13. Social media and external links

The website may contain links to external services, in particular LinkedIn and YouTube. Clicking such a link takes the user to an external service where data is further processed under the rules set by its provider.

Merely placing a link to an external service does not in itself mean that the provider’s cookies are installed on the user’s device before clicking, unless embedded content or another technical solution requiring contact with third-party servers is implemented on the website.

14. Automated decision-making

Personal data of website users is not subject to automated decision-making, including profiling, that would produce legal effects concerning the user or similarly significantly affect them – unless a separate solution is implemented in the future, of which the user will be informed.

15. Changes to the policy

This policy is reviewed periodically and may be updated in the event of changes to website functionality, the tools used, the law or the manner of data processing.

The current version of the policy is published on the website.