Privacy Policy
This Privacy Policy sets out the rules for the processing of personal data collected via the website operated at arpenergia.pl. This document has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
1. Data Controller
The controller of your personal data is:
ARP Energia Sp. z o.o.
ul. Nowy Swiat 6/12, 00-400 Warsaw, Poland
Tax ID (NIP): 7011076507
KRS: 0000973325 (District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register)
REGON: 521168390
(hereinafter: „the Controller”)
For matters relating to the protection of personal data, you may contact the Controller:
- e-mail: biuro@arpenergia.pl
- by post: ARP Energia Sp. z o.o., ul. Nowy Swiat 6/12, 00-400 Warsaw, Poland (marked „Personal data protection”)
2. What data we collect
We collect personal data that you provide voluntarily when using the website:
- Contact form: full name, company name, e-mail address, phone number, message content
- Tender form: bidder data required by the procurement documentation
- Technical data: IP address, browser type, operating system, visit time (collected automatically by the server and analytics tools)
3. Purposes and legal bases for processing
We process your personal data solely for specific purposes and on the basis of the relevant GDPR provisions:
| Purpose of processing | Legal basis |
|---|---|
| Responding to enquiries submitted via the contact form | Art. 6(1)(b) GDPR (steps taken prior to entering into a contract at the request of the data subject) |
| Handling tender proceedings | Art. 6(1)(b) GDPR (performance of a contract or steps prior to entering into a contract) |
| Website analytics (Google Analytics) | Art. 6(1)(a) GDPR (consent given by accepting analytics cookies) |
| Displaying personalised advertisements (Google Ads) | Art. 6(1)(a) GDPR (consent given by accepting marketing cookies) |
| Handling correspondence and archiving | Art. 6(1)(f) GDPR (legitimate interest of the Controller) |
| Establishing or defending against claims | Art. 6(1)(f) GDPR (legitimate interest of the Controller) |
| Fulfilling tax and accounting obligations | Art. 6(1)(c) GDPR (legal obligation incumbent on the Controller) |
4. Data retention period
We retain personal data for the period necessary to fulfil the purposes for which it was collected:
- Contact form enquiries – for the duration of the correspondence and 3 years from the last contact (limitation period for claims)
- Tender proceedings data – for the duration of the proceeding and 5 years after its conclusion (archiving obligations)
- Data processed on the basis of consent – until consent is withdrawn
- Analytics data (cookies) – in accordance with the validity period of each cookie (details in Section 7)
- Tax and accounting data – for the period required by tax law (5 years from the end of the tax year)
5. Data recipients
Your personal data may be shared with the following categories of recipients:
- Hosting provider – servers on which the website operates
- IT service providers – entities providing technical support and website maintenance
- Google LLC – within Google Analytics and Google Ads services (after consent to analytics or marketing cookies); data may be transferred to the USA under the European Commission adequacy decision (EU-US Data Privacy Framework)
- Accounting firm – to the extent necessary for bookkeeping
- State authorities – in cases provided for by law (e.g. tax authorities, law enforcement)
The Controller does not sell personal data to third parties.
6. Your rights
Under the GDPR, you have the following rights:
- Right of access – you may obtain information on whether and what data we process about you (Art. 15 GDPR)
- Right to rectification – you may request the correction of inaccurate data (Art. 16 GDPR)
- Right to erasure – you may request deletion of your data, the so-called „right to be forgotten” (Art. 17 GDPR)
- Right to restriction of processing – you may request restriction of processing in certain cases (Art. 18 GDPR)
- Right to data portability – you may receive your data in a structured format (Art. 20 GDPR)
- Right to object – you may object to processing based on legitimate interest (Art. 21 GDPR)
- Right to withdraw consent – where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR)
To exercise any of the above rights, please contact the Controller at: biuro@arpenergia.pl
Right to lodge a complaint: If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the supervisory authority:
President of the Personal Data Protection Office (PUODO)
ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl
7. Cookies
The Controller’s website uses cookies – small text files stored on the user’s device.
Types of cookies
| Category | Description | Can be disabled? |
|---|---|---|
| Essential | Required for the proper functioning of the website, forms and security. These include remembering cookie consent choices. | No |
| Analytics | Help us understand how users interact with the website. We use Google Analytics with IP anonymisation. | Yes |
| Marketing | Enable the display of personalised advertisements and measurement of their effectiveness. We use Google Ads. | Yes |
Third-party cookies
The website may use cookies from the following third parties:
- Google Analytics (Google LLC) – website traffic analysis. Google Privacy Policy
- Google Ads (Google LLC) – remarketing and conversion measurement. Google Ads information
Managing cookies
On your first visit, we display a cookie consent banner. You can change your preferences at any time by clicking the cookie settings icon in the bottom-left corner of the page. Analytics and marketing cookies are only installed after consent is given.
You can also manage cookies at the browser level. Instructions can be found in your browser settings. Deleting or blocking cookies may affect website functionality.
8. Changes to this Privacy Policy
The Controller reserves the right to update this Privacy Policy. Significant changes will be communicated via a notice on the website.
Last updated: 1 July 2026