Controller

Name and Contact Details of the Controller

The controller responsible for the processing described in this privacy notice within the meaning of Art. 4 No. 7 of the General Data Protection Regulation (GDPR) is:

Energeia Advisory Aleksandra Szymanowicz-Siwiec

Milkowskiego 5/171, 30-349 Krakow, Poland

Tel.: +48 609 117 352

Ola@EnergeiaAdvisory.com

Represented by: Aleksandra Szymanowicz-Siwiec

General Information and Security

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Processing of Personal Data

Data Processing Technologies on the Website

When you access this website, we process your personal data in order to provide you with this website and to ensure its operation and technical security.

Further processing of personal data when using services and cookies on this website is described below.

Hosting & Content Delivery Network

About this processing In order to display this website to you, we process your personal data. For this purpose, we use external service providers who provide us with storage space and technical infrastructure on servers (hosting) and ensure fast and secure transmission of data to your browser (Content Delivery Network). Without this processing, it is technically impossible to access the website.

Description and purpose of the processing For hosting our website and displaying the page content, we use the system of the following provider: Squarespace Ireland Ltd., Ship Street Great Dublin 8, D08 N12C Ireland (hereinafter: "Squarespace").

Categories of personal data When you visit our website, your personal data (e.g., IP addresses) is processed on Squarespace's servers. Log files are created containing the following information:

• Our visited website

• Date and time at the time of access

• Amount of data sent in bytes

• Source/reference from which you came to the page

• Browser used

• Operating system used

• IP address used

Legal basis for processing Processing is carried out on the basis of Art. 6 (1) lit. f GDPR. We have a legitimate interest in the most reliable presentation, provision, and security of our website.

Recipients / Categories of recipients All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties. Within the scope of the aforementioned services, data may also be transferred to Squarespace Inc. in the USA as part of further processing on our behalf. For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

Storage duration The personal data (server log files) are stored for as long as is necessary to provide the services and ensure technical security (e.g., to defend against cyber attacks). The data is deleted or anonymized as soon as it is no longer required to achieve the purpose. This usually takes place after a short period, unless longer storage is necessary due to legal retention obligations or for the preservation of evidence in the event of specific incidents.

Obligation to provide data You are not obliged to provide the personal data in question. However, failure to provide it will mean that you cannot use our website, as the data (especially the IP address) is strictly necessary for the technical establishment of the connection.

Contact Form, General Email Address

About this processing We offer you the opportunity on our website to contact us directly via a provided contact form or via the published email addresses. If you use this option, the data you enter will be transmitted to us and processed.

Description and purpose of the processing The processing serves exclusively to handle your contact request and the associated matter (e.g., answering questions, preparing an offer, or support).

• When using the contact form: The data is first stored on the servers of our service provider Squarespace and from there automatically forwarded to our email inbox.

• For email contact: The data is received and stored by our email provider.

Categories of personal data Data that you enter into the contact form and metadata (time of sending, IP address).

Legal basis for processing

• Contract initiation / contract fulfillment: If your request aims to conclude or fulfill a contract with us (e.g., request for an offer or support for a purchased product), the legal basis is Art. 6 (1) lit. b GDPR.

• Legitimate interest: For all other inquiries (e.g., general questions), processing is based on our legitimate interest in quick and efficient communication in accordance with Art. 6 (1) lit. f GDPR.

Recipients / Categories of recipients

• Squarespace Ireland Ltd.: If you use the contact form, your data is technically processed by Squarespace. As explained in the "Hosting" section, a data processing agreement is in place, and the data transfer to the USA is secured by the Data Privacy Framework.

• Email Provider: Your emails are stored on the servers of our email service provider.

Storage duration We store your personal data for as long as is necessary to process your respective request or as long as we are entitled or obliged to retain it due to legal retention obligations.

Obligation to provide data You are not obliged to disclose personal data. The fields marked as required in the contact form are mandatory. Without this personal data, your respective request cannot be processed. The remaining information is voluntary and can simplify the processing of your request.

Newsletter

About this processing We offer the option to subscribe to a newsletter on our website. If you register, we process your data to regularly send you information about our offers, news, or relevant topics by email. We also analyze how our newsletter is opened and used to optimize our offering for you.

Description and purpose of the processing The data you enter into the registration mask (email address and possibly name) is transmitted to us and stored. The processing serves the purpose of:

• Delivery of the newsletter.

• Measuring success (e.g., open rates and clicks on links) to make future newsletters more interesting.

Categories of personal data

• Data that you enter into the registration form

• Usage data (when the email was opened, which links were clicked).

• Metadata (IP address, time of registration and confirmation).

Legal basis for processing

• Sending the newsletter: Processing is based on your consent in accordance with Art. 6 (1) lit. a GDPR.

• Logging the registration: The storage of the registration time and the IP address serves our legal protection (proof of consent) and is based on our legitimate interest in accordance with Art. 6 (1) lit. f GDPR.

Recipients / Categories of recipients The newsletter is sent via the integrated service "Squarespace Email Campaigns". The provider is Squarespace Ireland Ltd. (or Squarespace Inc., USA). We have concluded a data processing agreement with the provider. The transfer of data to the USA is secured by the Data Privacy Framework (DPF) and standard contractual clauses (see "Hosting" section).

Storage duration Your data will be stored as long as the newsletter subscription is active. If you unsubscribe, your email address will be removed from the distribution list. We reserve the right to store the data to prove previously given consent for a limited time (usually 3 years after the limitation periods) in a separate "blocklist" or archive in order to defend against legal claims.

Obligation to provide data The provision of your data is voluntary. You are not obliged to subscribe to the newsletter. However, without providing your email address, we cannot send you the newsletter.

Cookies

About this processing We use so-called "cookies" and similar technologies (e.g., Local Storage) on our website. These are small text files or data records that your browser automatically creates and stores on your end device (laptop, tablet, smartphone, etc.).

Description and purpose of the processing We use cookies for two different purposes:

• Technically necessary cookies: These are strictly necessary to ensure the operation of the website. This includes functions such as navigating the site, accessing protected areas, managing the shopping cart (if applicable), and security functions to defend against attacks (e.g., Cross-Site Request Forgery / CSRF).

• Analysis and statistical cookies (Squarespace Analytics): These cookies help us understand how visitors interact with our website. We collect information about which pages are viewed, how long visitors stay on the page, and from which region accesses occur. This serves to improve our content and technically optimize the website. These cookies are only set if you have actively consented in the cookie banner.

Categories of personal data The following data can be processed by cookies:

• IP address (mostly anonymized)

• Unique identification numbers (cookie IDs) for recognizing the browser

• Device information (operating system, browser type)

• Usage data (visited subpages, click paths, timestamps)

Legal basis for processing

• For technically necessary cookies, the legal basis is our legitimate interest in the functional provision of the website in accordance with Art. 6 (1) lit. f GDPR in conjunction with Article 173 of the Polish Telecommunications Law (Prawo telekomunikacyjne).

• For analysis cookies, processing is carried out exclusively on the basis of your consent in accordance with Art. 6 (1) lit. a GDPR in conjunction with Article 173 of the Polish Telecommunications Law (Prawo telekomunikacyjne).

Recipients / Categories of recipients The recipient of the data is our hosting service provider Squarespace Ireland Ltd., which acts as a processor for us and provides the technical infrastructure. A transfer to the parent company Squarespace Inc. in the USA is possible (secured by standard contractual clauses and the Data Privacy Framework, see "Hosting" section).

Storage duration The storage duration varies depending on the type of cookie:

• Session cookies: These are automatically deleted as soon as you close your browser.

• Persistent cookies: These remain stored on your end device for a defined period until they expire or you manually delete them (for Squarespace analysis cookies, the duration is often between 30 minutes and 2 years).

Obligation to provide data

• Technically necessary cookies: Provision is not legally required but is technically strictly necessary for the use of the website. Without these cookies, parts of the website (e.g., secure forms) cannot be used or can only be used to a limited extent.

• Analysis cookies: Provision is voluntary. You are not obliged to consent to the use of these cookies. A rejection has no negative impact on the usability of the website.

Data Subject Rights

Overview

Under the GDPR, you have comprehensive rights regarding the processing of your personal data. We want to ensure that you are fully informed about these rights.

Your rights in detail:

• You can freely revoke your consent under data protection law at any time with effect for the future; we will point this out in more detail when obtaining consent. Processing carried out before a revocation remains unaffected by the revocation.

• You have the right to request information about your personal data that we process at any time.

• If your personal data is incorrect or incomplete, you have a right to rectification and completion.

• You can request the deletion of your personal data at any time, provided we are not legally obliged or entitled to further process your data.

• If the legal requirements are met, you can request a restriction of the processing of your personal data.

• If processing is based on your consent or as part of a contract, you have a right to the portability of the data you provided, provided this does not impair the rights and freedoms of other persons.

• You have the right to contact a supervisory authority with questions or complaints, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

Right to Object

You have the right to object at any time to the processing of your data based on a balancing of interests or in the public interest, if there are reasons arising from your particular situation. This also applies to profiling based on this provision. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

We also process your personal data for direct marketing purposes. If you do not wish to receive advertising, you have the right to object to it at any time; this also applies to profiling to the extent that it is related to such direct marketing. We will respect this objection for the future. The objection can be made informally.

Contact

Regarding the processing of your personal data described in this privacy policy, you can exercise the aforementioned rights using the following contact details:

Aleksandra Szymanowicz-Siwiec, Ola@EnergeiaAdvisory.com