Privacy Policy

1. Scope of application and entity responsible for the processing of personal dataThis Privacy Policy applies to all personal data provided by the user (the "User") of the website www.edpenergia.pl (the "Website") with regard to the use of the Website and the provisions of the requested services available on the Website, (the "Services") including the fill out of the forms available on the Website.

The entity responsible for processing this data in its capacity of data controllers:
EDP Energia Polska Spólka Z Organiczona Odpowiedzialnoscia (hereinafter referred to as “EDP Energia Polska”), registered in the register of entrepreneurs of the National Court of Register kept by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register under KRS no. 0000745590, with VAT code 7010845524, registered headquarters at ALEJE JEROZOLIMSKIE, 98, 00-807, Warsaw, Poland and PLN 8,505,000.00 of share capital.

The user must carefully read this privacy policy and decide freely if he intends to provide his personal data to EDP ENERGIA POLSKA before using the Website.
This Website is not addressed to under aged Users. The User guarantees that he is of legal age and that the data communicated is true, accurate, complete and current, being responsible for any nonconformity. If the data communicated belongs to a third party, the user guarantees that he informed the third party about the conditions provided in this document and that he was authorized to provide his data to EDP ENERGIA POLSKA for the indicated purposes.

You may contact EDP ENERGIA POLSKA on any matter related to this privacy policy, through the following contact points:
E-mail: edpenergia.pl@edp.com
EDP Website: edpenergia.pl

2. Collected personal Data
EDP ENERGIA POLSKA collects the following categories of personal data (the "Personal Data"):
• Browsing data related to Services offered through the Website and collected through cookies, according to the Cookie policy as available here;
• Data provided in case of requests as filled out by the Users or request of information or assistance on the part of the User;
• Identification data of the User accessing its personal account;
• Data provided by the User in the "Become an Agent" form (if applicable);
• Information relating to the agreement between the User and EDP ENERGIA POLSKA. The processing of personal data included in the personal account are regulated by the information notice provided by EDP ENERGIA POLSKA at the moment of execution of the contractual relationship with the User.
• Information relating to the agreement between the EDP ENERGIA POLSKA's agent and EDP ENERGIA POLSKA. The processing of personal data related to the entering into and performance of the agreement with an agent are regulated by the information notice provided by EDP ENERGIA POLSKA at the moment of execution of the contractual relationship with the agent.

3. Data processing purposes and legal basis
EDP ENERGIA POLSKA processes Personal Data for the following purposes:
a) the provision of the Services offered through the Website, including the provision of responses to the User's requests of information or assistance and the reception of applicantions and recruitment process of candidates for the position of EDP ENERGIA POLSKA's agents;
b) the compliance with the applicable national/EU laws and/or response to request from public and government authorities;
(the purposes as per letters a) and b) are jointly referred to as "Contractual Purposes")
c) to exercise or defend legal claims in court proceedings or in an administrative or out-of-court procedures; and
d) to complete a potential merger, sale of assets or transfer of all or a material part of its business, by disclosing and transferring the Personal Data to the third party or parties involved in the transaction as part of the transaction;
e) the delivery of marketing communications concerning products and services of EDP ENERGIA POLSKA. The communications, may be sent by both automated (e.g., SMS, MMS, fax, calling systems, email and web applications) and traditional (e.g., calls by human operators) means of contact;
(the purpose as per letters c), d) and e) above are jointly referred to as "Legitimate Interest Purposes").

The processing of Personal Data is necessary with regard to the Contractual Purposes as it is essential for the execution of contracts between users and EDP ENERGIA POLSKA or for pre-contractual procedures upon request with regard to the case as per Section 3 letter a) and in order to comply with provisions as provided by the applicable laws as per Section 3 letter b). Should the User not provide its Personal Data with regard to the Contractual Purposes, EDP ENERGIA POLSKA will not be able to provide the User with the relevant Services.

The processing of the Personal Data with regard to the Legitimate Interest Purposes as per Section 3 letters c), d) and e) is carried out pursuant to article 6, letter f) of the EU General Data Protection Regulation No. 679/2016 (the "Privacy Regulation"), for the pursuit of EDP ENERGIA POLSKA legitimate interest, which is adequately balanced with the User's interest since the data processing is performed within the limits strictly necessary to perform such economic activities. This data processing activity with regard to the Legitimate Interest Purposes is not mandatory and the User can object to the data processing at any time through the modalities as per this Privacy Policy. In such case no data processing will be carried out by EDP ENERGIA POLSKA, except in case where EDP ENERGIA POLSKA demonstrates the existence of legitimate prevailing arguments or the processing is necessary to exercise or defend EDP ENERGIA POLSKA rights pursuant to Article 21 of the Privacy Regulation.

4. Recipients
For the Contractual Purposes, Personal Data may be transferred to the following categories of recipients located within the EU: (a) suitable service provider outsourced by EDP ENERGIA POLSKA, entrusted with processing activities that provide services or assistance and advice to EDP ENERGIA POLSKA, with special - but not exclusive - reference to technology, accounting, administrative, legal, insurance, IT matters; (b) other companies within the EDP Group, and (c) persons and authorities whose right to access Personal Data is recognized by law, regulations or provisions issued by legally empowered authorities.

For the Legitimate Interest Purposes, Personal Data may be transferred to the following categories of recipients located within the EU: (a) third parties service providers entrusted with processing activities, (b) other companies within the EDP Group, (c) potential purchaser of EDP ENERGIA POLSKA and the entities resulting from mergers or any other transformation involving EDP ENERGIA POLSKA, (d) competent authorities.

A complete list of the data processors appointed by EDP ENERGIA POLSKA is available upon request through the modalities as per this Privacy Policy.

5. International data transfers
Data processing for the aforementioned purposes shall occur in its entirety within the European Economic Area. The transfer of personal data is based on information systems equipped with appropriate information security measures, such as content and communication encryption and the use of secure servers. If transfers from EU to countries not considered adequate by the European Commission apply, the EDP ENERGIA POLSKA will put in place appropriate and suitable safeguards to protect the Personal Data. Accordingly, the Personal Data are transferred in compliance with the requirements and the obligations provided by applicable data protection laws, such as standard contractual clauses adopted by the European Commission as per Articles 45 and 46 of the Privacy Regulation a copy of which the User will be able to request by contacting us.

6. Retention period
Collected data may be retained for the necessary period for the fulfilment of legal obligations or archiving purposes for which EDP ensures the implementation of appropriate technical and organizational measures; if there is a contract between EDP ENERGIA POLSKA and the user, during the validity period of the latter plus limitation periods and expiry of the rights derived therefrom, unless it is obliged to maintain them for a longer period by virtue of the law.

EDP ENERGIA POLSKA may also keep the data beyond these periods for statistical purposes, and for this purpose shall anonymize them.
Data collected for to the delivery of marketing communications as per Section 3 letter e) of this privacy policy is retained for the duration of the Services and a subsequent period of 24 months.

7. User rights
The User, at any given time, can exercise the following rights:
a) to obtain from EDP ENERGIA POLSKA confirmation of the existence of personal data and to be informed of its content and source, verify its accuracy and request its integration, update or amendment;
b) request the erasure, anonymization or restriction of the processing of personal data processed in breach of the applicable laws;
c) object in whole or in part, on legitimate grounds, to the processing of the data;
d) request EDP ENERGIA POLSKA to limit the processing of the User's personal data where:
• the User contests the accuracy of the personal data until EDP ENERGIA POLSKA has taken sufficient steps to correct or verify its accuracy;
• the processing is unlawful but User does not want us to erase his/her Personal Data;
• EDP ENERGIA POLSKA no longer needs the User's personal data for the purposes of the processing, but the User requires them for the establishment, exercise or defence of legal claims; or
• The User has objected to processing justified on legitimate interests, pending verification as to whether EDP ENERGIA POLSKA has compelling legitimate grounds to continue processing;
e) object to the processing of the User's personal data in case of processing based on legitimate interest, unless EDP ENERGIA POLSKA demonstrates the existence of compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims;
f) request the erasure of the User's personal data without undue delay;
g) receive an electronic copy of the User's personal data, if the User would like to port its personal data to itself or a different provider, when EDP ENERGIA POLSKA the processing is necessary for the provision of the services and the personal data is processed by automatic means; and
h) lodge a complaint with the relevant data protection supervisory authority.
i) Users have the right to define (general or specific) directives concerning the fate of their personal data in case of death.

In order to exercise the aforementioned rights, the user may contact the entity responsible for the processing of personal data by sending a written request to the addresses listed in paragraph 1 of this Privacy Policy or the following email address: edpenergia.pl@edp.com

The user also has the right to submit a complaint to the supervisory authority (in Poland Prezes Urzędu Ochrony Danych Osobowych) if he/she believes that his/her Personal Data rights have been violated.