Privacy Policy | PVhurt Photovoltaic Wholesale
SCOPE OF APPLICATION OF THE POLICY
This Privacy Policy (“Policy”) provides information on the processing of personal data by PVhurt.pl Anna Kulikowska, headquartered in Pasiecznik 82, 59-623 Lubomierz, Dolnośląskie Province (“PVhurt.pl,” “Administrator,” “we”). The Policy specifies the types of personal data collected by PVhurt.pl, explains how and why PVhurt.pl collects and uses certain personal data, explains when and why PVhurt.pl will share personal data with other entities, and presents the rights and options available to data subjects concerning the processing of their personal data. The Policy also includes information regarding the use of cookies.
This Policy applies to you if you are:
- a person visiting the PVhurt online store, available at https://pvhurt.pl or one of our international domains such as PVhurt.de, PVhurt.cz, PVhurt.sk, PVhurt.com, and PVsklep.pl (“Online Store”);
- a PVhurt.pl client, i.e., an individual running a business who has registered in the Online Store and has entered into an electronic services agreement with PVhurt.pl through it (“Client”) or a representative/agent of one of PVhurt.pl’s clients (“Client Representative”);
- a user with access granted by the Client to the account, authorized to use the services provided by PVhurt.pl on behalf of the Client (“Account User”);
- a Client who has joined the PVhurt.pl Partner Program under the terms specified in the Partner Program Regulations (“Partner”);
- a user of electronic forms available in the Online Store or the online chat;
- a user submitting a report on illegal content published in the Online Store or another interested person within the meaning of the Digital Services Act (DSA);
- a person supplying PVhurt.pl with any products or services (“Supplier”) or representing or acting on behalf of one of PVhurt.pl’s suppliers (“Supplier Representative”);
- a job applicant, i.e., a person participating in recruitment processes conducted by PVhurt.pl and sharing personal data with the company for this purpose (“Job Candidate”);
- a recipient of commercial information or marketing activities from PVhurt.pl, including the recipient of email marketing, newsletters, or other marketing forms conducted by the company (“Marketing Recipient”).
Your personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation – “GDPR”). This Policy fulfills the information obligation towards you based on Articles 13 or 14 of the GDPR.
Contact Information:
- Address: PVhurt.pl, Anna Kulikowska, Pasiecznik 82, 59-623 Lubomierz, Dolnośląskie Province
- Email: zamowienia@pvhurt.pl
- Phone: +48 536 119 865
DATA CONTROLLER
The controller of your personal data is PVhurt.pl Anna Kulikowska, headquartered in Pasiecznik 82, 59-623 Lubomierz, Dolnośląskie Province, registered in the Central Registration and Information on Business (CEIDG). You can contact the Administrator:
- by mail at the address: PVhurt.pl, Anna Kulikowska, Pasiecznik 82, 59-623 Lubomierz, Poland;
- by email at: zamowienia@pvhurt.pl;
- by phone at: +48 536 119 865.
SCOPE, PURPOSES, AND LEGAL BASES FOR PROCESSING PERSONAL DATA
The Administrator, PVhurt.pl Anna Kulikowska, processes personal data for various purposes, to different extents, and on various legal bases as specified in the GDPR. For clarity, we have grouped these based on the purpose or situation in which data may be processed.
Using the Online Store – Services Not Requiring Account Creation
The Administrator processes data of individuals visiting the PVhurt.pl Online Store to enable browsing of the assortment and using store functions without account creation. In this scope, we may process data regarding visitors’ activity on the Store, such as email address, IP address, session data, location, device, operating system, and browser information used by the visitor, as well as information contained in cookies and data included in inquiries directed to the Administrator.
The Administrator processes the personal data of Online Store visitors:
- to enable the use of the Store’s functionalities (Article 6(1)(b) GDPR);
- for purposes arising from the Administrator’s legitimate interests, such as ensuring the Store’s basic functions via cookies essential for its proper operation (Article 6(1)(f) GDPR);
- for analytical, statistical, and marketing purposes, when cookie data is used to analyze user activity and preferences, allowing improvements to store functions and offerings based on user consent (Article 6(1)(a) GDPR);
- for possible establishment, exercise, or defense of legal claims, i.e., when processing is necessary to protect the Administrator’s rights (Article 6(1)(f) GDPR).
Using the Online Store – Purchases Requiring Account Creation
The Administrator facilitates product sales to Clients who have registered an account on the PVhurt.pl Online Store. In connection with sales, the Administrator processes personal data of Clients with whom a purchase agreement has been made or will be made, as well as their representatives and agents. The Administrator may also process data of other users granted account access by the Client.
The Administrator processes data such as: first name, last name, business name and address, mailing address, VAT ID, business ID (REGON), bank account number, email address, phone number, account authentication data, activity data in the Store, and information about the agreement and its terms. Personal data may come from public sources such as CEIDG or GUS.
The Administrator processes personal data of Clients:
- to conclude and perform the purchase agreement, including setting up and maintaining the account, verifying the Client’s identity, processing payments, shipping orders, handling complaints, and providing access to purchases in the Online Store (Article 6(1)(b) GDPR);
- to fulfill legal obligations, e.g., tax regulations (Article 6(1)(c) GDPR);
- for purposes arising from the Administrator’s legitimate interests, such as maintaining business relationships, contact, establishing or defending claims, or for legal defense (Article 6(1)(f) GDPR);
- for direct marketing of products offered by the Administrator (Article 6(1)(f) GDPR);
- for analytical, statistical, and marketing purposes, when cookie data is used to analyze Clients’ activity and preferences to enhance Store functions and offerings, based on Client consent (Article 6(1)(a) GDPR);
- to ensure network and information security and to create backups (Article 6(1)(f) GDPR).
Personal data of Client Representatives and Account Users is processed by the Administrator for purposes arising from its legitimate interests (Article 6(1)(f) GDPR), such as:
- for Client Representatives – concluding and performing the purchase agreement, enabling account usage, ongoing contact and maintaining business relationships, conducting marketing activities, establishing or defending claims, or for legal defense;
- for Account Users – enabling the use of the Client’s account and establishing or defending claims, or for legal defense.
Implementation of the PVhurt Partner Program
The Administrator offers Clients the option to participate in the PVhurt Partner Program (“Program”). Participation in the Program is voluntary and takes place under the terms specified in the Partner Program Regulations. Participation in the Program requires the Administrator to process the Partner’s personal data, including: the type of Program selected, the balance of funds due to the Partner from participation in the Program, statistics of participation in the Program (number of orders placed using the Partner’s affiliate link or partner code), data contained on the VAT invoice issued by the Partner due to participation in the Program, including the Partner’s bank account number, date of birth, personal identification number (PESEL), and the relevant Tax Office.
The Administrator processes the personal data of Partners:
- to implement the Partner Program under the terms specified in its regulations, including making settlements with the Partner and handling any complaints submitted by the Partner (Article 6(1)(b) GDPR);
- to fulfill legal obligations of the Administrator arising from legal provisions, e.g., tax regulations (Article 6(1)(c) GDPR);
- for purposes arising from the Administrator’s legitimate interests, such as ongoing contact, establishment, or defense of potential claims (Article 6(1)(f) GDPR).
Using Electronic Forms and Online Chat Available in the Online Store
The Administrator provides electronic forms and an online chat feature on the PVhurt Online Store, through which the user can contact us regarding specific matters, ask questions, or perform other actions as specified by the form. Using the form or online chat requires providing basic personal data necessary to establish contact and respond to the inquiry or handle the submission. The user may also provide additional data that they believe may facilitate communication or improve the handling of the inquiry.
Providing the personal data marked as mandatory is required to establish contact or handle the submission; without it, we will be unable to process the inquiry. Providing other data is voluntary, and its submission implies the user’s consent to its processing.
Personal data collected via forms and online chat is processed by the Administrator:
- based on the Administrator’s legitimate interest, i.e., to contact the user and handle the inquiry or submission sent through the form or online chat (Article 6(1)(f) GDPR);
- based on the user’s consent, if the personal data is not necessary for contact or processing the inquiry/submission (Article 6(1)(a) GDPR).
Handling Illegal Content
The Administrator has implemented the DSA Form in the PVhurt Online Store, allowing any person or entity visiting the Store to report the presence of certain information considered illegal content as defined by the Terms and Conditions. Reporting illegal content requires providing information necessary to review the report, such as the reasons for the report, the exact location of the information (e.g., URL), the name or business name and email address of the Reporter (except for reports related to offenses specified in Articles 3-7 of Directive 2011/93/EU), and a declaration from the Reporter affirming their good faith belief that the reported information and allegations are true and complete.
The Reporter may provide additional data if they believe it will aid in identifying the illegal content or in processing the report. Providing personal data marked as mandatory in the DSA Form is necessary to submit and review the report; failure to provide such data may prevent its processing. Providing other data is voluntary, and its submission implies consent for its processing.
Personal data collected via the DSA Form is processed by the Administrator:
– to fulfill legal obligations under Articles 16-17 of the Digital Services Act (DSA), i.e., to receive a report concerning illegal content, review the report, inform about the decision, and provide justification for imposed restrictions (Article 6(1)(c) GDPR);
– based on the Reporter’s consent, if personal data is not necessary to handle the report (Article 6(1)(a) GDPR).
In addition, the Administrator may process personal data of its service recipients to fulfill other legal obligations arising from the Digital Services Act (DSA), including the execution of orders regarding actions against illegal content, providing information, or notifying about suspected crimes under Article 18 of the DSA (Article 6(1)(c) GDPR).
Supplying Us with Products and Services and Serving Recipients
The Administrator processes personal data of its Suppliers and their representatives or agents, as well as Product Recipients. Personal data processed may include: name, surname, business name and address, mailing address, VAT ID, business ID (REGON), bank account number, position/function, email address, phone number, and information regarding the agreement linking the Supplier or Recipient with the Administrator. Personal data of the Supplier or their representative may occasionally come from publicly accessible sources, such as the National Court Register (KRS).
The Administrator processes personal data of Suppliers and Recipients:
– to conclude and perform an agreement (Article 6(1)(b) GDPR);
– to fulfill legal obligations imposed on the Administrator by legal provisions, such as tax regulations (Article 6(1)(c) GDPR);
– for purposes arising from the Administrator’s legitimate interests, such as maintaining business relationships, ongoing contact, establishing or defending claims, or for legal defense (Article 6(1)(f) GDPR).
The Administrator processes personal data of Supplier and Recipient Representatives for purposes arising from its legitimate interests, such as taking necessary steps before concluding an agreement, concluding and performing the agreement, ongoing contact, maintaining business relationships, and establishing or defending claims (Article 6(1)(f) GDPR).
Recruitment
If you are applying for a job at PVhurt.pl, the Administrator collects information obtained from you during the recruitment process. This includes, in particular, personal data contained in the submitted application documents and data provided during phone interviews, email correspondence, and recruitment meetings.
The Administrator processes the personal data of Job Candidates:
– to fulfill legal obligations imposed on the Administrator by labor law (Article 6(1)(c) GDPR) and based on the Candidate’s consent if personal data provided exceeds the scope specified by labor law;
– based on the Job Candidate’s consent if the offered employment form is a civil law contract;
– for future recruitment processes, provided the Candidate has given consent (Article 6(1)(a), Article 9(2)(a) GDPR);
– for purposes arising from the Administrator’s legitimate interests, such as establishing or defending potential claims (Article 6(1)(f) GDPR).
Marketing of Our Products
The Administrator may engage in marketing activities aimed at acquiring new Clients, strengthening relationships with Clients, and enhancing the PVhurt brand and image. These activities may include sending marketing emails, newsletters, or other content requested by the Online Store user, as well as making phone contact.
The Administrator processes personal data for marketing purposes:
– based on consent given by the Marketing Recipient, if consent is the applicable legal basis for personal data processing (Article 6(1)(a) GDPR). Consent is typically obtained through forms or checkboxes provided by the Administrator on the Store’s website or in another effective manner, including verbally. The Administrator will need your consent to send newsletters or other requested content;
– based on the Administrator’s legitimate interests associated with conducting direct marketing, provided there is an appropriate relationship between the Administrator and the Marketing Recipient, such as when the Marketing Recipient is a Client of the Administrator or acts on their behalf (Article 6(1)(f) GDPR).
RECIPIENTS OF PERSONAL DATA
Where necessary to fulfill the purposes for which we process your personal data, we may transfer it to:
– entities authorized to process your personal data under the law, including but not limited to the prosecutor’s office, police, and tax authorities, in connection with legal obligations imposed on PVhurt, such as addressing potential abuses in the Online Store;
– entities cooperating with PVhurt in customer service, development, and maintenance of the Online Store, as well as other entities processing personal data on our behalf, such as providers of IT, telecommunications, information security, marketing, and accounting services – to the extent necessary for the delivery of these services. An up-to-date list of entities processing data on our behalf is available in the Policy annex;
– entities providing online payment services and other integrated services in the Online Store (a list of these entities is available on the PVhurt website).
Data will be transferred in full compliance with applicable laws, and we ensure that shared or entrusted data is transferred only to the extent necessary to achieve the processing purposes.
Your personal data may be transferred to third countries, i.e., outside the European Economic Area (EEA), according to the list of data recipients attached to the Policy.
Since July 10, 2023, data transfers between the European Union or EEA and the United States of America are governed by the “EU-US Data Privacy Framework.” The following non-EEA entities, which may receive your personal data:
– Twilio Inc.,
– Amazon.com, Inc.,
– Google LLC,
– Meta Platforms, Inc.,
– Microsoft Corporation,
have joined the “EU-US Data Privacy Framework.” For data transfers to these entities in the United States, the legal basis for the transfer of your data is the European Commission’s decision of July 10, 2023, recognizing the adequate level of protection for personal data in the United States as ensured by the “EU-US Data Privacy Framework.”
For data transfers to U.S.-based entities that have not joined the “EU-US Data Privacy Framework,” we cannot guarantee an adequate standard of data protection by these entities. In such cases, the legal basis for data processing by these entities is solely the consent you have provided (Article 6(1)(a) GDPR) upon activating the integration. Consent can be withdrawn at any time without affecting the legality of the processing before its withdrawal.
PERIOD OF DATA PROCESSING
The period for which PVhurt.pl processes personal data depends on the purpose for which the data is processed. Generally, PVhurt.pl processes data as long as necessary to fulfill the purpose for which it was collected or until consent, upon which the data processing is based, is withdrawn.
– **Visitors without an account** – if you visit the PVhurt Online Store without registering an account, your data will be stored as long as necessary to fulfill the purpose for which it was provided, but no longer than until objection or withdrawal of consent.
– **PVhurt Clients and Partners and their Representatives** – data will be processed during the term of the agreement with the Client or Partner or until it is no longer needed. After this period, data will be stored in compliance with legal obligations, e.g., financial documentation retention for five years. In justified cases, data may be stored as long as necessary to fulfill legitimate interests, such as the limitation period for claims arising from the agreement.
– **Client Account Users** – data will be stored as long as necessary to fulfill the purpose for which it was provided, but no longer than until objection to its processing.
– **Forms and online chat** – personal data provided via the form or online chat will be retained as long as useful, i.e., until the inquiry or submission is resolved and correspondence ends.
– **Reporters of illegal content** – if you are a Reporter under the Digital Services Act (DSA), your personal data will be stored for the time necessary to review the report or fulfill other DSA obligations, and then in compliance with legal requirements. If consent to process personal data in the report is given, data will be stored until consent is withdrawn.
– **Suppliers and their Representatives** – data will be processed during the term of the agreement with the Supplier or until the data is no longer needed. Afterward, it will be stored per legal requirements, e.g., a five-year retention period for financial records. In justified cases, data will be stored as long as necessary to fulfill legitimate interests.
– **Job Candidates** – data will be processed until the recruitment process to which the application pertains is completed. With consent for future recruitment, data will be stored for three years from collection, unless consent is withdrawn earlier.
– **PVhurt Marketing Recipients** – data will be processed as long as useful for PVhurt’s marketing purposes, but no longer than until consent is withdrawn (if it is the legal basis for processing) or a valid objection to data processing for marketing purposes is raised.
—
**RIGHTS RELATED TO PERSONAL DATA PROCESSING**
In connection with the processing of your personal data by PVhurt.pl, you are entitled to the following rights regarding the Administrator:
– **Right to withdraw consent for personal data processing**
If we process your data based on consent, you have the right to withdraw it at any time. Withdrawal applies from the time it is made and does not affect the legality of processing performed earlier. Withdrawal does not entail any negative consequences but may prevent the use of features requiring consent. To withdraw consent, please contact us at zamowienia@pvhurt.pl.
– **Right to access your data and receive a copy**
You have the right to obtain confirmation from us of whether we process your personal data. If so, you have the right to access this data and information about the purposes of processing, categories of data, recipients or categories of recipients, planned data retention periods, or criteria for its determination, as well as rights to request rectification, deletion, restriction of processing, objection to processing, filing a complaint with a supervisory authority, data source (if not obtained from you), and automated decision-making, including profiling. You also have the right to receive a copy of your personal data.
If your personal data is transferred to a third country or an international organization, you have the right to be informed of the appropriate safeguards regarding the data transfer (Article 46 GDPR).
– **Right to rectification (correction) of your data**
You have the right to request immediate correction of inaccurate personal data and to complete incomplete data concerning you.
—
**RIGHT TO DELETION OF PERSONAL DATA**
You have the right to request immediate deletion of your personal data if:
– your personal data is no longer needed for the purposes for which it was collected or otherwise processed;
– you object to the processing of data, and there are no overriding legitimate grounds for processing;
– you object to the processing of your data for direct marketing purposes;
– your personal data is processed unlawfully;
– your personal data must be deleted to comply with a legal obligation.
The right to delete personal data is not absolute and does not apply in cases specified in Article 17(3) GDPR (e.g., where processing is necessary to establish, exercise, or defend legal claims).
**Right to restriction of data processing**
You have the right to request restriction of processing of your personal data if:
– you contest the accuracy of the data – for a period that allows us to verify its accuracy;
– data processing is unlawful, but you oppose its deletion and request the restriction of its use instead;
– we no longer need your data for processing purposes, but you need it to establish, exercise, or defend claims;
– you have objected to data processing – pending verification of whether the Administrator’s legitimate grounds override your objection.
Right to Data Portability
You have the right to receive your personal data that you have provided to us and transfer it to another data controller, provided that the processing is based on the performance of a contract (Article 6(1)(b) GDPR) and is automated. You may also request that personal data be transferred directly to another data controller if technically feasible.
Right to Object
You have the right, at any time, to object—based on reasons related to your particular situation—to the processing of personal data when we process it based on our legitimate interest (Article 6(1)(f) GDPR). In such a case, we will cease processing unless we demonstrate compelling legitimate grounds for the processing or grounds for establishing, exercising, or defending claims.
If we process your personal data for direct marketing purposes, you have the right to object at any time to its processing for these purposes. Upon objection to direct marketing, the Administrator will no longer be entitled to process data for this purpose.
Right to Object to Profiling
You have the right not to be subject to a decision based solely on automated processing of your personal data, including profiling, which produces legal effects concerning you or similarly significantly affects you. PVhurt.pl does not process your data in this way without your consent.
Right to Lodge a Complaint with a Supervisory Authority
If, at any time, you believe that our processing of your personal data violates GDPR provisions, you have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office.
How Can You Submit Your Request?
To exercise these rights, please contact us by mail or via the email address indicated in section 2 of the Policy.
How Long Will It Take to Fulfill Your Request?
We will provide information on actions taken without undue delay, no later than within one month of receiving the request. If the request is complex or we receive numerous requests, we may extend this period by an additional two months, informing you in advance.
DO YOU HAVE TO PROVIDE YOUR DATA, AND WHERE DO WE OBTAIN IT IF NOT FROM YOU?
Providing personal data is generally voluntary. However, refusal to provide it may prevent us from fulfilling the purposes for which the data is collected, for example:
- preventing participation in recruitment processes conducted by the Administrator;
- preventing or significantly hindering contact with you or the presentation of an offer you request;
- preventing the conclusion or execution of an agreement;
- preventing the reporting of illegal content in accordance with the DSA.
If personal data has not been provided directly by you, it may have come from the entity you represent (e.g., a Client) or have been obtained through your use of an Integration via API. Your personal data may also come from publicly available sources, such as the National Court Register (KRS).
**COOKIES AND PIXEL TAGS POLICY**
Cookies are data files, specifically text files, installed on the devices of users visiting the PVhurt Online Store. Cookies typically contain the name of the domain from which they originate, the duration of storage on the end device, and a unique number. The cookies we use are safe for the user’s device – they do not allow viruses or other malicious software to access it.
The PVhurt Online Store uses the following types of cookies:
– **Necessary cookies** ensure the proper functioning of the Store. These files identify the software used by the Store visitor and adjust the Store for each user. They are essential for the correct provision of services and are processed based on legitimate interest (Article 6(1)(f) GDPR and Article 173(3) of the Telecommunications Law).
– **Functional cookies** enable functions such as sharing content on social media platforms, collecting feedback, and supporting other third-party features. These cookies tailor the Store’s content to individual user preferences and are used based on the user’s consent (Article 6(1)(a) GDPR and Articles 173(2) and 174 of the Telecommunications Law).
– **Analytical cookies** provide information about the number of visitors, bounce rate, traffic sources, etc. They generate anonymous statistics to help adjust the Store’s content and appearance to user preferences. These cookies are used based on the user’s consent (Article 6(1)(a) GDPR and Articles 173(2) and 174 of the Telecommunications Law).
– **Advertising cookies** are used to display relevant ads and marketing campaigns, track users across various websites, and personalize ads. These cookies are used based on the user’s consent (Article 6(1)(a) GDPR and Articles 173(2) and 174 of the Telecommunications Law).
You may withdraw consent to the Store’s use of cookies or change your preferences at any time using the browser options or by clicking a button on the Store’s website. Withdrawing consent does not affect the lawfulness of data processing based on consent before its withdrawal.
Clicking the “OK” button indicates consent to all cookies used in the Store, acknowledgment of the cookie information, and acceptance of their use by third parties.
The Store uses the following types of cookies:
– **Session cookies** – temporary files stored on the user’s device until leaving the Store.
– **Persistent cookies** – stored on the user’s device for a period specified in the cookie parameters or until manually deleted.
The Store may process the following data related to how users utilize our services:
– identifiers of the user’s telecommunications network or information system,
– information on the start, end, and scope of each use of services provided electronically by the Store.