Privacy policy

1. Who the data controller is

The controller of your personal data is NAATU Operator sp. z o.o., with its registered office in Gdańsk, ul. Jaśkowa Dolina 11B/3, 80-252 Gdańsk, Poland, entered in the register of entrepreneurs of the National Court Register under KRS 0000837560, VAT ID PL8133837787, REGON 385908770. The company runs the bieliq.pl website and the platform of the same name.

In any matter concerning personal data, write tobieliq@naatu.pl or to the registered address. We have not appointed a data protection officer – such correspondence is handled directly by the management board.

2. What data we collect and why

We collect data in one place: the contact form, available on the contact page and in the window opened by buttons across the site. You provide there:

• your name and e-mail address – mandatory fields, without them we have no way to reply;
• company name, phone number and information on who you are (e.g. trading company, renewable investor) – optional fields that help us prepare an answer;
• the message – whatever you decide to write to us.

Together with the enquiry we also record technical information about the place on the site it was sent from. We use it solely to judge which content prompts contact – it is not linked to you in any way beyond the enquiry itself.

We do not run a newsletter, we do not create user accounts and we do not accept payments through this site. We do not make automated decisions and we do not profile visitors.

3. The legal basis for processing

• Answering your enquiry and any further conversation – Article 6(1)(b) GDPR (steps taken at your request before entering into a contract), and where the matter does not lead to a contract – Article 6(1)(f) GDPR, our legitimate interest in conducting correspondence.
• Defending against and pursuing claims – Article 6(1)(f) GDPR.

4. How long we keep the data

We keep correspondence for the duration of the matter and then for3 years – the limitation period for claims connected with business activity under Polish law. Enquiries with no follow-up are deleted after12 months. If the correspondence results in a contract, data related to its performance and settlement is kept for as long as tax and accounting rules require.

5. Who processes the data on our behalf

We do not sell or share data with third parties for marketing purposes. We do use technical providers who process data on our behalf under data processing agreements:

• Vercel Inc. – hosting of the site and server-side handling of the form;
• Resend – delivery of form messages to our mailbox;
• our e-mail provider – storage of correspondence in the bieliq@naatu.pl mailbox;
• Google Ireland Limited – visit statistics, only after your consent (details in the cookies section).

Vercel and Resend are based in the United States, and analytics data may reach Google LLC – your data may therefore be transferred outside the European Economic Area. This happens on the basis of standard contractual clauses approved by the European Commission, which oblige those providers to protect the data at the level required in the Union.

If sending a message fails, its content goes to the event log of the server function at our hosting provider. We do this so that an enquiry is not lost together with the error – such entries are deleted automatically after a short time and serve no other purpose.

6. Cookies and browser storage

Before you give consent, the site stores no cookies in your browser and fetches nothing from external servers – typefaces are served from our own server, and there are no advertising pixels, maps or social plugins. The analytics script loads only at the moment you agree to the “analytics” category, not in advance.

Necessary

The site and the form need no cookies to work and we set none. We do storeyour choice from the consent window in the browser's local storage, under the key cookie-consent, so that we do not have to ask on every visit. That entry stays on your device and is never sent anywhere.

Analytics – Google Analytics 4

After your consent we start Google Analytics 4 to learn which content is read and where visitors get lost. The tool is provided by Google Ireland Limited(Gordon House, Barrow Street, Dublin 4, Ireland), which processes the data as our processor; data may also reach Google LLC in the United States on the basis of standard contractual clauses. IP anonymisation is enabled and we do not combine statistics with form data.

Google Analytics then stores in your browser:

• _ga – distinguishes visitors, valid for 2 years;
• _ga_<identifier> – maintains session state, valid for 2 years.

The basis is your consent – Article 6(1)(a) GDPR and Article 173 of the Polish Telecommunications Act. You may withdraw it at any time, without affecting the lawfulness of what happened earlier: click the cookie icon in the bottom left corner of the screen and change your choice. After withdrawal we delete the _ga cookies from your browser.

Marketing

Today we use no marketing tools and this category stays empty even if you switch it on. Should that change, we will describe the specific tools here before starting anything.

Google Search Console

We use Google Search Console, a tool that shows how the site performs in search. It works on Google's side, on search result data – it stores nothing in your browser, does not track visitors and therefore does not require consent. Ownership of the site is confirmed by a tag in the page code or an entry in the domain configuration.

Server logs

Our server, like any other, writes technical access logs containing among others the IP address, the date of the request and the type of browser. They are needed to maintain the security and stability of the site (Article 6(1)(f) GDPR), require no consent and are not used to identify visitors.

7. Your rights

In relation to your data you have the right to:

• access it and receive a copy;
• rectify inaccurate data or complete incomplete data;
• have the data erased;
• restrict processing;
• transfer the data to another controller;
• object to processing based on our legitimate interest – on grounds relating to your particular situation.

To exercise any of these rights, a message tobieliq@naatu.pl is enough. We answer without undue delay, within one month at the latest.

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

8. Is providing data mandatory

No. Filling in the form is entirely voluntary – without a name and an e-mail address, however, we will not be able to answer the enquiry.

9. Security

The site works only over an encrypted HTTPS connection, and the form accepts submissions only from our own addresses. Access to the mailbox receiving the enquiries is limited to the people who need it to reply.

10. Changes to this policy

If we change the way we process data – for example by starting visit statistics – we will update this document and change the date at the top of the page. Data collected earlier is always processed under the rules in force at the time of collection.