PRIVACY POLICY
OF THE GREENSEARCH.PL ONLINE PLATFORM
1. Who is who (and what) in this policy?
- Personal Data Administrator (in short: "Administrator") or "We" – refers to us, greensearch Sp. z o.o., with its registered office in Radom (26-600) at ul. Kazimierza Pułaskiego 6/10. We are the administrator of your personal data and determine the purposes and methods of its processing.
- In specific cases, we may act as a personal data processor, based on an agreement concluded with the relevant controller for entrusting us with the processing of personal data.
- In all matters concerning the protection of your personal data, you can contact us directly at the following e-mail address: kontakt@ greensearch .energy.
- Joint Controller of Personal Data (hereinafter referred to as the “Joint Controller”) – is SYNOWSKI CONSULTING & INVESTMENT Limited Liability Company with its registered office in Gdańsk (80-278), ul. Bernarda Chrzanowskiego 11 / O11, entered into the register of entrepreneurs of the National Court Register maintained by the District Court Gdańsk-Północ in Gdańsk, VII Commercial Division of the National Court Register, under KRS number: 0000522118 NIP: 6692522283, REGON: 321566871, with whom we have concluded a personal data joint control agreement.
- You – refers to any natural person who visits or uses our Platform (Guest or User), particularly a natural person conducting business activity or a person representing a User that is not a natural person.
- Platform – our internet portal available at https:// greensearch .energy.
- GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
- Terms and Conditions – refers to the Terms and Conditions for the Provision of Services of the greensearch.pl Online Platform. Terms capitalized in this Privacy Policy bear the meaning ascribed to them in those Terms and Conditions.
2. How, why, and on what legal basis do we process your data?
We primarily collect your personal data directly from you when you register an Account, complete a contact form, publish an advertisement, or make a payment. Below, you will find detailed information on the purposes, types of data, and legal bases for processing, as well as the duration of data retention.
| Purpose of processing | Legal basis under GDPR | What data do we process? | Retention period |
|---|---|---|---|
| Conclusion and Performance of the Account Service Agreement | Article 6(1)(b) – processing is necessary for the performance of the Account Service Agreement concluded with the data subject, or for taking steps to enter into such an agreement. | First and Last Name, Email Address | For the duration of holding an Account on the Platform and until the expiration of any potential claims arising from the Account Service Agreement. The provision of data is voluntary; however, failure to provide it will result in the inability to conclude and perform the aforementioned Agreement (i.e., create an Account). |
| Conclusion and Performance of the Advertisement Publication Agreement | Article 6(1)(b) – processing is necessary for the performance of the Advertisement Publication Agreement concluded with the data subject, or for taking steps to enter into such an agreement. | Company Name, Tax Identification Number (NIP), Logo, Location, Industry, Number of Employees, Website Address, Email Address, Links to Social Media Profiles, Other data provided in the company description | For the duration of the Agreement period and until the expiration of any potential claims arising from the Advertisement Publication Agreement. The provision of data is voluntary; however, failure to provide it will result in the inability to conclude and perform the aforementioned Agreement (i.e., publish the Advertisement). |
| Handling inquiries via the contact form | Article 6(1)(f) – our legitimate interest (communication with users and responding to received messages) | First and Last Name, Email Address, Company Name, Other data provided in the message content | For the period necessary to handle and resolve the matter addressed in the message, but no longer than until an effective objection is raised. Failure to provide data will result in the inability to receive a response. |
| Conducting Verification and Processing Appeals against Decisions on the Handling of Inadmissible Content | Article 6(1)(c) – legal obligation arising from the DSA | First and Last Name, Company Name, Email Address, Other contact details | For the period necessary to conduct verification, but no longer than until the expiration of the User's claims. Failure to provide data will result in the inability to receive a response to the submission and to exercise the aforementioned rights. |
| Complaint handling | Article 6(1)(c) – a legal obligation arising from regulations concerning the Administrator's liability in the event of non-conformity of the digital service with the relevant Agreement | Name, Company, Email address | For the duration of the complaint procedure, but no longer than until the expiry of the User's claims. Failure to provide the data will result in the inability to process the complaint or exercise the aforementioned rights. |
| Compliance with legal obligations in accounting and tax matters | Article 6(1)(c) – a legal obligation arising from tax and accounting regulations | Name, Company, Tax Identification Number (TIN), Registered office address/residence address | For a period of 5 years, counting from the end of the calendar year in which the tax payment deadline for the preceding year expired. Failure to provide this data will result in our inability to fulfill the aforementioned obligations. |
| Fulfillment of personal data protection obligations | Article 6(1)(c) – a legal obligation arising from personal data protection regulations | Name, other data provided by the User, including contact details. | Until the expiry of claims related to the violation of personal data protection regulations. Failure to provide this data will result in the inability to properly exercise the aforementioned rights. |
| Establishment, assertion, or defense against claims. | Article 6(1)(f) – our legitimate interest (protection of our rights in the context of claims arising from Agreements concluded by us) | Name, Company, Email address, Registered office address/residence address, Tax Identification Number (TIN) | Until the expiry of claims arising from Agreements concluded by us. Failure to provide this data will result in our inability to take action. |
| Platform administration | Article 6(1)(f) – our legitimate interest (obtaining information about User activity on the Platform) | IP address, Device and browser data, Approximate location, Device operating system | Until an effective objection is raised or our processing purpose is achieved. Failure to provide data will prevent us from ensuring the proper functioning of the Platform. |
| Analysis of User activity on the Platform | Article 6(1)(f) – our legitimate interest (ensuring the proper functioning of the Platform) | Time spent on the Platform, IP address, Device and browser data, Approximate location, Device operating system, visited subpages and other activities undertaken on the Platform | Until an effective objection is raised or our processing purpose is achieved. Failure to provide data will prevent us from analyzing User activity on the Platform. |
3. To whom may we disclose your data?
We may entrust your personal data for processing to third parties (our partners) who support us in conducting our business operations. Recipients of your data may include:
- hosting service provider: Amazon Web Services EMEA SARL (AWS) with its registered office in Luxembourg - for the purpose of storing data on servers;
- Payment operator: Stripe, Inc. based in the USA - for the purpose of processing and settling payments for paid Services;
- Accounting services provider: Kancelaria Księgowo – Finansowa H&P Sp. z o.o. based in Otwock - for the purpose of managing our accounting and providing us with accounting services;
- IT and technical support service providers: FutureCode IT Consulting Sp. z o.o. and other subcontractors who maintain and develop the Platform;
- Analytical services provider – Google;
- authorized state authorities: Courts, prosecutor's offices, law enforcement agencies, supervisory authorities (e.g., President of UODO, President of UKE), if they request data disclosure in accordance with applicable regulations.
4. Will your data be transferred outside the European Economic Area (EEA)?
Yes, in some cases, your data may be transferred to third countries, i.e., outside the EEA. This occurs because we utilize the services of global providers, such as:
- Amazon Web Services (AWS) – servers may be located in various global locations.
- Stripe, Inc. – the company's main headquarters are located in the United States,
- Google – the company's main headquarters are located in the United States.
Due to our use of services provided, among others, by the entities listed above, your personal data may be transferred to the following third countries: United Kingdom, Canada, USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia, and Australia. The basis for transferring data to the aforementioned third countries is:
- in the case of the United Kingdom, Canada, Israel, and Japan – decisions of the European Commission affirming an adequate level of personal data protection in each of the aforementioned third countries;
- in the case of USA, Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (Republic of China), Indonesia, and Australia - contractual clauses ensuring an adequate level of protection, consistent with the standard contractual clauses specified in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
You may obtain a copy of the data transferred to a third country from us.
5. What are your rights regarding data processing?
GDPR grants you a number of rights that you can exercise by contacting us at the following e-mail address: kontakt@ greensearch .energy. Here they are:
- Right of access to data (Art. 15 GDPR): You can request information on whether we process your data, and if so, obtain access to it and receive a copy (the first copy is free of charge; each subsequent copy may incur a fee).
- Right to rectification of data (Art. 16 GDPR): if you believe your data is inaccurate or incomplete, you have the right to request its correction.
- Right to erasure of data ("right to be forgotten") (Art. 17 GDPR): You can request the erasure of your data if, for example, it is no longer necessary for the purposes for which it was collected. Please note that this right is not absolute, and we may not be able to erase your data if its processing is based on a legal ground other than your consent.
- Right to restriction of processing (Art. 18 GDPR): you may request that we restrict the processing of your data (i.e., primarily store it) in specific cases, for example, when you contest its accuracy.
- Right to data portability (Art. 20 GDPR): if processing is based on a contract or consent and is carried out by automated means, you have the right to receive your data from us in a structured, commonly used format and to transmit it to another controller.
- Right to object (Art. 21 GDPR): if we process your data based on our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to such processing at any time on grounds relating to your particular situation.
- Right to lodge a complaint with a supervisory authority: if you believe that we are processing your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office.
- Right to withdraw consent (Art. 7(3) GDPR): if the processing of your data is based on consent (e.g., for marketing activities), you have the right to withdraw it at any time. Please note that the withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
6. Are you required to provide your data?
- Providing data is voluntary, but often necessary to use our Services. Some processes described above involve a legal obligation to provide data, such as fulfilling tax obligations.
- Without providing data in the registration form, you will be unable to create an Account. Similarly, without providing data in the contact form, we will not be able to respond to your inquiry.
7. Profiling and automated decision-making
- We inform you that within the operation of the Platform, we create your profile for marketing purposes (including direct marketing tailored to your preferences), which means we process your data in an automated manner, including profiling it, but this will not produce any legal effects concerning you, nor will it similarly significantly affect your situation.
- The legal basis for processing personal data in this case is Art. 6(1)(f) GDPR – legitimate interest, specifically our conduct of marketing activities tailored to Users' preferences. Providing data is not mandatory, but it is necessary to achieve the aforementioned purpose. Failure to provide them means that we will not be able to conduct marketing activities tailored to Users' preferences.
8. Final provisions
- This Privacy Policy constitutes an integral part of the Platform Regulations.
- We reserve the right to amend this Privacy Policy. Any changes will be communicated with appropriate advance notice on the Platform's website.
- This policy comes into effect on September 1, 2025. The current version is effective from June 1, 2026.
