Your personal data may be processed in accordance with the purpose for which it was collected, based on:
a) Article 6(1)(a) of the GDPR for one or more specific purposes for which you have consented to the processing of your personal data - to the extent covered by the consent, where the processing of personal data is not based on any of the other grounds listed below (e.g., consent to receive a newsletter, registration for in-person or remote events organized by AC S.A., such as training sessions, and the issuance of certificates or attestations confirming participation in the event);
b) Article 6(1)(b) of the GDPR for the purpose and to the extent necessary for the conclusion and performance of a contract to which the data subject is a party (applies exclusively to cases of concluding a contract with AC S.A. or taking action at the request of the data subject prior to the conclusion of the contract), including, in particular, the provision of services related to the shipment of ordered goods, the preparation of accounting and customs documents, the processing of payments, and the handling of complaints;
c) Article 6(1)(c) of the GDPR to fulfill the legal obligations incumbent upon the controller, including obligations arising from tax law or other specific statutes (e.g., requirements regarding the approval and installation of gas systems, document archiving requirements, and the obligation to issue and retain accounting documents);
d) Article 6(1)(a) and (f) of the GDPR to respond to your inquiry, return your call, or address the matter you bring to the controller’s attention—e.g., via a contact form, Facebook chat, or email—and to conduct informational, including direct marketing of the controller’s products and services, also through automated calling systems (in particular, sending marketing and commercial information about products, contests, promotions, training sessions, etc., as well as invitations to events organized by the controller, and promoting the controller’s fan page), providing technical support regarding the controller’s products and services, verifying your payment reliability and creditworthiness, e.g., when making decisions regarding cooperation or granting a credit limit, as well as to secure due payments (guarantee agreements and other legal forms of security);
e) Article 6(1)(f) of the GDPR for analytical and statistical purposes consistent with the controller’s legitimate interest, consisting in particular of the need to conduct commercial and market analyses, the need to ensure the accuracy and reliability of sales accounting and the performance of concluded commercial contracts, including contracts with distributors, conducting commercial and market analyses, including product sales analyses to increase the effectiveness of the business model used, verifying the accuracy and reliability of settlements for resale promotions and discounts, and implementing loyalty programs for workshops or distributors, tracking products and their circulation for the purposes of service campaigns or to enable the potential, effective recall of harmful or dangerous products from the market, verifying business relationships in the context of economic sanctions, including EU and Polish sanctions imposed on Russia in connection with the armed conflict in Ukraine, marketing activities and measuring their effectiveness, as well as collecting information regarding the preferences of business partners, including for the purpose of developing or improving products and services provided, ensuring the proper display of content on the website or the administrator’s profile on social media platforms, ensuring security and the ability to resolve any technical issues, monitoring and analyzing traffic on the website or Facebook fan page, preparing personalized offers and advertisements, publishing data on entities with which the controller cooperates on the controller’s website, including marking their locations on a map, and recording visits by third parties to the company’s premises as part of preventive measures;
f) Article 6(1)(f) of the GDPR for the purpose of protecting the rights of AC S.A., including safeguarding, pursuing potential claims, or defending against such claims, in particular pursuing overdue payments through debt collection and legal proceedings.

AC S.A. processes, in particular, the following categories of personal data: first name, last name/company name, PESEL number/ID card number (including for the purpose of entering into a contract), contact details such as: email address, residential or business address, mailing address, phone number, job title or position, tax identification number (NIP), REGON, BDO, bank account number, data contained in financial documents, and additionally, in connection with the use of the administrator’s website or social media platforms: IP address, image (e.g., in a profile photo), content of published comments or posts, information sent via chat, information about the device used by the user, the country of origin, or the web browser used. AC S.A. receives personal data both directly from the data subject (e.g., by filling out the appropriate contact form or via social media platforms, such as when visiting the administrator’s profile (fan page)), and may also obtain it from publicly available sources (e.g., from CEIDG, KRS, or GUS), as well as from other entities (e.g., a contractor, business partner, database owner, or employees).

If justified by the purpose of processing referred to above, your personal data may be transferred to third parties with whom the controller cooperates, such as: providers of IT systems, hosting services, cloud services, or other services related to IT systems and software; entities responsible for the maintenance and technical support of the controller’s website or email, monitoring and analyzing website traffic; and administrators of social media platforms used by the controller, such as: Facebook, Instagram, LinkedIn, Twitter, entities providing services to AC S.A., e.g., accounting, legal, consulting, marketing, financial, bookkeeping, tax, auditing, training, document archiving, etc., postal operators and couriers, banks in connection with payment processing, debt collection agencies, regional technical and sales advisors, sales representatives, subcontractors (e.g., those installing photovoltaic panels), financial institutions offering the Company’s customers financing for the purchase of AC S.A. goods or services (banks, leasing companies), as well as authorities authorized to receive your data pursuant to legal regulations.

Your personal data will generally be stored for the time necessary to achieve the purposes for which it is collected, but not for a period shorter than that required by legal obligations imposed on the controller or until the expiration of the statute of limitations for any claims, if the processing of personal data is necessary for the controller to establish or pursue such claims or to defend against them. Subject to the foregoing, data processed on the basis of consent will, as a rule, be processed until consent is withdrawn or the controller ceases the activity to which the consent relates, unless the controller has a legitimate interest in further processing that overrides the interests, rights, and freedoms of the data subject.

Providing your personal data is mandatory to the extent required by law; in all other respects, it is voluntary, though necessary to achieve the purposes set out above.

You may withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of processing carried out prior to its withdrawal, nor does it affect the controller’s ability to process your data on another legal basis. Please kindly submit any requests to withdraw consent in writing or electronically to the email address: rodo@ac.com.pl.

In cases specified by applicable law, you have the right to request from the controller access to your personal data, the right to request its rectification, erasure, or restriction of processing, the right to object to processing, and the right to data portability at any time. You also have the right to lodge a complaint with the competent supervisory authority responsible for personal data protection—i.e., the President of the Personal Data Protection Office—if you believe that the processing of your personal data violates the provisions of the GDPR.

AC S.A. does not independently carry out automated data processing in a manner that would result in any decisions being made regarding you, or in any other similar way that would significantly affect your situation or produce legal effects. However, entities that receive your personal data—for example, when you visit the website or the administrator’s social media profile—may use it, for instance, to display content similar to what you have previously searched for (profiling). This applies in particular to Google and Facebook services. In addition, data collected on the AC S.A. website: solarstag.pl is automatically processed using the SALESmanago Professional Marketing Automation tool, which enables AC S.A. to receive automatic notifications about the activity of potential customers and to conduct automated and personalized marketing and sales campaigns, in accordance with the detailed information available at the link: https://www.salesmanago.pl/marketing-automation/marketing_automation.htm.

The administrator uses the following tools on its websites in particular:

a) Google Analytics—an online tool for analyzing website statistics, provided by Google LLC, based in Mountain View, United States; for more information about this tool, visit: http://www.google.com/analytics/learn/privacy.html;

b) Facebook Pixel—an analytics tool that helps measure the effectiveness of ads based on an analysis of user activity on the website, provided by Facebook, Inc., headquartered in Menlo Park, United States. For more information about this tool, visit: https://pl-pl.facebook.com/business/help/742478679120153?id=1205376682832142;

c) Hotjar – a tool that tracks how users navigate the website using their eyes or mouse, provided by Hotjar Limited, based in Malta; for more information about this tool, visit: https://www.hotjar.com/;

In order to provide the highest quality of service, the administrator uses cookies. Cookies (or similar technologies) are small text files sent by the website you are visiting and stored on your device (computer, smartphone, etc.), which enable, among other things, the proper display of this website, the use of all its features, and the administrator’s collection of statistics regarding traffic on its pages, as well as allowing the website to remember your visits and the choices you make on the site, including to tailor the service to your needs. Cookies do not cause any configuration changes to your device or the software installed on your device. Some cookies are generated by the administrator’s website, while others operate in connection with services provided by third parties used by the administrator (e.g., Google, Facebook).

By using the administrator’s website, you consent to the placement of cookies on your device. Additionally, by using the administrator’s website, you consent to the processing of personal data provided electronically. When you visit the website for the first time, you will be asked to consent to the administrator’s use of cookies. You may change the settings of your web browser or mobile device at any time, including cookie settings, to specify the conditions for their storage and the scope of their use.

The administrator uses two types of cookies:

• performance cookies (which collect information about how visitors use the site, such as the most frequently visited pages or error messages, etc.)
• functional (which store user settings, such as language, consent preferences, etc.), such as:
  • google-analytics.com cookies – used to track website statistics;
  • inspectlet.com cookies – are used to determine how users interact with the website;
  • session cookies – these are temporary pieces of information stored in the browser’s memory until the end of the session, i.e., when the browser is closed.

Third-party websites, to which the administrator’s website sometimes links, may also use cookies other than those listed above, including, in particular, cookies that enable users to log in and deliver advertisements tailored to their preferences and behavior. Examples of such cookies include:

• on youtube.com – containing the user’s preferences and a click counter;
• on player.vimeo.com and av.vimeo.com—which allow you to log in—as well as cookies placed by advertisers to tailor content and ad formats.

In most web browsers, you can: delete cookies from your computer’s hard drive (via your browser settings), block all cookies, or set a warning before they are saved to your hard drive. Please note, however, that changing these settings to restrict the use of cookies may affect certain features available on websites that use them, such as preventing you from logging into your email account. Failure to change these settings constitutes acceptance of the use of cookies.