Documents

Privacy policy

This is an English translation of the Polish privacy policy. In the event of any discrepancy, the Polish version prevails.

Last updated: 20 October 2026.

This is an English translation of our Polish privacy policy.

1. Data controller

The controller of your personal data is Kwartz Sp. z o.o., a Polish limited liability company with its registered office at ul. Skórzewska 35, 62-081 Wysogotowo, Poland, Tax ID (NIP) 5252527330 (the “Controller” or “.KWARTZ”). For matters relating to the protection of your personal data, you can contact the Controller by email at biuro.obslugi@kwartz.pl or by phone on +48 731 456 220.

2. What data we process

We process the data you provide to us voluntarily, in particular through the contact form or the calculator (available on the Polish pages only), or when you contact us by email or phone: your full name, company name, email address, phone number, the content of your message, and information about the facility and its energy consumption that you include in your enquiry. An enquiry sent through the form also includes contextual data: the address of the page from which you sent it and, if you have consented to analytics, the campaign parameters (UTM) and the address of the referring page. We attach an available Google Analytics identifier only with consent to both Analytics and Marketing. If you have consented to marketing, we also attach available ad click identifiers and browser identifiers stored by Meta Pixel to your enquiry. We use contextual data to handle your enquiry and to assess the effectiveness of our activities. We also process technical data relating to your use of the website (e.g. IP address, cookies, statistical data), to the extent described in section 8.

3. Purposes and legal bases for processing

We process personal data for the following purposes:

• Handling enquiries and correspondence: we process data to handle correspondence and reply to you, on the basis of the Controller’s legitimate interests in business communication (Article 6(1)(f) of the EU General Data Protection Regulation, the “GDPR”). Where an enquiry is aimed at entering into a contract with the data subject, the legal basis is also taking steps at that person’s request prior to entering into a contract (Article 6(1)(b) GDPR).
• Preparing a proposal and performing a contract: to the extent necessary to take steps at your request prior to entering into a contract and to perform that contract (Article 6(1)(b) GDPR).
• Compliance with legal obligations to which the Controller is subject, e.g. tax and accounting obligations (Article 6(1)(c) GDPR).
• Website analytics and statistics, and measuring the effectiveness of advertising: solely on the basis of your consent given in the cookie settings, separately for the Analytics and Marketing categories (Article 6(1)(a) GDPR). We do not currently use details submitted through the form to send marketing communications. If we start doing so, this will need a separate legal basis and any consents the law requires.
• Displaying the directions map: with your separate consent given by clicking “Enable Google map” (Article 6(1)(a) GDPR). Section 8 explains how to enable and hide the map.
• Establishing, exercising or defending legal claims: on the basis of the Controller’s legitimate interests (Article 6(1)(f) GDPR).

4. How long we keep your data

We keep data for as long as is necessary to achieve the purposes for which they were collected: until we have replied to you and the correspondence has ended, for the duration of a contract and until it has been financially settled, and then for the periods required by law (e.g. tax law) and until the limitation periods for claims have expired. Data processed on the basis of consent are kept until you withdraw that consent.

5. Recipients of data

The recipients of data are entities that support the Controller in running its business: the CRM provider (Bitrix24), the hosting provider (Hostinger International Ltd., Cyprus), the email and office software provider (Microsoft 365), and the providers of analytics, advertising and map tools: Google (Google Analytics 4, Google Ads and Google Maps), Meta Platforms (Meta Pixel), Microsoft (Clarity) and Apollo.io (identification of visiting companies). We activate analytics and marketing tools according to the categories selected in the cookie banner, and the Google map after a separate click as described in section 8. These entities act under data processing agreements or as independent controllers with respect to their own tools. Transfers of data outside the European Economic Area rely on mechanisms provided for in the GDPR that are appropriate for the provider, in particular a European Commission adequacy decision (including the EU-US Data Privacy Framework for participating organisations) or standard contractual clauses.

Enquiries from the website are handled by Kwartz Sp. z o.o. At a later stage, when an order is being prepared or carried out, data may be disclosed to Kwartz Construction Sp. z o.o., which takes part in this work as a subcontractor. In this respect, Kwartz Construction uses the data solely to carry out the work commissioned by Kwartz Sp. z o.o., and not for its own sales or marketing purposes.

6. Your rights

You have the right to access your data, to have them rectified or erased, to have their processing restricted, to data portability, to object to processing based on legitimate interests and, where processing is based on consent, to withdraw that consent at any time (without affecting the lawfulness of processing carried out before its withdrawal). You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland.

7. Providing your data

Providing your data is voluntary but necessary in order to reply to an enquiry, prepare a proposal, or enter into and perform a contract. If you do not provide your data, we may be unable to handle your enquiry.

8. Cookies

On your first visit, you can choose “Accept all”, “Essential only” or “Settings”. Analytics and marketing cookies are off by default. Rejecting them does not stop you from browsing the website or using the calculator or the contact form. Tools in these categories are not loaded until you give consent. You can change your choice at any time via “Cookie settings” in the footer.

• Essential: remembering your cookie choice and, at your request, temporarily passing the calculator result to the contact form.
• Analytics, with consent: Microsoft Clarity (click maps and replays of interactions with the website), and storage by .KWARTZ of campaign parameters and the referring page. Session replays are not camera or microphone recordings. We activate Google Analytics 4 only when both Analytics and Marketing are enabled because its tag is linked to Google Ads. With analytics consent alone, we do not activate Google Analytics or Google Ads tags.
• Marketing, with separate consent: Apollo.io to identify visiting companies, Meta Pixel and storage of ad click identifiers to link an enquiry to an advert. We activate Google Ads when both Analytics and Marketing are enabled. Advertising tools measure effectiveness and personalise adverts. With both categories enabled, Microsoft Clarity may also synchronise advertising identifiers. The Google tag feature that uses contact details provided by users remains switched off.

We use Apollo.io to identify companies interested in our services and measure marketing effectiveness, based on consent to the Marketing category (Article 6(1)(a) GDPR). Apollo receives the IP address, a browser identifier and information about pages visited. These may be personal data, including where they identify a sole trader. We do not send Apollo data entered in our forms. The integration blocks the LiveIntent person-identification module. We do not activate Apollo on page views where the current or referring URL contains parameters or a fragment.

The provider is ZenLeads, Inc. (Apollo.io), USA. Under its published terms, Apollo may use the data it receives, including visitors’ IP addresses, to develop its own business Contributor Database; it acts as an independent controller for that purpose. Its data processing agreement describes standard contractual clauses for transfers outside the EEA. Apollo’s retention periods depend on the processing purpose and the provider’s policies, rather than the 180-day validity of our consent record described below. Details and how to request deletion: Apollo privacy policy and Apollo data processing agreement.

Before activating analytics and advertising tools, we remove ad click identifiers from the current page address. With marketing consent, we may retain them in .KWARTZ’s own storage and attach them to an enquiry. If the referring page address still contains these identifiers, we do not activate Clarity or Meta Pixel for that page view.

What we store in your browser and for how long

Cookies are small files saved by your browser. We also use localStorage (kept between visits) and sessionStorage (kept only for the current tab). The periods below refer to storage in your browser, not to how long providers keep data on their servers.

Cookie choice: kwartz_consent

An essential .KWARTZ record stored in your browser: the categories you selected, the date of your choice, its expiry date and the version of the cookie information. Valid for 180 days. After this period, or if the scope of consent changes significantly, we ask you to choose again. We do not ask again on every page. Your browser may delete this record earlier; a record that is no longer active is cleared on your next visit.

Settings and website operation

kwartz-estimator-handoff-v1: the calculator scenario you selected, saved only when you click through to the contact form, used once and kept for no more than 30 minutes in the current session. A fallback refusal record, kwartz_consent_blocked, kept in session storage or a session cookie, is used only to make sure that a browser storage error cannot reinstate consent you gave earlier.

Form status: kwartz_lead_pending_v1

An essential sessionStorage record: a random submission attempt identifier, without contact details. It lets you check the result of an earlier attempt without creating a second enquiry. We remove it when receipt is confirmed or when we establish that the enquiry was not sent; if the result remains uncertain, it stays until the tab session ends.

Google Analytics 4: _ga and _ga_*

Activated with consent to both Analytics and Marketing. Used to recognise your browser and link visits for statistics. Up to 2 years; the period may be renewed on later visits covered by consent. Google Analytics cookie description.

Microsoft Clarity: _clck and _clsk

Analytics, with consent. _clck remembers the browser identifier for up to 1 year; _clsk combines page views into one session for up to 1 day. The periods may be renewed when the tool is used. Microsoft Clarity cookie description.

Microsoft Clarity: _cltk

An analytics record in sessionStorage, used by Clarity during the current tab session. We remove it when analytics consent is withdrawn or expires; otherwise, it is cleared when the tab session ends.

Meta Pixel: _fbp and _fbc

Marketing, with consent. Used to identify your browser and, if you arrive from an advert, to store the ad click identifier. Up to 90 days by default; this period may be renewed as the tool is used. Meta cookie policy.

Meta Pixel: multiFbc, lastExternalReferrer, lastExternalReferrerTime

Marketing records in localStorage: ad click identifiers, the referral source and the time it was recorded. The website uses them only while marketing consent is valid (180 days). We delete the known records when consent is withdrawn or expires; if the website was closed, this happens on the next visit. The provider may delete a record earlier.

Google Ads: _gcl_au and _gcl_aw cookies, and _gcl_ls in localStorage

Records associated with advertising measurement and ad click identifiers. They may be created depending on whether you arrive from an advert and on the Google tag configuration. The website uses these Google records only while consent to both Analytics and Marketing remains valid, for no more than 180 days. When either consent is withdrawn or expires, we delete the known cookies we can access and the local record; if the website was closed, this happens on the next visit. This describes how long the website uses these records, not a default cookie expiry period set by Google.

Google Ads: _gcl_ag

A Google advertising cookie observed on this website after a visit with ad click identifiers. Its measured expiry period was 400 days. This does not mean consent to measurement for that length of time: the website uses this Google record only while consent to both Analytics and Marketing remains valid, for no more than 180 days. When either consent is withdrawn or expires, we delete the cookie if it is accessible to the website; if the website was closed, this happens on the next visit.

Apollo.io: apolloAnonId, event queue and identification setting

Marketing records in localStorage: a browser identifier and keys ending in _eventQueue and _canTrack. We use them only while marketing consent is valid, for no more than 180 days. The provider may remove them earlier. We remove these records when consent is withdrawn or expires; if the website was closed, this happens on the next visit. We also clear any existing liveIntentData record; the integration blocks the LiveIntent module.

Advertising identifiers: kwartz_click_ids

A local .KWARTZ record in localStorage, saved only with marketing consent. It stores available ad click identifiers so they can be attached to your enquiry. It remains valid until the consent under which the identifiers were saved expires, for no more than 180 days, or until you withdraw that consent, if earlier. Expired records are removed when next read or when the website next starts.

Campaign source: kwartz_utm_first, kwartz_utm_last, kwartz_ref

Local .KWARTZ analytics data, saved and attached to an enquiry only while your consent to analytics is valid. These data are kept at the latest until the consent under which they were collected expires (180 days), or until you withdraw that consent, if earlier; the expiry date is stored in kwartz_attribution_expires_at. As context for handling your enquiry, we pass on the plain page path, the topic and the selected service scope, without tracking parameters from the address.

For analytics and advertising tools, Google, Microsoft, Meta and Apollo receive data after the required categories described above have been enabled. The tools may also use cookies on the providers’ own domains, depending on your browser settings and the providers’ services. Their purposes and periods are described in the documentation linked above and in the Google privacy policy and the Microsoft privacy statement. We do not read cookies set on third-party domains and cannot delete them ourselves.

Withdrawing consent stops further use of the relevant category, including in other tabs where this website is open in the same browser. We delete the first-party cookies we know of and can access, and the local campaign data covered by your withdrawal. You may need to reload the page for the tools to stop. Withdrawing consent does not automatically delete data sent to providers earlier; to have them deleted, you can exercise the rights described in section 6 and write to us. The actual lifetime of a record may be shorter because of your browser’s privacy settings.

Google map on the contact page

The embedded map is switched off by default. Your browser connects to Google to display the map only after you click “Enable Google map”. This is a separate choice for the map, independent of the Analytics and Marketing categories. Google then receives your IP address and technical browser data and may read or store its own cookies, under the Google privacy policy and Google cookie information. We do not send the page address as referrer information when loading the map.

We do not save your choice to enable the map between visits or pages. “Hide map” removes it from the page; this does not delete Google cookies or data already sent to Google. You need to enable the map again after reloading the page. Separate directions links to Google Maps and Apple Maps are also available without enabling the embedded map. Opening one of these links takes you to the chosen provider’s service, which operates under its own privacy policy.

9. Changes to this privacy policy

The Controller may update this privacy policy. The current version is always published on this page together with the date of the last update.