Last updated: 22 October 2026
This Privacy Policy explains how ERGOSTROM sp. z o.o. processes personal data of visitors to ergostrom.com and energy.ergostrom.com, of persons who contact us, and of representatives of our business partners. It is issued under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Controller
The controller of your personal data is ERGOSTROM spółka z ograniczoną odpowiedzialnością, ul. Bociania 31, 71-696 Szczecin, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under no. 0001206347, NIP (VAT ID) PL8513341101, REGON 54328736600000 (“ERGOSTROM”, “we”, “us”).
Contact on all privacy matters: biuro@ergostrom.com (subject: “Privacy”) or by post to the address above. We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR.
2. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Answering enquiries sent via the contact form, e-mail or phone | First and last name, e-mail, phone, company, position, message content | Art. 6(1)(b) – steps taken at your request before entering into a contract; Art. 6(1)(f) – our legitimate interest in replying to business correspondence | Until the matter is closed, then up to 3 years (limitation of claims) |
| Preparing and performing contracts with our clients and suppliers (contact persons of companies) | Name, business contact details, position, employer | Art. 6(1)(f) – legitimate interest in maintaining business relations with the entity you represent | Duration of cooperation + up to 6 years (limitation of claims, Art. 118 Polish Civil Code) |
| Counterparty verification (KYC), sanctions and export-control screening in commodity and steel trading | Name, position, nationality, company ownership and management data, documents supplied by counterparties | Art. 6(1)(c) – legal obligations under EU sanctions regulations and export-control law; Art. 6(1)(f) – legitimate interest in preventing fraud and unlawful transactions | 5 years after the end of the business relationship |
| Accounting and tax | Data appearing on invoices and accounting documents | Art. 6(1)(c) – Polish Accounting Act and tax laws | 5 years from the end of the tax year |
| Website operation and security (server logs) | IP address, date and time of request, browser type, pages visited | Art. 6(1)(f) – legitimate interest in ensuring security and availability of the website | Up to 90 days |
| Establishing, pursuing or defending legal claims | Data necessary for the claim | Art. 6(1)(f) – legitimate interest in protecting our rights | Until final conclusion of proceedings |
| Sending our business offers by e-mail | Name, e-mail, company | Your prior consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law) | Until consent is withdrawn |
3. Source of data
We collect data directly from you. Where you are a representative of a company, we may also receive your data from your employer or principal, or obtain it from public registers (e.g. business registers, sanctions lists) and your company’s website. In that case we process: name, position, business contact details and employer.
4. Is providing data mandatory?
Providing data is voluntary. Fields marked with * in the contact form are necessary to reply to you. Data required for KYC and sanctions screening is a condition of concluding a transaction with us.
5. Recipients
We disclose personal data only to the extent necessary, to:
- our hosting provider cyber_Folks S.A. (Poland) and e-mail provider cyber_Folks S.A. (Poland);
- IT, website maintenance and cookie-consent service providers;
- accounting, legal and audit advisers;
- logistics, inspection, insurance and banking institutions involved in a given transaction;
- our cooperation partners in the energy commodities business, including a partner company established in the United Arab Emirates, where this is necessary to handle your enquiry or transaction;
- Google Ireland Limited (with possible transfer to Google LLC, USA): only if you consent to displaying the map on our Contact page (Google Maps) or use the website language switcher, which sends the page content to Google Translate; in both cases Google receives your IP address and technical data of your device;
- public authorities, where required by law.
Service providers act as processors under data processing agreements (Art. 28 GDPR).
6. Transfers outside the European Economic Area
Your data may be transferred outside the EEA, in particular to the United Arab Emirates (in connection with energy commodity transactions) and to the United States (if a provider such as Google or Microsoft is used). We transfer data only with appropriate safeguards: an adequacy decision of the European Commission (e.g. for US entities certified under the EU-US Data Privacy Framework) or Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), supplemented where needed by additional measures. You may obtain a copy of the safeguards by writing to biuro@ergostrom.com.
7. Your rights
You have the right to:
- access your data and receive a copy (Art. 15);
- rectify inaccurate data (Art. 16);
- erasure (Art. 17) and restriction of processing (Art. 18);
- data portability, where processing is based on consent or contract and carried out by automated means (Art. 20);
- object at any time to processing based on our legitimate interest, including direct marketing (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3));
- lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the authority in your EU country of residence.
We respond within one month (extendable by two months in complex cases, Art. 12(3)).
8. Automated decision-making
We do not take decisions based solely on automated processing, including profiling, that produce legal effects for you (Art. 22).
9. Cookies
Information on cookies and similar technologies is set out in our Cookie Policy.
10. Security
We use appropriate technical and organisational measures, including TLS encryption of the website, access control and regular software updates.
11. Changes
We may update this Privacy Policy when our processing or the law changes. The current version is always published on this page with its date.