Privacy Policy

This Privacy Policy sets out the rules for processing and protecting personal data of visitors to the voltimer.com.pl website, Clients, Contractors, Candidates, and other natural persons whose personal data may be processed by Voltimer Sp. z o.o. in connection with its business activity.

Processing takes place in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR);
• Polish Personal Data Protection Act of 10 May 2018;
• Polish Act on Electronic Services of 18 July 2002;
• Polish Telecommunications Law of 16 July 2004 (cookies).

§ 1. Data Controller

The controller of your personal data is:

§ 2. Data Protection Officer

Voltimer has appointed a Data Protection Officer (DPO) within the meaning of Art. 37 GDPR:

You may contact the DPO on all matters relating to the processing of personal data and the exercise of your rights under GDPR.

§ 3. Categories of personal data processed

3.1. Website visitors and contact form users

• identification data: full name, job title, company name;
• contact data: business email, phone number;
• content of messages sent via the contact form;
• technical data: IP address, browser type, operating system, visit date and time, pages visited;
• cookies and similar technologies (see § 9).

3.2. Clients and Contractors (including representatives and contact persons)

• company identification and registry data: name, Tax ID, Statistical ID, court registry, registered address;
• representatives' data: full name, job title, national ID if legally required;
• contact data: business email, phone number;
• financial data: bank account number, payment history;
• data relating to projects and assignments.

3.3. Job / collaboration candidates

• data in CV and cover letter (name, date of birth, contact details, education, work experience, qualifications);
• portfolio / reference data;
• interview notes.

3.4. Event, training, and webinar participants

• full name, company name, job title;
• email, phone number;
• invoicing data (for paid events);
• dietary preferences and special needs (only if voluntarily provided).

§ 4. Purposes, legal bases, and retention periods

Purpose	Legal basis (GDPR)	Retention period
Responding to inquiries, preparing offers	Art. 6(1)(b) (pre-contractual steps) Art. 6(1)(f) (legitimate interest)	Up to 12 months from last contact, unless cooperation is established
Performance of a service agreement	Art. 6(1)(b)	Until end of contract
Accounting, tax, bookkeeping	Art. 6(1)(c) (legal obligation)	5 years from end of tax year
Claims assertion / defence	Art. 6(1)(f)	Until applicable limitation period expires (typically 3-6 years under Polish Civil Code)
Direct marketing (newsletter, invitations)	Art. 6(1)(a) (consent) Art. 6(1)(f)	Until consent is withdrawn / objection raised
Current recruitment process	Art. 6(1)(b), (c); Art. 9(2)(b)	Until end of recruitment + 6 months
Future recruitments (with consent)	Art. 6(1)(a)	24 months from consent
Website analytics and optimisation	Art. 6(1)(f)	Up to 26 months (analytics cookies)
IT security and fraud detection	Art. 6(1)(f)	Up to 12 months

§ 5. Recipients of data

Your personal data may be disclosed to or entrusted to the following categories of recipients:

• IT and cloud providers — Microsoft Ireland Operations Ltd. (SharePoint, Microsoft 365, Teams, Exchange), website hosting and email providers;
• Accounting firms and tax advisors — for bookkeeping and tax;
• Law firms — for legal representation including dispute handling;
• Banks and financial institutions — for payments and settlements;
• Project subcontractors — strictly to the extent necessary for client service, under a data processing agreement;
• Analytics and marketing tool providers — Google LLC (Google Analytics), LinkedIn Corporation;
• Public authorities — where a legal obligation applies (Polish Social Insurance Institution, Tax Office, UODO, courts).

All recipients are bound by confidentiality and appropriate security measures. Data processing agreements under Art. 28 GDPR are concluded with processors.

§ 6. Transfers outside the European Economic Area (EEA)

Due to the use of international service providers (Microsoft, Google, LinkedIn), your data may be transferred outside the EEA, in particular to the United States. In such cases we apply GDPR-compliant safeguards:

• Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914/EU);
• Provider certification under the EU-U.S. Data Privacy Framework (European Commission decision of 10 July 2023);
• Additional technical and organisational measures (encryption, pseudonymisation).

A copy of the safeguards applied is available upon request to the DPO.

§ 7. Your rights

Under GDPR, you have the following rights:

1. Right of access (Art. 15) — to confirm whether and what data we process and receive a copy;
2. Right to rectification (Art. 16) — if data is inaccurate or incomplete;
3. Right to erasure ("right to be forgotten") (Art. 17);
4. Right to restriction of processing (Art. 18);
5. Right to data portability (Art. 20) — for consent- or contract-based automated processing;
6. Right to object (Art. 21) — especially against legitimate-interest and direct-marketing processing;
7. Right to withdraw consent (Art. 7(3)) — at any time, without affecting prior lawful processing;
8. Right not to be subject to automated decisions (Art. 22) — Voltimer does not apply such decisions with legal effects;
9. Right to lodge a complaint with the supervisory authority — President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

To exercise these rights, please contact the DPO at m.dampc@voltimer.com.pl. We will respond without undue delay, no later than within 30 days (with possible 60-day extension in justified cases — we will notify you).

§ 8. Obligation to provide data

Providing personal data is voluntary but may be necessary to:

• respond to your contact form inquiry;
• conclude and perform a contract;
• participate in a recruitment process;
• issue an invoice.

In these cases, failure to provide data prevents the relevant purpose from being fulfilled.

§ 9. Cookies and tracking technologies

9.1. What cookies are

Cookies are small text files stored on your device (computer, tablet, smartphone) by the websites you visit.

9.2. Types of cookies used

Category	Purpose	Basis / Duration
Essential	Ensure website functionality (sessions, security)	No consent required · Session or up to 30 days
Analytics	Traffic and behaviour analysis (Google Analytics)	Consent required · Up to 26 months
Functional	Remembering preferences (e.g. language)	Consent required · Up to 12 months
Marketing	Remarketing, ad targeting (LinkedIn Insight, Meta Pixel)	Consent required · Up to 12 months

9.3. Managing cookies

You can change cookie settings in your browser or block them at any time. Blocking essential cookies may impair website functionality. Instructions for the most popular browsers:

• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Safari

§ 10. Profiling and automated decision-making

Voltimer does not make decisions with legal or similarly significant effects based solely on automated processing, including profiling (Art. 22 GDPR).

We use limited profiling for analytics and marketing (e.g. newsletter segmentation), which does not produce legal effects.

§ 11. Data security

Voltimer applies appropriate technical and organisational measures, including:

• encryption in transit (SSL/TLS);
• encryption at rest (Microsoft 365 E3/E5);
• role-based access control (RBAC) and least-privilege principle;
• multi-factor authentication (MFA) for all business accounts;
• regular backups and recovery procedures;
• information security policies and regular staff training;
• record of processing activities (Art. 30 GDPR);
• data processing agreements (Art. 28 GDPR) with subprocessors;
• breach notification procedure to UODO within 72 hours (Art. 33 GDPR).

§ 12. Reporting data breaches

If you suspect a breach of your data protection rights, please contact the DPO immediately at m.dampc@voltimer.com.pl.

Every report is treated as a priority and registered in the internal breach register. Breaches under Art. 33 GDPR are reported to the Polish DPA within 72 hours and — in justified cases — affected data subjects are notified (Art. 34 GDPR).

§ 13. Changes to this Privacy Policy

Voltimer reserves the right to update this Privacy Policy. Any material change will be communicated by publishing the updated version on voltimer.com.pl and — in justified cases — directly to affected data subjects.

Version history:

• Version 2.0 (19.04.2026) — DPO appointment, extended EEA transfer information, processing purpose table, detailed cookie information;
• Version 1.0 (17.04.2026) — initial publication.

§ 14. Contact