PRIVACY POLICY

JOINT CONTROLLERS

For the joint operation of the NEXIVO Platform and for processes in which both entities jointly determine the purposes and essential means of processing, the joint controllers of personal data of Users are:

• Marek Kupaj conducting business under the name Nivato Marek Kupaj, Stara Kakawa 65, 62-872 Godziesze Małe, NIP 9681000625, REGON 388436395.
• Nivato spółka z ograniczoną odpowiedzialnością (limited liability company), with its registered office in Stara Kakawa, Stara Kakawa 65, 62-872 Godziesze Małe, KRS 0001138219, NIP 9681014159, REGON 540177631.

In the rest of this document, “Controller” means, depending on the process, the relevant controller or the Joint Controllers acting together.

How to contact the Joint Controllers

• postal address: Stara Kakawa 65, 62-872 Godziesze Małe;
• email: biuro@nivato.pl;
• joint contact point for personal data protection matters: rodo@nivato.pl.

A data subject may exercise their rights against either Joint Controller, regardless of the joint contact point.

Essential content of the Joint Controllers arrangement

• Joint controllership covers those NEXIVO Platform processes in which both entities actually decide together why and how data are processed. This may in particular concern the joint operation and development of the Platform, its security, communication with Users and other activities carried out jointly.
• If a process is carried out independently by one of the entities, that entity acts as a separate controller. This applies in particular to its own contracts, settlements and legal obligations. Nivato Marek Kupaj is the service provider, the party to contracts with direct B2B and B2C customers, the recipient of payments and the issuer of invoices, and the controller of data processed for those own purposes.
• In the partner model, Nivato Marek Kupaj contracts with the Partner and makes the Platform available to the Partner, while the Partner contracts with its own customers. If a Partner or its customer enters into the Platform personal data of its employees, collaborators, customers or other persons and itself decides the purpose of using those data, it remains the controller of those data, and Nivato may process them on its instructions as a processor, under Article 28 GDPR and the relevant data-processing agreement.
• The Joint Controller that obtains the data provides access to the appropriate processing information, and the Joint Controllers cooperate in exercising data-subject rights and in handling any personal data breaches.

SCOPE OF PERSONAL DATA PROCESSED

The Controller processes personal data of Users:

• relating to use of the Platform and its security, including the IP address, device and browser information, session and security-event data, and settings stored in cookies, local storage or session storage;
• provided when creating and maintaining an account and using a workspace, in particular first name and surname, email address, telephone number, avatar, organisation or workspace data, role and permissions, invitation information, and data related to sign-in, account recovery and additional account-security methods. If the User chooses Google or Facebook sign-in or additional account security, the data necessary to operate those functions are also processed (for example a link to an external account or TOTP/WebAuthn settings);
• provided or created in connection with use of the Controller services, conclusion and performance of contracts, subscriptions, orders, payments, invoicing, complaints and technical support, including buyer data, address and billing data, NIP (tax identification number), information on the selected plan, order and payment, and transaction identifiers. When a payment is initiated, the IP address may be passed to the payment operator; full payment-card data are handled by the operator and are not stored by the Platform;
• related to use of Platform functions for managing installations and energy data, including data on installations, measurements, forecasts and schedules, and data entered into the Platform by Partners or their customers. That information is personal data only when it relates to an identified or identifiable natural person.

The scope of data processed depends on which Platform functions the User uses, what role the User has, and whether the User uses the Platform directly or in the partner model. Not every category described applies to every User.

Data may come directly from the User, from a person managing the workspace or sending an invitation, from a Partner in the partner model, from an external sign-in provider if the User chooses that method, and from the payment operator as regards the course and status of a transaction.

The Controller applies organisational and technical measures appropriate to the risk. They include in particular an encrypted connection to the Platform, access control and User roles, email verification, password rules, the option to use additional sign-in security methods, management of active sessions, control of uploaded files, and technical logs available to authorised persons to the extent necessary to maintain and secure the Platform.

PURPOSE AND LEGAL BASIS OF PROCESSING

Personal data of the User will be processed by the Controller for the following purposes:

• performance of a contract or steps prior to entering into a contract, in particular creating and maintaining an account, enabling sign-in and use of the Platform and workspace, handling invitations, subscriptions, orders, payments, complaints, technical support and Platform functions related to installations and energy data (Article 6(1)(b) GDPR);
• compliance with legal obligations imposed on the Controller, in particular tax, accounting and consumer-law obligations, obligations related to issuing and storing invoices, and handling complaints (Article 6(1)(c) GDPR);
• the legitimate interests of the Controller, in particular ensuring the security and proper operation of the Platform, preventing abuse, keeping necessary technical logs and diagnostics, handling correspondence and reports, managing invitations and permissions of persons acting for customers, and establishing, pursuing or defending claims (Article 6(1)(f) GDPR).

If activities that require consent are introduced, such as a newsletter, marketing contact or optional analytics or marketing technologies, data will be processed on the basis of consent of the User (Article 6(1)(a) GDPR), to the extent stated when consent is given.

Sending commercial information, including direct marketing using telecommunications terminal equipment, also requires prior consent under Article 398 of the Act of 12 July 2024 — the Electronic Communications Law. Storing information, or gaining access to information stored, on the device of the User requires consent under Article 399 of that Act, except in the cases indicated in that provision. The scope and purpose of consent are stated in the consent itself.

In the partner model, Nivato may also process data entered into the Platform by a Partner or its customer as a processor. This applies where the Partner or its customer itself determines the purposes of using those data, and Nivato processes them only on documented instructions, in accordance with Article 28 GDPR and the relevant data-processing agreement.

DATA RETENTION

How long personal data of the User are processed depends on the purpose and the legal basis. That period is:

• the period for which consent was given or, if consent was not given for a fixed period, until it is withdrawn or the purpose for which it was given ceases;
• the time needed to perform the contract, in particular the period of holding an account and using the Platform, the subscription term, fulfilment of orders and payments, handling of complaints and technical support, and use of Platform functions related to installations and energy data, and then the period necessary to settle the contract;
• the period required by law for keeping particular records or for complying with legal obligations imposed on the Controller, in particular tax and accounting obligations;
• the period necessary for the legitimate interests of the Controller, including recording and demonstrating the course of correspondence and establishing, pursuing or defending claims, taking account of limitation periods, or until an effective objection is made where an objection applies;

and also:

• for cookies, local storage, session storage and similar technologies — the period resulting from their function and settings, and no longer than needed for that function or until the identifier expires. Necessary technologies may be used for as long as required for the Platform to operate properly and securely;
• for data related to a workspace and to Platform functions concerning installations and energy data — as a rule until the workspace is deleted or the contract ends, subject to data that must be kept further under the law or for settlements or protection of claims; invitations are kept until they are accepted, rejected, cancelled or expire, and data linking an external sign-in account (OAuth) are kept until that account is disconnected;
• for an Account whose email address is not verified within 24 hours of registration — until that deadline; after it passes, the Account and the data provided at registration are deleted automatically;
• for technical logs, including IP addresses and technical request data recorded to ensure proper operation and security of the Platform — for up to 2 years;
• for data held in backups — for up to 30 days from creation of the given backup.

After the relevant period, data are deleted or anonymised, unless further storage is required by law or needed for settlements or protection of claims. Deletion of an account covers, as a rule, the profile, connections to external sign-in accounts, security data, active sessions and workspace memberships. Order, payment and invoice records may be kept longer if the law or settlements require it. Deleting a workspace, as a rule, deletes operational data for that workspace, but does not automatically delete the accounts of Users assigned to it.

DISCLOSURE OF PERSONAL DATA OF USERS

We may disclose personal data of Users to:

• entities providing hosting, infrastructure, email and technical and IT support for the Platform, in particular OVH and cyber_Folks;
• providers of services used in selected Platform functions, including Google and Meta/Facebook if the User chooses sign-in through the relevant external account, and OpenStreetMap / Nominatim for maps and geocoding;
• payment operators, in particular PayU S.A. and the relevant entity in the Stripe group, and banks and other entities involved in processing payments. PayU S.A. also processes personal data provided in connection with a payment as a separate controller, to the extent resulting from the payment services it provides and the legal obligations that apply to it. The relevant entity in the Stripe group may act as a separate controller to the extent it independently determines the purposes and means of processing data related to payments;
• providers of invoicing and settlement systems, in particular Insert Subiekt Nexo, and the National e-Invoicing System (KSeF);
• energy operators Energa, PGE and Tauron — if the User uses Platform functions that require forecasts or other operational data to be passed to an energy operator — and Nivato sp. z o.o. to the extent it takes part in operating or developing the Platform and has an appropriate basis for access to the data;
• entities providing accounting, legal, audit or advisory services, and entities or authorities entitled by law to obtain data of the User, and entities to which disclosure is necessary to protect the rights of the Controller or third parties, including pursuing or defending claims.

If an external provider handles a process carried out jointly by both Joint Controllers, the relevant processing arrangements cover both Joint Controllers. If it handles a process carried out independently by one entity, it acts for the controller responsible for that process.

Because global cloud, communication, authentication or payment services are used, data of the User may be transferred outside the European Economic Area. The Controller verifies the transfer basis in each case and applies the mechanisms required by Chapter V GDPR, in particular an adequacy decision, including the EU-US Data Privacy Framework for certified recipients, or the European Commission standard contractual clauses together with supplementary safeguards where needed. Further information on the safeguards used, including how to obtain a copy, is available by contacting the Controller.

REFUSAL TO PROVIDE PERSONAL DATA

Providing personal data is voluntary, but some data are necessary to create and maintain an account, conclude or perform a contract, use particular Platform functions, carry out a subscription, order or payment, issue an invoice, or handle a complaint or technical support. Without those data, that purpose may be impossible to achieve. Refusal of consent for any future optional technologies, a newsletter or marketing contact will not affect the ability to use the basic functions of the Platform.

WITHDRAWAL OF CONSENT

The User may withdraw consent to the processing of personal data at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. After withdrawal, the Controller will not further process the data for purposes that require consent, unless another legal basis applies. Consent may be withdrawn by email or post to the Controller, by using the unsubscribe mechanism in a marketing message, or by changing settings in the consent panel, depending on the type of consent given.

RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA

In connection with the processing of data of the User, the User has the rights listed below, to the extent and on the terms set out in the GDPR. They can be exercised using the contact routes indicated in this document. They are:

• the right of access to the data and to receive a copy (Article 15 GDPR);
• the right to rectify or complete personal data (Article 16 GDPR);
• the right to erasure of personal data where the GDPR conditions are met (Article 17 GDPR);
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability to another controller, in the cases set out in Article 20 GDPR;
• the right to object to processing:
  • on grounds relating to the particular situation of the User — against processing of personal data based on Article 6(1)(f) GDPR, including profiling based on that provision (Article 21(1) GDPR);
  • at any time — if personal data are processed for direct marketing, including profiling, to the extent the processing is related to such marketing (Article 21(2) GDPR).

To exercise these rights, contact the Controller. For matters covered by joint controllership, the rights may be exercised against either Joint Controller. The address rodo@nivato.pl has been set up to make contact easier.

If the User believes that their data are processed unlawfully, they may lodge a complaint with the President of the Personal Data Protection Office.

COOKIES AND SIMILAR TECHNOLOGIES

The Platform uses cookies and similar technologies, including local storage and session storage.

The Platform may use:

• necessary cookies — used for sign-in, maintaining a secure session, proper operation of the Platform and handling the workspace;
• functional cookies — used to remember User settings and how the interface is displayed, and to support selected functions;
• analytics and statistics cookies — not currently used by the Platform;
• marketing cookies — not currently used by the Platform.

For clarity, the technical names of the main cookies are also given below. “auth_sid” handles the sign-in session, “NIVATO_LOCALE” remembers the selected language version, “SESSION-AUTH” and “SESSION-GATEWAY” maintain the User session, “sidebar_state” remembers the side-menu setting, and “wct” supports technical handling of the session or workspace.

The Platform may also store in the browser (local storage or session storage) information needed for selected functions, for example the theme preference, information needed to handle an invitation or external-account sign-in, and the technical state of notifications and the interface. Those data are technical or functional and are used only to the extent needed for the given function or to maintain a secure session.

Necessary cookies and similar technologies may be used without consent of the User. Other cookies and similar technologies are used after consent is obtained where the applicable law requires consent, unless the technology is necessary to provide a service expressly requested by the User.

The Platform does not currently use external analytics tools, advertising tags or marketing pixels. Consents for analytics or marketing are therefore not currently used. If optional technologies are introduced in the future, they will be enabled only after the required consent, and the User will be able to change that choice or withdraw consent later.

When selected functions are used, the Platform may connect to third-party services, in particular Google or Meta/Facebook for external sign-in and OpenStreetMap / Nominatim for maps or geocoding. The data passed depend on the function chosen by the User and on the settings of that provider.

The current lifetime of the main cookies is: “auth_sid” — up to 1 year, “NIVATO_LOCALE” — up to 1 year, “SESSION-AUTH” and “SESSION-GATEWAY” — up to 7 days, “sidebar_state” — up to 7 days, “wct” — up to 7 days. Data stored in local storage or session storage are kept until the given operation ends, their function expires, or they are deleted in line with how the Platform works.

Cookies may be session cookies or persistent cookies. The User can also manage them in the browser settings. Restricting necessary cookies may affect proper operation of the Platform.

If information obtained through cookies or similar technologies is personal data, it is processed in accordance with this Privacy Policy.

PROFILING

The Controller does not currently use data of Users for marketing profiling. Some Platform functions may use models to prepare forecasts related to energy processes. They are not used to evaluate the User or to take decisions about the rights or personal situation of the User.

The Controller does not take decisions based solely on automated processing that would produce legal effects concerning Users or similarly significantly affect them.

If profiling based on consent of the User is introduced in the future, the User will be able to withdraw that consent at any time in the manner indicated when it is given.

CHANGES TO THE POLICY

The Policy may be updated if the way the Platform works changes, or if joint controllership, the functions or technologies used, suppliers, retention periods or the law change. The current version is published in the Platform and at nivato.app. Changing the language version of the Platform does not change who the controller or Joint Controllers are.