Legal information

    Privacy policy

    We explain what personal data we process, why, on what legal basis and for how long, who we share it with and what rights you have.

    • Effective from

    1. Data controller

    The controller of your personal data is Meterd spółka z ograniczoną odpowiedzialnością, Orzeszkowo 32A, 17-200 Orzeszkowo, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court in Białystok, 12th Commercial Division, under KRS number 0001159037, tax ID (NIP) 6030084737, REGON 541057580 (“Meterd”, “we”).

    You can contact us about personal data:

    We have not appointed a data protection officer. Please contact us directly about any matter concerning personal data.

    2. Scope of this policy

    This policy covers data processed when you use meterd.eu, contact us (form, email, phone, booking calls), sign up to our newsletter or enter our contests, and in our work with clients, subcontractors and partners and on Meterd's LinkedIn page.

    We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Polish Personal Data Protection Act of 10 May 2018 and the Polish Electronic Communications Law of 12 July 2024.

    Data we process when providing services to clients, including data from meters, building systems and our energy management platform, is processed under our contracts with those clients, including data processing agreements, which set out how it is handled.

    3. Purposes, legal bases and retention periods

    Below we describe each purpose for which we process data, with the data involved, the legal basis and how long we keep it.

    3.1. Answering an enquiry sent through the contact form

    Data
    Email address, phone number, the place on the site the form was sent from, and the language version of the site.
    Legal basis
    Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) or, if you contact us on behalf of a company or institution, Article 6(1)(f) GDPR (our legitimate interest in answering the enquiry).
    Retention period
    Until we have dealt with the enquiry, and then until any claims become time-barred, for no longer than 3 years.

    3.2. Email correspondence and phone calls

    Data
    The data given in the message or call, usually name, email address, phone number, company, job title and the content of the correspondence.
    Legal basis
    Article 6(1)(f) GDPR (conducting correspondence) and, where the contact concerns entering into or performing a contract, Article 6(1)(b) GDPR.
    Retention period
    For as long as the correspondence lasts, and then up to 3 years to document what was agreed.

    3.3. Booking online calls

    Data
    Name, email address, the chosen time slot and any information given when booking in the Cal.com calendar.
    Legal basis
    Article 6(1)(b) GDPR or Article 6(1)(f) GDPR (organising the meeting you ask for).
    Retention period
    Until the meeting takes place, and then up to 3 years if the call leads to further cooperation.

    3.4. Entering into and performing contracts with clients, subcontractors and partners

    Data
    Name, job title, business contact details, company details (including tax ID) and the information needed to deliver the project.
    Legal basis
    Article 6(1)(b) GDPR where you are a party to the contract (for example as a sole trader), and Article 6(1)(f) GDPR for people who represent a client or contractor or are named as contacts.
    Retention period
    For the duration of the contract, and then until claims become time-barred.

    3.5. Billing, accounting and tax obligations

    Data
    Data on invoices and other accounting documents.
    Legal basis
    Article 6(1)(c) GDPR in connection with the Polish Accounting Act and tax law.
    Retention period
    For the period required by law, as a rule 5 years from the end of the calendar year in which the tax payment deadline passed.

    3.6. Building business relationships and marketing our own services

    Data
    Name, job title, company name, business email address and phone number, and information about your professional profile. We may obtain this data from publicly available sources (company websites, public registers, LinkedIn) or from commercial business contact databases.
    Legal basis
    Article 6(1)(f) GDPR (direct marketing of our own services). We send commercial information by email or phone only where the law allows it, in particular once we have obtained any consent required.
    Retention period
    Until you object and, if the contact does not lead to cooperation, no longer than 3 years from the last contact.

    3.7. Newsletter

    Data
    Email address, language version of the site, date and time of sign-up and the wording of the consent you gave.
    Legal basis
    Your consent – Article 6(1)(a) GDPR in connection with Article 398 of the Polish Electronic Communications Law.
    Retention period
    Until you unsubscribe (withdraw consent); after that, a record of the consent and its withdrawal for 3 years, to show that we complied with the law (Article 6(1)(f) GDPR).

    3.8. The “Win a ticket for tonight” contest (Smart City Expo World Congress 2026)

    Data
    Email address, answer to the contest question, language version of the site and date and time of entry; from the winner and the authors of the reserve answers, also name, phone number, the identity document details required by the ticket issuer and the data needed to settle tax on the prize.
    Legal basis
    Article 6(1)(b) GDPR (taking part in the contest under its rules), Article 6(1)(c) GDPR (tax and accounting obligations related to the prize) and Article 6(1)(f) GDPR (handling complaints and establishing, pursuing or defending claims).
    Retention period
    Entrants' data – until the contest ends and complaints have been dealt with, no later than 31 December 2026; the winner's data – for the period required by tax and accounting law and until claims become time-barred.

    3.9. Keeping the site secure and working properly

    Data
    IP address, date and time of the visit, address of the page visited, browser and device type (server logs).
    Legal basis
    Article 6(1)(f) GDPR (keeping the site secure and running).
    Retention period
    For as long as the hosting provider keeps logs, no longer than 30 days.

    3.10. Visit statistics without cookies

    Data
    Aggregated information about visits: pages visited, referral source, country, and device, operating system and browser type. Vercel Web Analytics does not store cookies; it recognises a visitor within a single day using a hash that is deleted after 24 hours.
    Legal basis
    Article 6(1)(f) GDPR (measuring traffic and improving the site).
    Retention period
    Kept only as aggregated statistics that do not allow you to be identified.

    3.11. Analytics and marketing using cookies

    Data
    Cookie identifiers, IP address, information about your device and browser and about your activity on the site, collected by tools run through Google Tag Manager (for example Google Analytics).
    Legal basis
    Your consent – Article 6(1)(a) GDPR in connection with Article 399 of the Polish Electronic Communications Law.
    Retention period
    Until you withdraw consent or the cookie expires; data in Google Analytics – no longer than 14 months.

    3.12. Identifying companies that visit the site

    Data
    IP address, cookie identifiers and information about the pages visited, collected by the Leadsy (leadsy.ai) and Apollo.io tools. From this, the providers of these tools may identify the company a visit comes from or the visitor's professional profile.
    Legal basis
    Your consent to marketing cookies – Article 6(1)(a) GDPR in connection with Article 399 of the Polish Electronic Communications Law.
    Retention period
    Until you withdraw consent; information these tools pass to us – no longer than 12 months.

    3.13. Remembering your settings

    Data
    The language version you chose (saved in browser storage) and your cookie decision (saved by Cookiebot).
    Legal basis
    Article 6(1)(f) GDPR. Saving this information does not require consent because it is necessary to provide the service you are using (Article 399 of the Polish Electronic Communications Law).
    Retention period
    Language version – until you clear your browser data; cookie decision – 12 months.

    3.14. Running Meterd's LinkedIn page

    Data
    Data from your public profile, and reactions, comments and messages sent to our page.
    Legal basis
    Article 6(1)(f) GDPR (communicating and promoting our business). For page statistics (Page Insights), we are joint controllers with LinkedIn Ireland Unlimited Company.
    Retention period
    For as long as we run the page or until the content is deleted; LinkedIn also processes data on its platform under its own privacy policy.

    3.15. Establishing, pursuing or defending claims

    Data
    The data needed to show whether or not a claim exists.
    Legal basis
    Article 6(1)(f) GDPR (protecting our rights).
    Retention period
    Until claims become time-barred under the law, in particular the Polish Civil Code.

    4. Do you have to provide your data?

    Providing data is voluntary. However, without an email address and phone number we cannot answer an enquiry sent through the form, and without the data needed to conclude a contract we cannot conclude or perform it. Entering a contest requires an email address, an answer to the contest question and signing up to the newsletter, and the winner also provides the data needed to hand over the prize. Providing invoice data is a statutory requirement.

    5. Recipients of data

    Your data may be received by organisations that help us run our business. Those that process data on our behalf do so under data processing agreements (Article 28 GDPR) and only on our instructions.

    • Vercel Inc. (USA) – hosting the site and handling the contact and contest forms, visit statistics without cookies.
    • Resend (Plus Five Five, Inc., USA) – delivering messages from the contact and contest forms to our inbox and sending entry confirmations.
    • Google Ireland Limited and Google LLC – email and office tools (Google Workspace), Google Tag Manager and Google Analytics (with your consent), Google Fonts.
    • Cal.com, Inc. (USA) – the calendar for booking online calls.
    • Usercentrics A/S (Denmark) – the Cookiebot tool for managing cookie consent.
    • The providers of Leadsy (leadsy.ai) and Apollo.io (ZenLeads Inc., USA) – identifying companies that visit the site (with your consent to marketing cookies).
    • The issuer of the contest prize ticket (Futbol Club Barcelona, Spain) – only the winner's name and identity document details, if it needs them to issue or transfer the ticket; the issuer processes them as a separate controller.
    • LinkedIn Ireland Unlimited Company – the platform where we run our company page.
    • Our collaborators and advisers – our accounting firm, law firms, IT service providers and subcontractors working on projects with us, to the extent they need for their tasks.
    • Public authorities – only where the law requires us to share data.

    6. Transfers outside the European Economic Area

    Some of our providers (Vercel, Resend, Cal.com, Google LLC, Apollo.io) are based in the United States, so your data may be transferred outside the European Economic Area. This takes place on the basis of the European Commission's decision of 10 July 2023 on the adequate level of protection under the EU–U.S. Data Privacy Framework (for certified organisations) or on the basis of standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can obtain a copy of these safeguards by contacting us.

    7. Cookies and similar technologies

    Cookies are small text files saved on your device when you use the site. Browser storage (localStorage) works in a similar way. On the site we use:

    • necessary cookies, which remember your cookie decision and chosen language and keep the site secure; they do not require consent,
    • statistics cookies, which help us understand how you use the site (for example Google Analytics); we only run them with your consent,
    • marketing cookies, which measure the effectiveness of our marketing and identify companies that visit the site (for example Leadsy and Apollo.io); we only run them with your consent.

    On your first visit we ask for your consent with the Cookiebot banner. Until you give it, Google tools run in Consent Mode, with consent to analytics and advertising cookies switched off by default. A detailed list of cookies, their providers and retention periods is available in the cookie settings. You can change or withdraw your consent at any time:

    You can also delete or block cookies in your browser settings. Blocking necessary cookies may make the site harder to use.

    8. Your rights

    In connection with the processing of your personal data, you have the right to:

    • access your data and receive a copy of it (Article 15 GDPR).
    • have your data corrected if it is inaccurate or incomplete (Article 16 GDPR).
    • have your data erased (Article 17 GDPR).
    • restrict processing (Article 18 GDPR).
    • data portability for data we process by automated means on the basis of consent or a contract (Article 20 GDPR).
    • object to processing based on our legitimate interest (Article 21 GDPR); we always respect an objection to direct marketing.
    • withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
    • lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) if you believe we process your data unlawfully.

    To exercise these rights, write to contact@meterd.eu. We will reply without undue delay and no later than one month after receiving your request. In special cases we may extend this by a further two months, and we will let you know if we do.

    9. Automated decision-making

    We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Analytics and marketing tools may analyse how you use the site only with your consent.

    10. Data security

    We use technical and organisational measures appropriate to the risk, including an encrypted connection (HTTPS), access to data limited to the people who need it, and data processing agreements with our service providers.

    11. Changes to this policy

    We update this policy when the law, our services or the tools we use change. The current version is always available on this page, and the date it took effect is shown at the top. This policy is also published in Polish; if the two versions differ, the Polish version prevails.