PRIVACY

September 24, 2025

This document sets out the rules and basic information on the processing of personal data by KENO Sp. z o.o. with its registered office in Gliwice, in particular the data of Customers and other persons interested in KENO’s offer, via the website available at: https://www.keno-energy.com/, B2B platform available at: https://b2b.keno-energy.com/, as well as a mobile application called ‘MyKENO’ (available for download on Google Play and AppStore) offering functionalities analogous to the abovementioned B2B platform.

This document is of a general nature. If you have received any other information clause from KENO regarding the processing of your data, the information contained in this clause will take precedence over the provisions of this policy. This is particularly important because, due to the wide range of activities of KENO, your data may be processed in specific cases for reasons and purposes other than those set out in this policy. However, if you have not received any further document from KENO regarding the processing of personal data, the provisions of this policy should be considered binding in their entirety and constitute the sole and complete information about the processing of data by KENO.

In this document you will find the following information about the processing of your data by KENO:

  1. who is the controller of your data – including contact details;
  2. who you can contact in case of questions or requests regarding the data being processed and who is responsible at KENO for ensuring the lawfulness of data processing, i.e. the identity and contact details of KENO’s Data Protection Officer;
  3. for what purposes KENO may process your data and on what legal basis, as well as whether you are obliged to provide certain types of data and, if so, whether this is a legal requirement or whether it is necessary for the conclusion of a contract between you and KENO;
  4. to whom KENO may transfer your personal data and for what purpose;
  5. whether KENO intends to transfer your data to countries outside the European Economic Area or to international organisations;
  6. for how long KENO may process your data and, if it is not possible to determine it precisely – on what basis KENO will determine this period;
  7. what rights you have in connection with the processing of your personal data by KENO;
  8. whether your data will be subject to automated decision-making, and if so, to what extent and on what basis.

In this document, you will also find information about the processing of your data in connection with the recording of telephone calls on the KENO hotline. To this end, we recommend that you familiarize yourself in particular with § 10a, as well as with general information on the identity of the data controller, the contact details of the data protection officer, as well as with the definitions of terms used in this document, contained in § 1 – § 3.

§1. MEANING OF TERMS USED

In order to improve the readability of this document and to ensure that some of the terms used herein are understandable, we state that the following capitalized terms should be understood as follows:

  1. KENO (or Administrator) – KENO limited liability company with its registered office in Gliwice, at 609 Ignacego Daszyńskiego Street, 44-151 Gliwice, registered in the Register of Entrepreneurs maintained by the District Court in Gliwice, X Commercial Division of the National Court Register under KRS number 0000688578, using NIP: 6312671983 and ID No.: 36787086300000, with a registered capital of PLN 200,000.00.
  2. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). The basic European legal act on the protection of personal data.
  3. User – each of you, if you use KENO services, in particular through the Website or the B2B Platform.
  4. Website – a website available at: https://www.keno-energy.com/ that contains basic information about KENO and the offer.
  5. B2B platform – an online sales platform available at: https://b2b.keno-energy.com/, which allows registered users to place orders for goods offered by KENO.
  6. Application – a mobile application under the name “MyKENO”, available for download to mobile devices from Google Play and AppStore, with functionality analogous to the B2B Platform, i.e. enabling registered Users to order goods offered by KENO
  7. Third countries – countries that are not members of the European Economic Area.
  8. AI Chat – a chat based on artificial intelligence technology, which is available to you on our website.

Terms that are not included in the above list should be given a meaning in accordance with the general rules of the Polish language. We assure you that we have made every effort to make this document as readable and understandable as possible for you.

If we refer to “us” or refer to ourselves as “we” in this document, then in this case we are referring to KENO – i.e. the controller.

Unless expressly stated otherwise herein, if we refer to the functionality of the B2B Platform and the processing of your data in connection with the use of this platform, we also mean the functionality of the App and the processing of your data during the use of the App.

§ 2. PERSONAL DATA, PROCESSING OF PERSONAL DATA – DEFINITIONS

Your personal data should be considered to be any information, and in particular a set of information about you, which allows you to be individually identified as an individual, an individual, a specific person. The term ‘personal data’ should therefore be understood as any information relating to an identified or identifiable natural person. It should therefore be emphasized that personal data is information only about natural persons, however, if you represent a company or other organization, KENO will continue to process personal data, but only to the extent of the information that directly relates to you as a natural person – representatives or employees of these companies or organizations.

By data processing , we mean virtually all operations that we may perform with your personal data. This term covers practically everything that can be done with your data from the moment of its collection to its deletion, including these operations. Therefore, data processing will also include the mere storage of data in databases or archives, their organization, transfer, modification, updating, use for business purposes, combining them into databases, pseudonymization, anonymization or copying.

§ 3. GENERAL INFORMATION – CONTROLLER AND DATA PROTECTION OFFICER

Data Controller

KENO is the controller of your personal data processed in connection with the provision of services offered on the Website and the B2B Platform, as well as any other activities carried out in connection with the above-mentioned services. You can get direct contact with the administrator through the following contact points:

  1. E-mail address: biuro@keno-energy.com,
  2. Phone number: +48 32 341 71 71,
  3. Registered office address: KENO Sp. z o.o., Ignacego Daszyńskiego 609, 44-151 Gliwice.

Data Protection Officer

We would like to inform you that we have appointed a Data Protection Officer to whom you can contact in case of any questions or requests related to the processing of your data. The Data Protection Officer at KENO is Mr. Kamil Stępor, whom you can contact:

  1. Email address: prawny@keno-energy.com,
  2. Phone number: +48 603 640 013,
  3. Correspondence address: KENO Sp. z o.o., Ignacego Daszyńskiego 609, 44-151 Gliwice, with the note: “Data Protection Officer” or “Personal Data Protection”.

Contact with the controller or data protection officer

We recommend that any questions or requests regarding the processing of your personal data by KENO be addressed directly to the Data Protection Officer using one of the above contact methods. At the same time, we emphasize that any form of contact with us is equivalent and – unless we expressly state otherwise in this document or when contacting us – the choice of such form is yours and we will not consider any of these forms to be a priority when dealing with matters. We will also consider questions or requests regarding the processing of personal data that are not addressed directly to the Data Protection Officer under the same conditions and with the same care as in the case of contacting the Data Protection Officer directly. In addition, we accept the principle that we answer in the same form in which the question was asked. For example, if you contact us by e-mail, we will respond to you in the same way to the e-mail address from which you asked for your enquiry or requested, unless the law requires us to respond in another form (e.g. in writing).

§ 4. SOURCE OF PERSONAL DATA COLLECTION

You are the main source of origin of the data we process. The personal data we process therefore comes directly from the data subjects. Personal data is collected in particular when you – the user:

  1. They voluntarily enter them into forms made available by KENO (e.g. registration forms or application forms);
  2. Join or register for webinars, seminars and training courses organised by KENO or its suppliers;
  3. use a B2B platform or application;
  4. Place orders or purchase products and services offered by KENO;
  5. Contact KENO customer service: by phone, mail, email, B2B platform or app;
  6. They provide data for the purpose of consent to receive marketing information, newsletters or other content addressed directly to KENO.
  7. They use the AI Chat feature that is available on the website.

Cookies and similar cookies and tools

If you use the Website or B2B Platform, we will further collect your data through cookies. We have included detailed rules regarding the collection of cookies by us in a separate document, which can be found at the following address: https://www.keno-energy.com/KENO cookies.pdf File Policy.

At the same time, we would like to inform you that our Website, B2B Platform and Application use Google Analytics, Pixel Facebook and LinkedIn Insight Tag and the like, i.e. codes that collect website navigation data. The above information will only be used for marketing purposes.

§ 5. VOLUNTARY PROVISION OF DATA

The provision of the data we request (e.g. in forms) is in principle voluntary for you in the sense that it does not arise from any legal obligation to which you are subject. However, we reserve the right to ensure that your personal data is necessary for us to properly provide the services we offer to you, or to deliver the goods you have ordered, or for other purposes related to or arising from the services we provide. This means that your refusal to provide data will be fully respected by us, but may result in us refusing to provide you with services.

However, should a situation arise where the provision of data is mandatory on your part, we will clearly inform you of this before collecting this data and in any event at the latest at the time of collection.

§6. PURPOSES AND REASONS FOR DATA PROCESSING

We will only process your data if we have a compelling legal basis for such processing. We process all information about you for a specific, specified purpose. If all the legal grounds for processing information about you cease to exist, or if all the purposes for which we did so are fulfilled, or for any reason their implementation becomes impossible or disproportionate – we undertake to delete your data in this regard or anonymize them in such a way that it cannot be concluded that they concern you. We emphasize that data anonymization is an irreversible process.

Documents for data processing

We may process your personal data for the following reasons:

  1. If we need this data for the performance or conclusion of a contract with you (Art. 6 (1) (b) GDPR). This contract may relate to both the sale of the goods offered by us and the provision of the services offered by us, including in particular the organization of training, or even the maintenance of your profile on the B2B Platform or in the Application itself. On this basis, however, we can only process your data if you are personally a party to this contract (e.g. as a sole trader or training participants). If you are merely an agent or employee of a company or organisation that is party to such an agreement – this basis does not apply. In the table below, this basis is listed as “PERFORMANCE OF THE CONTRACT”.
  2. If we are required by generally applicable law to process personal data, or if the fulfilment of such an obligation involves the need for us to process personal data (Article 6(1)(c) of the GDPR). In the table below, this basis is listed as “LEGAL OBLIGATION”.
  3. Consent to the processing of personal data (Art. 6 (1) (a) GDPR) – which you have given us if we have expressly requested it or on your own initiative. Your consent will only be effective if it is expressed in a voluntary, informed, specific and unambiguous manner. Where we ask for your consent and prepare a declaration of consent for you (e.g. in the form of a checkbox on the website), we will make every effort to ensure that the content of the declaration of consent provides you with all the necessary information so that you can give your consent knowingly, specifically and unambiguously. In addition, we do not normally use the practice of ticking boxes or inserting consents regarding the processing of personal data into the content of documents submitted to you, so any consent you give is made knowingly. If you have given your consent to the processing of your data, you can withdraw it at any time by contacting the Data Protection Officer using one of the contact methods specified in § 3 of this document. Rest assured that withdrawing consent will be as simple as granting it. In the table below, this basis is listed as “CONSENT”.
  4. If we have a legitimate interest in processing your data (Art. 6 (1) (f) GDPR). Our interest may include, but is not limited to, the need to defend or enforce claims arising out of or in connection with the services we provide, to respond to and implement your complaints and requests, to keep an archive, to send you marketing content related to our own services, or to present you with certain other services (e.g., other ways to fund your purchases on our B2B platform). In any case, if we rely on this basis to process your data, you have the right to object to the processing of your data. A catalogue of situations in which we process your data on the basis of our legitimate interest is set out below, in the “Legitimate interests” section. In the table below, this basis is listed as “LEGITIMATE INTEREST”.

Purposes of data processing

The table below sets out the purposes for which we process the data, a brief description of the possible steps we may take to carry it out and their legal basis.

PURPOSE SPECIAL OFFER LEGAL BASIS
Account management on the B2B Platform or in the Application
  • Collection of data provided by the user in the registration form
  • Verification of the data provided
  • Storing the User’s data in the user database of the B2B Platform and the Application
  • Fulfilment of obligations related to the provision of services by electronic means
  • Deleting data
PERFORMANCE OF THE CONTRACT, LEGAL OBLIGATION, CONSENT
Training
  • Collection of data provided by the user in the registration form
  • Issuing certificates and certificates of participation in training
  • Informing the Office of Technical Inspection about the training carried out and its participants (in the case of training for a certified plumber)
  • Archiving data on completed trainings and their participants
  • Deleting data
PERFORMANCE OF THE CONTRACT, LEGAL OBLIGATION, CONSENT
Sales and distribution
  • Identification of the person who placed the order
  • Verification of the financial capacity of a potential counterparty
  • Compliance with tax obligations related to trade in goods and services
  • Performing sales analytics and statistics
  • Sending the goods to the specified address
  • Deleting data
PERFORMANCE OF A CONTRACT, LEGAL OBLIGATION, LEGITIMATE INTEREST
Creating projects
  • Identification of the person who placed the order
  • Order fulfillment
  • Collection of technical information and determination of the Client’s preferences
  • Deleting data
PERFORMANCE OF THE CONTRACT
Defence and assertion of claims
  • Using personal data stored in our collections, reorganizing, organizing and adapting them for processing purposes
  • Defending against potential claims by data subjects
  • Asserting claims against data subjects
  • Deleting data
LEGITIMATE INTEREST
Handling of complaints
  • Collection of data contained in a complaint report or otherwise when a complaint is submitted
  • Identification of the person filing the complaint
  • Analysis of the data retained for the purpose of proper assessment of the complaint lodged
  • Deleting data
PERFORMANCE OF A CONTRACT, LEGAL OBLIGATION, LEGITIMATE INTEREST
Answers to questions
  • Collection of data provided in the contact form or otherwise when you ask a question
  • Identify the sender of the query
  • Analysis of the data retained in order to provide a correct and satisfactory answer to the question posed
  • Deleting data
PERFORMANCE OF THE CONTRACT, CONSENT, LEGITIMATE INTEREST
Marketing
  • Collection of marketing consents together with the contact details provided in the consent statement
  • Send marketing content to designated recipients
  • Deleting data
CONSENT, LEGITIMATE INTEREST

Legitimate interests

Since we sometimes rely on our legitimate interest to determine the reasons for processing your personal data, we explain in the table below what this interest consists of in each case.

sales

complaints

PURPOSE/ACTIVITY OF PROCESSING DESCRIPTION OF LEGITIMATE INTEREST
Sales and distribution – verification of the financial capacity of a potential supplier In some cases (e.g. if you express your will to purchase goods in KENO with a deferred due date), our decision to enter into cooperation on the terms and conditions proposed by you may depend on the verification of the financial capacity of the entity you represent. This verification may include the processing of your personal data, in particular if you are acting personally, on your own account, as a sole trader. The provision of certain payment and financial methods may require you to provide information about your business (and therefore personal data about you) to KENO’s contractual partners, who are providers of individual payment solutions offered on the B2B Platform or in the App, in order to verify your financial data.
Sales and distribution – execution of We may use your personal data to perform sales analyses and statistics. The aim of this activity is to constantly increase the attractiveness of our offer and adapt it to the current economic situation and your expectations. We want our offerings to meet your expectations and needs as much as possible, but this requires us to use the information we have about you.
Defence and assertion of claims We will need to process your personal data if you make a claim against us or if we are the one exercising any rights against you. In the event that you make a claim against us – the processing of data will be necessary for us to respond to your requests and present our opinion on them. In the event that we are the ones exercising our rights against you, the processing of personal data will be necessary to precisely determine our request.
Handling of Although we are obliged to assess complaints primarily by generally binding legal regulations, but also by the contract concluded between you and us, it is also in our interest to deal with them. For this reason, we distinguish our legitimate interest as one of the bases that allows us to process your data when handling complaints.
Answers to questions The basis for processing your personal data in order to be able to answer the questions asked depends to a large extent on what the inquiry is about. Regardless, it is also in our interest to provide an answer, which lies in the desire to build the image of our company as a company open to dialogue with its customers, willing to explain any inaccuracies to them. For this reason, we distinguish our legitimate interest as one of the bases that allows us to process your data when answering queries.
Marketing We accept the policy of not sending you advertising content without your consent. However, some communications you receive from us may have the characteristics of marketing content, but they are not exclusively advertising. We send you these communications on the basis of our legitimate interest in staying in touch with you and keeping you informed about current matters related to our offer.

Special rules

Information on the purposes and reasons for data processing in connection with the recording of telephone calls and making AI Chat available on our Website can be found in separate paragraphs, i.e. in § 10a – for recording phone calls and in § 10b – for AI Chat. At the same time, we would like to point out that if any of the issues mentioned in this document have not been addressed in these paragraphs – the general principles that we have stated in the other parts of this document apply to these processing activities.

§ 7. DATA RETENTION PERIOD

We assure you that your data is stored in accordance with the principle of data minimisation, i.e. only for the period necessary to fulfil the purposes for which the data was collected or – alternatively – until the realization of these purposes becomes impossible or intolerable.

Due to our business profile and the specificity of the purposes for which we process your data, it is difficult to quantify the retention period of your data on our part. For this reason, instead of numerically specific data processing periods, we present the basis for their calculation below:

  1. until consent to the processing of personal data is withdrawn – if they are processed on the basis of consent – or
  2. until you have effectively objected to the processing of your personal data, insofar as it is processed on the basis of a legitimate interest, or
  3. until all steps taken by us on the basis of our legitimate interest have been fully implemented – or
  4. until the full performance of the contract – if such performance was the basis for the data processing – or
  5. until the obligation to which KENO is subject has been fully complied with or after the expiry of the numerical period for which KENO was obliged to process the data – or
  6. until the expiry of the limitation period for any claims.

It should be emphasized that your data may be processed both for several purposes and for several reasons at the same time. In such a case, the loss of any basis (e.g. withdrawal of consent) or the achievement of one of the purposes (e.g. performance of the contract by delivering the ordered goods) may not always lead to the deletion of the data. In this case, we may continue to process the data, but with reference to other bases or other purposes of processing. Sometimes, the removal of one of the bases or the achievement of one purpose of processing will be associated with a limitation of the scope of the data we process.

§ 8. RIGHTS OF DATA SUBJECTS

Based on the provisions of the GDPR, each person whose data we process has a number of rights that they can request from us. We provide the possibility and possible assistance in the implementation of each of them, if this would not be technically or legally impossible. We will immediately inform you of any inability to exercise your rights if you submit a request that we are unable to accommodate. At the same time, we assure you that the above-mentioned obstacles of a technical or legal nature will be the only reason for refusing to exercise your rights.

You have the following rights in relation to data processing:

  1. Right of access – as part of exercising this right, you can request:
    1. confirm that your data is being processed at all;
    2. access to the data – and if direct access to it proves technically impossible – to obtain a copy of it.
  2. Right to rectification – as part of exercising this right, you can request:
    1. Completing data – if the data we have is incomplete,
    2. Update data – if the data we hold is out of date,
    3. Correction of data – if the data we store is inconsistent with the actual situation.
  3. Right to be forgotten – i.e. the right to request the erasure of the data we process. This application shall enter into force when:
    1. we have processed your data on the basis of consent that has been withdrawn, or
    2. We have processed your data on the basis of our legitimate interest and you have effectively objected to the processing, or
    3. In your opinion, all grounds have already been removed and all purposes of processing have been fulfilled and the data has not yet been deleted.
  4. Right to restriction of processing of your data – where you believe that some (but not all) of the data we process about you is no longer necessary for us to fulfil the purposes of the processing. However, due to the need to ensure the implementation of the principle of data minimization, we ensure that your data will only be processed to the extent necessary to achieve the intended purposes of the processing. Notwithstanding the foregoing, we assure you that we will acknowledge any such request.
  5. Right to data portability – you can ask us to transfer data from our databases to the databases of another controller, if we process your data on the basis of the above-mentioned prerequisites such as CONSENT or PERFORMANCE of CONTRACT and if we process this data in an automated manner (e.g. by storing it in an IT system). We can only exercise this right at your request if it is technically feasible.
  6. The right to lodge a complaint with the President of the Office for Personal Data Protection (PUODO) – detailed information on how to lodge a complaint can be found at: https://uodo.gov.pl/pl/p/skargi.

All requests to exercise the rights referred to in this paragraph – with the exception of the request referred to in point 6 above (filing a complaint with the Data Protection Officer) – may be addressed directly to the Data Protection Officer, who may be contacted in the manner specified in Section 3.

Objection

It should be emphasized that within the framework of the right to be forgotten mentioned in point 3 above, you have the right to object to the processing of your data on the basis of our legitimate interest. We have listed the individual situations in which we process your data on the basis of our legitimate interest in Section 6 in the section “Legitimate Interest” in Section 6. In any such case, if you find that your fundamental rights to liberty, and in particular your right to privacy, are more important or outweigh our legitimate interest on which we rely to process your data, you may object by contacting the Data Protection Officer directly using one of the contact methods set out in Section 3. We will do our best to consider your opposition without undue delay – and if we reject it – we will give you detailed reasons why we rejected it. In any case, if you are not satisfied with our response to the submitted objection, you can file a complaint with the President of the Office for Personal Data Protection in the manner specified in point 6 above.

Identification

We emphasize that we are obliged to act in accordance with the principle of confidentiality and integrity of the personal data we process. Therefore, we may verify your identity before processing your requests related to the exercise of your rights. For this purpose, we may ask you to provide specific data, which we then compare with those we process. Since the purpose of such a request is only to verify your identity and identification, it will never be a question for data that we do not process (e.g. if we do not process your PESEL number, we will not ask you to do so for identification purposes).

§ 9. DATA RECIPIENTS. THIRD COUNTRIES AND INTERNATIONAL ORGANISATIONS

In the course of achieving the purposes for which we process your data, in particular in the performance of contracts concluded between us and you or in the fulfilment of obligations imposed on us by generally binding legal regulations, we may use the cooperation of third parties – especially our suppliers and state authorities, in which your data may be transferred to these entities. We assure you that your data will be disclosed only when necessary and in accordance with the law. Below are the types of entities to whom we may disclose your information:

  1. our suppliers, with whom we organize trainings, events and trade fairs;
  2. our suppliers who provide us with IT, marketing, courier, freight forwarding or financial services;
  3. state authorities and other entities authorized under generally applicable legislation.

Third countries and international organisations

We do not provide the possibility of transferring your personal data to third countries (persons or other entities residing or having their registered office in their territory) or to international organizations, subject to the content of § 10b of this document.

§ 10. PROFILING AND AUTOMATED DATA PROCESSING

Profiling – means the automated processing of personal data, in particular with the use of IT algorithms, which consists in analysing the behaviour of specific persons (e.g. when using the Website) and, on this basis, creating profiles of the preferences, interests, location or economic situation of these persons, the exemplary purpose of which may be to adapt the content displayed on the Website.

Your personal data that we process may be subject to profiling. However, this profiling will not involve automated decision-making against you that could have certain legal effects for you. Therefore, we do not use your profiles in any way to make binding decisions about you that would have important consequences for you.

The basis for profiling your personal data on our part is our legitimate interest and the purpose is to improve the quality of the services we provide and to adapt our offer and content presented on the Website and the B2B Platform to your personal preferences and expectations.

At the same time, in order to improve the quality and provide the services we offer as quickly as possible, some of the activities we perform (e.g. in connection with the processing of orders placed) – or even all of them – may be automated and carried out without human intervention. As a result, your data may be processed in an automated manner. However, we will not make any decisions about the legal consequences for you during this process.

If you do not want your personal data to be subject to profiling or automated processing, we inform you that you have the right to object to profiling.

§ 10a. RECORDING OF TELEPHONE CALLS

We would like to inform you that we record all phone calls on the KENO hotline (number: +48 32 341 71 71). In this paragraph, we provide detailed information about the processing of your data in connection with the recording of telephone calls.

We record all phone calls on the KENO hotline. After dialing the general number (+48 32 341 71 71), you will be asked to dial the branch number for each KENO department. That is why we emphasize that we record calls under all branch numbers.

Call recording purposes

We record phone calls on the KENO infoline for the following purposes:

  1. ensuring the safety of customers calling the hotline,
  2. Providing additional proof of the terms of the transaction agreed during the conversation (if the conversation is of a business nature);
  3. improve the quality of customer service on our part and enable continuous testing of the level of this quality.

Legal basis for call recording

We do not record telephone calls without your consent (Art. 6 (1) (a) GDPR). By calling the infoline, you are informed about the recording of calls and that if you do not agree with the recording, you can hang up. Since we cannot obtain your consent in any other way, we acknowledge that after hearing the above communications, the continuation of the call constitutes implicit consent. You can withdraw your consent at any time by contacting us as a data controller or our data protection officer. Contact details can be found in Section 3.

In exceptional cases, in particular if the recording of a conversation constitutes evidence in civil or criminal proceedings, an already recorded conversation may be stored on our servers on the basis of our legitimate interest (Article 6(1)(f) of the GDPR) or, if requested by the competent state authorities, on the basis of a legal obligation imposed on us (Article 6(1)(c) of the GDPR).

In the above situations, it is in our legitimate interest to assert or defend against any claims that you may have against us or that we may have against you.

If we store recordings on the basis of our legitimate interest, you have the right to object to such processing.

Recording of recipients

As a rule, we record conversations only for our own purposes. However, we reserve the right to hand them over to state authorities in exceptional cases – but only at their request, ordered on the basis of applicable law. Call recordings will not be forwarded to recipients based in countries outside the European Economic Area or to international organizations.

Record retention period

We will keep call recordings for 30 days. After that, the recordings will be permanently deleted from our servers. The above period may be extended in exceptional cases – in particular at the request of the competent state authorities, or if we have a legitimate interest that entitles us to do so. However, we would like to point out that in such cases, we will not process your data for longer than is strictly necessary. In such cases, we will delete the recordings as soon as any claims expire or when the relevant government authorities release us from the obligation to continue retaining the recordings.

Your rights

Since we process your personal data when recording recordings of telephone calls and storing recordings on our servers, you have the following rights with regard to this circumstance:

  1. the right to request access to, rectification, erasure and restriction of processing of data concerning you;
  2. the right to data portability;
  3. withdraw consent or object to processing;
  4. file a complaint with the President of the Office for Personal Data Protection.

A detailed description of each of your rights is set out in Section 8.

Obligation to provide data

Providing your details during a phone call is completely voluntary, but in most cases it is necessary to handle the matter you are calling with. Therefore, in such cases, the refusal to provide data may result in our refusal to deal with your case.

Automated data processing

We will store recordings of telephone calls on our servers – and in this context we will process your data in an automated manner. However, in the course of such automated processing, we will not make any decisions against you, in particular those that have legal effects or the like, and we will not profile this data.

§ 10b. CHAT WITH ARTIFICIAL INTELLIGENCE

On our website, we have provided you with an interactive chat feature based on artificial intelligence models (Chat AI). Since we are not the provider of the technology used by AI Chat that is available to you, your personal data may be processed in the manner and under the conditions set out in this paragraph.

Purpose and legal basis

Your data in the form of queries (prompts) entered into the AI chat, as well as technical data related to the session, are processed in order to answer legitimate queries. The legal basis for such processing is our legitimate interest (Article 6(1)(f) of the GDPR), which is the desire to provide you with a fast and innovative channel of access to information, in particular with regard to the goods and services we offer.

Data recipients and transfer outside the European Economic Area

The AI Chat service is based on the technology provided by OpenAI, i.e. one of the following entities:

  1. OpenAI Ireland Ltd, a company registered in the Republic of Ireland, having its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, registration number 737350;
  2. OpenAI, L.L.C., a Delaware corporation with its registered office at 1455 3rd Street, San Francisco, CA 94158, United States of America, identification number 7063675.

OpenAI provides that for users residing in the European Economic Area, the entity responsible for providing the AI Chat service is OpenAI Ireland Ltd, which is based in the Republic of Ireland, i.e. an entity based in the European Economic Area. However, it cannot be excluded that, as part of the provision of the AI Chat service, your data may be transferred to a recipient based in a third country, i.e. in a country outside the European Economic Area (USA). However, we would like to point out that the basis for this transfer is the contract concluded between us and OpenAI, the content of which is based on standard contractual clauses approved by the European Commission, which ensure an adequate level of protection of your data processed as part of such transfer.

OpenAI’s Dual Role in Processing Your Data

In order to generate answers to your questions via AI chat, OpenAI acts as our processor based on a data processing agreement concluded between us and OpenAI. At the same time, please note that OpenAI may also process your data for its own purposes (e.g. to ensure security), acting as a separate data controller in this regard.

Detailed information on OpenAI’s data processing can be found in the OpenAI information clause, available at the link: https://openai.com/pl-PL/policies/privacy-policy/.

AI Chat Rules

Detailed rules for the use of AI Chat are specified by us in separate terms and conditions of the Website, which can be found on our Website. However, for the sake of transparency, we also state in this document that it is prohibited to insert information that constitutes confidential information, personal data, and especially personal data of special categories (e.g. health status) into the AI Chat queries (prompts).

Your rights

Since we process your personal data when you use the Chat AI service, you have the following rights:

  1. the right to request access to, rectification, erasure and restriction of processing of data concerning you;
  2. the right to data portability;
  3. withdraw consent or object to processing;
  4. file a complaint with the President of the Office for Personal Data Protection.

A detailed description of each of your rights is set out in Section 8.

Automated data processing

Since your use of AI Chat takes place exclusively in a digital environment, our processing of your personal data in connection with the provision of this feature should be considered as automated processing of your data.

However, in the course of such automated processing, we will not make any decisions against you, in particular those that have legal effects or the like, and we will not profile this data. As a data controller, we will also not outsource similar processing activities to a processor, i.e. OpenAI.

§ 11. LINKS TO OTHER WEBSITES

Our website, B2B platform and app may contain links to external websites. In general, this website operates independently of us and is not controlled by us in any way. This site may have its own privacy policies and terms and conditions, which we encourage you to read.

§ 12. AMENDMENT TO THE PRIVACY POLICY

Rest assured that the privacy processes at KENO. For this reason, this document may be updated in the future, which we reserve the right to do. At the same time, we emphasize that any changes to the content of this document will primarily be aimed at ensuring the highest quality of personal data protection for you and increasing the transparency and comprehensibility of this document. We will keep you informed of any changes to this document.