Privacy policy

This document explains who processes the personal data collected through the HydroNexis website, for what purpose, on what legal basis and for how long. It also sets out the rights available to every individual and how to exercise them.

1. Who processes your data

The controller within the meaning of Article 4(7) GDPR is:

HydroNexis Sp. z o.o.
ul. św. Alberta Chmielowskiego 1
97-400 Bełchatów, Poland
Court register (KRS): 0001231251  |  VAT ID: 7692256557  |  REGON: 544347283

We have not appointed a data protection officer, as none of the conditions in Article 37(1) GDPR applies. For any matter concerning personal data, please contact us:

• by email: rodo@hydronexis.pl,
• in writing, at the registered address above.

We respond without undue delay and at the latest within one month of receiving a request (Article 12(3) GDPR). For complex requests that period may be extended by a further two months, of which we will inform you together with the reasons.

2. What data we collect

The scope depends on which part of the site you use.

2.1. Consultation form

• email address - required, used to reply to you,
• phone number - required in the consultation form,
• the content of your enquiry - the subject of the conversation,
• the date and wording of the consents given - as evidence that they were granted (Article 7(1) GDPR).

If your message contains additional information, such as an organisation name or job title, we process it only to the extent needed to answer you.

You sign up for webinars in the HydroNexis Academy (akademia.hydronexis.pl), which handles the sign-up form, the confirmation and the reminders. The site only shows dates fetched from the Academy and a link to sign up; viewing them does not require you to provide any data.

2.2. Technical data

• IP address - processed by the anti-bot check and by the mechanism limiting the number of submissions from one address,
• form submission timestamp - used solely to distinguish a person from an automated script,
• standard HTTP request data - recorded in server logs by our hosting provider.

We do not collect special categories of data (Article 9 GDPR) and ask that you do not include such information in your message.

2.3. Visit statistics and heatmaps

We measure traffic with our own tool, on our own server, without third-party providers and without cookies.

• on every page view - the address of the page visited, the domain of the site you came from (not the full address), the campaign tag (utm_source), the type of browser, operating system and device read from the header your browser sends, and the date and time to the minute,
• only with your consent (“Accept all” in the banner) - active browsing time, which parts of the page were on screen and for how long, how far the page was scrolled, and where clicks landed relative to page elements. We never record what you type into forms.

We do not store your IP address in the statistics. To count unique visitors we derive a one-way hash from the IP address and the browser header, using a key that changes every day. The key is deleted after a day and the hash after 48 hours - from then on page views cannot be linked to any person or device. Statistics are never combined with form data. Visits from browsers sending a “Do Not Track” or “Global Privacy Control” signal are not counted.

2.4. Advertising tools - only with your consent

Once you choose “Accept all” in the banner, we load Google Ads with Google Tag Manager and the OpenAI measurement pixel (ads in ChatGPT). Before you consent their scripts are not loaded and your browser does not connect to these companies' servers.

• Google Ads - a cookie identifier, IP address, the address of the page visited, information about the visit and about actions we measure as conversions (for example opening a particular page), and browser and device data, including screen resolution,
• OpenAI pixel - a random browser identifier and a ChatGPT ad click identifier stored in cookies, IP address, the address of the page visited, the time and type of the event, and browser data,
• OpenAI automatic advanced matching - when you type an email address or phone number into a form, the pixel creates a hash (SHA-256) of it in your browser and sends that hash to OpenAI together with the event. It does not send the address or number itself, but the hash lets OpenAI match the event to an account in its services registered with the same address or number, so we treat it as personal data.

3. Why and on what basis we process data

4. How long we keep data

Once these periods expire, data is deleted or anonymised so that re-identification is no longer possible.

5. Who we share data with

We entrust data to processors only on our documented instructions, under a data processing agreement compliant with Article 28 GDPR. Separate controllers receive data only to the extent shown in the table and process it on their own responsibility.

Processors act solely on our instructions, are bound by confidentiality and may not use the data for their own purposes, including marketing. Data may be disclosed to public authorities where the law requires it.

We do not sell personal data and do not share it with data brokers. The only advertising tools we use are Google Ads and the OpenAI measurement pixel - to measure the effectiveness of our campaigns and to select the ads shown, and only where you have given your consent.

Google and OpenAI are separate controllers of this data and also use it for their own purposes. Google describes this in its page on how it uses information from sites that use its services. Under its advertising terms OpenAI uses conversion data, among other things, for reporting to advertisers, building ad audiences and developing and improving its services (OpenAI's privacy policy for Europe).

6. Transfers outside the EEA

As a rule we process data within the European Economic Area. The exceptions are:

• hCaptcha - the provider is established in the United States. The transfer relies on standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR).
• Google Fonts - typefaces are fetched from Google infrastructure. The transfer relies on the Commission implementing decision of 10 July 2023 on the adequate protection afforded by the EU-US Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses.
• Google Ads and Google Tag Manager - only after you consent to marketing cookies. The transfer relies on the same Commission decision on the EU-US Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses. Without your consent the scripts of these services are not loaded and no data reaches them.
• OpenAI - only after you give consent. Data from the EEA is processed by OpenAI Ireland Limited. For any onward transfer to a country without an adequate level of protection, OpenAI has undertaken to use a valid transfer mechanism provided for in the GDPR.

In the platform cloud model, customer data is held in Google Cloud data centres in Europe, with no transfer outside the EEA. A copy of the safeguards applied is available on request sent to rodo@hydronexis.pl.

7. Your rights

In connection with the processing of your data, you have the right to:

• access your data and obtain a copy of it (Article 15 GDPR),
• rectification of inaccurate data and completion of incomplete data (Article 16 GDPR),
• erasure of your data (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability for data processed on the basis of consent or a contract (Article 20 GDPR),
• object to processing based on legitimate interests (Article 21 GDPR); an objection to direct marketing is absolute,
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3) GDPR).

Send your request to rodo@hydronexis.pl. There is no charge. Where a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse to act (Article 12(5) GDPR).

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority in your country of residence.

8. Is providing data mandatory

Providing data is voluntary but necessary to use certain features:

9. Profiling and automated decisions

We take no decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

With your consent, information about your visit is also used to select the ads you see: Google Ads adds your browser to the audience lists of our campaigns (remarketing), and OpenAI may build ad audiences. This may constitute profiling within the meaning of Article 4(4) GDPR. In our view it produces no legal effects concerning you and does not similarly significantly affect you, and you can withdraw your consent at any time (section 10).

The hCaptcha mechanism assesses whether a form is being completed by a person or by an automated script. That assessment does not concern you as an individual or your characteristics, and its only effect is that a submission is accepted or rejected. If a submission is rejected in error, please write to biuro@hydronexis.pl.

10. Cookies and similar technologies

The site uses cookies strictly necessary for it to function and to keep it secure and, with your consent, Google Ads and OpenAI pixel marketing cookies. Marketing cookies are set only after you give consent in the banner shown on your first visit. We do not use Google Analytics and we embed no social network pixels. Our own visit statistics work without cookies (section 2.3).

Until you give consent we do not load the Google Ads, Google Tag Manager or OpenAI pixel scripts - your browser does not connect to their servers and no marketing cookies are created. When you withdraw consent we pass your refusal on to both companies, delete the marketing cookies stored under the site's domain, and from the next page view the scripts are no longer loaded. Cookies that Google stores under its own domains (such as doubleclick.net) can be deleted in your browser settings.

You can withdraw your consent at any time through the Cookie settings link in the site footer - as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

You can also manage cookie settings in your browser. Blocking technical cookies may prevent form submission.

11. Data security

We apply technical and organisational measures appropriate to the risk, in line with Article 32 GDPR:

• TLS encryption of traffic across the whole site,
• role-based access control and the principle of least privilege,
• operation logging and record versioning instead of permanent deletion,
• regular backups together with restore testing,
• rate limiting per IP address and protection against automated abuse,
• periodic review of permissions and vetting of suppliers before data is entrusted to them.

We report personal data breaches to the President of the Personal Data Protection Office within 72 hours of becoming aware of them, in accordance with Article 33 GDPR. Where a breach is likely to result in a high risk to rights and freedoms, we also notify the individuals concerned (Article 34 GDPR).

12. Compliance with sector regulation

The HydroNexis platform is aimed at water infrastructure operators, so we design it with the requirements our customers face in mind.

12.1. NIS2 and the national cybersecurity system

Directive (EU) 2022/2555 (NIS2) covers drinking water suppliers as essential entities. It is being transposed into Polish law through amendments to the Act on the national cybersecurity system. Our platform supports the customer in meeting those obligations through an alarm register, an audit log of control operations, role-based access control and record versioning. The regulatory obligations rest with the customer as the entity in scope; as a supplier we support their fulfilment to the extent set out in the contract.

12.2. DORA

Regulation (EU) 2022/2554 (DORA) applies to financial entities and their ICT providers. HydroNexis is not a financial entity and does not provide services to the financial sector, so the regulation does not apply to us directly. We mention it for completeness because it is sometimes raised in procurement procedures. Were we to be treated as a third-party ICT service provider within the meaning of DORA, the relevant contractual terms would be agreed individually.

12.3. Digital accessibility

We design the site with the WCAG 2.1 Level AA guidelines and the requirements of the European Accessibility Act (Directive (EU) 2019/882) in mind. If you encounter a barrier to accessing content, write to biuro@hydronexis.pl and we will provide an alternative way to obtain the information.

13. Our role regarding platform customer data

This policy covers data collected through the website. Data entered into the platform itself by customers is handled differently:

• the water utility remains the controller,
• HydroNexis acts as a processor under a data processing agreement,
• we provide a template of that agreement before anything is signed,
• in the cloud model data stays within the European region, and in the on-premise model it never leaves the customer infrastructure.

14. Changes to this policy

We update this policy when the law, the scope of our services or the way the site works changes. The current version is always available at this address. We give advance notice by email of material changes affecting people we are in contact with.

Version 2.3  |  effective from 29 October 2026