Privacy Policy

This Privacy Policy describes how Modus ("we", "us", or "our") collects, uses, and protects your personal data when you use the Opti-Carbon platform (the "Service"). We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

**Data Controller:** Modus Sp. z o.o. ul. Peszteńska 2 lok. 26 03-925 Warszawa, Poland Email: biuro@paszportenergetyczny.com

We collect the following types of data:

**Account Information:** Name, email address, company name, job title, and account credentials.

**Usage Data:** Login times, features accessed, actions performed within the platform, and user preferences.

**Technical Data:** IP address, browser type and version, device information, operating system, and cookies.

**Emission Data:** Organization structure, emission sources, activity data, and calculated emissions. This data relates to your business operations and is not personal data unless it identifies individuals.

**Communication Data:** Messages sent through support channels, feedback, and inquiries.

We process your personal data based on the following legal grounds under GDPR Article 6:

**Contract Performance (Art. 6(1)(b)):** To provide the Opti-Carbon service, manage your account, and deliver features you've subscribed to.

**Legitimate Interest (Art. 6(1)(f)):** To improve our service, ensure platform security, prevent fraud, and conduct business operations. We balance these interests against your rights.

**Legal Obligation (Art. 6(1)(c)):** To comply with accounting, tax, and regulatory requirements.

**Consent (Art. 6(1)(a)):** For marketing communications, optional analytics, and features requiring explicit permission. You may withdraw consent at any time.

We use your personal data to:

• Provide and maintain the Opti-Carbon service • Authenticate users and manage accounts • Process and store emission calculations • Generate ESG reports and analytics • Communicate about service updates, maintenance, and support • Improve platform functionality and user experience • Ensure platform security and prevent fraud • Comply with legal and regulatory requirements • Respond to inquiries and provide customer support • Send marketing communications (with your consent)

We may share your personal data in the following circumstances:

**Service Providers:** Cloud hosting providers (AWS, Google Cloud), email service providers, and analytics tools. These processors are bound by data processing agreements and may only process data according to our instructions.

**Legal Requirements:** When required by law, court order, regulatory authority, or to protect our legal rights.

**Business Transfers:** In the event of a merger, acquisition, or sale of assets, your data may be transferred. You will be notified of any such change.

**With Your Consent:** We may share data with third parties when you explicitly authorize us to do so.

**We do not sell your personal data to third parties.**

**Active Accounts:** We retain your personal data while your account is active and for as long as necessary to provide the Service.

**Deleted Accounts:** Personal data is deleted within 30 days of account closure, except where longer retention is required by law.

**Legal and Tax Requirements:** Some data (e.g., invoices, contracts) must be retained for 7 years to comply with Polish accounting and tax laws.

**Anonymized Data:** We may retain aggregated, non-identifiable data indefinitely for analytics and service improvement.

You have the following rights regarding your personal data:

**Right to Access:** Request a copy of the personal data we hold about you.

**Right to Rectification:** Correct inaccurate or incomplete data.

**Right to Erasure:** Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.

**Right to Restrict Processing:** Limit how we process your data in certain circumstances.

**Right to Data Portability:** Receive your data in a structured, machine-readable format.

**Right to Object:** Object to processing based on legitimate interest or for direct marketing.

**Right to Withdraw Consent:** Withdraw consent for marketing or optional processing at any time.

**Right to Lodge a Complaint:** File a complaint with the Polish supervisory authority (UODO).

To exercise these rights, contact us at biuro@paszportenergetyczny.com.

We implement industry-standard security measures to protect your personal data:

• TLS/SSL encryption for data in transit • Encrypted data storage • Access controls and authentication mechanisms • Regular security assessments and updates • Employee confidentiality obligations • Incident response procedures

While we strive to protect your data, no method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

Your personal data is primarily stored in data centers located within the European Union.

If data is transferred outside the EU/EEA, we ensure adequate protection through:

• EU Standard Contractual Clauses (SCCs) • Adequacy decisions by the European Commission • Other legally approved transfer mechanisms

Your rights remain protected regardless of where your data is processed.

We use cookies and similar technologies:

**Essential Cookies:** Required for authentication, session management, and core functionality. These do not require consent.

**Analytics Cookies:** Help us understand usage patterns and improve the Service. These require your consent.

**Cookie Management:** You can control cookies through your browser settings. Disabling essential cookies may affect platform functionality.

For detailed information, see our Cookie Policy or browser settings.

Opti-Carbon is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated via:

• Email notification to registered users • Platform notification upon login • Updated "Last Updated" date at the top of this policy

Continued use of the Service after changes constitutes acceptance of the updated policy. Previous versions are available upon request.

For privacy-related inquiries, data subject requests, or concerns, please contact:

**Email:** biuro@paszportenergetyczny.com

**Address:** Modus Sp. z o.o. ul. Peszteńska 2 lok. 26 03-925 Warszawa, Poland

**Polish Data Protection Authority (UODO):** ul. Stawki 2 00-193 Warszawa, Poland Website: https://uodo.gov.pl/