Skip to main content

Privacy policy

Last updated 2026-09-24.

This privacy policy explains how bartzz Bartłomiej Szabłowski ("we", "us" or "our") collects, uses, stores and shares information about you when you use ComparePV at comparepv.com, including its pages, tools, embeddable widgets, partner portal and the emails we send. We are the controller of that information under the EU General Data Protection Regulation (GDPR).

Reading this policy will help you understand your privacy rights and choices. If you do not agree with how we handle your information, please do not use the site. If you have any questions or concerns, write to us at [email protected].

Summary of key points

This summary gives the main points of the policy. Each one is explained in more detail in the section it links to.

Do we need an account or your name to show you the site? No. You can use every public page and tool without signing up. We only learn what your browser sends with each request and what you choose to type into a form. See what information we collect.

Do we use analytics? Only if you allow it in the cookie banner. Until you do, Google Analytics is not loaded and sets no cookies. See cookies and similar technologies.

Do we sell your information or show you ads? No. We do not sell or rent personal information, we do not run advertising and we do not build profiles of visitors. See when and with whom we share it.

Do we keep your IP address? Only in short-lived server logs, and in one record kept on purpose: when a shop grants or refuses a photo licence. No other table in our database stores it. See how long we keep it.

What are your rights? You can ask for a copy of your information, have it corrected or deleted, object to its use and complain to a data protection authority. See your privacy rights.

Table of contents

  1. Who is responsible for your information?
  2. What information do we collect?
  3. How do we use your information?
  4. What legal bases do we rely on?
  5. When and with whom do we share it?
  6. Cookies and similar technologies
  7. Is your information transferred outside the EU?
  8. How long do we keep it?
  9. How do we keep it safe?
  10. Do we collect information from children?
  11. What are your privacy rights?
  12. Do-Not-Track signals
  13. Links to shops and other websites
  14. Do we update this policy?
  15. How can you contact us?

1. Who is responsible for your information?

The controller is bartzz Bartłomiej Szabłowski, a sole proprietorship registered in Poland (NIP 5242878542), ul. Gołębia 19 lok. 2, 11-041 Olsztyn, Poland. The full legal notice is in our Impressum.

We have not appointed a data protection officer, as the law does not require one for a service of this size. Every privacy question goes to [email protected] and is answered by the operator.

2. What information do we collect?

In short: technical data your browser sends with every request, analytics data if you allow it, a record of clicks to shops without your IP address, and whatever you choose to give us in a form, a partner account or a shop consent.

Information collected automatically on every visit

Like almost every website, our web server records each request it receives: your IP address, the date and time, the address of the page you asked for (which includes anything you typed into a search box), the page you came from, the response status and your browser's User-Agent string, which names the browser and operating system. Our application keeps its own log of the same requests, including the IP address. We use these logs to keep the site running, to find faults and to defend it against abuse.

To enforce rate limits on forms and tools, we also hold IP addresses in memory, and in a cache that is never written to disk, for at most a week. They are not stored in our database.

Analytics, only if you allow it

If you click "Allow" in the cookie banner, we load Google Analytics. It sets cookies with a random identifier and records the pages you view, how you arrived, your device type, screen size and approximate location derived from your IP address. We use it to learn which pages people find useful. If you click "Reject", or never answer, Google Analytics is not loaded at all.

Clicks to shops

When you follow a link to a shop's offer, the link passes through our own address first so that we can count the click. For each click we record the time, the shop, the offer, which of our pages carried the link and your browser's User-Agent string. We do not record your IP address in our database; the last hundred clicks, with the IP address, are held for at most a day in a cache that is never written to disk, so that we can watch clicks arrive and spot abuse. From the same event we also keep anonymous daily totals per shop, per page and per browser family, which say nothing about any one visitor. Requests from automated crawlers are not counted.

Information you give us in forms

You can suggest a panel, report a wrong specification or propose a new shop. We store what you write, the address of the page you sent it from, your browser's User-Agent string and, if you give one, your email address. An email address is optional except when you propose a shop, because that form exists to get an answer. If we reply, we keep the text of our reply and the time we sent it. A copy of the message text, without your email address, is sent to our own Telegram chat so that we notice it.

Reports built with the comparison calculator store only the panels, prices and settings you entered, not anything about you.

Partner accounts

If you register for the partner portal to embed our widget, we store your email address, your shop's name and web addresses, the widget key we issue you, when you last signed in, and the number of times the widget was displayed on your site per day. Sign-in works by a link sent to your email address; we store only a hash of that link, never the link itself.

Visitors to partner sites

When a partner's page shows our widget, your browser downloads it from our servers, so the request appears in our server logs like any other visit. The widget then counts one display for the partner. That count stores the partner, the day and the number, and nothing about you. The widget does not count anything if your browser sends a Do-Not-Track signal.

Shops we contact about product photos

We ask shops for permission to show their product photographs. To do that we collect business email addresses that shops publish on their own contact, imprint or terms pages, together with the address of the page where we found them. If that address belongs to a person, this is personal data we did not receive from you directly; its source is always that public page, and we will tell you which one if you ask. Our email provider tells us if a message bounces, or if the recipient marks it as spam or unsubscribes, and we record that against the address.

When a shop grants, refuses or withdraws permission, we record the name, role and email address of the person who decided, the choice itself, the language and version of the terms shown, the time, and the IP address and User-Agent string of the browser used. This is the one place where we keep an IP address in our database, and we do so because the record is our evidence of the licence.

3. How do we use your information?

We use the information described above to:

  • deliver the pages and tools you ask for and keep them working;
  • detect, prevent and investigate faults, abuse, spam and attacks, and enforce rate limits;
  • understand which pages are useful, if you have allowed analytics;
  • count clicks to shops, understand which of our pages send readers to them, and settle commissions with shops that run an affiliate programme;
  • read and act on your suggestions and corrections, and reply when you asked us to;
  • run the partner portal: sign you in, issue your widget key and show you your display counts;
  • ask shops for permission to show their photographs, act on the answer and keep proof of it;
  • comply with legal obligations and establish, exercise or defend legal claims.

We do not use your information for advertising, we do not sell it, and we make no decisions about you by automated means that have legal or similarly significant effects.

4. What legal bases do we rely on?

The GDPR requires us to name a legal basis for each use of personal information. We rely on the following:

  • Consent (art. 6(1)(a)) for Google Analytics. You can withdraw it at any time under "Cookie settings" in the footer; withdrawal does not affect what was lawfully collected before it.
  • Contract (art. 6(1)(b)) for partner accounts: we need your email address and site addresses to provide the portal you signed up for.
  • Legitimate interests (art. 6(1)(f)) for server logs and rate limits (keeping the site available and secure), click records (measuring how the site is used and settling commissions), form submissions (acting on what you sent us), shop contact addresses (asking a business for a licence) and the consent record (proving the licence we were given). We have weighed these interests against your rights and keep the data involved small and short-lived.
  • Legal obligation (art. 6(1)(c)) where the law requires us to keep or disclose information.

Storing the cookie that remembers your banner choice, your currency setting and a partner's sign-in is strictly necessary for the service you asked for, so it does not need consent under art. 399 of the Polish Electronic Communications Law and art. 5(3) of the ePrivacy Directive.

5. When and with whom do we share it?

We do not sell, rent or trade personal information. We share it only with the service providers below, which process it on our behalf and only for the purposes described in this policy:

  • Hetzner Online GmbH (Germany) hosts our servers and database.
  • Cloudflare, Inc. delivers the site and protects it from attacks, so it sees every request, including your IP address. It processes data in the EU and the USA.
  • Google Ireland Ltd. / Google LLC provides Google Analytics, only if you have given consent.
  • Mailgun Technologies, Inc. sends our emails (sign-in links, replies, messages to shops) from its EU region.
  • Proton AG (Switzerland) hosts the mailbox that receives emails you send us.
  • Telegram carries our internal notice that a form was sent, containing the message text only.

We may also disclose information where the law requires it, for example in response to a lawful request from a court or public authority, or where it is needed to establish, exercise or defend legal claims.

Shops never receive your data from us. When you follow a link to a shop, your browser goes there directly and the shop receives what any website receives from a visitor. Shops with an affiliate programme also receive a tracking code in the link, which tells them the visit came from us, not who you are.

6. Cookies and similar technologies

Cookies are small text files a website stores in your browser. We set as few as possible, and only analytics cookies need your consent. You can change your answer at any time under "Cookie settings" in the footer; if you withdraw consent, we delete the analytics cookies and reload the page.

  • _ga, _ga_*: Google Analytics. Set only after you click "Allow". Kept for up to 2 years. Needs consent.
  • cpv_consent: remembers your answer in the cookie banner so we do not ask on every page. Kept for 6 months. Strictly necessary.
  • cpv_currency: remembers the currency you chose for prices. Kept for 1 year. Set only when you choose one.
  • cpv_partner: keeps a partner signed in to the portal. Kept for 30 days. Strictly necessary, set only when you sign in.

We also use your browser's local storage to remember your preferences, the inputs of the calculators and a copy of the day's exchange rates. That information stays on your device and is never sent to us. You can clear it at any time in your browser's settings.

The fonts, icons and scripts on our pages are served from our own servers, not from third-party content networks, so loading a page does not send your IP address to font or script providers.

7. Is your information transferred outside the EU?

Our servers are in Germany. Cloudflare and Google may process data in the USA; both are certified under the EU-US Data Privacy Framework, which the European Commission has found to provide an adequate level of protection, and both also offer the Commission's standard contractual clauses. Proton processes data in Switzerland, which the Commission has likewise found adequate. Telegram does not publish where it processes data; the only thing we send it is the text you wrote in a form.

8. How long do we keep it?

We keep personal information only as long as we need it for the purpose it was collected for:

  • Web server logs: 14 days.
  • Application logs: overwritten as they fill up, usually within days.
  • Rate limit entries: in memory, a week at most.
  • Recent clicks with an IP address: the last hundred, in a cache never written to disk, a day at most.
  • Google Analytics data: 14 months, then deleted by Google.
  • Click records with a User-Agent string: 90 days, after which only the anonymous daily totals remain.
  • Form submissions: until we have dealt with them, and deleted on request.
  • Partner accounts: until you delete the account; sign-in links expire after 15 minutes and sessions after 30 days.
  • Shop contact addresses: while we list the shop's offers, or until you ask us to remove the address.
  • Photo licence records: while we show the shop's photographs, and afterwards until the limitation period for claims about them has run out.

When we no longer need the information, we delete it.

9. How do we keep it safe?

We use appropriate technical and organisational measures to protect personal information. The site is served only over encrypted connections, the database is not reachable from the internet, access to the servers and the admin pages is limited to the operator and protected by keys and strong passwords, sign-in links are stored only as hashes, and we collect as little as we can in the first place. No method of transmission or storage is completely secure, however, so we cannot guarantee absolute security. If a breach puts your rights at risk, we will notify the supervisory authority and, where required, you.

10. Do we collect information from children?

ComparePV is a tool for comparing solar panels and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, write to us and we will delete it.

11. What are your privacy rights?

Under the GDPR you have the right to:

  • ask whether we hold information about you and get a copy of it (art. 15);
  • have inaccurate information corrected (art. 16);
  • have your information deleted (art. 17);
  • have its use restricted (art. 18);
  • receive information you gave us in a portable format (art. 20);
  • object at any time to processing based on our legitimate interests (art. 21);
  • withdraw your consent at any time, without affecting what was done before (art. 7(3)).

To use any of these rights, send one email to [email protected]. We will answer within one month. Because most of what we hold is not linked to a name, we may ask for details that let us find it, for example the time of your visit or the email address you used.

You also have the right to lodge a complaint with a data protection authority. Ours is the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland. You may also complain to the authority in the country where you live or work.

12. Do-Not-Track signals

Most browsers can send a Do-Not-Track signal. There is no agreed standard for how websites should respond to it, so the site as a whole does not change its behaviour when it receives one. One part does: if your browser sends the signal, our widget on partner sites does not count your visit. Analytics is governed by your answer in the cookie banner instead, which is a clearer and legally binding choice.

Our pages link to shops, manufacturers and other websites that we do not control. Once you follow such a link, that website's own privacy policy applies, and we are not responsible for how it handles your information. Please read its policy before you give it any personal information.

14. Do we update this policy?

Yes. We update this policy whenever what we collect or who processes it changes. The date at the top shows when it was last revised. If we make a material change, such as a new purpose or a new kind of data, we will also note it in our changelog.

15. How can you contact us?

If you have questions or comments about this policy, email us at [email protected] or write to:

bartzz Bartłomiej Szabłowski
ul. Gołębia 19 lok. 2
11-041 Olsztyn
Poland