Privacy policy

Definitions:

1. Data Controller – a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data,
2. Personal Data – any information relating to an identified or identifiable natural person,
3. Filing system – any structured set of personal data which is accessible according to specific criteria,
4. Data processing – any operations performed on personal data, such as collection, recording, storage, compilation, alteration, disclosure and erasure, whether carried out in traditional form or in IT systems.

Information on the processing of personal data

Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “ GDPR”).

Personal Data Controller:

VINCI Immobilier Polska sp. z o.o. with its registered office in Warsaw, at 32 Domaniewska Street, entered in the Register of Entrepreneurs of the National Court Register (KRS) under KRS number: 0000682823, maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, NIP (Tax Identification Number): 5213785217, REGON (Statistical Identification Number): 36755339300000

I. General provisions

1. This Policy applies to Personal Data processed by VINCI Immobilier Polska Sp. z o.o., regardless of the form in which they are processed (traditionally kept record files, IT systems) and of whether the data are or may be processed in filing systems.
2. We obtain your Personal Data:
   1. when you use the contact form available on our website,
   2. by e-mail,
   3. by telephone, for the purpose of contacting VINCI Immobilier Polska sp. z o.o.,
   4. when a relevant agreement is concluded with the company,
   5. when you consent to electronic contact for marketing purposes.
3. The Data Controller ensures that all activities carried out in connection with the processing and protection of personal data comply with this Policy and with the applicable legislation.

II. Purposes of data processing, legal basis and personal data retention period

1. In the case of an enquiry submitted via the contact form on the website or by e-mail, the data will be processed for the purposes of:
   1. responding to the question asked, and considering and handling the request. The legal basis for the processing is the legitimate interest of the Data Controller, namely providing reliable information to persons who contact us and forwarding the matter to the appropriate department of our company (legal basis: Article 6(1)(f) GDPR),
   2. documenting the matter handled for evidential purposes, in connection with defence against possible claims (legal basis: Article 6(1)(f) GDPR),

   The data will be stored for a period of 1 year and, in some cases, until the claims become time-barred, i.e. for 6 years.

2. Where data are provided for the purpose of concluding a reservation agreement or a development agreement, the data will be processed for the purposes of:
   1. signing and performing the agreement (legal basis: Article 6(1)(b) GDPR),
   2. keeping accounting and tax records (legal basis: Article 6(1)(c) GDPR),
   3. handling any disputes and pursuing claims under the signed agreement, as well as conducting fraud investigations – which constitutes the legitimate interest of the Controller (legal basis: Article 6(1)(f) GDPR),
   4. fulfilling the legal obligations incumbent on the Controller, in particular those arising from the Act of 16 September 2011 on the Protection of the Rights of Purchasers of Residential Units or Single-Family Houses (ustawa o ochronie praw nabywcy lokalu mieszkalnego lub domu jednorodzinnego) and the Act of 24 June 1994 on the Ownership of Premises (ustawa o własności lokali) (legal basis: Article 6(1)(c) GDPR),
   5. performing activities arising from the statutory warranty (rękojmia) in respect of the proper performance of the development agreement. The legal basis for the processing is a provision of law, i.e. the Civil Code (Kodeks cywilny). The data will be processed for a period of 6 years,
   6. disclosing data to credit advisers cooperating with us. The legal basis for the processing is the consent of the data subject,
   7. disclosing contact details to designers and subcontractors in order to agree on buyer-requested alterations (so-called tenant changes) at the unit finishing stage. The legal basis for the processing is the necessity of disclosing the data in order to perform the agreement with the purchaser of the unit,
   8. recovering receivables arising from the signed agreement. The legal basis is the legitimate interest of the Data Controller, namely pursuing financial claims in connection with the agreement. The data will be processed for the limitation period for claims and, in the case of pending court proceedings, until the proceedings are concluded.

   The data will be stored for the period required by law, in particular by accounting regulations, and additionally until claims in connection with the signed agreement become time-barred. In the event of a court dispute, personal data will be stored at least until the final conclusion of the proceedings in that matter.

3. Marketing purposes:

   Since personal data have been provided to us, it is in our legitimate interest to be able to process the data for direct marketing purposes. The data will be processed until an objection is lodged with us.

   If a person expresses a wish to receive information about our developments and services by electronic means or by telephone, using telecommunications terminal equipment and so-called automated calling systems, we will send information about our offer by e-mail or through telephone contact with our consultant, depending on the consent given. The legal basis for the processing is voluntary consent given by ticking the relevant checkbox on the form or by providing us with an e-mail address or telephone number for this purpose.

   In some cases, it will be possible to provide contact details solely for the purpose of receiving information about a specific development. In such a case, the form will specify precisely what the consents relate to.

   If you contact us by telephone to obtain information about our offer, we will save your telephone number in our database in order to provide you with further information regarding your enquiry in the future. In such a situation, we will ask whether you consent to this.

   The data will be processed until the consent given is withdrawn.

4. In connection with our cooperation with business partners and suppliers, we process the data of representatives of these entities and of employees designated for cooperation, for the purposes of
   1. negotiating and performing the agreement, which is the legal basis for the processing in the case of persons representing the entity. The data will be processed for the period required by law, in particular by accounting regulations,
   2. negotiating contracts,
   3. evidence in connection with claims, which is the legitimate interest of the Data Controller. The data will be processed until the claims become time-barred.
5. Video surveillance (CCTV) of the office and construction site premises for the purpose of ensuring the safety of persons present on the premises and the security of property, which is the legitimate interest of the Data Controller. The data will be processed for a period of 1 month and, in the case of pending court proceedings, until the proceedings are concluded.

III. Data recipients:

1. employees and associates of the Data Controller authorised to process the data,
2. processors processing personal data on behalf of the Controller and solely on the basis of a data processing agreement, including in the areas of IT services, debt collection, advisory services, marketing services, and property management and administration services,
3. if a decision is made to conclude a development agreement, the data will also be disclosed to a notary's office for the purpose of preparing the agreement,
4. credit advisers in connection with loan agreements being concluded,
5. banks maintaining residential escrow accounts, in connection with the account maintained.

IV. Principles of personal data collection

Providing data to the extent necessary to conclude an agreement is voluntary; however, failure to provide them will make it impossible to conclude the agreement. Providing data for marketing purposes is voluntary.

V. Rights related to the processing of personal data

The data subject may exercise the following rights against the Controller:

1. the right to request access to their personal data and to obtain information about their processing and, should the data be inaccurate, the right to request their rectification (in accordance with Articles 15 and 16 GDPR),
2. the right to request restriction of the processing of their data in the situations and in accordance with the rules set out in Article 18 GDPR (The data subject may request restriction of the processing of their personal data for the period necessary to verify their accuracy or until their objection to the processing has been considered. This right is also available where, in the data subject's opinion, the processing of their data is unlawful but they do not wish the data to be erased immediately, or where they need the data for longer than the envisaged processing period for the establishment or defence of claims),
3. the right to request erasure of data in accordance with Article 17 GDPR (the “right to be forgotten”),
4. the right to data portability in accordance with Article 20 GDPR, i.e. to receive from the Controller their personal data in a structured, commonly used and machine-readable (computer-readable) format, and to request that they be transmitted to another data controller; this right applies only to data provided to the Controller by the data subject which are processed in connection with the performance of a contract and are in electronic form,
5. the right to withdraw, at any time, consent previously given to the processing of their personal data, which will not, however, affect the lawfulness of the processing of personal data carried out on that basis before the right to withdraw consent was exercised,
6. the right to object at any time to the processing of their personal data on grounds relating to their particular situation, where the data are processed by the Controller for the purposes of its legitimate interests (in accordance with Article 21(1) GDPR),
7. the right to object at any time to the processing of their personal data for direct marketing purposes (in accordance with Article 21(2) GDPR).

To exercise the above rights, please contact the Data Controller.

In addition, the data subject has the right to lodge a complaint concerning the processing of their personal data with the President of the Personal Data Protection Office (address: 2 Stawki Street, 00-193 Warsaw).

VI. Security management

1. All personal data are processed in compliance with the processing principles laid down by law:
   1. in every case where at least one of the legal grounds for processing provided for by law exists,
   2. the data are processed fairly and in a transparent manner,
   3. personal data are collected for specified and explicit purposes and not further processed in a manner incompatible with those purposes,
   4. personal data are processed only to the extent necessary to achieve the purpose of the processing,
   5. personal data are accurate and, where necessary, kept up to date,
   6. the data retention period is limited to the period necessary to achieve the purposes for which the data were collected, and after that period they are anonymised or erased,
   7. the information obligation towards the data subject is fulfilled in accordance with Articles 13 and 14 GDPR, depending on the source from which the data were obtained.
2. The data are protected against breaches of the rules on their protection.
3. VINCI Immobilier Polska sp. z o.o. implements appropriate technical and organisational measures to ensure, when processing personal data, a level of security appropriate to the potential risk of infringement of the rights or freedoms of natural persons, of varying likelihood and severity.
4. VINCI Immobilier Polska sp. z o.o. takes the necessary steps to ensure that its employees and associates provide guarantees that appropriate security measures are applied whenever they process personal data on behalf of the Controller.

VII. Personal data breaches

1. If a personal data breach is identified, the Controller assesses whether the breach may have resulted in a risk to the rights or freedoms of natural persons.
2. In every situation in which the breach may have resulted in a risk to the rights or freedoms of natural persons, the Controller notifies the supervisory authority of the data protection breach without undue delay – where feasible, not later than 72 hours after having become aware of the breach.
3. If the risk to rights and freedoms is high, the Controller also notifies the data subject of the incident.
4. In accordance with Article 33(5) GDPR, the Controller documents all personal data breaches.

VIII. Entrustment of personal data processing

1. The Data Controller may entrust the processing of personal data to another entity only by way of an agreement concluded in writing, in accordance with the requirements laid down for such agreements in Article 28 GDPR.
2. Before entrusting the processing of personal data, the Controller, where possible, obtains information about the processor's existing practices regarding the security of personal data.

IX. Cookies and Google Analytics

1. The website uses cookies. These are small text files sent by a web server and stored by the computer's browser software; they are saved on the end user's device in order to facilitate navigation and to adapt the website to the user's preferences. They allow your individual settings to be remembered and enable you, for example, to log in to your e-mail account. Blocking the storage of cookies on the terminal device, or deleting them, is possible once the web browser settings have been configured appropriately; however, this may cause difficulties or prevent some of the website's functions from working. Failure to change the web browser settings to settings that block the storage of cookies is tantamount to consenting to their storage.
2. This website uses two types of Cookies:
   1. session cookies, which are permanently deleted when the User's browser session ends,
   2. persistent cookies, which remain on the User's device after the browser session ends, until they are deleted.
3. Neither session nor persistent Cookies make it possible to establish the User's identity. The Cookies mechanism does not allow any personal data to be retrieved.
4. Files generated directly by the Website cannot be read by other websites. Third-party Cookies (i.e. Cookies placed by entities cooperating with VINCI Immobilier Polska sp. z o.o.) may be read by an external server.
5. Users may change their Cookies settings themselves at any time, specifying the conditions of their storage, via the web browser settings or through the service configuration. Users may also delete the Cookies stored on their device themselves at any time, in accordance with the browser manufacturer's instructions.
6. The User may disable the storage of Cookies on their device, in accordance with the browser manufacturer's instructions, but this may render some or all of the Website's functions unavailable.
7. Detailed information on how Cookies are handled is available in the settings of the web browser used by the User.
8. The website may store HTTP requests; consequently, certain information may be recorded in the server log files, including the IP address from which the request originated, the name of the User's workstation – identification performed via the HTTP protocol, where possible – the system date and time of registration and receipt of the request, and information about errors that occurred during the performance of the HTTP transaction. Logs may be collected as material for the proper administration of the Application. Only persons authorised to administer the IT system have access to this information. Log files may be analysed in order to compile statistics on traffic on the Website and on errors that occur. A summary of such information does not identify the User.
9. The website uses Google Analytics tools. More information on the use of Google Analytics tools is available at: http://www.google.com/analytics/learn/privacy.html . To give users of our website more choice as to how their data collected by Google Analytics tools are used, Google has developed a browser add-on that blocks Google Analytics. The add-on communicates with the Google Analytics JavaScript protocol (ga.js) to indicate that information about website visits should not be sent to Google Analytics. The Google Analytics opt-out browser add-on does not block data from being sent to the website itself or to other web analytics services.

X. Correspondence

You can contact us:

• by traditional post – by letter to the following address: 32 Domaniewska Street, 02-672 Warsaw
• by e-mail – [email protected]
• by telephone on 22 202 60 02

Effective from 7 January 2020.

Last updated: 9 July 2024.