This document constitutes the fulfillment of the information obligation referred to in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as: “GDPR”).
This clause is central and universal. It applies to all cases in which the Company processes personal data of natural persons within the scope of its business operations, regardless of the form of data submission (including written contracts, online CTA forms, e-mail correspondence, SMS messages, telephone contact, or direct verbal arrangements).
The Controller of your personal data is GÓRZYŃSCY Spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, ul. Grzybowska 87, 00-844 Warsaw, Poland, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register under KRS number: 0001031112, REGON: 525053441, NIP: 5273052085, with a share capital of PLN 5,000 (hereinafter referred to as: the “Controller”).
In all matters related to data processing and the exercise of your rights under the GDPR, you can contact the Controller:
– In writing to the registered office address: ul. Grzybowska 87, 00-844 Warsaw, Poland.
– Via e-mail: dziendobry@gorzynscy.com.
Your personal data is processed solely for purposes resulting from the specific nature and stage of our legal or business relationship:
A. Taking steps prior to entering into a contract and performance of a contract (including handling inquiries from CTA forms, negotiating and executing real estate brokerage agreements, cooperation agreements, and contracts with contractors and suppliers).
– Legal basis: Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract).
– Storage period: For the duration of negotiations or for the entire term of validity and performance of the concluded agreement.
B. Handling ongoing correspondence and communication (answering inquiries, managing arrangements, and exchanging information via e-mail, SMS messages, telephone, or verbally).
– Legal basis: Article 6(1)(f) of the GDPR (legitimate interest of the Controller consisting in efficient management, building market relations, and handling communication).
– Storage period: For the time necessary to handle the inquiry and definitively close the correspondence (maximum 12 months from the date of the last contact).
C. Compliance with legal and public law obligations (invoicing, maintaining accounting and financial records, tax settlements, and performing verification procedures resulting from the Act on Counteracting Money Laundering and Terrorism Financing – AML).
– Legal basis: Article 6(1)(c) of the GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject).
– Storage period: For the periods strictly specified by the relevant provisions of national law (as a rule, 5 years from the end of the calendar year in which the tax payment deadline expired).
D. Establishment, exercise, or defense of legal claims (safeguarding and protecting the legal, procedural, and property interests of the Company).
– Legal basis: Article 6(1)(f) of the GDPR (legitimate interest consisting in the right to defend one’s rights before courts and other state authorities).
– Storage period: Until the final completion of proceedings or until the expiry of the statutory limitation periods for claims resulting from the Polish Civil Code (as a rule, 3 years for claims related to business activity and 6 years for others).
E. Direct marketing of own products and services (including sending the Newsletter and commercial offers by electronic means or telephone contact for marketing purposes).
– Legal basis: Article 6(1)(a) of the GDPR (explicit, voluntary, and prior consent of the data subject to use a specific communication channel).
– Storage period: Until you withdraw your consent or object to marketing activities.
Your personal data may be shared or entrusted only to external entities closely cooperating with the Controller for operational purposes:
– Authorized employees and associates of the Controller (including associated real estate agents).
– Entities processing data on behalf of the Controller based on data entrustment agreements (hosting service providers, external accounting and HR services, legal advisors, IT and cloud system providers, and operators of dedicated CRM systems for the real estate market).
– Independent data controllers, solely at your express request or with your prior knowledge in order to finalize a transaction (notaries public, property developers, banks, independent financial and mortgage advisors).
– Public administration authorities, courts, and law enforcement agencies, if the obligation to share data results directly from generally applicable provisions of law.
The Controller uses the services of global providers of technological and cloud solutions (such as Google LLC for e-mail and cloud drives, and Meta Platforms, Inc. for advertising systems and communication tools). Consequently, data may be transferred to the United States (USA) based on:
– The European Commission’s adequacy decision of 10 July 2023 – EU-US Data Privacy Framework – in relation to entities entered on the list of certified participants of this program.
– Standard Contractual Clauses (SCC) approved by the European Commission – in relation to entities not covered by the above certification, which guarantees full protection and compliance with European security standards.
The data is not subject to automated decision-making processes that produce legal effects or similarly significantly affect the situation of the data subjects.
In accordance with the provisions of the GDPR, every User has the full right to control their personal data. To exercise the following rights, please contact the Controller at the e-mail address: dziendobry@gorzynscy.com. You have the right to:
– Right of access (Article 15 GDPR): The right to obtain confirmation as to whether or not data is being processed, and to receive the first copy of it free of charge.
– Right to rectification (Article 16 GDPR): The right to request the immediate correction of inaccurate or completion of incomplete personal data.
– Right to erasure (“right to be forgotten” – Article 17 GDPR): The right to request the deletion of data in cases provided for by law (e.g., when the data is no longer necessary or the consent constituting the sole basis for processing has been withdrawn).
– Right to restriction of processing (Article 18 GDPR): The right to request a temporary suspension of data operations. This restriction lasts for the period necessary for the Controller to verify the accuracy of the data or to consider your objection.
– Right to data portability (Article 20 GDPR): The right to receive your data in a structured, machine-readable format (e.g., CSV), if it is processed by automated means on the basis of a contract or consent.
– Right to object (Article 21 GDPR): The right to object at any time to the processing of data based on the legitimate interest of the Controller (Article 6(1)(f) GDPR), including profiling for direct marketing purposes.
– Right to withdraw consent (Article 7(3) GDPR): If the processing is based on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.
You also have the right to lodge a complaint with the competent supervisory authority – in Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland), if you consider that the data operations violate the provisions of law.
Providing personal data is completely voluntary. However, it constitutes a contractual requirement and an indispensable element for the Controller to initiate contact with you, efficiently handle correspondence, prepare a personalized offer, or successfully conclude and perform a brokerage agreement. Failure to provide data will result in the inability to establish and conduct any cooperation with GÓRZYŃSCY Sp. z o.o.
