I. General information

1. The controller of personal data collected by means of www.apartamentyostrodzka.pl website is Apartamenty Ostródzka spółka z ograniczoną odpowiedzialnością with its registered seat in Krakow (address: 30-701 Kraków, ulica Zabłocie 23 unit 18, REGON: 367281813, NIP: 9452208488) entered in the Register of Entrepreneurs of the National Court Register at KRS no. 0000678023.
2. Data protection takes place in line with the applicable regulations, including but not limited to the Act on providing electronic services of 18 July 2002 and the Regulation of the European Parliament and the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).
3. To ensure improved understanding of the Privacy Policy, the term “User” and “Customer” was replaced by “You”, and the “Controller” or “Apartamenty Ostródzka” by “We”.
4. We respect the right to privacy and take care of data security. For that purpose, e.g. the communication enciphering protocol (SSL) is used, and personal data is stored on secured servers.
5. Personal data provided in the contact form is considered confidential and is not visible to any unauthorized parties.

II. Purposes and legal grounds of personal data processing by the Controller

1. Apartamenty Ostródzka is a controller of its customers’ data. This means that if you use contact forms on our website or send e-mails to an address of Apartamenty Ostródzka employees on the website, or you have subscribed to a newsletter, we process your personal data, including your name and surname, e-mail address, phone number, address, IP, company name and NIP, as well as other data provided by the User. The Controller does not process special categories of data.
2. Personal data is processed:
   a) compliant with the personal data protection regulations and the Personal Data Security Policy;
   b) in the scope and for the purpose required to establish, phrase the Agreement wording, amend it or terminate it, and to ensure correct performance of Services provided by electronic means (Article 6(1)(b) GDPR);
   c) in the scope and for the purpose required to fulfill the legitimate interests (purposes justified under the applicable law) and processing does not violate any rights and freedoms of the data subject (Article 6(1)(f) GDPR);
   d) in the scope and for the purpose of your consent (Article 6(1)(a) GDPR), e.g.:
   – when you have subscribed to a newsletter;
   – in a commercial contact form;
   – to direct marketing and to sending commercial information by electronic means;
   – to direct marketing and to sending commercial information over the phone.
   e) if is required to fulfill the legal obligation of the Data Controller (Article 6(1)(c) GDPR).
   The data is collected solely in the adequate, required and necessary scope for the purposes of processing.

III. Period when the personal data is stored

1. Personal data is processed for the period required to achieve the processing purposes named in section II above, i.e.:
   – until the User withdraws their consent to such processing (when the consent was granted e.g. to marketing);
   – until there is effective objection made (with respect to the legitimate interests of the Controller);
   – until the legal obligations of the Controller are fulfilled;
   – with respect to performing the agreement or services, data will be processed for the period of performance by Apartamenty Ostródzka and, in justified cases, after its expiry/termination, but solely when this is permitted or required by the applicable law, e.g. processing for statistical, accounting purposes or to pursue claims. In such a case, data will be processed solely for the period required to achieve relevant purposes.
2. We try to reduce personal data storage period as much as possible for any data which is no longer used. Please be informed, however, that this may take place for operating and technological reasons.

IV. Information on the data subject’s rights

1. Every data subject is entitled to access their data, to have it rectified, deleted or to have its processing restricted, to the data portability, to object and to complain to the supervisory body (in Poland, this is President of the Personal Data Protection Office).
2. We reserve the right to process your data after the Agreement is terminated or you withdraw your consent solely for the purpose of pursuing any claims in court or if we are obliged to retain data under domestic or EU, or international law provisions.
3. It is voluntary to provide your personal data with respect to your consent to answering the question in the contact form and to direct marketing and providing commercial information by electronic means and over the phone, although it will not be possible to use the contact form unless you provide such data. If you do not want to give your consent, you can contact us by e-mail, over the phone or in person in sales offices.
4. Data can be deleted as a result of consent withdrawal or making legally permissible objections to personal data processing. Consent can be withdrawn in the form used for its granting, by contacting the Controller using electronic means, over the phone or in the Controller’s seat. The consent withdrawal does not affect the legitimacy of processing carried out under the consent before the withdrawal.
5. The Controller makes every effort to protect data from unauthorized third-party access and uses high-level organizational and technical security measures to that aim.
6. To maintain, develop and analyze relationships with Users and to create statistics and carry out marketing of products and services, Apartamenty Ostródzka uses profiling consisting in using the User’s personal data to assess some of their properties, including but not limited to the analysis or prognosis of personal preferences, interests, locations or traveling.

V. Personal data recipients

1. Personal and operational data of users can be shared with third parties to perform the agreement, in connection with the Controller’s legal liabilities or for purposes stemming from the Controller’s legitimate interests. Data recipients may include, without being limited to:
   (a) Processors employed by Apartamenty Ostródzka to process personal data based on a relevant agreement, e.g. providers of repair and construction or IT services commissioned by Apartamenty Ostródzka if this is required to perform the agreement a party to which is the data subject;
   (b) Public and judicial authorities, including the police, public prosecutor’s office, courts or regulatory authorities, at their request and solely in the scope required by law or to protect Apartamenty Ostródzka rights or the security of a user, Apartamenty Ostródzka employees and Apartamenty Ostródzka resources;
   (c) Legal firms and courts to enforce or perform an agreement with the User.
2. The User’s data is not transferred outside the European Economic Area by default or transferred to intentional organizations. If data is transferred to any third-country recipients, Apartamenty Ostródzka shall employ standard contractual clauses adopted by the European Commission, determining the basic guarantees of the User’s data security.

VI. Social media tools

1. On our websites, we use plug-ins and other social media tools provided by social media, including by Facebook, Instagram, Youtube, LinkedIN.
2. Viewing our website which contains such a plug-in, your browser will connect directly with servers of social media administrators’ (service providers). The plug-in content is transferred directly to your browser by the respective service provider and integrated with the website. Thanks to this integration, the service providers are informed that your browser displayed our website even if you do not have a profile with the service provider or if you are not signed-in at present. Such information (including your IP) is sent directly to the service provider’s server (some servers are situated in the U.S.) and stored there.
3. If you have signed in a social media website, the service provider will be able to ascribe your visit to our website to your profile in the social medial website.
4. If you use the plug-in, e.g. by clicking the “Like” or “Share” button, relevant information will also be sent to the service provider’s server and stored there.
5. What is more, the information will be published on the social media website and displayed to your contacts. The purpose and scope of data collection and its further processing and use by service providers, and the contact opportunities and your rights in this respect, and the opportunity to make settings ensuring your privacy protection are described in privacy policies of individual service providers.
   Facebook – https://www.facebook.com/legal/FB_Work_Privacy,
   Instagram – https://help.instagram.com/519522125107875?helpref=page_content,
   Youtube – https://policies.google.com/privacy?hl=pl,
   LinkedIN – https://www.linkedin.com/legal/privacy-policy.
6. If you do not want social media to ascribe any data collected when you visit our website directly to your profile in the social media, sign out before visiting our website. You can also disable any plug-ins on the website, by using specific extensions for your browser, e.g. script blocking.

VII. Cookies

1. The website uses cookies. They are small text files sent by a web server and stored by the browser software. When the browser reconnects with a page, the website recognizes the device type used by the user to connect. The parameters enable the information included in them to be read solely by the server which created them. Cookies facilitate use of the previously visited websites.
2. The collected information refers to the IP address, type of the browser used, language, operating system type, Internet service providers, information on the time and date, location and information submitted to the website using a contact form.
3. The collected data is used to monitor and verify how our websites are used to facilitate the website operation ensuring more effective and trouble-free navigation. The user information is monitored using tools which record user behavior on the website.
4. Cookies identify the user which enables to match the content of the website used by them with their needs. Remembering their preferences, it enables to adapt the advertisements addressed to them. We use cookies to guarantee the highest standards of our website convenience and the collected data is used solely internally for optimized operation.
5. We use the following cookies on our website:
   a) “essential” cookies enabling to use services offered by the website and ensuring security;
   b) “analytical” cookies helping to improve our website, collecting and reporting information concerning its use;
   c) “marketing” cookies helping us to improve the relevance of the advertising campaigns received by you.
6. The user may disable or restore the cookies collection option at any time by changing their browser settings. Cookies management manual can be found in your software settings (i.e. of your browser: (Chrome, Firefox, Edge, Opera, Safari).
7. Additional personal data, including an e-mail address, is collected solely when the user gave their explicit consent to it when filling in the form. We keep and use the above-mentioned data solely for purposes required to perform the function.
8. Cookies removal or disabling in your browser may result in incorrect website operation and restricted access to its selected functionalities.