1). The customer acknowledges that his or her personal data will be processed by Vastint Poland spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, ul. Żwirki i Wigury 16B, 02-092 Warsaw, hereinafter referred to as the "Administrator", in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as "GDPR"). The Administrator can be contacted by email: info.poland@vastint.eu and by correspondence: Vastint Poland sp. z o.o., ul. Żwirki i Wigury 16B, 02-092 Warsaw and by phone at +48 22 820 91 51.

2). The Customer's personal data in the form of name and surname, e-mail address and telephone number will be processed in order to:

1. provide marketing, promotional information and offers regarding the Administrator's investments by e-mail and/or telephone based on the Customer's consent, if such consent has been given (legal basis of Article 6(1)(a) of the GDPR) - until the consent is withdrawn or at the latest by the moment of completion of the sale of apartments
2. conduct direct marketing of products and services (legal basis: Article 6(1)(f) of the GDPR) - until the purpose of processing ceases
3. take action at the Customer's request before concluding the contract, if such a request has been expressed by the Customer (legal basis: Article 6(1)(b) of the GDPR) - for the time related to taking actions aimed at concluding the contract
4. arrange a meeting with the Customer regarding the services provided by the Administrator and the products offered, which is the Administrator's legitimate interest (legal basis: Article 6(1)(f) of the GDPR) - until an objection to processing is raised or the purpose of processing, depending on which event occurs first
5. perform an activity analysis, which will allow for the presentation of personalized content, based on the Customer's consent, if such consent has been given (legal basis: Article 6(1)(a) of the GDPR) - until the consent is withdrawn
6. make a possible determination, investigation or defense against claims (legal basis: Article 6(1)(f) of the GDPR) - no longer than it is necessary until the expiry of the relevant limitation period for claims provided for in the provisions of the Civil Code, i.e. up to 6 years
7. fulfill the legal obligations incumbent on the Administrator (legal basis: Article 6(1)(c) of the GDPR) - for a period in accordance with applicable law.

3). The recipient of the Customer's personal data may be:

1. entities processing data on behalf of the Administrator, participating in the Administrator's performance of specific activities: providers of IT systems and IT services; entities providing the Administrator with advisory, consulting, marketing, auditing, organizational, legal, tax, accounting and property management services, where such entities process data on the basis of an agreement with the Administrator and only in accordance with the Administrator's instructions
2. entities from the INTEROGO HOLDING AG capital group
3. authorities authorized to receive the Customer's data on the basis of legal provisions.

4). Personal data may also be transferred to some subcontractors of IT system providers who are located in countries outside the European Economic Area for which the European Commission has not found an adequate level of personal data protection. If personal data is transferred outside the EEA, the Administrator will introduce appropriate safeguards to ensure that such transfer takes place in accordance with applicable data protection regulations.

5). Providing data is voluntary. The consequence of not providing this data will be the inability to process the Customer's personal data for the purpose of direct marketing of products and services, or to take action at the Customer's request before concluding the contract or arranging a meeting with the Customer regarding the services provided by the Administrator and the products offered.

6). Each person has the right to access their data and rectify, delete, limit processing, the right to transfer data, the right to object to processing and the right to withdraw consent at any time without affecting the lawfulness of processing. A declaration of withdrawal of consent to the processing of personal data must be submitted in writing or electronically to the e-mail address:  info.poland@vastint.eu.

7). Each person has the right to lodge a complaint with the President of the Office for Personal Data Protection [Prezes Urzędu Ochrony Danych Osobowych], if they consider that the processing of their personal data violates the provisions of the GDPR.

8). The Customer's personal data will be processed in an automated manner, including in the form of profiling. Automated decision-making will take place on the basis of the use of data left in contact forms and information about the Customer's activity on the website (identification of interests in specific premises, content and the way of using the website). The consequence of such processing will be the creation of personalized marketing communication (display of personalized messages) and the transfer of data to the Administrator's sales department.

9). Profiling means the processing of personal data consisting in the use of the Customer's personal data to assess some of the Customer's characteristics, in particular to identify interests in specific premises, content and the way of using the website. Making decisions in an automated manner for the purpose of creating personalized marketing communication is based on the consent given by the Customer.