BPI Piano Forte Sp. z o.o.

1. Introduction

1.1. This document constitutes the privacy policy (hereinafter referred to as the "Policy") of BPI Piano Forte Sp. z o.o., with its registered office in Warsaw, at ul. Komitetu Obrony Robotników 48, registered in the register of entrepreneurs kept by the District Court for the Capital City of Warsaw, XIII Commercial Division of the National Court Register, under KRS number: 0000812200, REGON: 384789205, NIP: 5223171770 (hereinafter referred to as the "Administrator" or "We").

1.2. The purpose of the Policy is to define the principles and methods of processing personal data obtained from individuals who are users of websites administered by the Administrator (hereinafter referred to as the "User"). The Policy also contains information regarding the rights of individuals concerning the personal data they have provided.

1.3. The legal basis for this Policy is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as "GDPR"), as well as the Personal Data Protection Act of 10 May 2018 (Journal of Laws 2018, item 1000). The Policy constitutes the fulfillment of the Administrator's obligations under Articles 12 and 13 of the GDPR.

1.4. This Policy applies to any website, application, or service that refers to this information, as well as to data provided through them, via telephone, electronically, or in person at the Administrator's registered office. Please note that when leaving the websites administered by the Administrator (e.g., by following a link to another domain), the User enters an area where this Policy does not apply. The Administrator is not responsible for the privacy policies in place on websites operated by other entities.

2. Data Controller

2.1. BPI Piano Forte Sp. z o.o. is the data controller of personal data provided by Users of the websites who have visited and used the functionalities offered by the websites administered by the Administrator (hereinafter referred to as "Websites"):
www.apartamenty-pianoforte.pl

2.2. When collecting personal data, the Administrator records information about the source of its acquisition. The acquisition of Users' personal data occurs directly from the individuals concerned, as well as from third parties.

2.3. The Administrator takes special care to ensure that personal data is processed in accordance with the purpose for which it was collected and used, in compliance with the legal requirements, particularly in line with the principles set out in Article 5 of the GDPR.

3. Purposes and Legal Basis for Processing Personal Data

I. Contact via Telephone, Email, or Live Chat with Customer Service

• We process your contact details and other data you provide during the conversation or in correspondence. These data have been obtained directly from you. Please note that all telephone calls made via the helpline are recorded.

• We process your data for the legitimate interests of the Administrator (Article 6(1)(f) of the GDPR), including:
  a) Handling ongoing contacts, including responding to your inquiries;
  b) Ensuring proper customer service – improving the customer service process and the quality of services provided, monitoring emails and telephone conversations, and conducting analytical and statistical activities related to customer service;
  c) Establishing, pursuing, and defending claims.

• Providing personal data is voluntary but necessary to receive a response. Failure to provide personal data will result in the inability to process your inquiry and the subsequent deletion of your message.

• Personal data is stored for the duration of handling your inquiry.

II. Receiving Marketing Communications via Email

• If you have consented to receiving marketing communications from us, we process your personal data necessary for such transmissions, such as your email address or phone number, and optionally your postal code. These data have been obtained from you.

• We process your data to pursue the legitimate interests of the Administrator (Article 6(1)(f) of the GDPR), consisting of conducting marketing activities by sending commercial information to persons who have agreed to receive such content.

• Providing your email address or phone number is voluntary, but necessary for sending marketing content. If you do not provide it, we will not be able to send you the messages.

• Personal data is stored until you withdraw your consent to receive marketing content, effectively object to marketing activities, or until our interest in such activities ceases.

4. Recipients of Personal Data

4.1. Recipients of personal data provided to the Administrator by the data subjects include the following entities, which receive personal data in the minimal necessary scope required to fulfill the purposes for which the data was collected:

• Authorized personnel of the Administrator;

• Entities processing personal data on behalf of the Administrator (e.g., accounting firms, technical service providers, hosting service providers);

• Entities with which the Administrator has concluded data processing agreements;

• Relevant authorities authorized under applicable laws.

4.2. The Administrator declares that it does not sell, share, or transfer the collected personal data to other individuals or institutions unless it is done with the explicit consent or request of the data subject or at the request of legally authorized state authorities.

5. Transfer of Personal Data Outside the European Economic Area (EEA)

Since the Administrator uses applications whose servers are located outside the EEA, personal data collected in connection with Users’ use of the websites may be transferred to third countries. The Administrator ensures that only providers guaranteeing a high level of personal data protection are used.

6. Rights of Data Subjects

6.1. Data subjects have the right to:

• Access their personal data;

• Rectify personal data;

• Erase data (“right to be forgotten”);

• Restrict data processing;

• Object to data processing.

6.2. Where data processing is based on the legitimate interest of the Administrator, the data subject has the right to object at any time without providing a justification, particularly when the legitimate interest involves direct marketing.

6.3. Data subjects can withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

7. Complaints

In the event of a violation of rights arising from the law and this Policy, Users have the right to file a complaint with the Personal Data Protection Office in Warsaw at ul. Stawki 2.

8. Final Provisions

Any matters not regulated by this Policy shall be governed by EU and national data protection laws.
Last update of this Policy: 27.01.2025