Privacy and Cookie Policy

This Privacy Policy sets out the rules for the processing and protection of personal data provided by users in connection with their use of the website www.pba.pl (hereinafter: the “Website“).

Data Controller

1. The controller of personal data collected on the website pba.pl is GEO PROPERTY GROUP POLSKA JUSTYNA LIPKA SPÓŁKA KOMANDYTOWA, with its registered office at Boduszewo 15A, 62-095 Boduszewo, Poland, REGON (statistical number) 380794043, NIP (tax identification number) 782-282-74-10 (hereinafter: the “Controller“).
2. The Controller can be contacted on matters relating to personal data protection at the e-mail address kontakt@pba.pl
3. The Controller takes particular care to protect the interests of data subjects and, in particular, ensures that personal data are:
   1. processed lawfully,
   2. collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes,
   3. factually accurate and adequate in relation to the purposes for which they are processed,
   4. kept in a form which permits identification of data subjects for no longer than is necessary to achieve the purpose of processing.
4. The Controller fully ensures the security of personal data, including guaranteeing influence over the scope of the data processed, and facilitates the exercise of all rights to which data subjects are entitled. To protect the personal data entrusted to it, the Controller acts on the basis of internal procedures and recommendations that comply with the relevant data protection legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Purpose, Scope and Legal Basis for Processing Personal Data

1. The Controller processes personal data for various purposes, but always in accordance with the law and on the appropriate legal basis:
   1. To handle an enquiry submitted via the contact form or directly by electronic means, the personal data provided are processed, such as first name, surname and contact details. The legal basis for such processing is Art. 6(1)(b) GDPR. If the person submitting the enquiry also provides other data, this is deemed to be consent to the processing of those data as well. In that case, the legal basis for processing is Art. 6(1)(a) GDPR, which permits the processing of personal data on the basis of freely given consent;
   2. Where an offer is accepted or an order is placed, the following personal data are processed for the purpose of concluding and performing the contract, i.e. on the basis of Art. 6(1)(b) GDPR: first name and surname, home address (if provided), PESEL number (Polish personal identification number) or NIP (tax identification number), identity document details, e-mail address and business details (if provided), such as: business name, registered office address, NIP number, REGON number.
   3. For the marketing purposes of the Controller, cooperating entities and authorised entities, for the analysis and personalisation of the offer presented on the Website, as well as for promoting the Controller’s services and managing services, pursuant to Art. 6(1)(f) GDPR;
   4. For the purpose of establishing, pursuing or defending against claims, the following personal data are processed: first name and surname, home address (if provided), PESEL number or NIP number, identity document details, e-mail address (if provided) and business details (if provided), such as: business name, registered office address, NIP number, REGON number. The legal basis for such processing is Art. 6(1)(f) GDPR, which permits the processing of personal data where the Controller thereby pursues its legitimate interest (in this case, the Controller’s interest is to hold personal data that make it possible to establish, pursue or defend against claims, including those of customers and third parties);
   5. For archiving and evidential purposes, the following personal data are processed: first name and surname (if provided) and e-mail address, in order to secure information that may serve to demonstrate legally relevant facts. The legal basis for such processing is Art. 6(1)(f) GDPR, which permits the processing of personal data where the Controller thereby pursues its legitimate interest (in this case, our interest is to hold personal data that make it possible to prove certain facts related to the provision of services, e.g. when a public authority requests it);
   6. For the purpose of fulfilling obligations imposed on the Controller by law (Art. 6(1)(c) GDPR);
   7. For analytical purposes, i.e. examining and analysing activity on the Website, the following personal data are processed: date and time of the visit, type of operating system, approximate location, type of web browser used to view the website, time spent on the website, subpages visited and the subpage on which the contact form was completed. The legal basis for such processing is Art. 6(1)(f) GDPR, which permits the processing of personal data where the Controller thereby pursues its legitimate interest (in this case, the Controller’s interest is to understand customer activity on the website);
   8. For the purpose of administering the website, the following personal data are processed: IP address, server date and time, information about the web browser and information about the operating system. These data are recorded automatically in so-called server logs each time the website www.pba.pl is used. Administering the website would not be possible without a server and without this automatic recording. The legal basis for such processing is Art. 6(1)(f) GDPR, which permits the processing of personal data where the Controller thereby pursues its legitimate interest (in this case, the Controller’s interest is the administration of the website).
2. Providing personal data is voluntary and depends on the decision of the person providing them. However, in some cases providing certain personal data is necessary, for example to contact the person in order to handle a request for a quotation, to perform a contract, or to meet the expectations of Website users with regard to its use.

Cookies

1. The Website uses cookies. Cookies contain data in text form and are stored on the user’s end device. Cookies usually contain the name of the website they come from, their storage time on the end device and a unique number.
2. When a user visits the Website for the first time, a banner explaining cookies is displayed. By clicking the “Save preferences” button, the user consents to the Controller’s use of the categories of cookies and plug-ins selected in the pop-up window, in accordance with the preferences chosen. As described below, the user may disable cookies via their browser, but should bear in mind that the Website may then not function properly.
3. The entity placing cookies on the Website user’s end device and obtaining access to them is the Controller. The legal basis for such processing is Art. 6(1)(a) GDPR, which permits the processing of personal data on the basis of freely given consent.
4. Cookies do not store any information that could constitute the user’s personal data and are not used to establish the user’s identity.
5. Web browsing software (a web browser) usually allows cookies to be stored on the user’s end device by default. Website users may change these settings: the web browser allows cookies to be deleted, and cookies can also be blocked automatically. For details, please consult your browser’s documentation. However, restricting the use of cookies may affect some of the functionalities available on the Website.
6. Cookies are used for the following purposes:
   1. influence on processes and performance when using the website: cookies are used so that the website runs smoothly and its features can be used, which is possible, among other things, by remembering settings between successive visits. They therefore make it easy to navigate the website and its individual subpages;
   2. session state: cookies often store information about how visitors use the website, e.g. which subpages they view most often. They also make it possible to identify errors displayed on some subpages. Cookies used to store the so-called “session state” therefore help improve services and increase browsing comfort;
   3. creating statistics: cookies are used to analyse how users use the website (how many people open it, how long they stay, which content attracts the most interest, etc.). This makes it possible to continuously improve the website and adapt it to users’ preferences. To track activity and create statistics, the Controller uses Google tools such as Google Analytics. In addition to reporting website usage statistics, Google Analytics, together with some of the cookies described above, may also help display more relevant content to the user in Google services (e.g. in Google Search) and across the web;
   4. displaying advertisements: this type of cookie makes it possible to tailor advertisements, which allow websites to be used free of charge, to users’ preferences and habits. They make it possible to deliver advertising content better suited to users’ interests and needs and to assess the effectiveness of advertising activities.
7. Analytical cookies are used in cooperation with the Controller’s analytics partners to collect information about the use of the website, such as pages visited, traffic sources and other website metrics:
   1. Google Analytics: collects information that reports trends on the website without identifying individual visitors. These cookies track information such as the duration of the visit, whether the visitor has been to the website before and which website referred the user to the Website. More information is available at: https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/partner-sites?hl=en
   2. Google Tag Manager: makes it possible to collect information about actions performed by users on the Website, such as triggering various events. This allows the website’s analytics to be configured more effectively. More information is available at: https://policies.google.com/privacy?hl=en
8. The Controller uses marketing tools available within the Facebook service. Within these tools, it targets advertisements at audiences on that service, based on users’ consent. In order to target advertisements personalised according to users’ behaviour on the Website, the so-called Facebook Pixel has been implemented on it, which automatically collects information about the use of our website with regard to the pages viewed. The information collected by the Facebook Pixel is anonymous, i.e. it does not allow users to be identified. However, please note that Facebook may combine this information with other information about the user collected through their use of Facebook and use it for its own purposes, including marketing. More information is available at: https://www.facebook.com/privacy/explanation.

Rights of Data Subjects

1. Persons whose data are processed by the Controller have the right to:
   1. access their personal data;
   2. rectification of their personal data;
   3. erasure of their personal data;
   4. restriction of processing of their personal data;
   5. object to the processing of their personal data;
   6. data portability.
2. The above rights are not absolute, and therefore in certain situations the Controller may lawfully refuse to comply with them. This may be the case where refusal of the request is necessary or where there are compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subjects, in particular for the establishment, pursuit or defence of legal claims.
3. Data subjects may exercise their rights by sending an e-mail to kontakt@pba.pl.
4. Data subjects have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).
5. Where personal data are processed on the basis of consent, the data subject may withdraw that consent at any time:
   1. To withdraw consent to the processing of personal data, please send an e-mail to kontakt@pba.pl or a letter by post to the address of the Controller’s registered office. Where personal data were processed on the basis of consent, its withdrawal does not render the processing carried out up to that point unlawful. Thus, until consent is withdrawn, the Controller is entitled to process personal data, and its withdrawal does not affect the lawfulness of the processing carried out before.
   2. Cookie storage preferences can be changed at any time as described below.

Recipients of Personal Data

1. In certain situations, the Controller is entitled to transfer personal data to other recipients if this is necessary for the performance of a concluded contract or for the fulfilment of the Controller’s obligations. This applies to the following groups of recipients: IT and hosting service providers, postal and courier operators, providers of legal services, banks, insurers, law firms and other entities cooperating in the performance of orders (to the extent necessary to achieve the purpose of processing).
2. Data of Website users, such as cookies relating to their visit to the Website, are also transferred to online advertising operators such as Google or Facebook.
3. On the basis of an applicable legal provision or a decision of a competent authority, the Controller may also be obliged to transfer personal data to other entities, whether public or private.

Period of Processing Personal Data

1. The Controller processes personal data only for as long as is necessary to achieve the intended purpose. After this period, the personal data will be irreversibly deleted or destroyed.
2. The Controller makes every effort to limit as far as possible the storage period of personal data that are no longer used. However, for technological and operational reasons, the actual time needed to delete data from backup copies may be longer. An additional 30 days should be added to the periods indicated below for the deletion of data from backup copies.
3. With regard to the individual periods of processing personal data, please be informed that data will be processed:
   1. in the case of contact or an enquiry: for the duration of the correspondence on the matter and for the time necessary to achieve the purpose arising from the content of the enquiry. Subsequently, depending on the outcome of the correspondence, the data will either be added to the customer database and further processed for the purpose of performing a contract, or deleted if no cooperation is established. Where the discussions are clearly concluded, the data will be promptly deleted from the working system databases. Where a contract is concluded, the data will be processed for the time necessary to perform it and to exercise the rights and obligations arising from it, including the time necessary to fulfil the Controller’s statutory obligations and to pursue and defend against claims,
   2. until consent is withdrawn or the purpose of processing is achieved, but for no longer than 10 years, with regard to personal data processed on the basis of consent;
   3. until an objection is effectively raised or the purpose of processing is achieved, but for no longer than 10 years, with regard to personal data processed on the basis of the Controller’s legitimate interest,
   4. until the data become outdated or cease to be useful, but for no longer than 10 years, with regard to personal data processed mainly for analytical purposes, the use of cookies and website administration.

Automated Decision-Making, Profiling and Transfer of Data to Third Countries

1. Website users may be subject to automated decision-making, including profiling, for the purpose of providing services under a concluded contract and for the purpose of the Controller’s marketing activities.
2. Personal data are not transferred to third countries within the meaning of data protection legislation. This means that we do not transfer them outside the European Union.