Pursuant to Article 13 of the Regulation of the European Parliament and of the Council (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as: “GDPR“), Asbud Management Sp. z o.o. in Warsaw (hereinafter referred to as the “Company“) hereby announces the rules for processing your personal data in the Company:
- Who is the controller of my personal data?
The Company under the business name Asbud Management Spółka z o.o. with its registered office at 30 Karolkowa St., Warsaw, +48 22 622 18 63 is the controller of your personal data.
- What are the purposes (grounds) for processing my personal data by the Company?
Your personal data will be processed for the purposes of advertising, statistics, direct marketing, promotion, information about the company’s activities, performing the contract which you are a party to or taking on acts at your request which may be necessary to enter into any contract with us, finally also for the purposes of the legitimate interests pursued by the data controller as indicated in the further part of this information.
In any case of the processing of your personal data by our Company, there is at least one of the above grounds. The Company does not process personal data if it is not able to prove that such processing is necessary for the fulfilment of any of the above purposes.
- Where does the Company have my personal data from?
We have probably obtained your personal data directly from you – at the time of the direct contact between you and the Company (regardless of which party the contact was initiated by).
It may happen that it was not you who provided us with your personal data – in such case your personal data most probably come from your next of kin or friends, or direct co-workers who when contacting us for some reason decided that we should also have your personal data. Most frequently, it applies to the situations where the Company is to aim its operations not only directly at the person who has addressed the Company but at the request of those persons – also at third parties concerned that do not address the Company directly or do not initiate any contact with the Company in this respect (e.g. it applies to people indicated as “cc” in the address list in e-mail enquires sent to the Company).
Also, we frequently need to have personal data of people who have not shared them with us directly in order to be able to enter into a proper contract for the purchase of the Company’s products with all the relevant entities (e.g. if a married couple or several people purchase premises as joint ownership, at some point we have the personal data of both spouses or all future joint owners – even when only one of the spouses or one of the future joint owners addresses the Company directly).
Upon obtaining your personal data as described above, we can take authorised actions in relation to you in order to fulfil the purposes described in section 2 above.
- If the Company has not obtained my personal data from me, which categories of my personal data does the Company process?
The categories of the personal data not obtained directly from the data subjects concerned which the Company usually processes include: identification data (forename / middle name, surname/surnames, sex, age, marital status, type of the matrimonial regime /if applicable/, Polish Resident Identification Number (PESEL), Personal Identification Number (NIP), type and number of the identity card and contact details (contact address, e-mail address, contact telephone number). In the case of people – representatives of the legal persons / guardians of a legal person – we also have information on the position held in the structures of such legal person. The scope of personal data which the Company processes, depends on the individual circumstances and needs, and may vary; we try to make every effort to minimise the need for possessing specific categories of data.
- What are the legal grounds for the processing of my personal data by the Company?
The processing of your personal data requires a legal ground. The GDPR provides for several types of such legal grounds, and in the case of the Company we, essentially, have three legal grounds for the processing of personal data:
- Article 6(1)(a) of the GDPR – the data subject’s consent to the processing of his or her personal data – this ground for the lawfulness of the processing of personal data, in principle, only occurs if we want to provide you with marketing and sales information or information originating from third parties (outside the Company) or when we want to process specific types of personal data (so-called sensitive data); however we strive to make sure that marketing, commercial or promotional content which we would like to transfer is not addressed to people who refuse to receive such information – hence, before we undertake marketing, advertising or promotional activities, we will try to obtain your consent to the processing of your personal data in the above-mentioned authorised purposes;
- Article 6(1)(b) of the GDPR – the necessity to perform a contract which the data subject is a party to or to take actions at the request of the data subject prior to entering into a contract – this ground for the lawfulness of the processing of personal data by the Company will occur relatively frequently – in a situation where we enter into a contract with you for the purchase of a product or products of the Company or we undertake preparatory operations aimed at entering into such contract at your request;
- Article 6(1)(f) of the GDPR – legitimate interests pursued by the controller – this ground will occur the most frequently. It applies to cases where the processing of your personal data is authorised based on our legitimate needs.
- What is the legitimate interest pursued by the data controller?
The legitimate interests of the controller include marketing of the Company’s own products and the need for the implementation of the primary object of the Company, which are property developer activities. To this end we process your personal data to:
- be able to contact you as part of the authorised marketing activities, in particular and upon your consent – by e-mail and on the phone;
- support your requests, applications, enquiries etc. received particular by the Sales Department or (where applicable) or by the Technical Department or via the contact form in a situation where they do not relate directly to the performance of any contract entered into with the Company;
- be able to organise loyalty programmes, competitions and promotional campaigns in which you can participate;
- be able to enhance our products and tailor them to the needs and the convenience of future users/buyers of premises as part of our property developer investment
- be able to conduct debt collection; legal, arbitration and mediation proceedings;
- be able to conduct statistical analyses;
- store personal data for archiving purposes and ensure accountability (i.e. demonstrate that the Company fulfils the obligations arising from the provisions of the law);
- in addition, the provision of the law may require us to process your data for tax, accounting and financial reporting purposes.
- Who, in accordance with the law, is the Company allowed to share my personal data with?
Your personal data, depending on the particular needs justified by the legal or factual relationship binding upon us, may be shared with: (1) direct marketing, legal and accounting advisers to the Company – for the purposes related to the preparation of the quotation to purchase a product or products of the Company and for their legal and formal assessment; (2) audit companies – for the purposes of auditing the annual reports on the Company’s operations; (3) IT company that supports (services) the Company’s ITC system; (4) operator of the CRM system used by the Company’s Sales Department; (5) selected state institutions and industry organisations in accordance with the applicable legislation in Poland; (6) shareholders of the Company – for the purposes related to the fulfilment of the reporting or information obligations of the Company in relation to its shareholders and in order to make sure that the shareholders exercise their rights attached to the shares in the Company; (7) notary public’s offices in order to enter into a preliminary, property developer or promised contract, or to grant powers of attorney arising from the contract entered into with you, or to prepare declarations for those contracts in the form of notary deeds; (8) banks that finance the construction of the property developer investment project covered by the contract entered into with you, and operators of individual housing accounts for the buyers of premises in such investment project; (9) banks or institutions financing the premises that you purchase and that are covered by the contract entered into with you; (10) architectural offices in connection with agreements entered into with you, for the implementation of the premises, including in particular in connection with the so-called tenement changes in the premises; (11) companies cooperating with the Company involved in designing, arranging or finishing interiors in your premises; (12) entities performing, at the request of the Company, technical operations in the property developer investment project covered by the contract entered into with you (e.g. acceptance of the premises, repair in the premises or common areas, finishing/installation work in the premises or common areas, guarantee inspections and inspections during the implied warranty period); (13) companies supplying utilities to the premises and property covered by the contract entered into with you; (14) housing association and manager of the property where the premises described in the contract entered into with you are located; (15) your direct advisers (legal, accounting, investment and premises purchase intermediary advisers, etc.) – at your explicit request.
The above-mentioned list and enumeration are illustrative and in specific situations your personal data will be delivered only to the selected recipients and in accordance with the legitimate need.
- Will the Company transfer my personal data to a third country (i.e. outside the EEA) or international organisation?
Your personal data will not be transferred to a third country / international organisation without your consent, but they may be transferred to a third
country, if the administrator of your e-mail you use for contacting the Company, uses servers located physically outside the EEA.
- How long will my personal data be stored in the Company?
Your personal data will be stored as long as there are grounds for their processing – that is, if you consent to the above – until your consent is withdrawn, limited or otherwise restricted; if your personal data are required to perform the contract, your personal data will be stored throughout the performance of the contract and the time required to resolve claims under the contract, and where the ground for the processing of the data is the controller’s legitimate interest – until such legitimate interest exists (i.e. until the date on which further processing of your personal data is unfounded in view of the purpose it was to serve).
- What rights do I have with regard to the processing of my personal data by the Company?
In connection with the processing of your personal data by the Company you have:
- the right to withdraw, at any time, your consent to the processing of your personal data, if your data are processed on this basis in the Company – without affecting the lawfulness of processing based on your consent before its withdrawal pursuant to Article 13(2)(c) of the GDPR,
- the right of access to the content of your personal data pursuant to Article 15 of the GDPR,
- the right to rectification of your personal data pursuant to Article 16 of the GDPR,
- the right to erase your personal data pursuant to Article 17 of the GDPR (this right may not be at variance with the applicable legislation in Poland),
- the right to restriction of the processing of your personal data pursuant to Article 18 of the GDPR,
- the right to object to the processing of your personal data pursuant to Article 21 of the GDPR,
- the right to the portability of your personal data pursuant to Article 20 of the GDPR,
- If you believe that the processing of your personal data infringes the provisions of the GDPR, you also have the right to lodge a complaint with the President of the Office for the Protection of Personal Data.
- Do I have to give the Company my personal data?
Giving your personal data as required is necessary for the Company to fulfil the purpose referred to in section 2 above. The provision of your personal data is voluntary, but failure to give the data results in the Company not being able to perform the operations referred to in section 2 above
- Will the Company take decisions regarding me by automated means or conduct automatic profiling (e.g. via algorithms)?
The Company does not take decisions by automated means or conduct automatic profiling of your personal data. Your personal data will be processed both manually and with the use of the ICT system.
- Does the Company have specific procedures in place to protect my personal data?
In the Company we attach an exceptional importance to the protection of your personal data we have obtained. To this end we have implemented the Personal Data Protection Policy in our business in accordance with the requirements of the GDPR, the compliance with which provides protection of your personal data you entrusted with us, against unauthorised processing. It is one of our top priorities to proceed in accordance with the Personal Data Protection Policy.