Privacy policy

1. Personal data controller

The personal data controller is Zarządzanie Nieruchomościami Dominika Frąckowiak, with its registered office at ul. Młynarska 1A, 59-420 Bolków, Poland, hereinafter referred to as the “Controller”.

The Controller may be contacted:

• by using the e-mail address provided in the Contact section,
• by phone at +48 667 911 361,
• by correspondence to the Controller’s registered office.

The Controller has not appointed a data protection officer. Matters concerning personal data protection should be addressed directly to the Controller.

2. Scope of processed data

The Controller may process personal data of property and premises owners, housing-community members, housing-community board members, tenants and residents, contractor representatives, service providers, persons contacting the Controller and other persons whose data is necessary for property management or administration.

Depending on the matter, the data may include in particular:

• first name and surname,
• residential or correspondence address,
• e-mail address and telephone number,
• information concerning a property or premises,
• information concerning the legal title to premises,
• settlement and payment data,
• bank account number,
• data contained in housing-community documentation,
• PESEL number, if processing is justified by the nature of the matter or required by law,
• correspondence content and information provided during contact with the Controller.

The Controller processes only data necessary for specified purposes.

3. Purposes and legal bases of processing

Personal data may be processed for the purposes listed below.

3.1. Concluding and performing contracts

Data is processed to take steps before concluding a contract and to conclude and perform contracts concerning property management or administration.

The legal basis is Article 6(1)(b) GDPR.

3.2. Compliance with legal obligations

Data may be processed to comply with legal obligations, in particular those concerning ownership of premises and property management, accounting and financial documentation, taxes, archiving and providing information to authorized public authorities.

The legal basis is Article 6(1)(c) GDPR.

3.3. Contact and correspondence handling

Data of persons contacting the Controller may be processed to reply, handle a request, present an offer or continue correspondence.

Depending on the matter, the legal basis is Article 6(1)(b) GDPR where the contact concerns a contract, or Article 6(1)(f) GDPR where processing is based on the Controller’s legitimate interest in communication and request handling.

3.4. Establishing, pursuing or defending claims

Data may be processed to establish, pursue or defend claims related to the Controller’s business activity.

The legal basis is Article 6(1)(f) GDPR. The Controller’s legitimate interest is to protect its rights and pursue or defend claims.

3.5. Website security

When using the website, basic technical data may be processed automatically, such as IP address, date and time of connection, requested resource, browser and operating-system information, and technical error or event data.

This data may be stored in server logs to ensure security, diagnose errors, prevent abuse and ensure proper website operation. The legal basis is Article 6(1)(f) GDPR.

4. Sources of personal data

The Controller may obtain personal data directly from the data subject, from housing communities and their bodies, property or premises owners, contractors and service providers, property documentation, public registers where permitted by law, and other entities authorized to provide data.

5. Voluntary provision of data

Providing personal data is generally voluntary, but may be necessary to conclude or perform a contract, handle a request or correspondence, comply with legal obligations or perform property management activities. Failure to provide required data may make it impossible to handle a matter or perform the Controller’s obligations.

6. Data recipients

Personal data may be disclosed or entrusted to entities supporting the Controller, including hosting and IT providers, e-mail and office-tool providers, accounting service providers, law firms, banks and payment operators, postal and courier operators, property-management software providers, technical and service contractors, insurers and entities authorized by law, including courts, public administration authorities and law-enforcement authorities.

7. Google Workspace and transfers outside the EEA

The Controller may use Google Workspace services, in particular for e-mail, document storage and work organization. Data may be processed using infrastructure located outside the European Economic Area.

Transfers outside the EEA take place only using mechanisms permitted by GDPR, in particular an adequacy decision of the European Commission where applicable, standard contractual clauses approved by the European Commission, and additional safeguards where required.

8. Data retention period

Personal data is retained for the period necessary to achieve the purpose for which it was collected. In particular, contract data is kept for the contract term and then until claims become time-barred; accounting and tax data is kept for the period required by law; correspondence data is kept for the period needed to handle the matter and then for a period justified by possible claims; server logs may be kept for the period necessary for security and technical diagnostics.

9. Rights of data subjects

A data subject may have the right to access data and receive a copy, rectify incorrect data, complete incomplete data, request erasure, request restriction of processing, data portability where applicable, object to processing based on legitimate interest, withdraw consent where data is processed on consent, and lodge a complaint with the President of the Personal Data Protection Office.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Individual rights may be limited by GDPR or other legal provisions.

10. Right to lodge a complaint

A person who believes that their personal data is processed contrary to the law may lodge a complaint with the supervisory authority:

President of the Personal Data Protection Office
ul. Stanisława Moniuszki 1A
00-014 Warsaw, Poland

11. Automated decision-making and profiling

The Controller does not make decisions producing legal effects or similarly significantly affecting website users based solely on automated processing. Website users’ data is not used for marketing profiling.

12. Cookies

The website may use only cookies necessary for its proper, secure and technical operation. The website does not use Google Analytics or other tools for behavior analytics, profiling or behavioral advertising.

Users may manage cookies in their browser settings, including deleting or blocking them. Blocking all cookies may affect the operation of some website features.

13. External content and services

In its current version, the website does not use Google Analytics, Google Maps, Google reCAPTCHA, embedded YouTube materials, behavioral advertising tools, social-media tracking pixels or a contact form.

If additional tools or services processing user data are introduced in the future, this Privacy Policy will be updated and, where required by law, the user will be asked for consent.

14. Data security

The Controller applies appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Data is accessible only to authorized persons and entities to which data has been entrusted in accordance with applicable law.

15. Changes to the Privacy Policy

This Privacy Policy may be updated in the event of changes to the website, new services or tools, changes in the scope of data processing or changes in applicable law. The current version is published on the website.

Last updated: 30 July 2026.