Privacy Policy - ALMO INVEST sp. z o.o.

1. Controller

The controller of the personal data described in this policy is:

ALMO INVEST sp. z o.o.
ul. Kościuszki 39, 32-340 Wolbrom, Poland
entered in the Register of Entrepreneurs of the National Court Register (KRS) under number KRS 0000945869, kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register
NIP (tax ID) 6372215958, REGON 521010423
kontakt@almo-invest.com.pl · +48 888 696 997

The controller has not appointed a data protection officer, as it is not required to do so (Article 37 GDPR). For any matter concerning personal data, you can contact us at the email address above, by telephone or in writing at our registered office.

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

2. Summary

Purpose	Data	Legal basis	Retention
Security and operation of the website; understanding how it is used (section 3)	IP address, browser, pages visited, time of visit; visit statistics	Article 6(1)(f) GDPR	Server logs: for a short period, for security purposes. Statistics: for as long as needed to understand use of the website over time
Responding to correspondence (section 4)	Name, contact details, content of the message or call	Article 6(1)(f) GDPR or, where the correspondence leads to a contract, Article 6(1)(b) GDPR	2 years after the last contact, unless the correspondence becomes part of a tenancy or contract file
Concluding and performing a lease (section 5)	Name, PESEL number, identity document series and number, address, contact details, payment data	Article 6(1)(b), (c) and (f) GDPR	Duration of the lease, then until the limitation period for claims has expired or statutory retention obligations end, whichever is later
Selecting a tenant (section 6)	Name, contact details, information provided in connection with interest in the lease	Article 6(1)(b) GDPR	Data of candidates with whom no lease is concluded: deleted within 6 months
Working with business partners and suppliers (section 7)	Name, business name, NIP (tax ID), contact details	Article 6(1)(b) and (c) GDPR	For the period required by tax and accounting law (as a rule 5 years from the end of the calendar year in which the tax payment deadline fell)
Invoicing and accounting (section 8)	Data contained in invoices and accounting records	Article 6(1)(c) GDPR	For the period required by tax and accounting law (as a rule 5 years from the end of the calendar year in which the tax payment deadline fell)
Property management (section 9)	Data of tenants and business partners, to the extent necessary to manage the flat	Article 6(1)(b), (c) and (f) GDPR	As for the lease or the contract with the business partner
Establishing, exercising or defending legal claims (section 10)	Data necessary to establish, exercise or defend legal claims	Article 6(1)(f) GDPR	Until the limitation period for claims has expired or, if proceedings are brought, until they have been finally concluded and the decision has been enforced
Disclosure to recipients (section 11)	Data from the categories above, only to the extent necessary	As for the purpose for which the data is processed	As for the purpose for which the data is processed

3. Website

When you visit the website, the servers record technical data: your IP address, browser type, the pages you visit and the time of your visit. Server logs are kept for a short period for security purposes.

To understand how the website is used, we use web analytics that do not rely on cookies. The analytics are operated on our behalf by ALMO Consulting BV (Belgium) as processor. Statistical data is kept for as long as needed to understand use of the website over time.

The website does not use cookies, and the analytics store nothing on your device.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is ensuring the security and proper operation of the website and understanding how it is used.

4. Correspondence (email and telephone)

If you contact us by email or telephone, we process your name, contact details and the content of your message or call in order to respond.

Legal basis: Article 6(1)(f) GDPR (our legitimate interest in responding to enquiries addressed to us) or, where the correspondence leads to a lease or another contract, Article 6(1)(b) GDPR (taking steps at your request before entering into a contract and performing it).

We keep correspondence for 2 years after the last contact. Correspondence that becomes part of a tenancy file is kept as described in section 5.

5. Tenants

We process tenants' data in order to conclude and perform the lease, including settling the deposit and service charges, taking meter readings, and the recorded handover and return of the flat.

Data processed: name, PESEL number, identity document series and number, address, contact details and payment data. We do not keep copies of identity documents.

Legal basis:

Article 6(1)(b) GDPR: concluding and performing the lease;
Article 6(1)(c) GDPR: compliance with legal obligations, in particular under tax and accounting law;
Article 6(1)(f) GDPR: our legitimate interest in managing the flat properly and in establishing, exercising or defending legal claims.

We keep the data for the duration of the lease, then until the limitation period for claims has expired or statutory retention obligations end, whichever is later. Accounting records are kept for the period required by tax and accounting law (as a rule 5 years from the end of the calendar year in which the tax payment deadline fell).

6. Prospective tenants

Where we use an estate agency to find a tenant, the agency is a separate controller of the data of people who contact it about the offer, and processes that data under its own privacy policy.

We receive from the agency only the data of the selected candidate (name, contact details and the information necessary to conclude the lease). Candidates may also contact us directly; in that case we process the data they provide to us.

Legal basis: Article 6(1)(b) GDPR (taking steps at the candidate's request before entering into a lease).

We delete the data of candidates with whom no lease is concluded within 6 months. The data of the person with whom a lease is concluded is kept as described in section 5.

7. Business partners and suppliers

We process the data of our business partners and suppliers, who are mainly sole traders, and of their representatives, in order to conclude and perform contracts and to meet our tax and accounting obligations.

Data processed: name, business name and business details, NIP (tax ID), contact details.

Legal basis: Article 6(1)(b) GDPR (concluding and performing a contract) and Article 6(1)(c) GDPR (obligations under tax and accounting law).

We keep the data for the period required by tax and accounting law (as a rule 5 years from the end of the calendar year in which the tax payment deadline fell) or, where the possibility of pursuing claims requires a longer period, for that longer period.

8. Invoicing and accounting

We issue invoices through an invoicing platform, and our accounts are kept by an external accounting office. Both act as processors under contracts concluded with us.

Where the law requires it, data contained in invoices and accounting records is transmitted to the National e-Invoicing System (KSeF) and to the tax authorities.

Legal basis: Article 6(1)(c) GDPR in conjunction with the Polish VAT Act (ustawa o podatku od towarów i usług) and the Accounting Act (ustawa o rachunkowości).

We keep accounting records for the period required by tax and accounting law (as a rule 5 years from the end of the calendar year in which the tax payment deadline fell).

9. Property management

In connection with managing the flats, we disclose data of tenants and business partners to the owners' community or housing cooperative, utility providers, the insurer and contractors carrying out work in the flat, only to the extent necessary for the purpose concerned, for example to settle charges, report damage or arrange a repair.

Legal basis: Article 6(1)(b) GDPR (performance of the lease or the contract with the business partner), Article 6(1)(c) GDPR (legal obligations relating to the flat) and Article 6(1)(f) GDPR (our legitimate interest in managing the property properly).

10. Legal claims

We may process the data described above in order to establish, exercise or defend legal claims.

Legal basis: Article 6(1)(f) GDPR (our legitimate interest in protecting our rights).

We keep the data until the limitation period for claims has expired or, if proceedings are brought, until they have been finally concluded and the decision has been enforced.

11. Recipients

Depending on the purpose of processing, personal data may be disclosed to the following categories of recipients:

IT, hosting and email service providers, including ALMO Consulting BV, which operates our website analytics and provides IT services to us;
the invoicing platform and the accounting office;
estate agencies;
our bank;
insurers;
the owners' community or housing cooperative;
utility providers;
contractors carrying out work in the flats;
public authorities, courts and bailiffs, where the law requires it.

Our service providers act as processors under data processing agreements and process data only on our instructions. Other recipients process data as separate controllers. We do not sell personal data.

We process personal data within the European Economic Area. Personal data may be transferred outside the European Economic Area only where one of our service providers uses sub-processors outside the EEA, for example for email delivery. Any such transfer is based on the Standard Contractual Clauses adopted by the European Commission or on an adequacy decision of the Commission. You can obtain a copy of the safeguards used by contacting us.

12. Security and backups

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration and loss.

Backups are encrypted, kept within the European Economic Area (in Belgium) and overwritten on a fixed rotation, so data we delete disappears from the backups when the rotation expires.

13. Your rights

Under the conditions set out in the GDPR, you have the right to:

access your data and receive a copy of it (Article 15 GDPR);
rectification of your data (Article 16 GDPR);
erasure of your data (Article 17 GDPR);
restriction of processing (Article 18 GDPR);
data portability (Article 20 GDPR);
object to processing based on Article 6(1)(f) GDPR, on grounds relating to your particular situation (Article 21 GDPR).

Right to object: you may at any time object, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) GDPR (Article 21(1) GDPR). Once you object, we will stop processing that data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

To exercise these rights, please contact us at kontakt@almo-invest.com.pl. We reply within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months in line with Article 12(3) GDPR; we will inform you of any extension within one month of receiving your request.

We do not make decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland.

14. Whether you must provide data

Providing data is voluntary but necessary to conclude a lease or another contract. Without it, the contract cannot be concluded. Where tax law requires it, providing data is a statutory requirement.

15. Changes to this policy

We may update this policy. The date of the last update is shown at the top of this page.

This policy is available in Polish and English. This is a translation; the Polish version prevails.