Privacy policy

I. General provisions and scope

This Privacy and cookie policy sets out the rules for processing personal data and for using cookies and similar technologies on the Sobieskiego 5 website, available at sobieskiego5.pl together with related pages (the “Website”). The policy applies to visitors of the Website and to persons using the contact form, the viewing-request form or the apartment-enquiry form.

The policy has been prepared in light of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as well as other applicable personal-data and privacy laws (the “GDPR”).

In this policy, a person using the Website is referred to as the “User”, and Sobieskiego 5 w Krakowie Sp. z o.o. as the “Controller”. The policy takes into account the nature of the Website as a site presenting a residential development and enabling contact with the Controller, arranging a viewing of the development and submitting an enquiry about an apartment.

II. Data controller and contact

The controller of Users’ personal data is Sobieskiego 5 w Krakowie Sp. z o.o., with its registered office in Kraków, at Jana Zamoyskiego 73/LU1, 30-519 Kraków, entered in the register of entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register, under KRS no. 0001202119, NIP: 6793345776, REGON: 543079188 (the “Controller”).

For matters relating to the processing of personal data, including to exercise the rights described in this policy, you may contact the Controller:

• by e-mail: biuro@sobieskiego5.pl;
• by telephone: +48 730 255 544;
• by post: at the Controller’s registered address given above.

III. Definitions, categories of data and sources

For the purposes of this policy, the following terms mean:

• Controller — Sobieskiego 5 w Krakowie Sp. z o.o., with its registered office in Kraków, at Jana Zamoyskiego 73/LU1, 30-519 Kraków;
• Personal data — any information relating to an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, contact details, IP address or other technical data;
• Policy — this Privacy and cookie policy;
• GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
• Website — the Sobieskiego 5 website, available at sobieskiego5.pl together with related pages, operated by the Controller;
• Cookies — small text files stored on the User’s device when using the Website, allowing the Website or entities providing services to the Controller to store or read information;
• User — any natural person visiting the Website or using its features, in particular the contact form, the viewing-request form or the apartment-enquiry form;
• European Economic Area, EEA — the free-trade area and single market comprising the Member States of the European Union and of the European Free Trade Association (EFTA), with the exception of Switzerland.

The scope of data processed depends on how the Website is used and may include in particular:

• first name and surname;
• e-mail address;
• telephone number;
• the content of a message sent via the contact form or the content of an apartment enquiry;
• information related to arranging a viewing of the development, including an agreed time for contact or a viewing;
• technical data related to use of the Website, such as IP address, browser type and time of visit — solely to the extent necessary for the operation, security and accountability of the Website;
• information stored in necessary cookies and similar technologies, in accordance with section X of this policy.

Personal data are obtained directly from the User, in particular via the forms available on the Website, and automatically in connection with use of the Website, through system logs, technical data and necessary cookies. As a rule, the Controller does not obtain data from other sources unless this is necessary to pursue a specified purpose or is required by law.

IV. Purposes, legal bases and legitimate interests

Personal data are processed only to the extent necessary to pursue specified purposes. Depending on the situation, the legal basis for processing may be:

• taking steps at the User’s request prior to entering into a possible contract, including handling enquiries about the development or apartments, communicating with the User, organising and agreeing a viewing of the development, and providing information about apartments — Art. 6(1)(b) GDPR; where a given action is not necessary in order to take steps prior to entering into a contract, the basis may be the Controller’s legitimate interest under Art. 6(1)(f) GDPR;
• compliance with legal obligations incumbent on the Controller — Art. 6(1)(c) GDPR;
• establishing, exercising or defending legal claims — Art. 6(1)(f) GDPR;
• ensuring security, protection against abuse and the proper operation and maintenance of the Website, including documenting the course of contact — Art. 6(1)(f) GDPR;
• carrying out the Controller’s own marketing — solely on the basis of a separate, voluntary consent of the User, if such activities are launched — Art. 6(1)(a) GDPR.

When handling enquiries, contact and the organisation of viewings, the Controller may process data identifying the person making the enquiry, their contact details, the content of correspondence, information about the subject of the enquiry and data concerning the agreed method and time of contact. Processing also covers correspondence conducted with the User in connection with the request.

The Controller’s legitimate interests may include in particular efficient communication with Users, handling and documenting requests, ensuring the security of infrastructure and the Website, preventing abuse, protection against claims and the pursuit of claims. The Controller always takes into account the necessity and proportionality of processing and the rights and freedoms of data subjects.

Where processing is based on consent, the User may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The Controller also processes personal data for secondary purposes, in particular:

• for archival and evidential purposes in the event of a legally justified need or duty to demonstrate facts, in particular to demonstrate the proper performance of obligations arising from the GDPR;
• in order to establish, exercise or defend legal claims on the basis of Art. 6(1)(f) GDPR.

The Controller undertakes to take the measures required under Art. 32 GDPR, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing, as well as the risk of a breach of the rights or freedoms of natural persons. The Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to that risk.

V. Transfers of data to countries outside the EEA

In connection with the use of certain technology providers or cloud infrastructure, a transfer of personal data outside the European Economic Area (the “EEA”) may occur, depending on the configuration of the services and the location of the infrastructure. The Controller does not assume that such a transfer occurs in every case, and verifies on each occasion how the providers used operate and the scope of their services.

Any transfer of personal data to a third country or an international organisation takes place solely in accordance with Chapter V GDPR, in particular on the basis of an adequacy decision, standard data-protection clauses, binding corporate rules or another appropriate mechanism provided for in the GDPR.

The Controller takes steps to ensure that a transfer of data is covered by the required safeguards and that its scope is limited to what is necessary to use the given service. The User may obtain from the Controller information about the safeguards applied and, to the extent permitted by law, a copy of the relevant documents, by contacting the Controller at biuro@sobieskiego5.pl.

VI. Period of processing and storage of data

Personal data are processed for no longer than is necessary for the purpose for which they were collected, taking into account legal obligations and the Controller’s legitimate interests. In particular:

• data related to an enquiry, contact or the organisation of a viewing of the development are stored for the time needed to handle the enquiry and take further steps prior to entering into a possible contract, and then — if justified — until the limitation period for any related claims expires;
• data processed in order to comply with legal obligations are stored for the period required by the applicable provisions;
• data processed on the basis of consent are stored until that consent is withdrawn, unless further storage is based on another legal ground;
• technical data and information related to the security of the Website are stored for the period necessary to ensure the proper operation, security and accountability of the Controller’s activities;
• archival and evidential data and data related to claims are stored for the period necessary to pursue those purposes, including until the relevant limitation periods expire.

VII. Recipients of personal data

Personal data may be disclosed only to recipients who need them to pursue the purposes indicated in this policy, in particular:

• authorised employees and associates of the Controller, bound by a duty of confidentiality;
• hosting and infrastructure providers, including the hosting provider MyDevil.net, used to maintain the Website;
• IT and technical-support providers;
• e-mail providers and tools used to handle correspondence from the forms;
• the provider of the Cookiebot consent-management platform (Cybot A/S), to the extent necessary to display the consent banner, store the User’s choice and block optional scripts until consent is given — on the production version of the Website;
• entities providing advisory, legal, accounting or administrative services — to the extent necessary to perform those services;
• other entities, if a duty to disclose data arises from the law or is necessary to protect the Controller’s rights.

Where an entity acts for the Controller as a processor, the Controller enters into an appropriate data-processing agreement with it or applies another legal basis required by law. Personal data are not sold or shared with third parties for marketing purposes without a separate consent of the User.

Data submitted via the forms may be forwarded by e-mail to the sales office in order to handle the request.

VIII. Rights of data subjects

A data subject has — to the extent provided for by the GDPR — the right to:

• obtain access to their personal data and information about their processing (Art. 15 GDPR);
• rectify inaccurate data or complete incomplete data (Art. 16 GDPR);
• erasure of personal data, if one of the grounds indicated in the GDPR applies (Art. 17 GDPR);
• restriction of processing in the cases provided for in the GDPR (Art. 18 GDPR);
• data portability, if processing is based on consent or a contract and is carried out by automated means (Art. 20 GDPR);
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to their particular situation;
• object at any time to processing for direct-marketing purposes, including profiling related to such marketing, if marketing is launched (Art. 21 GDPR);
• withdraw consent at any time, if processing is based on consent (Art. 7 GDPR);
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

A request to exercise these rights may be submitted by e-mail to biuro@sobieskiego5.pl or by post to the Controller’s registered address. The Controller may ask for information allowing a proportionate verification of the identity of the person making the request, if this is necessary to protect data against disclosure to an unauthorised person.

A complaint may be lodged with the President of the Personal Data Protection Office, which is the supervisory authority competent for personal-data protection in the Republic of Poland.

The rules for using the Website are set out in the Terms and Conditions.

IX. Voluntary provision of data and consequences of not providing data

Providing personal data is voluntary, but some data are necessary to handle a request or to perform a specified action at the User’s request. In particular:

• providing data in the contact form is necessary for the Controller to reply to an enquiry;
• providing data needed to agree a viewing of the development is necessary to organise it and to pass on information about the time or place;
• providing data in the apartment-enquiry form is necessary to handle the enquiry and reply;
• failure to provide data marked as required may prevent the form from being sent, a reply from being given or the request from being carried out;
• providing data for marketing purposes and giving marketing consent, if marketing is launched, remains voluntary and does not affect the ability to use the other features of the Website.

The scope of data necessary to handle a given form is specified each time the form is completed.

X. Activity on the Website and cookies

Activity on the Website. When the User connects to the Website, the system logs may record information about the IP address, type of device, browser type and the time and manner of using the Website. The Controller processes these data only to the extent necessary to ensure the proper operation, security, diagnostics and accountability of the Website, in accordance with the law.

Cookies — general information. Cookies are small text files stored on the User’s device when using the Website. They may make it possible to maintain a session, remember technical information and protect the Website’s features. Depending on how long they are stored and who stores them, cookies may be session cookies, persistent cookies or third-party cookies. The description below indicates the solutions currently used on the Website.

Cookies currently used. The Website uses necessary Laravel session cookies to maintain the session and to protect forms against CSRF attacks. These files are required for certain features of the Website to work correctly. They are not used to create marketing profiles or to conduct behavioural advertising.

Consent management (Cookiebot). On the production version of the Website, the Controller uses the Cookiebot consent-management platform provided by Cybot A/S (Denmark). Cookiebot displays a consent banner, records the User’s choice and — in accordance with its configuration — blocks optional scripts until consent is given. Cookies used to store that consent choice are necessary in order to meet privacy-law obligations. The Cookiebot script is not loaded outside the production environment.

No optional tools without consent. The Website does not load analytics or advertising tools without the User’s consent. Fonts are hosted locally on the Website, and the map on the contact page is a static image. The Website does not embed Google Maps or similar third-party maps.

Managing cookies. The User may change or withdraw consent at any time using the Cookiebot mechanism available on the production Website, and may also manage cookies in their browser settings. Restricting or blocking necessary cookies may cause the Website to malfunction, in particular by preventing a session from being maintained or a form from being submitted.

Future optional technologies. If in the future the Controller deploys analytics, advertising, social-media or other similar optional cookies or technologies, the Controller will update this policy before using them and will implement the choice and consent mechanisms required by law, if required. Until those conditions are met, such technologies should not be switched on.

XI. Profiling and automated decision-making

The Controller does not currently carry out marketing profiling of Users and does not take decisions based solely on automated processing of personal data, including profiling, that would produce legal effects concerning those persons or similarly significantly affect them.

If the way data are processed on the Website changes, and processing includes profiling, analytics, advertising or automated decision-making requiring additional information or the User’s consent, this policy will be updated accordingly, and the required information and consent mechanisms will be implemented before such processing begins.

XII. Security of processing

The Controller applies appropriate technical and organisational measures, commensurate with the risk associated with the processing of personal data, in order to protect data against unauthorised access, loss, destruction, disclosure or unauthorised modification.

Access to data is limited to persons who need it to perform their duties, and authorised persons are bound by a duty of confidentiality. The Controller selects technical and organisational solutions taking into account the nature, scope, context and purposes of processing and the risk of a breach of the rights and freedoms of data subjects.

The Controller takes steps to ensure the security of the forms, correspondence and Website infrastructure, including solutions that reduce the risk of abuse and unauthorised access. The User should use the Website with up-to-date software and protect access to their devices and mailboxes against unauthorised persons.

XIII. Changes to the Privacy and cookie policy

The Controller may update this policy, in particular in connection with a change in the law, a change in the Website’s features, a change of providers or technologies used, the deployment of optional cookies, or a change in the way personal data are processed.

The current version of the policy is published on the Website. The Controller may notify Users of material changes in a manner appropriate to the nature of the change, in particular by a notice on the Website.

Date of last update: 30.09.2026.