Privacy Policy

PRIVACY POLICY
1. Introduction
The protection of personal data and information security are top priorities for Henniger Investment Spółka Akcyjna. We are committed to providing reliable and clear information about how we collect, use, share, and protect the data of individuals who use our website, contact our sales department, subscribe to our newsletter, and use forms to submit inquiries to our Partners.
The primary legal act governing the processing of personal data is the GDPR. To the extent applicable, we also comply with the Act of May 10, 2018, on the Protection of Personal Data (i.e., Journal of Laws of 2019, item 1781, as amended), the Act of July 18, 2002, on the Provision of Electronic Services, and the Act of July 12, 2024—the Electronic Communications Act.

2. Data Controller and Contact Information
The controller of personal data is Henniger Investment Spółka Akcyjna, with its registered office at 31-351 Kraków, ul. Odkrywców 13, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków under KRS number 000599210, NIP 6350000742, with fully paid-up share capital in the amount of 7,772,547.00 PLN, hereinafter referred to as the “Controller” or “Company.”
The Administrator can be contacted electronically at odo@mieszkajwmiescie.pl or odo@hannigerinvestment.pl, or in writing at the Administrator’s registered office address.
If the Administrator has appointed a Data Protection Officer, the DPO can be contacted via email at odo@mieszkajwmiescie.pl or odo@hannigerinvestment.pl, or by phone at +4812 446 99 91. The DPO’s contact information is also published on the Website in accordance with applicable regulations.

3. Scope of the Policy and Data Sources

This Policy applies to the processing of data in connection with the use of the Website, services provided electronically, the Company’s sales and marketing communications, the Newsletter, Sales Forms, the Financing Form, the Finishing Form, the “Land Purchase” Form, the handling of correspondence, and the security of the Website.

As a general rule, we collect data directly from you—through Forms, correspondence, Newsletter subscriptions, or contact with a Sales Advisor. Technical data may be generated automatically in connection with your use of the Website. If, in a specific case, data has been obtained from another source, the required information is provided in accordance with Article 14 of the GDPR.

This Policy primarily describes situations in which the Company acts as the data controller. Financial Partners and Finishing Partners identified in the relevant forms, upon receiving the data provided to them, act as separate data controllers with respect to handling their own inquiries and providing their own services.

4. Purposes, Scope, and Legal Basis for Data Processing
4.1. Use of the Website and Technical Data
In connection with the use of the Website, technical and operational data may be processed, such as IP address, device and browser information, date and time of the request, URL of the accessed page, error information, technical identifiers, and other data necessary to ensure communication, security, and the proper functioning of the Website.
We process this data to the extent necessary to provide electronic services and to ensure system security, perform diagnostics, prevent abuse, and protect against claims—pursuant to Article 6(1)(b) or (f) of the GDPR, depending on the nature of the operation, taking into account Article 18 of the Act on the Provision of Electronic Services.

4.2. General Inquiries, Sales Forms, and Contact with a Sales Advisor
If you contact the Company regarding an investment, a unit, a house, a parking space, a storage unit, or any other element of our offering, we process your contact information, details identifying the subject of your interest, and the content of your inquiry in order to respond to your inquiry, provide materials, present availability and sales information, schedule a meeting, and conduct communication related to the possible conclusion of a contract.
The legal basis for processing is Article 6(1)(b) of the GDPR—when we take action at your request prior to entering into a contract or provide the requested electronic service—or Article 6(1)(f) of the GDPR, when the contact is of a general nature, and our legitimate interest is to conduct correspondence, organize the sales process, and provide service to individuals interested in the Company’s activities.
The data may be accessible to authorized employees and associates in the sales, marketing, and customer service departments, as well as other organizational units of the Company, to the extent necessary to handle your inquiry. Access is restricted in accordance with the scope of duties and granted permissions.

4.3. Newsletter and the Company’s Own Marketing
The newsletter may contain information about new and current investments, the start of sales, available units, new phases of investments, events, open houses, sales materials, news, promotions, and other activities of the Company. To subscribe to the newsletter, you must provide at least your email address.
We process the data necessary to manage and administer the newsletter subscription pursuant to Article 6(1)(b) of the GDPR—for the purpose of providing the free newsletter service requested by the subscriber. The sending of commercial information and direct marketing to an email address occurs only after obtaining prior consent to use the provided email address. If a double opt-in mechanism is used, we also store the information necessary to demonstrate confirmation of the subscription.

In the case of marketing the Company’s own products and services outside the scope of the Newsletter, the processing of data for direct marketing purposes may be based on the Controller’s legitimate interest—Article 6(1)(f) of the GDPR. However, the use of a telephone, email, or other end devices to send commercial communications requires the User’s prior consent to the use of that communication channel for this purpose.
We do not make the sending of a standard sales inquiry contingent upon consent to future marketing unrelated to that inquiry. Consent for specific communication channels may be withdrawn at any time just as easily as it was granted.

4.4. Financing Form
The Financing Form may include, in particular: first and last name, phone number, email address, preferred method of contact, estimated financing amount, estimated price of the apartment, and additional information and questions.
The Company processes this data for the purpose of accepting the application and—in accordance with your explicit instructions—forwarding it to the Financing Partner or Financing Partners identified by their full names on the form. The legal basis for processing on the Company’s part is, as a general rule, Article 6(1)(b) of the GDPR, since accepting and forwarding the application constitutes the performance of a service requested by the person using the Form. With regard to documenting the handling of the application and defending against claims, the legal basis is Article 6(1)(f) of the GDPR.
If the Form allows you to select a Partner, the data is transferred exclusively to the Partners you have selected. If, as described in the Form, the request is directed to all indicated Financial Partners, the data is transferred to all such entities. Upon receiving the data, each Financial Partner acts as a separate controller and fulfills its own obligation to provide information regarding further processing.
If a Financial Partner is to contact you by phone or electronically in a manner involving the transmission of commercial information or direct marketing, such contact occurs within the scope of the User’s previously granted consent regarding the specified Financial Partner and the selected communication channel.

4.5. Apartment Finishing Form
The Finishing Form is used to submit an inquiry to the Finishing Partner or Finishing Partners identified by their full names on the relevant subpage or in the Form. The Company may process, in particular, your first and last name, phone number, email address, and the content of your inquiry regarding the expected scope of finishing, interior design, or furnishings.
The legal basis for the Company’s processing is, as a general rule, Article 6(1)(b) of the GDPR—the performance of the requested service consisting of receiving and forwarding the inquiry—and Article 6(1)(f) of the GDPR with regard to documenting the handling of the inquiry and safeguarding claims.

If the Form allows you to choose one of two Finishing Partners, the data is provided exclusively to the selected entity. If, as described in the Form, the submission is intended for both Partners, information regarding this procedure is provided before the Form is submitted. Upon receiving the data, each Partner acts as a separate data controller with respect to contacting the User, preparing a quote, and, if applicable, providing its own service.
If a Partner’s contact with the User involves the transmission of commercial information for marketing purposes, such contact will occur only after the User has given prior consent for the designated Partner to use the selected communication channel for this purpose.

4.6. “Land Purchase” Form
If you provide us with information about a parcel of land or a proposal to sell it, we process your contact information, details about the property, and the content of the proposal in order to assess the possibility of establishing a business relationship, conducting negotiations, and potentially purchasing the property. The legal basis is Article 6(1)(b) of the GDPR—actions taken at your request prior to entering into a contract—or Article 6(1)(f) of the GDPR with regard to conducting correspondence, analyzing proposals, and protecting against claims.
4.7. Claims, Security, and Legal Obligations
Regardless of the purposes indicated above, we may process data to establish, pursue, or defend against claims, document incidents, ensure the security of the Website, and prevent abuse. The legal basis is Article 6(1)(f) of the GDPR—the Company’s legitimate interest in protecting its rights and ensuring security.
If the obligation to process or disclose data arises from legal provisions or a legally binding request from an authorized authority, the legal basis is Article 6(1)(c) of the GDPR.

5. Data Recipients
Access to personal data may only be granted to individuals and entities for whom such access is justified by the purpose of processing. Depending on the situation, data recipients may include:
• authorized employees and associates of the Company, in particular those working in sales, marketing, customer service, IT, finance, and legal affairs;
• providers of website hosting, maintenance, and development; email services; CRM/CMS; telephony or call center services; newsletter distribution tools; cybersecurity; analytics; and other IT services—to the extent necessary to provide these services;
• law firms, consultants, auditors, insurers, postal and courier operators, and other entities supporting the Company’s operations, provided there is a valid basis for their access to the data;
• Financial Partners and Finishing Partners specified in the relevant Form—if the person using the Form requests that the submission be forwarded to these entities;
• public authorities and other entities authorized to receive data pursuant to applicable law.
If an entity processes data exclusively on behalf of the Company and pursuant to its documented instructions, it is a processor with whom the Company establishes processing rules in accordance with Article 28 of the GDPR. Partners receiving a lead for their own handling of inquiries and provision of services do not act in this regard as the Company’s processors, but as separate controllers.

6. Transfer of Data Outside the European Economic Area
If, in connection with the Company’s use of specific technology providers, personal data is transferred outside the European Economic Area, such transfer takes place exclusively through a mechanism permitted under Chapter V of the GDPR, in particular based on a European Commission decision confirming an adequate level of protection, standard contractual clauses, or other appropriate safeguards.
Information regarding the suppliers used, transfers to third countries, and appropriate safeguards is made available to the extent required by the GDPR, specifically in this Policy, the cookie settings panel, or upon request by the data subject. The specific scope of information may depend on the tools actually used on the Website.

7. Data Retention Period
We retain data no longer than is necessary to fulfill the purpose for which it was collected, taking into account legal obligations and the statute of limitations for claims. Specifically:
• data from correspondence and Sales Forms—for the duration of the contact and the sales process, and subsequently for the period necessary to document the course of the contact and to safeguard against claims;
• data related to the Newsletter—for the duration of this Service, and after unsubscription, only to the extent and for the period necessary to demonstrate the fact and date of granting and withdrawing consent or to defend against claims;
• data used for our own marketing conducted on the basis of a legitimate interest—until a valid objection is raised or the purpose ceases to exist earlier, and data regarding consent for a communication channel—until such consent is withdrawn, with the possibility of retaining a minimal evidentiary trail;
• data from the Company’s Financing and Completion Forms—for the time necessary to accept, forward, and document the submission, and subsequently for the period necessary to protect against claims; Partners establish their own retention periods as separate data controllers;
• technical data and logs—for a period justified by security, diagnostics, and event logging, taking into account the principle of data minimization;
• data processed based on a legal obligation—for the period required by applicable laws.

8. Voluntary Provision of Data and Consequences of Failure to Provide It
Providing data in the Forms is generally voluntary; however, data marked as required is necessary to perform the requested Service, communicate with you, or take action at your request. Failure to provide required data will prevent the Form from being submitted or the relevant Service from being performed.
Providing data in additional fields and granting marketing consents unrelated to the essence of the requested Service is voluntary. Failure to consent to future marketing does not affect your ability to submit a regular inquiry. In the case of the Newsletter, consent to use the provided email address for sending it is necessary to provide this Service, as its purpose is to periodically send the User the requested information, including information about investments, available properties, news, offers, and promotions.

9. Rights of Data Subjects
In the cases and under the conditions specified in the GDPR, you have the right to:
• access your data and obtain a copy of it;
• have your data corrected;
• have your data erased;
• restrict processing;
• to data portability—if the basis for processing is consent or a contract, and the processing is carried out by automated means;
• to object to processing based on Article 6(1)(f) of the GDPR; if the data is processed for direct marketing purposes, an objection to such processing is effective at any time;
• the right to withdraw consent at any time—if the processing or the method of communication is based on consent; the withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal;
• the right to lodge a complaint with the President of the Personal Data Protection Office.
Requests regarding data processed by the Company may be sent to odo@mieszkajwmiescie.pl or odo@hannigerinvestment.pl, or to the Data Protection Officer (DPO), if one has been appointed. Requests regarding data processed by a Partner as a separate data controller should also be directed directly to that Partner.

10. Profiling and Automated Decision-Making
As a general rule, the Company does not make decisions regarding Users that produce legal effects or similarly significantly affect them based solely on automated processing within the meaning of Article 22 of the GDPR, unless separate information indicating the basis and rules for such processing is provided prior to the commencement of such a process.
If analytical or advertising tools activated with the User’s consent create interest segments or marketing profiles, information about such activity is provided in the consent management panel or in the description of the relevant technology. Such profiling does not constitute decision-making as referred to in Article 22 of the GDPR if it does not meet the conditions set forth in that provision.

11. Cookies and Similar Technologies
The Website may use cookies, local storage, pixels, tags, or similar technologies. These may be used for the Website’s operation, security, saving settings, measuring traffic, analytics, personalization, and—if such tools are used—advertising and campaign measurement.
Technologies necessary to transmit an electronic message or provide the Service requested by the User may be used without the need to obtain the User’s separate consent. Other cookies and similar technologies, particularly those used for analytical, functional, or advertising purposes, are activated only after the User has given their prior consent. If the use of such technologies involves the processing of personal data, such data is processed in accordance with the principles set forth in the GDPR and this Privacy Policy.
Upon their first visit, Users are given the option to manage optional technologies, including accepting or rejecting them and changing their selection at a later time. Closing the banner, continuing to use the website, or failing to change browser settings are not considered consent to optional cookies. The current list of cookie categories, providers, purposes, and retention periods is available in the cookie settings panel or in another easily accessible location linked to this Policy. You may change or withdraw your consent to optional technologies at any time.

12. Data Security
We implement appropriate technical and organizational measures, taking into account the nature, scope, context, and purposes of the processing, as well as the risks to the rights and freedoms of natural persons. Depending on the risk, these measures may include, in particular, access and authorization controls, transmission encryption, backups, system updates, incident response procedures, vendor assessments, and training for individuals with access to the data.

13. Special Categories of Data and Open-Ended Fields
The forms available on the Website are not intended for the submission of special categories of data as defined in Article 9 of the GDPR or data relating to criminal convictions and offenses. Please do not include such data in the “additional information,” “questions,” or similar fields unless it is necessary. The mere accidental submission of such information is not considered to constitute automatic, explicit consent to its use in any manner.
14. Changes to the Privacy Policy
This Policy is reviewed regularly and may be updated, in particular, in connection with changes in the law, the scope of the Services, data processing methods, Partners, or the technology providers or tools used on the Website. The current version is published on the Website with the effective date.