Skip to main content

Privacy Policy for gregorek realestate

Last updated: 18.08.2026

This Privacy Policy (the "Policy") provides information on the processing of your personal data in connection with your use of the website available at https://gregorek.realestate (the "Website") and the services provided by the Controller.

Personal Data Controller

The controller of your personal data is Gregorek Real Estate Sp. z o.o., with its registered office in Warsaw (registered office address: ul. Złota 75A/7, 00-819 Warsaw, Poland), entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS number 0001159454, Tax Identification Number (NIP): 5273155566, National Business Registry Number (REGON): 541133860 (the "Controller").

Contacting the Controller

For all matters relating to the processing of personal data, you may contact the Controller electronically by e-mail at: contact@gregorek.realestate.

Personal Data Protection Measures

The Controller applies modern organisational and technical safeguards to ensure the highest possible level of protection of your personal data and ensures that such data is processed in accordance with Regulation (EU) 2016/679 (GDPR), the Polish Act of 10 May 2018 on the Protection of Personal Data, and other applicable data protection legislation.

Scope of the Policy

This Policy applies to the Service available at gregorek.realestate, in all language versions (the "Service"), and to communications conducted through it.

Information on the Processing of Personal Data

Your use of the Website and the services provided by the Controller requires the processing of your personal data. Detailed information on the purposes and legal bases of processing, the relevant processing periods, and whether the provision of data is mandatory or voluntary is set out below.

Handling contact form enquiries

Personal data processed:

  • First and last name
  • E-mail address

Legal basis: Article 6(1)(f) GDPR — processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case responding to the message submitted.

Data provision: Providing the above personal data is voluntary but necessary in order to receive a response to your message (failure to provide such data will make it impossible to receive a response).

Responding to an enquiry and presenting a property offer

Personal data processed:

  • First and last name
  • E-mail address

Legal basis: Article 6(1)(f) GDPR — processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case responding to the message submitted and presenting a property offer.

Data provision: Providing the above personal data is voluntary but necessary in order to receive a response to your message and a property offer.

Conducting correspondence with persons who are not parties to an agreement

Personal data processed:

  • First and last name
  • E-mail address

Legal basis: Article 6(1)(f) GDPR — processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case conducting communications, maintaining business relationships, ensuring the efficient operation of the organisation and, where necessary, establishing, pursuing or defending claims.

Data provision: Providing the above personal data is voluntary but necessary for the purpose of conducting communications.

Booking and organising a meeting

Personal data processed:

  • First and last name
  • E-mail address

Legal basis: Article 6(1)(b) GDPR — processing is necessary for the purposes of the Controller's legitimate interests, in this case organising meetings, communicating with participants and ensuring the efficient organisation of work.

Data provision: Providing the above personal data is voluntary but necessary to book and organise a meeting (failure to provide such data will make it impossible to book and organise a meeting).

Ensuring the proper operation and security of the Service

Personal data processed:

  • IP address
  • Date and time of connection
  • Information about the web browser
  • Information about the operating system and device
  • Session or device identifiers, where used
  • URL of the page visited and the referring page
  • Information about errors and events within the Service
  • Data contained in system logs, including information about attempted unauthorised access and security incidents
  • Data from essential technical cookies

Legal basis: Article 6(1)(f) GDPR — processing is necessary for the purposes of the legitimate interests pursued by the Controller, consisting in ensuring the security, integrity and proper functioning of the Service and protecting it against abuse and cyber threats.

Data provision: Providing the above personal data is voluntary but necessary to ensure the security, integrity and proper functioning of the Service and to protect it against abuse.

Operating the Controller's profiles on WhatsApp, Instagram and LinkedIn (the "Platforms")

Personal data processed:

  • Your profile name
  • Data made publicly available on your profile
  • Your image, where visible in photographs made publicly available on your profile
  • Personal data included by you in comments under published content or sent in a private message
  • Statistical and advertising data collected by the social media platform

Legal basis: Article 6(1)(f) GDPR — processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case operating profiles on the Platforms.

Data provision: Providing the above personal data is voluntary but necessary for you to use the Controller's profile on a given Platform. The Controller will process the above personal data until an effective objection is raised or the purpose of the processing has been achieved.

Joint controllers: With regard to statistical and advertising data, the entity responsible for operating the relevant Platform is a joint controller of personal data, namely Meta Platforms Ireland Limited (Instagram and WhatsApp) and LinkedIn Ireland Unlimited Company (LinkedIn). Detailed information concerning the arrangements between the Controller and these entities is available in their respective privacy policies. Any questions and claims arising from your use of the Platforms should be addressed directly to the relevant entities.

Posting comments on the Website

Personal data processed:

  • First name and, optionally, last name
  • E-mail address
  • IP address

Legal basis: Article 6(1)(a) GDPR — personal data is processed on the basis of your consent.

Data provision: Providing the above personal data is voluntary but necessary in order to post a comment.

Posting reviews of products and services

Personal data processed:

  • First name and, optionally, last name
  • E-mail address
  • IP address

Legal basis: Article 6(1)(a) GDPR — personal data is processed on the basis of your consent.

Data provision: Providing the above personal data is voluntary but necessary in order to post a review.

Analysing your activity on the Website

Personal data processed:

  • Date and time of visit
  • IP address of the device
  • Type of operating system used by the device
  • Approximate location
  • Type of web browser
  • Time spent on the Website
  • Pages visited and other activities performed within the Website

Legal basis: Article 6(1)(f) GDPR — processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case obtaining information about your activity on the Website.

Data provision: Providing the above personal data is voluntary but necessary for the establishment, pursuit or defence of claims that may arise in connection with the provision of services or use of the Website.

Establishing, pursuing or defending claims

Personal data processed:

  • First and last name / company name
  • E-mail address
  • Residential / registered office address
  • PESEL / KRS number
  • NIP number

Legal basis: Article 6(1)(f) GDPR — processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case establishing, pursuing or defending claims that may arise in connection with the provision of services or use of the Website.

Data provision: Providing the above personal data is voluntary but necessary for the establishment, pursuit or defence of claims.

Operation of the chatbot on the Website

Personal data processed: Data provided by you in the chatbot window.

Legal basis: Article 6(1)(f) GDPR — processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case operating the chatbot within the Website.

Data provision: Providing the above personal data is voluntary but necessary in order to use the chatbot.

Compliance with tax and accounting obligations following the conclusion of an agreement

Personal data processed:

  • First and last name
  • Company name / business details
  • Address
  • NIP and, where applicable, other identification numbers
  • Data concerning the agreement concluded
  • Data concerning transactions and services performed
  • Data contained in invoices and other accounting documents
  • Payment information, including amounts and payment dates
  • Bank account details, where necessary for settlement purposes
  • Data of representatives or contact persons, where included in accounting documentation

Legal basis: Article 6(1)(c) GDPR — processing is necessary for compliance with a legal obligation to which the Controller is subject, arising in particular from tax and accounting legislation.

Data provision: Providing the above personal data is voluntary but necessary for the fulfilment of obligations relating to accounting, tax settlements and the maintenance of required financial documentation.

Profiling

The Controller will process your personal data by automated means, including profiling. However, such processing will not produce legal effects concerning you or similarly significantly affect you.

The scope of personal data subject to profiling corresponds to the scope specified above in relation to the analysis of your activity on the Website. The legal basis is Article 6(1)(f) GDPR, pursuant to which the Controller may process personal data for the purposes of its legitimate interests, in this case conducting marketing activities tailored to recipients' preferences. Providing the above personal data is voluntary but necessary for the above purpose. The Controller will process personal data for profiling purposes until an effective objection is raised or the purpose of the processing has been achieved.

AI Assistant

An artificial intelligence-based assistant named Magdalena is available within the Service and is intended to provide information about the Controller's offering. The assistant is available both as a chat window within the Service and as an embedded chat on individual property pages.

Information on interaction with an AI system. When using the assistant, you are communicating with an artificial intelligence system rather than a human being. Information to this effect is displayed before the conversation begins, in the assistant's greeting and alongside its responses. The Controller, as a deployer of the AI system, thereby ensures — in cooperation with the system provider — compliance with the transparency obligations arising under Article 50 of Regulation (EU) 2024/1689 (Artificial Intelligence Act).

Informational nature. The assistant provides information solely on the basis of content published within the Service. It does not provide legal, tax or investment advice, does not provide profit forecasts or rates of return, and does not make decisions concerning the conclusion of agreements, prices or transaction terms. Such decisions are made by the Controller or persons authorised by the Controller. The assistant's responses are for illustrative and informational purposes and require confirmation by an adviser of the Controller, particularly with regard to prices, availability, payment plans and completion dates.

Scope of processing. During a conversation, the content of your questions and the assistant's responses, as well as technical session data, are processed. The assistant does not collect contact details. Contact with the Controller takes place via WhatsApp, the meeting booking system or e-mail. Please do not provide special categories of personal data or other particularly sensitive information during the conversation.

Technology providers. The assistant operates on the Zapier platform (Zapier, Inc.), which uses a language model provided by OpenAI and Amazon Web Services infrastructure as further processors. According to Zapier's documentation, conversation content is not used by model providers to train AI models, and a zero data retention mechanism is applied in relation to OpenAI, meaning that requests are not retained by the model provider. The current list of Zapier subprocessors is available at: https://zapier.com/legal/subprocessors.

Retention period for conversations. Conversation records are stored on the Zapier platform for 60 days, after which they are automatically deleted. Deletion from the provider's backups takes place within up to 4 months. The Controller may delete a conversation record earlier upon request.

Personal Data Retention Periods

  • AI assistant conversation records — 60 days from the date of the conversation (automatic deletion; backup copies retained for up to 4 months)
  • Contact form data and enquiries — 12 months from the date of the meeting
  • Enquiries not resulting in the conclusion of an agreement — 12 months from the last contact, unless you object earlier
  • Meeting booking data — 12 months from the date of the meeting
  • E-mail correspondence and WhatsApp communications related to an agreement or dispute — until the expiry of the limitation period for any potential claims
  • Data processed for the establishment, pursuit or defence of claims — until the expiry of the limitation period for any potential claims
  • Accounting and tax documentation — 5 years from the end of the calendar year in which the tax obligation arose
  • Data related to posting comments on the Website — until the consent granted is withdrawn (and the comment is removed)
  • Data related to posting reviews of products and services — until the consent granted is withdrawn (and the review is removed)
  • Technical data and server logs — in accordance with the retention periods applied by the hosting provider

Recipients of Personal Data

Personal data is entrusted to processors on the basis of agreements meeting the requirements of Article 28 GDPR:

  • Webflow, Inc. (United States) — hosting of the Service and aggregated visitor statistics
  • Zapier, Inc. (United States) — AI assistant platform; further subprocessors: OpenAI (language model) and Amazon Web Services (infrastructure), both based in the United States
  • Calendly, LLC (United States) — meeting booking system
  • Mapbox, Inc. (United States) — interactive property map
  • BunnyWay d.o.o. (Slovenia) — hosting and delivery of video content
  • Microsoft Corporation (United States) — e-mail services

If you contact the Controller via WhatsApp, the provider of this service for users within the European Economic Area is WhatsApp Ireland Limited (Ireland), which processes data in accordance with the rules set out in its own privacy policy. The Controller receives the content of your correspondence as well as your telephone number and profile name.

The consent management panel (Consent Pro, Finsweet) operates in your browser and stores only information concerning the decision you have made.

Data may also be disclosed to entities authorised under applicable law and, to the extent necessary, to the Controller's legal and tax advisers. The Controller does not sell personal data or disclose it to third parties for marketing purposes.

Transfers of Personal Data Outside the European Economic Area

In connection with the Controller's use of tools such as Webflow, Zapier, OpenAI, Calendly, Mapbox, BunnyWay, Microsoft Corporation and Google Analytics, your personal data may be transferred to the following third countries: the United Kingdom, Ireland, Slovenia and the United States. The legal bases for transferring data to the above third countries are:

  • European Commission adequacy decisions confirming an adequate level of personal data protection in each of the above third countries
  • In the case of the United States — Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework
  • Contractual clauses ensuring an adequate level of protection, consistent with the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021

You may obtain from the Controller a copy of the data transferred to a third country.

Cookies and Embedded Services

The Website uses cookies, which are installed on your end device. Cookies may be read by the Controller's systems as well as by systems belonging to other entities whose services are used by the Controller (e.g. WhatsApp, Google).

Cookies and the browser's local storage may be used by services embedded within the Service, including the AI assistant and the interactive map. These services are technically blocked and are activated only after you have given your consent through the consent management panel displayed during your first visit. Until consent is provided, a message containing a button allowing you to open your preferences is displayed in place of the map.

The background video player (BunnyWay d.o.o.) loads by default as part of the visual layer of the Service. Activating the player involves transmitting the user's IP address and basic technical data to the provider where necessary to deliver the content. In the configuration implemented within the Service, the player is not used to track users or for advertising purposes. The legal basis for processing such data is Article 6(1)(f) GDPR.

You may change or withdraw your consent at any time by clicking the "Cookie Preferences" button in the footer of the Service. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

You may also manage cookies through your browser settings. Restricting the storage of cookies may affect the availability of certain functions of the Service.

Your Rights

In connection with the processing of your personal data, you have the following rights:

  1. Right of access — you have the right to obtain confirmation as to whether personal data concerning you is being processed and, where that is the case, access to such personal data and a copy thereof (Article 15 GDPR).
  2. Right to rectification — you have the right to request rectification of outdated, incomplete or inaccurate personal data (Article 16 GDPR).
  3. Right to erasure — in certain circumstances, you may request that the Controller erase your personal data (Article 17(1)(a)–(d) GDPR).
  4. Right to data portability — where your personal data is processed on the basis of your consent or for the performance of an agreement, you have the right to have your data transmitted to another controller (Article 20 GDPR).
  5. Right to withdraw consent — where your personal data is processed on the basis of your consent, you have the right to withdraw that consent at any time (Article 7(3) GDPR).
  6. Right to restriction of processing — you may request that the Controller refrain from carrying out operations on your data for a specified period, merely storing it (Article 18 GDPR).
  7. Right to object — you have the right to object to the processing of personal data where such processing is based on the Controller's legitimate interests (Article 21(1) GDPR).
  8. Right to lodge a complaint — you have the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your personal data infringes the GDPR (Article 77 GDPR).

You may submit requests to contact@gregorek.realestate. The Controller will respond without undue delay and no later than one month after receipt of your request. In complex cases, this period may be extended by a further two months, and you will be informed accordingly.

Conversations with the AI assistant are not assigned to identified individuals. If your request concerns a conversation record, please provide information enabling the conversation to be located, such as its approximate date and content. Pursuant to Article 11 GDPR, the Controller is not required to obtain additional information solely for the purpose of identifying the data subject.

You also have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

Automated Decision-Making and Profiling

Your personal data is not used for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. The Controller does not conduct marketing profiling of users of the Service.

Data Security

The Controller applies technical and organisational measures appropriate to the identified risks, including encryption of data in transit using the TLS protocol, access controls for systems (with access to AI assistant conversation records restricted exclusively to the Controller), authentication of accounts maintained with service providers, and verification of the safeguards implemented by service providers.

External Links

The Service may contain links to third-party websites, including property developers' websites and social media profiles. The Controller is not responsible for the data processing practices applicable to those services. You are encouraged to review their respective privacy policies.

Changes to this Policy

This Policy may be updated in connection with changes in applicable law, the scope of the Controller's activities or the tools used. The current version will be published within the Service together with the date of its most recent update.