Legal

Privacy Policy

Protecting your personal data is a priority for us. Below we explain what we collect, why, and how you can manage it.

In force since 29 August 2026

Data controller

The controller of your personal data is VILLA ESTATE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Warsaw, ul. Żelazna 51/53, 00-841 Warszawa, entered in the register of entrepreneurs of the National Court Register under KRS number 0001257272 by Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy Krajowego Rejestru Sądowego, NIP 5243079145, REGON 545381833, share capital 5 000,00 zł.

In matters concerning the processing of personal data you can contact us at [email protected] or by phone at +48 572 296 752.

We have not appointed a data protection officer — all personal-data enquiries are handled through the contact details above.

Purposes and legal bases of processing

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and applicable national law. Below we explain for what purpose, and on what legal basis, we do so.

Responding to an enquiry

Answering a message sent through a form, by e-mail or by phone — Art. 6(1)(b) and (f) GDPR (our legitimate interest in handling correspondence).

Presenting an offer

Selecting and presenting property offers matching your preferences — Art. 6(1)(b) GDPR (steps taken before entering into a contract, at your request).

Concluding and performing a contract

Preparing, concluding and performing a brokerage agreement and handling the transaction — Art. 6(1)(b) GDPR.

Legal obligations

Tax and accounting settlements and obligations under anti-money-laundering law — Art. 6(1)(c) GDPR.

Marketing our own services

The newsletter and information about Villa Estate offers and events, and the selection of ads and building of audience lists in advertising tools — Art. 6(1)(a) GDPR (your consent), and, for direct marketing to clients, Art. 6(1)(f) GDPR.

Site analytics and security

Maintaining, protecting and improving the website, including detecting errors and abuse — Art. 6(1)(f) GDPR, and, for tools that require consent, Art. 6(1)(a) GDPR.

Pursuing claims

Establishing, pursuing or defending claims connected with our business — Art. 6(1)(f) GDPR.

Consent register

Demonstrating when, and to what extent, you consented to cookies and analytics tools — Art. 7(1) GDPR (the accountability obligation).

Categories of data we process

Depending on how you contact us, we process:

Contact details

Name and surname, e-mail address, phone number.

The content of your enquiry

A message sent through the contact form, by e-mail or given by phone.

Property preferences

Information about the property you are looking for, selling or letting — location, floor area, budget, timing.

Contract and billing data

Data needed to conclude and settle a brokerage agreement, where cooperation goes ahead.

Technical data

IP address, browser and device type, date and time of the visit, events recorded on the site, and identifiers stored in cookies.

Consent records

The content and date of your cookie choice, together with the IP address from which it was made.

How we obtain your data

We receive data above all directly from you — through the forms available on the website, e-mail, phone contact and the other channels of communication with Villa Estate.

Some technical data is collected automatically as you use the site — to the extent described in the cookies part of this policy.

Providing your data is voluntary, but without contact details we will not be able to answer your enquiry or present an offer.

How long we keep your data

We keep data for as long as necessary to fulfil the purpose for which it was collected, and then for the period required by law or until the limitation period for any claims expires.

Data from correspondence that did not lead to cooperation is deleted no later than three years after the last contact. Contract and billing documentation is kept for the period required by tax and accounting law. Data processed on the basis of consent — including marketing data — is kept until the consent is withdrawn or an objection is raised.

Records of cookie consents are kept for as long as needed to demonstrate accountability, and no longer than three years from the moment a given choice was recorded.

Recipients and service providers

Data may be entrusted to entities that provide services necessary for running our business. Each such entity acts under a data-processing agreement and is bound to confidentiality and to security measures compliant with the GDPR. Currently these are:

Infrastructure and data storage

Google Cloud — the site, the database and the system logs. Your data is stored in the Warsaw region (europe-central2); the application layer runs in the Netherlands region (europe-west4), because the hosting service offers no region in Poland. All processing takes place within the European Economic Area, and data is encrypted both in transit and at rest.

Site protection

Cloudflare — domain handling, protection of the site against attacks and abuse, the form-verification mechanism (Turnstile) that protects against automated spam, and property image delivery. Traffic to the site passes through Cloudflare's network, which filters it before it reaches our infrastructure; the IP address and technical connection data are processed for that purpose.

Handling enquiries

ASARI — the CRM in which we handle enquiries and contacts so that a reply can follow without undue delay.

Business e-mail

Google Workspace — the mailboxes on the villaestate.pl domain. A message you send us by e-mail, and its attachments, are stored in Google's global infrastructure: our plan does not allow a storage region to be specified, so unlike form submissions this data may be stored outside the European Economic Area, under the terms described below.

Error monitoring

Sentry (European region) — recording technical errors on the site only, so we know about a failure and can fix it. The tool does not record the course of a visit, sets no cookies and stores nothing on your device, and no IP address is written into the events; it runs on our legitimate interest (art. 6(1)(f) GDPR) in keeping the site working and secure.

Marketing tools

Microsoft Clarity, Meta, Google and LinkedIn — measuring campaign effectiveness and remarketing; enabled only with your consent and only while a given campaign is running. If, with your consent to Google Ads, you submit a form on a campaign page, the phone number and e-mail address from that form reach Google as a cryptographic hash (SHA-256) computed in your browser; Google does not receive them in plain form. Google uses those hashes for two purposes: to match the enquiry to the ad click, and to build customer lists (Customer Match) in our Google Ads account, which are then used to select who sees our ads and what we bid. For that purpose Google acts as a processor on our behalf, under the Google Ads Data Processing Terms.

Business operations

Providers of IT and CRM systems, our accounting office, legal advisers and entities providing technical support.

Transfers outside the European Economic Area

We aim to have data processed within the European Economic Area. Some of our providers, however, are established outside the EEA or use global infrastructure — this applies in particular to business e-mail (Google Workspace), site protection (Cloudflare) and advertising tools (Google Ads).

In such cases the transfer takes place under the mechanisms provided for in Chapter V of the GDPR — above all the standard contractual clauses approved by the European Commission, supplemented with additional security measures. A copy of the safeguards applied is available on request sent to [email protected].

Profiling and automated decisions

We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.

If you consent to analytics and marketing tools, your activity on the site may be analysed to match content and marketing messages to your interests. If you also submit a form on a campaign page, the phone number and e-mail address passed on as a hash may be used by Google to add you to an advertising audience list in our Google Ads account. This analysis serves only the selection of ads — it does not affect the terms of any offer or the way your enquiry is handled. You can withdraw your consent at any time; from that moment we pass no new data to Google.

Manage consents

Your rights

In connection with the processing of your personal data you have the following rights:

Right of access

The right to know whether and how we process your data, and to receive a copy of it.

Right to rectification

The right to have inaccurate data corrected and incomplete data completed.

Right to erasure

The so-called right to be forgotten — unless legal provisions or our legitimate interests stand in the way.

Right to restriction

The right to demand that processing be suspended — for example while the accuracy of the data is being verified.

Right to portability

The right to receive your data in a commonly used format and to transmit it to another controller.

Right to object

The right to object to processing based on legitimate interest, including direct marketing.

Withdrawal of consent

The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Notification of a breach

The right to be notified of a personal-data breach where it could result in a high risk to your rights.

Complaint to the supervisory authority

The right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, if you consider that we process data unlawfully.

How we handle your request

To exercise the rights above, write to [email protected] or call +48 572 296 752.

We reply in writing or electronically — as a rule through the same channel the request came in, unless you indicate another. At your request we may provide the information orally, provided we can confirm your identity by other means.

We act on requests without undue delay, no later than one month after receiving them. For complex requests, or a large number of them, this period may be extended by a further two months — in that case we will inform you of the extension and its reasons.

Write to us

The principles we follow

Whatever the legal basis of processing, we take care that your personal data is:

Lawfulness

Processed lawfully, fairly and transparently.

Purpose limitation

Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

Data minimisation

Adequate, relevant and limited to what is necessary for the purposes of processing.

Accuracy

Accurate and, where necessary, kept up to date, with inaccurate data erased or rectified without delay.

Storage limitation

Kept in a form permitting identification of the data subject for no longer than necessary.

Security

Processed in a manner ensuring appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

What cookies are

Cookies are small text files saved on your computer, tablet or phone as you use a website. They usually contain the name of the site they come from, their storage period and a browser identifier.

We use them so that the site works correctly, to remember your preferences and — if you consent — to analyse how the site is used and measure the effectiveness of marketing activities.

Types of cookies

We divide cookies exactly as the consent window shown on your first visit presents them:

Essential

Keep the site working, maintain your session and remember your consent choice and site preferences. They require no consent and are not used for tracking.

Analytics

Help us understand how you use the site — which content is read and where errors occur. We enable them only after you consent.

Marketing

Used to measure campaign effectiveness and for remarketing. We enable them only after you consent.

Managing your consents

You give consent to cookies other than the essential ones knowingly, in the window shown on your first visit — you can accept everything, reject everything, or open the advanced settings and decide on each tool separately.

You can change or withdraw your choice at any time on the consent-management page — it is as easy as giving consent and does not affect your use of the site. Independently of this you can manage cookies in your browser settings; restricting essential cookies, however, may disrupt some parts of the site.