Privacy policy and cookie policy

• Responding to inquiries sent via the contact form, by phone or by email, including scheduling a visit to the sales office – for the contact form, on the basis of the consent given in the form (Article 6(1)(a) GDPR); for phone or email contact, on the basis of Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Article 6(1)(f) GDPR (the Controller's legitimate interest in handling inquiries).
• Direct marketing of our own products and services – sending commercial information by electronic means or by phone – only on the basis of separate, voluntary consent (in the form: the “I would like to receive commercial information…” checkbox; Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law of July 12, 2024). You may withdraw your consent at any time.
• Entering into and performing a reservation agreement or a development agreement – Article 6(1)(b) GDPR, and Article 6(1)(c) GDPR with respect to obligations under the law (including tax and accounting obligations).
• Establishing, pursuing or defending legal claims – Article 6(1)(f) GDPR.
• Ensuring the security of the Website (server logs: date and time of the visit, IP address, browser type) and protecting the contact form against spam (Google reCAPTCHA) – Article 6(1)(f) GDPR. Server log data is not used to identify Users.
• Visit statistics (Google Analytics) – only after “Analytics” consent in the cookie banner (Article 6(1)(a) GDPR, Article 399 of the Polish Electronic Communications Law). Without this consent, the Google Analytics script is not loaded and no data about the visit is sent to Google Analytics.
• Heatmaps and visit recordings (Microsoft Clarity) – only after “Analytics” consent in the cookie banner (Article 6(1)(a) GDPR, Article 399 of the Polish Electronic Communications Law).
• Ad performance measurement and remarketing (Google Ads, run through Google Tag Manager) – only after “Advertising” consent in the cookie banner (Article 6(1)(a) GDPR, Article 399 of the Polish Electronic Communications Law).
• Third-party content – the 3DEstate apartment list on the Apartments page loads right away because it is the core feature of that page (presenting the offer, Article 6(1)(f) GDPR; the module does not store cookies). The module loads fonts from Google Fonts, so Google receives the IP address – temporarily, on the basis of the Controller's legitimate interest (presenting the offer, Article 6(1)(f) GDPR), until 3DEstate serves the fonts from its own server. The map in the site footer is made from OpenStreetMap data and loads from our server – it does not connect to any third-party provider; clicking it opens Google Maps in a new tab. The Google map on the Contact page and the 360° map – only after “Marketing” consent in the cookie banner or after you click the “Load…” button next to the content in question (Article 6(1)(a) GDPR, Article 399 of the Polish Electronic Communications Law).

The contact form is on the home page and on the Contact page. The data you provide in the form – full name, email address, optionally a phone number, the option selected in the “I am interested in” field, the preferred date and time of a visit, the message and information on the consents given – is sent by email to the Bunscha Residence Sales Office (biuro@bunscharesidence.pl). We send an automatic confirmation of receipt to the email address you provide – without the content of your message (with the preferred visit date, if you selected one). The website server does not store messages in a database. The form is protected by Google reCAPTCHA (described in “Services and cookies on this website”). The required fields of the form are your full name, email address and consent to data processing – the form cannot be sent without them.

• data from inquiries and the contact form – for the time needed to handle the inquiry and any further correspondence, and then for up to 3 years from the last contact (the limitation period for possible claims);
• data processed on the basis of consent to commercial information – until the consent is withdrawn or an objection is raised;
• data collected after consent in the cookie banner – Google Analytics: up to 14 months from collection (according to the data retention setting of the service; aggregated reports without identifiers may be kept longer), Microsoft Clarity: visit recordings 30 days (heatmaps and recordings we mark – longer, according to Microsoft Clarity's rules), Google Ads: remarketing audience lists up to 540 days from the last visit (according to the campaign settings); third-party content – according to the providers' policies; withdrawing consent stops the collection of new data;
• data related to a concluded agreement – for the term of the agreement, then for the period required by law (including 5 years from the end of the tax year) and until the limitation periods for claims expire;
• server logs – for up to 12 months;
• cookies and data in browser storage – for the periods given in “Services and cookies on this website”.

Data may be disclosed to entities processing it on behalf of the Controller and to other recipients – only to the extent necessary for the purposes described above (for separate controllers, see below):

• IT service providers – website hosting and email (servers located in the European Economic Area);
• Google Ireland Limited and Google LLC – form protection (Google reCAPTCHA), the Google map on the Contact page (after consent or after clicking “Load the map”), Google Analytics visit statistics (only after “Analytics” consent), Google Ads ad performance measurement (only after “Advertising” consent) and Google Fonts used by the 3DEstate module on the Apartments page and by the 360° map;
• Microsoft Ireland Operations Limited and Microsoft Corporation – Microsoft Clarity heatmaps and visit recordings (only after “Analytics” consent);
• the advertising agency running Google Ads campaigns on the Controller's behalf – with access to the data in Google Analytics, Google Tag Manager and Google Ads (visit statistics and online identifiers, without contact form data), as a processor acting on the Controller's behalf;
• 3DEstate – the interactive apartment list on the Apartments page, loaded when that page opens; technical data related to the use of the module (IP address, browser information);
• mapyinwestycji.pl – the 360° map on the Location page (after “Marketing” consent or after clicking “Load the map”); the map uses the provider's Google Analytics and loads files from Google Fonts, Font Awesome and code.jquery.com, so these providers also receive the IP address and browser information;
• INTER-BUD Group companies providing accounting, legal and administrative services to the Controller;
• partners providing additional services (Notus Finanse S.A., Excellent Wnętrza, MAXFLIZ) – only at the Customer's express request;
• entities authorized under the law.

Google and Microsoft services may also process data in the USA – under the terms described in “Services and cookies on this website” (EU-US Data Privacy Framework). Otherwise, the Controller does not transfer personal data to third countries or international organizations. After “Advertising” consent, Google may use information about the visit to tailor ads (remarketing) – this is profiling that has no legal effects on the User. The contact form is protected by Google reCAPTCHA: based on information about the browser and how the site is used, it automatically assesses whether the message is sent by a person, and if the score is too low the message is not accepted (you can then call or email us); this assessment has no legal effects on the User. Otherwise, the data is not subject to profiling or automated decision-making. For Google Ads, Google Maps and Google Fonts, Google, and for Microsoft Clarity, Microsoft, act as separate controllers of the data they receive and also use it for their own purposes in accordance with their own policies (links under “Transfers of data outside the EEA”); the Controller is also responsible for collecting this data on the site and transmitting it to the provider.

In connection with the processing of your personal data, you have the right to:

• access your data and receive a copy of it,
• have your data rectified (corrected),
• have your data erased,
• restrict processing,
• receive your data and transfer it to another controller (data portability),
• object to processing based on legitimate interest, including direct marketing,
• withdraw your consent at any time – without affecting the lawfulness of processing carried out before its withdrawal,
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

Right to object. You may object at any time to processing based on the Controller's legitimate interest (Article 6(1)(f) GDPR) on grounds relating to your particular situation (Article 21(1) GDPR), and to processing for direct marketing purposes without giving any reason (Article 21(2) GDPR).

Providing your data is voluntary, but necessary to respond to an inquiry or to enter into an agreement. The data comes directly from you.

The Controller has appointed a data protection team. Please send any questions or requests concerning your personal data to odo@inter-bud.pl or in writing to the address of the Controller's registered office.