Privacy Policy

As of April 27, 2023, the Personal Data Controller changes from EPP RETAIL – M1 RADOM SPÓŁKA Z OO, Konstruktorska 12a Street, 02-673 Warsaw as Joint Controllers: EPP Property Management sp. z o. o. with its registered office in Kielce, address: ul. Świętokrzyska 20, 25-406 Kielce and the company under the name EPP COMMUNITY PROPERTIES – PM SERVICES sp. z o. o. with its registered office in Kielce, address: ul. Świętokrzyska 20, 25-406 KielceThe data will be further processed for marketing purposes.

1. DEFINITIONS

1.1. Administrator – means Administrator 1 and Administrator 2 jointly or, depending on the context, either of them.
1.2. Administrator 1 – a company under the name EPP PROPERTY MANAGEMENT Spółka z ograniczoną odpowiedzialnością with its registered office in Kielce, address: ul. Świętokrzyska 20, 25-406 Kielce.
1.3. Administrator 2 – a company under the name EPP COMMUNITY PROPERTIES – PM SERVICES sp. z o. o. with its registered office in Kielce, address: ul. Świętokrzyska 20, 25-406 Kielce.
1.4. Personal data – information about a natural person identified or identifiable by one or more specific factors determining their physical, physiological, genetic, mental, economic, cultural or social identity, including device IP, location data, online identifier and information collected via cookies and other similar technology.
1.5. Policy – this Privacy Policy.
1.6. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
1.7. Website – the website operated at https://epp-poland.com/ as well as other services provided for properties managed by Administrator 1 or Administrator 2, such as this website. Website addresses may be updated from time to time.
1.8. User – any natural person visiting the Website or using one or more services or functionalities described in the Policy.

2. DATA PROCESSING IN CONNECTION WITH THE USE OF THE SERVICE

2.1. In connection with the User's use of the Website, Administrator 1 and Administrator 2 collect data to the extent necessary to provide the individual services offered, as well as information about the User's activity on the Website. Detailed rules and purposes for processing Personal Data collected during the User's use of the Website are described below.
2.2. Administrator 1 and Administrator 2 are joint controllers of Personal Data based on an appropriate agreement.

3. PURPOSES AND LEGAL BASIS FOR DATA PROCESSING ON THE WEBSITE
USING THE SERVICE

3.1. Personal data of all persons using the Website (including IP address or other identifiers and information collected via cookies or other similar technologies) are processed by the Administrator:
3.1.1. in order to provide services electronically in the scope of making the content collected on the Website available to Users – then the legal basis for processing is the necessity of processing for the performance of the contract (Article 6, paragraph 1, letter b of the GDPR);
3.1.2. for analytical and statistical purposes – then the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR), consisting in conducting analyses of Users’ activities and their preferences in order to improve the functionalities used and the services provided;
3.1.3. in order to possibly establish and pursue claims or defend against claims – the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR).
3.2. User activity on the Website, including their Personal Data, is recorded in system logs (a special computer program used to store a chronological record containing information about events and activities related to the IT system used to provide services by the Administrator). The information collected in logs is processed primarily for purposes related to the provision of services. The Administrator also processes it for technical and administrative purposes, to ensure the security of the IT system and to manage this system, as well as for analytical and statistical purposes – in this respect, the legal basis for processing is the Administrator's legitimate interest (Article 6, Section 1, Letter f of the GDPR).

CONTACT FORMS
3.3. The Administrator provides the ability to contact the Administrator using electronic contact forms. Using the form requires providing Personal Data necessary to contact the User and respond to the inquiry. The User may also provide other data to facilitate contact or process the inquiry. Providing data marked as mandatory is required to accept and process the inquiry, while failure to provide such data will result in the inability to process the inquiry. Providing the remaining data is voluntary.
3.4. Personal data are processed:
3.4.1. in order to identify the sender and process their inquiry sent via the provided form – the legal basis for processing is the necessity of processing for the performance of the service provision contract (Article 6 paragraph 1 letter b of the GDPR); in the scope of data provided optionally, the legal basis for processing is consent (Article 6 paragraph 1 letter a of the GDPR);
3.4.2. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR), consisting in maintaining statistics of inquiries submitted by Users via the Website in order to improve its functionality.

NEWSLETTER AND OTHER MARKETING CONTENT
3.5. The Controller sends marketing content, including providing a newsletter service (in selected properties managed by Controller 1 or Controller 2) and implementing push notification campaigns, to individuals who have provided their email address, telephone number, or consented to receive push notifications. Providing data or expressing consent is required to send marketing content and provide the newsletter service and push campaigns, and failure to provide such data results in the inability to send such content. This form of communication with the User may include profiling.
3.6. Personal data are processed:
3.6.1. in the case of sending marketing content to the User as part of a newsletter or via other channels – the legal basis for processing, including the use of profiling, is the legitimate interest of the Controller (Article 6 paragraph 1 letter f of the GDPR) in connection with the consent given to receive the newsletter;
3.6.2. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR), consisting in conducting analyses of Users’ activity on the Website in order to improve the functionalities used;
3.6.3. in order to possibly establish and pursue claims or defend against claims – the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR), consisting in the protection of its rights.

SOCIAL NETWORKS AND OTHER FORMS OF REGISTRATION
3.7. The Controller processes the Personal Data of Users visiting the Controller's social media profiles (Facebook, YouTube, Instagram, Twitter). This data is processed solely for the purpose of maintaining the profile, including for the purpose of informing Users about the Controller's activities and promoting various events, services, and products. The legal basis for processing Personal Data by the Controller for this purpose is its legitimate interest (Article 6, paragraph 1, letter f of the GDPR), consisting in promoting its own brand.
3.8. In the event of participant registration in the application and/or participation in the points program, motivation program and/or in individual campaigns, as appropriate, and in connection with the use of the application, the Administrator may obtain the User's personal data from Facebook, TikTok, Google and Apple.

4. COOKIES AND SIMILAR TECHNOLOGY

4.1. GENERAL INFORMATION
Cookies are small text files that are placed on your computer by websites you visit. They are widely used to make websites work or perform more efficiently, as well as to provide information to the owners of the site. The table below explains the cookies we use and why.
We use the following categories of cookies: session and persistent.
4.1.1. session cookies – remain on the User's device until the User leaves the website or turns off the software (web browser);
4.1.2. Permanent files remain on the device for the time specified in the file parameters or until they are manually deleted by the User.

4.2. FOR WHAT PURPOSE DOES THE ADMINISTRATOR USE COOKIES?
Taking into account the purpose of using files, the Administrator uses two categories of cookies: "necessary" and "additional" for the following purposes:
4.2.1. "Necessary" cookies – for the purpose and to the extent necessary to properly display the website. This is to ensure basic functions such as security, network management, and accessibility. You can disable them by changing your browser settings, but this may affect the functionality of the website. The Website may use session cookies for this purpose.
4.2.2. "Additional" cookies, including:
a) functional – in order to research the preferences of people using the Website, with the results of these research intended to improve the quality of the page display;
b) marketing – in order to enrich information about the User, provide personalized promotions and/or make automatic decisions
c) analytical – for marketing purposes to display personalized advertising on portal websites as well as remarketing in Google Ads, tracking user traffic on the website
For this purpose, the Website may use permanent and session cookies.
The use of this category of cookies is based on user consent. This data is not combined with information such as name, email address, or other data that would allow for easy identification of the website visitor.

4.3. ANALYTICAL COOKIES (THIRD-PARTY)
The Administrator and the providers of individual functionalities use various solutions and tools for analytical and marketing purposes. Below is basic information about these tools. Detailed information can be found in the privacy policy of the respective provider.
4.3.1. GOOGLE ANALYTICS (provided by Google Inc.) These cookies are used to collect information about how visitors use the Website. The Administrator uses this information to create reports and improve the website. These cookies allow us to count visits and traffic sources, so we can measure and improve the performance of our website. They help us determine which pages are the most and least popular and see how visitors move around the site. All information collected by these cookies is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you visited our website. Google's privacy and data protection overview can be found at https://support.google.com/analytics/answer/6004245As part of the service provided, data may be transferred outside the EEA and Switzerland, primarily to the United States.
4.3.2. META PIXEL (provider: Meta Platforms, Inc.) Meta Pixel is an analytical tool that allows you to measure the effectiveness of Facebook ads based on the analysis of user behavior on the Service. It allows you to personalize advertising content displayed on Facebook and Instagram. More information about Meta's personal data protection can be found at: Meta Privacy PolicyIn connection with the use of this tool, data may be transferred outside the EEA, primarily to the United States.
4.3.3. GOOGLE TAG MANAGER (provider: Google Inc.) Google Tag Manager is a tag management system that allows you to implement various tracking codes and analytical tools without having to modify the website's source code. Google Tag Manager itself does not collect personal data, but it may trigger other tools (e.g., Google Analytics, Meta Pixel) that collect user data. More information about data processing by Google can be found at: Google Privacy Policy.
4.3.4. USER.COM (provider: User.comUser.com is a marketing automation tool that allows for user segmentation and content personalization based on their behavior on the Website. It may use cookies to track user activity and tailor marketing content. More information about User.com's privacy policy can be found at: User.com Privacy Policy.
4.3.5. Google Ads (Provider: Google Ireland Limited) Google Ads enables us to present our offerings in the Google search engine and on websites that are part of the Google advertising network. Using Google Ads, we analyze the effectiveness of our ads, which allows us to better tailor our offerings to user needs. When you click on an advertising banner served by Google, cookies related to the Ads service are stored on your device. More information about how the provider processes data can be found at: https://support.google.com/google-ads/answer/9028179.

4.4. MARKETING COOKIES
4.4.1. Information about how the User uses the Website, which allows us to tailor the display of relevant advertisements on our websites or third-party websites to reflect the preferences and habits of Users. Based on this information, we can create, for example, general User profiles. This means that the User is subject to profiling, but this type of profiling does not affect their rights.
4.4.2. Decisions regarding the display of promotions on websites may be made automatically based on information collected about User activity.
The processing of User's personal data for the purpose of preparing and delivering tailored promotions may, in some cases, involve the use of IT systems that allow for automated tailored promotions, which are then displayed on the Website without human intervention. The Administrator informs that, in accordance with applicable law, in cases where a decision based on such processing of User's personal data produces legal effects for the User or significantly affects them in a similar manner, the User has the right to obtain human intervention from the Administrator, express their position, and challenge the decision. For this purpose, the User may contact the Administrator or use the functionalities available on the Website.
Automatic decision-making, including profiling, referred to in point 4.4.2, will take place if you expressly consent in the cookie configurator.

4.5. SOCIAL PLUGINS
4.5.1. The Website uses social media plugins (such as Facebook, Google+, LinkedIn, Twitter, Instagram, YouTube). Plugins allow the User to share content published on the Website on a selected social media platform. Using plugins on the Website allows the social media platform to receive information about the User's use of the Website and may assign it to the User's profile created on the relevant social media platform. The Administrator has no knowledge of the purpose and scope of data collection by social media platforms. Detailed information on this subject can be found at the links below:

• Facebook: https://www.facebook.com/policy.php
• Google: https://privacy.google.com/take-control.html?categories_activeEl=sign-in
• LinkedIn: https://www.linkedin.com/legal/privacy-policy?_l=pl_PL
• Twitter: https://twitter.com/en/privacy
• Instagram: https://help.instagram.com/155833707900388
• YouTube: YouTube Privacy Settings That Protect Your Data - How YouTube Works

4.5.2. Plugins used on the Website:
4.5.2.1. Smash Balloon Instagram Feed – for displaying live photos/posts from our Instagram profile. This content is embedded by Meta Platforms Ireland Ltd., based in Ireland. When you visit a page with embedded Instagram content, Meta may collect information about your visit, including your IP address and browser information. This happens even if you don't have an Instagram account or are not currently logged in. More information: https://help.instagram.com/155833707900388
4.5.2.2 FluentBooking – a plugin designed to support a specific contact form. Data is processed to accept and process appointment/consultation bookings and to send confirmations and reminders regarding the scheduled appointment.
4.5.2.3 Fluent Forms / Fluent Forms Pro – these plugins are used to manage forms. In response to a contact inquiry, the first name, last name, and email address will be processed. The Data Recipient will be the Administrator. These plugins integrate to transmit the aforementioned personal data.
4.5.2.4. GT Translate – Sends page content to Google servers or other translation service providers for processing. When loading the translation, Google servers may receive the user's IP address, browser information, interface language, and information that the user is using the translation service. For more details, see: https://policies.google.com/privacy.
4.5.2.5. Converter for Media – image processing and conversion takes place on the Administrator's server (Self-hosted), using a free conversion plan to the WebP format. The Administrator will be the recipient of the data.
4.5.2.6. Mapplic – The website uses the Mapplic plug-in to display interactive maps and building plans.
4.5.2.7. Manage WP (provided by GoDaddy) – technical website management, updates, security monitoring, and backup creation and storage. The plugin serves administrative purposes, ensuring a constant connection to the external platform and data transfer (especially backups). More information: https://www.godaddy.com/pl-pl/legal/agreements/privacy-policy.
4.5.2.8 Fluent SMTP – a plugin used to mediate the transfer of personal data (emails and their content) to external email service providers via an external SMTP service (e.g., EmailLabs, user.com). More information at: https://www.user.com/security/privacy-policy and https://emaillabs.io/polityka%20-prywatnosci/

4.6. CONTROLLING AND DELETING COOKIES
4.6.1. Most browsers offer the ability to accept or reject all cookies. Users can also easily change their cookie settings in their browser settings. Blocking all cookies from the Website may cause performance issues or prevent the use of certain features altogether.
4.6.2. Managing and deleting cookies varies depending on the browser you are using. For more information, please refer to your browser's Help function or visit the website http://www.allaboutcookies.org, which explains step-by-step how to control and delete cookies in most browsers.4.6.3. Information specific to specific browsers can be found at:
a) EDGE: https://support.microsoft.com/pl-pl/microsoft-edge/usuwanie-plik%C3%B3w-cookie-w-przegl%C4%85darce-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
b) Mozilla Firefox: http://support.mozilla.org/pl/kb/ciasteczka
c) Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=pl&answer=95647
d) Opera: http://help.opera.com/Windows/12.10/pl/cookies.html
e) Safari: https://support.apple.com/kb/PH5042?locale=en-GB
4.6.4. You can opt out of Google Analytics on all websites by visiting: http://tools.google.com/dlpage/gaoptout

4.6. OPERATING DATA
4.6.1. Even if cookies are not installed, the website administrator may gain access to the following data characterizing the manner of using the website (hereinafter: other operational data):
a) the ID number assigned to the device of the person visiting the website,
b) markings identifying the termination point of the telecommunications network,
c) the IT system (type of device, operating system, Internet browser) used by the Internet User,
d) information about the start, end and scope of each use of the website.
4.6.2. To ensure the highest possible quality of the website, the Administrator occasionally analyzes log files to determine: which pages are visited most often, which web browsers are used, whether the website structure contains any errors, etc. Operational data is not combined with information such as name, email address, and other data enabling easy identification of the website visitor.

4.7. ACCESS TO INFORMATION STORED ON YOUR DEVICE OTHER THAN COOKIES
4.7.1. Based on consent (expressed on the device) and solely for the purpose of providing the service electronically via the application, the Administrator obtains access to the following functionalities of the end device (e.g. mobile phone).

4.8. PROTECTION OF PERSONAL DATA
4.8.1. Information obtained through cookies and operational data may constitute personal data within the meaning of the GDPR in certain exceptional circumstances. If the information indicated above is classified as personal data, the Administrator is the controller of the personal data. Even in the event of doubt as to whether a specific category of information constitutes personal data, the Administrator implements mechanisms to protect this information as personal data.
4.8.2. The processing of the above categories of data to the extent necessary for the correct display of the website ("necessary" cookies) is based on the so-called legitimate interest of the website administrator (Article 6, paragraph 1, letter f) of the GDPR. For this purpose, the following may occur:
a) occasionally analyzing log files in order to determine: what browsers are used by website visitors; which tabs, pages or subpages are visited or viewed most often or least often; whether the structure of the website contains any errors;
b) preventing unauthorised access to the website and the distribution of malicious code, interrupting denial of service attacks and preventing damage to computer systems and electronic communications systems.
In the above cases, you have the right to object.

4.8.3. However, if you consent to the installation of "additional" cookies (analytical, e.g., provided by Google Analytics / marketing cookies), the information collected in this way will be used to research the preferences of people using the Website, with the results of this research intended to improve the quality of the displayed page. In this case, the basis for data processing is Article 399, paragraphs 1 and 2 of the Electronic Communications Law (Journal of Laws of 2024, item 1221) in conjunction with Article 6, paragraph 1, letter a) of the GDPR. As indicated in Article 400 of the Electronic Communications Law, personal data protection regulations apply to obtaining the consent of the subscriber or end user. You may withdraw and delete cookies from your device at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

5. PERIOD OF PERSONAL DATA PROCESSING

5.1. The period of data processing by the Controller depends on the type of service provided and the purpose of the processing. Generally, data is processed for the duration of the service provision, until consent is withdrawn or an objection to data processing is raised in cases where the legal basis for data processing is the Controller's legitimate interest.
5.2. The data processing period may be extended if processing is necessary to establish, pursue, or defend against potential claims. After the processing period expires, the data is irreversibly deleted or anonymized.

6. USER RIGHTS

6.1. The User has the right to access the content of the data and to request its rectification, deletion, restriction of processing, the right to data transfer and the right to object to data processing, as well as the right to lodge a complaint with the supervisory authority responsible for the protection of Personal Data.
6.2. To the extent that User data is processed based on consent, such consent may be withdrawn at any time by contacting the Administrator or using the functionalities provided on the Website.
6.3. The User has the right to object to the processing of data for marketing purposes if the processing is carried out in connection with the legitimate interest of the Controller, and – for reasons related to the specific situation of the User – in other cases where the legal basis for data processing is the legitimate interest of the Controller (e.g. in connection with the implementation of analytical and statistical purposes).
6.4. More information about your rights under the GDPR can be found in Transparency policy.

7. DATA RECIPIENTS

7.1. In connection with the provision of services, Personal Data will be disclosed to external entities, including in particular IT service providers, in particular hosting services, providers responsible for the operation of IT systems, analytical service providers, marketing agencies (in the scope of marketing services) and entities associated with the Controller, including companies from its capital group.
7.2. If the User consents, their data may also be made available to other entities for their own purposes, including marketing purposes.
7.3. The Administrator reserves the right to disclose selected information concerning the User to competent authorities or third parties who submit a request for such information, based on an appropriate legal basis and in accordance with the provisions of applicable law.

8. DATA TRANSFERS OUTSIDE THE EEA

8.1. The level of protection of Personal Data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, the Controller transfers Personal Data outside the EEA only when necessary and with an adequate level of protection, in particular by:
8.1.1. cooperation with entities processing Personal Data in countries for which an appropriate decision of the European Commission has been issued regarding the adequate level of protection of Personal Data;
8.1.2. use of standard contractual clauses issued by the European Commission;
8.1.3. application of binding corporate rules approved by the relevant supervisory authority.

9. PERSONAL DATA SECURITY

9.1. The Controller conducts ongoing risk analysis to ensure that Personal Data is processed securely – ensuring, above all, that only authorized individuals have access to the data and only to the extent necessary for the tasks they perform. The Controller ensures that all operations on Personal Data are recorded and performed only by authorized employees and associates.
9.2. The Controller shall take all necessary measures to ensure that its subcontractors and other cooperating entities also guarantee the application of appropriate security measures whenever they process Personal Data on behalf of the Controller.

10. CONTACT DETAILS

10.1 Contact with the Administrator is possible via e-mail. [email protected] or mailing address: ul. Świętokrzyska 20, 25-406 Kielce.
10.2 The Controller has appointed a Personal Data Protection Coordinator who can be contacted by e-mail. [email protected] in any matter relating to the processing of Personal Data

11. CHANGES TO THE PRIVACY POLICY

11.1. The policy is reviewed on an ongoing basis and updated as necessary.