Privacy Policy

1. Who is the controller of your data

The Controller of your personal data is BZB Projekt prosta spółka akcyjna (a Polish simple joint-stock company) with its registered office at ul. Piotrkowska 55/302, 90-413 Łódź, Poland, entered in the register of entrepreneurs of the Polish National Court Register (Krajowy Rejestr Sądowy) under KRS number 0000934641, NIP (tax identification number) 7252314316, REGON (statistical number) 520518869, hereinafter referred to as the "Controller".

In all matters concerning the processing of personal data and the exercise of the related rights, you may contact us at biuro@bzbprojekt.com or by sending correspondence to the address of the Controller's registered office.

The Controller has not designated a data protection officer. Matters concerning personal data are handled directly by the Controller, at the address given above.

This document fulfils the information duty arising from Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

2. What this policy covers

This policy describes how we process the personal data of persons who:

• visit our website,
• send us an enquiry through the form on the website,
• contact us by electronic mail or by telephone.

The website runs no shop and has no registration, no user account and no newsletter. The only data we deliberately collect is what you type into the enquiry form yourself. Everything else is described below for completeness, so that the picture is a full one.

3. What happens when you visit the website

The website does not use cookies. Nor do we use browser local storage (localStorage, sessionStorage) or any other technologies that store information on your device. For this reason the website does not display a cookie consent banner — there is nothing for which consent could be collected.

No analytics or tracking tools operate on the website. We do not use Google Analytics, social media pixels or advertising systems. We do not profile visitors and we do not build interest profiles of them.

The website does not make any requests to third-party servers. All resources — images and typefaces — are uploaded together with the website and load from its own server. In particular, the typefaces are not downloaded from Google Fonts servers, and therefore, when you simply browse the website, your IP address is not transferred to Google or to any other external entity.

Server logs

The only data processed in connection with the browsing of the website itself are the standard server logs kept by the hosting provider. They comprise the IP address, the date and time of the request, the address of the requested page, and the type of browser and operating system. The logs serve solely to ensure the security and correct operation of the website. The basis for the processing is the legitimate interest of the Controller (Article 6(1)(f) GDPR), consisting in ensuring the security and continuity of operation of the website.

The map

On the Contact page we have placed a location map from Google Maps. The map does not load by itself. The page contains no map frame — the frame is created only once you press the "Show the map" button, below a note explaining what that click does. Until that moment no data reaches Google. Once you enable the map, Google learns your IP address and processes that data as a separate controller, under its own privacy policy, over which we have no influence.

Links to other services

The footer of the website contains links to our profiles on LinkedIn and Facebook. These are ordinary links — they are not social plug-ins and they fetch nothing unless you choose to click them. Once you proceed to such a service, the processing of your data is governed by the privacy policy of its operator.

4. The enquiry form

This is the only place on the website where you ask us to get in touch by giving us your data.

Data: first name and surname, e-mail address, telephone number (an optional field), company or organisation name and country, the type and stage of the investment, a description of the investment and, in the form attached to a particular trade fair, also the name of the event. Sending the form requires ticking the consent box.

Purposes and legal bases:

• replying to the enquiry and taking steps at your request prior to entering into a contract, including preparing a quotation — Article 6(1)(b) GDPR;
• contacting you about the enquiry, to the extent covered by the consent you tick — Article 6(1)(a) GDPR; consent may be withdrawn at any time, and withdrawal does not affect the lawfulness of processing carried out before its withdrawal;
• establishing, pursuing or defending claims — Article 6(1)(f) GDPR.

Providing the data is voluntary, but without a name, an e-mail address and a description of the investment we will not be able to answer the enquiry.

Please do not include special categories of data (for example information about health) or other people's data in the description of the investment if you have no basis for passing it on. We do not need any of that in order to prepare a quotation.

The form is operated by Netlify, Inc., the provider of the website's hosting. The content of a submission is stored in that service's panel and forwarded to our mailbox. In this respect Netlify acts as a processor, under a data processing agreement.

5. Correspondence and telephone contact

Data: e-mail address, first name and surname, telephone number, and any other data contained in the content of the message or given during the call.

Purpose and legal basis: providing a reply and conducting correspondence — Article 6(1)(f) GDPR and, where the correspondence concerns entering into or performing a contract, Article 6(1)(b) GDPR. We do not record telephone calls.

6. To whom we disclose data

Your data may be disclosed solely to:

• entities to which we have entrusted the processing of data under a processing agreement — in particular the provider of the website's hosting and form handling (Netlify, Inc.), the e-mail provider (Google, under the Google Workspace service), the accounting office and legal counsel;
• entities entitled to receive it under provisions of law.

We do not sell personal data and we do not disclose it to third parties for marketing purposes.

7. Transfers of data outside the European Economic Area

The provider of the website's hosting and form handling and the e-mail provider belong to corporate groups with their seat in the United States, and therefore your data may be processed outside the European Economic Area.

In such cases, the transfer of data takes place on the basis of a European Commission decision finding an adequate level of protection or on the basis of Standard Contractual Clauses approved by the European Commission, together with additional technical and organisational safeguards. You may obtain a copy of these safeguards by contacting the Controller.

8. How long we retain data

Category of data	Retention period
An enquiry that did not lead to cooperation	48 months from the last contact concerning the enquiry — a period matching the preparation cycle of a construction investment, in which an investor often returns to an earlier enquiry
An enquiry that led to a contract	for the duration of the cooperation and thereafter for the period of limitation of claims
Accounting and settlement documents	5 years, counted from the end of the calendar year in which the tax payment deadline fell
Correspondence	3 years from the end of the correspondence
Data processed on the basis of consent	until consent is withdrawn
Server logs	in accordance with the hosting provider's policy, no longer than 12 months

9. What rights you have

You have the right to:

• access your data and obtain a copy of it;
• rectification of inaccurate or incomplete data;
• erasure of data, in the cases provided for in Article 17 GDPR;
• restriction of processing;
• portability of data processed on the basis of consent or a contract, by automated means;
• object to processing based on the legitimate interest of the Controller;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Please address requests to biuro@bzbprojekt.com. We respond without undue delay and no later than within one month of receiving the request.

10. Complaint to the supervisory authority

If you consider that the processing of your data infringes the provisions of the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

11. Automated decision-making

Your data is not used for automated decision-making, including profiling. Every enquiry is read and assessed by a person.

12. Data security

The Controller applies technical and organisational measures appropriate to the risk of infringement of the rights and freedoms of data subjects, in particular: encryption of the connection to the website using the HTTPS protocol, restriction of access to data solely to authorised persons, an obligation of confidentiality imposed on those persons, and the conclusion of data processing agreements with service providers.

13. Changes to the privacy policy

The Controller reserves the right to amend this Privacy Policy, in particular in connection with a change of service providers or of the range of functions available on the website. The updated text is published on this page together with the date of its entry into force.

This Privacy Policy is effective from 31 August 2026.
This document has been drawn up in Polish and in English. In the event of any discrepancy between the language versions, the Polish version shall prevail.