Privacy Policy

1. WHO IS THE CONTROLLER The controller of your personal data is M2 Properties. For any matter concerning your personal data, write to contact@m2properties.pl. We have not appointed a data protection officer, as we are not required to. 2. WHAT DATA WE COLLECT Data you give us: - contact form: name, email address, phone number (optional), message; - viewing request: name, email address, phone number (and WhatsApp number, if given), preferred viewing date and time, planned move-in date, intended rental period, number of occupants, employment situation, monthly income (optional), whether you have pets, your message, and the property concerned; - partner agent form: name, agency name, email address, phone number, markets of interest; - listing pack download: email address, the listing downloaded and the time of the download. Data collected automatically: - your cookie choice: a random identifier, accepted or declined, the cookies-policy version and the time (no IP address); - events about how the site is used (a listing viewed, a click on the phone number or WhatsApp), linked to a random session identifier held in your browser for the duration of one visit; - technical data passed to our hosting, map and error-monitoring providers, including IP address and browser information. We do not collect payment data. We do not collect special categories of data such as health, origin or beliefs. 3. PURPOSES AND LEGAL BASES - Answering your enquiry, arranging a viewing and other steps leading to a tenancy agreement - Article 6(1)(b) GDPR. - Sending availability notifications to partner agents - Article 6(1)(a) GDPR, your consent, which you may withdraw at any time. - Keeping the site secure and working, visit statistics, and establishing or defending legal claims - Article 6(1)(f) GDPR, our legitimate interest. - Meeting legal obligations, in particular tax and accounting ones where an agreement is concluded - Article 6(1)(c) GDPR. 4. WHO RECEIVES YOUR DATA We use service providers who process data only on our instructions, under data processing agreements: - Supabase - the database holding enquiries and viewing requests; - Vercel - website hosting; - Umami (Umami Software, Inc., USA) - visit statistics; sets no cookies and does not store IP addresses; - Resend - sending email; - Sentry - application error monitoring; - Google - maps shown on listing pages and, for staff who choose it, sign-in to the admin panel; - Backblaze - encrypted backup copies of our database and photos, stored in the EU (Amsterdam); - GitHub (Microsoft) - runs the automated weekly backup, handling the data briefly before it is encrypted. We do not sell your data. We do not share it with third parties for their marketing. 5. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA Some of the providers above are established in the United States. Transfers take place under the European Commission's implementing decision of 10 July 2023 on the adequate level of protection under the EU-U.S. Data Privacy Framework, and otherwise under standard contractual clauses approved by the European Commission. You may request a copy of the safeguards applied by writing to our contact address. 6. HOW LONG WE KEEP DATA - Enquiries and viewing requests: for as long as needed to deal with the matter, and then for the limitation period for any claims. - Partner agents: notifications are sent only while you are subscribed. After you unsubscribe, or if your registration is declined, we keep your record marked as such, so that we never email you again by mistake and keep a record of our past cooperation (our legitimate interest). You can ask us to delete it at any time. - Accounting records where an agreement was concluded: for the period required by tax and accounting law. - Visit statistics in Umami: 6 months. - Encrypted backups of our database: about 3 months. Data we delete at your request disappears from older backups as they expire, within about 3 months; we do not restore it from a backup in the meantime. We delete data earlier on request, unless a legal obligation prevents it. 7. YOUR RIGHTS You have the right to: - access your data and obtain a copy of it; - have inaccurate data corrected and incomplete data completed; - have your data erased; - restrict processing; - object to processing based on our legitimate interest; - data portability; - withdraw consent at any time where processing is based on it - withdrawal does not affect the lawfulness of processing carried out before it. To exercise these rights, write to contact@m2properties.pl. You also have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. 8. IS PROVIDING DATA REQUIRED Providing data is voluntary but necessary for us to answer your enquiry or arrange a viewing. Without a name and an email address we have no way to reach you. The phone number on the contact form is optional. 9. AUTOMATED DECISION-MAKING We do not make decisions about you by automated means. We do not profile you. 10. COOKIES How we use cookies and similar technologies is described in our separate Cookies Policy. 11. CHANGES TO THIS POLICY If we change what data we process or how, we will update this policy and the date shown at the top of the page. 12. STAFF SIGN-IN (ADMIN PANEL) This section concerns only people we invite to manage this website, not visitors. Visitors to the public site have no accounts. Staff sign in to the admin panel with a passkey, or with a password together with an authenticator app, and may link a Google account. For this we store their name, email address, role, sign-in methods (passwords only as one-way hashes, authenticator secrets encrypted), the time of each sign-in with the IP address and browser used, and, if they link Google, the account identifier and email address Google provides. We use this data only to secure access to the admin panel, on the basis of our legitimate interest in protecting the website and the data in it, and delete it when the person no longer needs access.