Privacy Policy and data processing notice (GDPR)

1. Introduction

This document describes processing associated with the Website and enquiries, including the Controller, processing purposes and data subject rights under Articles 13 and 14 GDPR.

We aim to process only the data necessary for the stated purposes, lawfully, fairly and transparently, and to protect it with appropriate technical and organisational measures.

2. Data controller

The controller of your personal data is Hala Gwardii spółka z ograniczoną odpowiedzialnością, plac Mirowski 3, 00-138 Warszawa, Poland, Tax ID (NIP) 5252862206, KRS 0000899474, REGON 388945381 (the “Controller”).

Contact the Controller: hello@halagwardii.pl; postal address: plac Mirowski 3, 00-138 Warszawa, Poland.

[COMPLETE: details of the Data Protection Officer (name, e-mail) or state that no DPO has been appointed and data matters are handled at the address above.]

3. What data we process

Data provided in forms: first name, last name, e-mail address, phone number (if the form asks for it), company or institution name, job title, message content and other information you choose to provide (e.g. a description of planned activity or event). The set of fields depends on the form (Contact, What will be in the Hall, For tenants, For organisers, For media, Partnerships).

Connections involve IP and metadata. The form endpoint uses IP addresses for a ten-minute rate limit. IP is not a submission record field but an in-memory entry without periodic deletion. [TO BE COMPLETED: hosting log fields, retention and anti-abuse data cleanup.]

Submission status data: date received, page language, the form used, and whether the e-mail notification was sent successfully.

Providing data in forms is voluntary, but fields marked as required are necessary to handle your enquiry. Without them we cannot reply.

Please do not include special categories of data (e.g. health data), document numbers or data unnecessary for handling the matter in your message.

4. Purposes and legal bases

Handling enquiries and applications sent through forms and e-mail correspondence – basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest in replying and maintaining communication) and, where the enquiry concerns steps taken at your request prior to entering into a contract (e.g. a lease or cooperation enquiry), Article 6(1)(b) GDPR.

Article 6(1)(b) applies to requested pre-contractual steps and contracts with the individual. Data of corporate counterparties’ representatives is generally processed under Article 6(1)(f) for communication and relationship management, not on the assumption that the representative is personally a contracting party.

Ensuring Website security, detecting and preventing abuse, spam and attacks, and diagnosing errors – basis: Article 6(1)(f) GDPR (interest in the security and proper operation of systems).

Establishing, pursuing or defending claims and archiving documentation – basis: Article 6(1)(f) GDPR.

Complying with legal obligations of the Controller (e.g. tax and accounting, if a contract is concluded) – basis: Article 6(1)(c) GDPR.

The Website does not offer newsletter subscriptions. An enquiry is not marketing consent. Future marketing requires separate legal bases and electronic communications compliance; the current forms do not collect such consents.

The Website does not use automated decision-making, including profiling, producing legal effects or similarly significantly affecting users (Article 22 GDPR).

5. Legitimate interests of the Controller

Where Article 6(1)(f) GDPR is the basis, the Controller’s interests are: communicating with persons interested in the Hall project, developing business cooperation, ensuring the security and continuity of the Website, protection against abuse, and defence against claims.

You have the right to object to such processing on grounds relating to your particular situation (section 11).

6. Recipients

Authorised employees and associates of the Controller responsible for the relevant area (leasing, events, media, partnerships, general contact) have access, only to the extent necessary and bound by confidentiality.

Data may be entrusted or disclosed to providers engaged by the Controller for services necessary for the Website, in particular: (a) hosting and cloud infrastructure providers (Railway Corporation – application and database hosting) [TO BE COMPLETED: hosting provider entity and region]; (b) e-mail and SMTP service provider used to send submission notifications [COMPLETE: provider name]; (c) IT, maintenance and security providers [COMPLETE]; (d) legal, accounting and audit advisers – as necessary to provide their services.

[TO BE COMPLETED: processing agreements for hosting, e-mail and IT, scope, subprocessors and locations]

Data may be disclosed to public authorities, courts or other entitled bodies where required by law.

The Controller does not sell personal data.

7. Transfers outside the EEA

Cloud services and Google Maps may involve access from outside the EEA. An EU server region does not exclude support or subprocessor transfers.

[TO BE COMPLETED: recipients, countries, current basis for each transfer, adequacy or standard clauses, transfer assessment and supplementary measures. EU–US Data Privacy Framework participation and scope.]

Information and copies of safeguards can be requested at hello@halagwardii.pl, subject to others’ rights.

8. Retention

Form submissions and correspondence – for the time necessary to handle the matter and then for 3 years after the last contact for possible further communication and defence against claims, unless a contract is concluded (then the period below applies).

Contractual, tax and accounting records follow applicable periods and starting events. No single period applies automatically to every enquiry. [TO BE COMPLETED: category-specific schedule, limitation periods and purpose-limited archiving scope.]

Server logs and technical data – for no longer than [PERIOD, e.g. 30–90 days], unless needed to investigate a security incident.

Data processed on the basis of consent – until consent is withdrawn.

The code does not delete expired submissions automatically. [TO BE COMPLETED: database and mailbox deletion procedure, responsible person and, if backups exist, rotation and restoration rules.]

9. Cookies and similar technologies

The Website does not use a Google Analytics integration or its own advertising pixel.

Google Maps is embedded in an iframe. Loading sends connection data including IP and browser information to Google, which may use cookies and its own processing rules. [TO BE COMPLETED: consent and prior-blocking rules for Google Maps services requiring consent.]

Google information: https://policies.google.com/privacy and https://policies.google.com/technologies/cookies. See the Cookie Policy.

10. Data security

The panel requires authentication. Code includes rate limiting and a honeypot, not a guarantee of full protection. [TO BE COMPLETED: access, encryption, update, backup and recovery procedures]

In the event of a personal data breach likely to result in a high risk to your rights and freedoms we will notify you without undue delay under Article 34 GDPR and, where required, report the breach to the President of the Personal Data Protection Office within 72 hours (Article 33 GDPR).

11. Your rights

You have the right to: access your data and obtain a copy (Article 15 GDPR); rectification (Article 16); erasure, the “right to be forgotten” (Article 17); restriction of processing (Article 18); data portability for data processed by automated means on the basis of consent or contract (Article 20); object to processing based on legitimate interest (Article 21); and withdraw consent at any time (Article 7(3)).

To exercise your rights, write to hello@halagwardii.pl. We may ask for additional information needed to confirm your identity.

We will reply without undue delay and in any case within one month of receiving the request; this may be extended by two further months for complex or numerous requests, in which case we will tell you the reason.

You have the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office (UODO), with current contacts and complaint instructions at https://uodo.gov.pl. You may also complain to the supervisory authority of your habitual residence or workplace in another EU/EEA member state.

12. Third-party data

Representatives’ identification, contact and enquiry data may come from the sender or represented organisation.

The Controller remains responsible for Article 14 information, generally within one month, at first communication or disclosure as applicable. Asking the sender to inform the third party does not automatically discharge this duty. Exceptions require documented assessment.

13. Children

Minors may browse informational content. Persons representing organisations should be authorised. Unnecessary children’s data should not be submitted.

Article 8 GDPR concerns certain consent-based services offered to children, not a general under-16 browsing ban. Processing children’s data requires an individual assessment of basis, purpose and their interests.

14. Changes to this Policy

The Policy may be updated, in particular when legislation, the scope of data processing or the tools used change. The current version is always available on the Website with the date of last update. We will notify of material changes visibly on the Website.

15. Contact

For personal data matters contact us: hello@halagwardii.pl.

Controller: Hala Gwardii spółka z ograniczoną odpowiedzialnością, plac Mirowski 3, 00-138 Warszawa, Poland, Tax ID (NIP) 5252862206, KRS 0000899474, REGON 388945381.