privacy·policy

1. Data controller

The controller of personal data is:

Projekt Towarowa 22 spółka z ograniczoną odpowiedzialnością
ul. Chmielna 69
00-801 Warsaw, Poland

Contact e-mail for data protection matters: [to be completed]

The Controller carries out the Towarowa22 project in cooperation with entities from the Echo Investment and AFI groups.

2. Scope of data processed

Depending on how you use the website, we may process the following data:

a) Newsletter

• first name
• last name
• e-mail address

b) Contact form

• first name
• last name
• e-mail address
• phone number
• message content

c) Automatically collected data (cookies and analytical tools)

• IP address
• cookie identifiers
• browser and device data
• website activity data
• traffic source
• approximate location (country / city)

3. Data minimisation principle

The Controller makes every effort to ensure that the scope of personal data processed is always minimal and adequate to the purposes of processing indicated in this Privacy Policy.

We process only the data that is necessary to achieve the specified purposes.

4. Purposes and legal bases for data processing

1. Newsletter delivery

Sending marketing information about the Towarowa22 project.

Legal basis: Art. 6(1)(a) GDPR – consent.

Consent may be withdrawn at any time.

2. Responding to enquiries (contact form)

Contact for the purpose of providing a response, presenting an offer or further communication related to the enquiry.

Legal basis: Art. 6(1)(f) GDPR – the legitimate interest of the Controller in handling enquiries.

3. Analytical and statistical purposes

Analysis of website usage in order to:

1. improve its performance,
2. optimise the user experience,
3. measure the effectiveness of advertising campaigns.

Legal basis: Art. 6(1)(a) GDPR – consent (in respect of analytical and marketing cookies).

4. Marketing and remarketing

Displaying tailored advertising content based on user activity.

Legal basis: Art. 6(1)(a) GDPR – consent.

5. Establishing, pursuing or defending claims

Processing data for the purpose of establishing, pursuing or defending legal claims.

Legal basis: Art. 6(1)(f) GDPR – the legitimate interest of the Controller.

5. Voluntary provision of data

Providing personal data is voluntary; however:

• in the case of the newsletter – it is necessary to receive it,
• in the case of the contact form – it is necessary to receive a response,
• in the case of analytical and marketing cookies – it depends on the consent given.

Failure to provide data may prevent the fulfilment of the purposes indicated above.

6. Cookies and third-party tools

The website uses the Cookiebot tool and the Google Consent Mode v2 mechanism. The user may:

• accept all cookies,
• reject cookies other than essential ones,
• choose custom settings (separately for analytical and marketing cookies).

Tools used include, among others:

• Google Analytics 4
• Google Ads (remarketing)
• Meta Pixel
• HubSpot (CRM and newsletter)

Detailed information about cookies can be found in the separate Cookie Policy.

7. Recipients of data

Data may be transferred to:

1. Processors acting on the basis of data processing agreements, including:
   • Echo Investment sp. z o.o.,
   • AFI Management sp. z o.o.,
   • entities affiliated with AFI Europe N.V., supporting the marketing and sales operations of the project.
2. IT and marketing service providers, in particular:
   • hosting providers,
   • CRM system providers (e.g. HubSpot),
   • analytical tool providers (Google),
   • advertising tool providers (Google, Meta),
   • marketing and media agencies.
3. Public authorities – where the obligation to transfer data arises from the law.

8. Transfer of data outside the European Economic Area

Due to the use of Google, Meta and HubSpot tools, data may be transferred outside the European Economic Area. The transfer takes place on the basis of:

• Standard Contractual Clauses approved by the European Commission, or
• an adequacy decision (e.g. the EU–US Data Privacy Framework).

9. Data retention periods

• Newsletter – until consent is withdrawn.
• Contact form – until the communication is concluded, up to a maximum of 12 months from the last contact.
• Analytical data – in accordance with tool settings (e.g. up to 26 months in GA4).
• Data processed for the purpose of claims – until the limitation period for claims expires.

10. Rights of the data subject

The data subject has the right to:

• access their data,
• rectify their data,
• erase their data,
• restrict processing,
• data portability,
• object to processing,
• withdraw consent at any time,
• lodge a complaint with the President of the Personal Data Protection Office.

11. Automated decision-making

The Controller does not make decisions based solely on automated processing that produce legal effects concerning the user.

12. Changes to the privacy policy

This Privacy Policy may be updated periodically, in particular in the event of changes in legislation, technological changes, or changes in the way personal data is processed in connection with the operation of the website.

We will inform you of any significant changes by publishing an updated version on the website or – where appropriate – through direct communication.

13. Additional information

If you believe that the processing of your personal data infringes GDPR provisions — in particular where the Controller has failed to fulfil the obligations set out in Art. 12–22 GDPR — you have the right to lodge a complaint with the supervisory authority.

The supervisory authority in Poland is:

We encourage you, however, to contact the Controller first in order to resolve any concerns.