Privacy policy

As the personal data controller (PDC), Hocan Estate sp.z o.o. with its registered office in Warsaw determines the following policy of personal data protection:

1. PDC carries out the assessment of risk associated with the processing of personal data and undertakes all measures, which are adequate to the given risk, in order to secure the processing of personal data.
2. Personal data is processed only to the extent necessary as a result of the PDC's business activity. In each case, in which the extent of processed data is not justified by the implementation of the purpose for which the data was made available, the pursuit of claims or if there is no other legal premise for the processing of data, the data may be processed only after getting the consent of the data subject.
3. Every natural person, whose data is processed, must be particularly informed about:
   1. data processor
   2. purpose and extent of data processing
   3. voluntary nature of the provision of data
   4. possibility of access to data
   5. right to request the deletion of data, as well as transfer and correction of data
   6. period of time after which the data will be deleted
   7. possibility to lodge a complaint regarding violation of the personal data protection.
4. The information referred to in section 3 must be provided in a manner that is clear and understandable to an average recipient, and it may be provided in any form, including:
   1. in the oral form
   2. in the form of placing information in an accessible location at the company's registered office or on the website.
5. In order to ensure the protection of personal data, the following measures are applied:
   1. technical measures that protect the data against loss, unauthorised modification, unauthorised access of third parties
   2. training of employees in the scope of personal data protection
   3. securing rooms and data stored in paper form against access of unauthorised persons, as well as against random factors that may result in the loss/destruction or disclosure of data to unauthorised persons.
6. PDC does not envisage the processing of data in an automated manner, nor for the purpose of profiling.
7. Transfer of data to a third country/international organisation, in relation to which a decision of the European Commission has not been issued stating that such country provides appropriate protection of personal data, may be carried out to the extent necessary to implement an agreement or activities preparing for conclusion of an agreement, or based on the express consent of the data subject. In such case, the transfer of data requires:
   1. estimation of the risk associated with the processing
   2. notification of the supervisory authority about such transfer
   3. notifying the data subject about the scope of such transfer and associated risk
   4. ensuring the processing in accordance with the standards of personal data protection resulting from applicable provisions of the Polish law and the European Union law.
8. The personal data shall be deleted immediately after it ceases to be necessary to implement the purpose for which it was collected. The data necessary for accounting settlements is stored for the period provided for in the tax law. Data of employees is stored for the period required by applicable regulations.
9. In the case of violation of the principles of personal data protection, PDC shall implement a procedure associated with the violation of data protection.
10. The PDC’s employees and contractors are obliged to observe the procedures ensuring the protection of personal data, particularly including:
    1. appropriate use of the technical measures that secure data, including the use of passwords for securing the devices on which the data is processed
    2. processing of data only to the extent necessary for the purpose for which it was collected
    3. maintaining full confidentiality of personal data
    4. securing documents containing data against access of unauthorised persons by ensuring their appropriate storage (in locked cabinets and rooms)
    5. providing the data subjects with information, in accordance with section 3
    6. reporting potential threats to the protection of personal data to supervisors, including information regarding insufficient protection of data
    7. reporting each case of data breach to supervisors.
11. In the case of entrusting data processing to a processor, the processing of data by such processor on behalf of PDC may be implemented only based on an agreement concluded between PDC and such processor, which must at least specify the nature and purpose of processing, the type of personal data, the categories of data subjects and the duration of processing. In the contents of agreements concluded with the processors, there must be reserved the processor's obligation to observe the principles of personal data processing, as well as technical measures ensuring the security of data. PDC shall undertake cooperation only with the processors ensuring the compliance with the principles of personal data protection.