Privacy policy

Effective October 8, 2026

This Privacy Policy explains how PropVestor Sp. z o.o. processes the personal data of people who use the no44.pl website (the "Website"), contact us through the form, by e-mail or by phone, or attend viewings of apartments in the Złota 44 building. It fulfills the information duties under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and contains the cookie information required by Article 399 of the Polish Electronic Communications Law of July 12, 2024.

1.Data controller

1.1 The controller of your personal data is PropVestor Sp. z o.o., with its registered office in Warsaw, ul. Złota 44/194, 00-120 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001011463, NIP (tax ID) 7812045568, REGON 524067642 (the "Controller", "we"). The Controller operates the Website and, as the exclusive sales partner, handles the sale and rental of apartments in Złota 44 on behalf of their owner.

1.2 The apartments offered under the NO. 44 brand are owned by Notos 33 sp. z o.o., ul. Złota 44/194, 00-120 Warsaw, KRS 0001006612, NIP 7792548035, REGON 523852178. If you decide to conclude a purchase or rental agreement, Notos 33 sp. z o.o. becomes a separate controller of the data needed to conclude and perform that agreement, and we pass the data on for that purpose.

1.3 For any matter concerning your personal data, including exercising your rights, contact us by e-mail at info@no44.pl or by post at the registered address, marked "Personal data". The Controller has not appointed a data protection officer.

2.What data we process and where it comes from

2.1 You provide the data yourself: in the contact form (name, e-mail address, optional phone number, your message, the chosen topic: purchase or rent), in an e-mail, during a phone call or at a viewing.

2.2 Together with a form message we record its source: the page from which the form was sent, the language version, the referring website (if you reached us from an external link) and any campaign parameters present in the page address (utm_*, gclid). This serves only to route the inquiry to the right advisor and to assess the effectiveness of our activities.

2.3 Technical data collected automatically: IP address, browser and device type, date and time of access, requested addresses (server logs, section 8) and, only after your consent, statistical and marketing data from Google and Microsoft tools (section 7).

2.4 We do not collect special categories of data and ask you not to include them in your messages. The Website is not intended for persons under 18.

3.Purposes, legal bases and retention

3.1 Answering your inquiry, arranging and holding a viewing, presenting an offer (form, e-mail, phone): the legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in handling correspondence and customer inquiries (Art. 6(1)(f) GDPR). We keep the data while the inquiry is being handled and then until any claims become time-barred, no longer than 3 years from the last contact, unless an agreement is concluded.

3.2 Concluding and performing a purchase or rental agreement: the data required for the agreement is passed to the owner of the apartment (section 1.2) and processed under Art. 6(1)(b) GDPR; where obligations arise from legal provisions (including the Polish Act of March 1, 2018 on Counteracting Money Laundering and Terrorism Financing, and tax and accounting law), the basis is Art. 6(1)(c) GDPR, for the period required by those provisions.

3.3 Our own marketing: we send information about the NO. 44 offer by e-mail or by phone only to people who have given separate consent (Art. 6(1)(a) GDPR in conjunction with Article 398 of the Electronic Communications Law), until that consent is withdrawn. Sending an inquiry through the form is not marketing consent.

3.4 Statistics and ad measurement (Google Analytics 4, Microsoft Clarity, Google Ads): only on the basis of the consent given in the cookie banner (Art. 6(1)(a) GDPR, Article 399 of the Electronic Communications Law), until withdrawn; cookie lifetimes are listed in section 7.

3.5 Website security and abuse prevention (server logs, limiting the number of form submissions, anti-spam measures): the Controller's legitimate interest (Art. 6(1)(f) GDPR). Server logs are kept for up to 12 months; one-way hashed IP identifiers used for rate limiting are kept for up to 24 hours.

3.6 Establishing, pursuing and defending claims: the Controller's legitimate interest (Art. 6(1)(f) GDPR), for the limitation period of claims.

4.Recipients of data

4.1 Data may be disclosed to: the owner of the apartments, Notos 33 sp. z o.o. (section 1.2); the hosting and e-mail provider of the Website (Hostinger International Ltd., Larnaca, Cyprus, servers in the European Union); providers of statistics and advertising tools (Google Ireland Ltd., Microsoft Ireland Operations Ltd., only after your consent); providers of IT, legal, accounting and advisory services; notaries and banks in connection with an agreement being concluded; public authorities entitled under the law.

4.2 Processors acting on our behalf do so under data processing agreements and in accordance with our instructions.

5.Transfers outside the European Economic Area

5.1 Data from forms, correspondence and logs is processed on servers in the European Union. Only after you consent to statistics or marketing may data from Google and Microsoft tools be processed by Google LLC and Microsoft Corporation in the United States. Both companies participate in the EU-US Data Privacy Framework, which under the European Commission's adequacy decision of July 10, 2023 ensures an adequate level of protection (Art. 45 GDPR). Details: policies.google.com/privacy and privacy.microsoft.com/privacystatement.

6.Your rights

6.1 You have the right to: access your data and obtain a copy (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability of data processed under a contract or consent (Art. 20), objection to processing based on legitimate interest, including direct marketing (Art. 21), and withdrawal of consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

6.2 To exercise your rights, write to info@no44.pl or to the Controller's registered address. You withdraw cookie consent yourself by clicking "Cookie settings" in the footer of any page.

6.3 You have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

6.4 Providing data is voluntary. Without your name, e-mail address and message, however, we cannot reply or arrange a viewing. We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you.

7.Cookies and similar technologies

7.1 On your first visit the Website shows a banner in which you can accept all categories, choose essential only, or set them individually. The two main buttons are equivalent and nothing is pre-selected. Until you consent, the Website loads no Google or Microsoft scripts and passes no data to third parties; fonts and script libraries are served from our own server. You can change or withdraw your consent at any time via "Cookie settings" in the footer.

7.2 Essential (no consent required, Article 399(3) of the Electronic Communications Law): remembering your cookie decision and the interface state during a single session.

7.3 Statistics (with consent): Google Analytics 4 in Google Consent Mode, measuring visits without transmitting full IP addresses, and Microsoft Clarity: anonymous heat maps and recordings of how the site is used (cursor movement, clicks, scrolling); text entered into forms is masked and never recorded. Marketing (with consent): Google Ads, measuring the effectiveness of ads, for example a submitted form. These tools are started through Google Tag Manager only after consent to the respective category.

7.4 You can also delete and block cookies in your browser settings. Blocking essential storage may cause the banner to appear on every visit.

8.Server logs

The hosting provider automatically records standard web server logs: IP address, date and time, requested address, response code, referring page and browser identifier. The logs are used solely to administer the Website, keep it secure and investigate failures (Art. 6(1)(f) GDPR) and are not linked to form data.

9.Security

The connection to the Website is encrypted (TLS). Form messages go only to a password-protected company mailbox and are not stored in a database on the Website. Only authorized persons have access to the data, to the extent needed to handle inquiries.

10.Changes to this Policy

This Policy may be updated when the law, the scope of our services or the tools we use change. The current version is always available at no44.pl/en/privacy-policy/. This version applies from October 8, 2026.