In this Privacy Policy you will find information regarding:

• the principles of processing and protecting personal data by the personal data controller – information obligation,
• the rules of providing services by electronic means via the website https://5s.com.pl,
• the terms and conditions of using the website https://5s.com.pl.
  This Privacy Policy is made available free of charge on the website https://5s.com.pl in a form that enables any user of the website to record, store, and reproduce it.

Information obligation

Data Controller

The controller of your personal data processed on the website https://5s.com.pl is 5S Invest spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw (02-674), at ul. Marynarska 15, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under number 0001165294 (hereinafter: the “Company” or the “Controller”).

The Company attaches particular importance to the protection of personal data. Therefore, all personal data of users of the website (hereinafter: “Users” or “User”) processed via the website is processed in accordance with the provisions of law applicable in the territory of the Republic of Poland concerning the protection of personal data.

In processing your personal data, the Company fulfills the obligations arising from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “GDPR”), as well as applicable provisions of national law.

Only employees and other persons acting on behalf of the Company who have been duly authorized to process personal data and who are bound by confidentiality undertakings are permitted to process personal data.

Given that the Company operates within a group of undertakings within the meaning of Article 4(19) GDPR, your personal data may, where necessary, be processed for purposes defined by the group of undertakings, which constitutes a legitimate interest of the Company (Article 6(1)(f) GDPR).

Contact

If you have any doubts or questions regarding this Privacy Policy or the protection of your personal data, you may contact the Company in particular via the above-mentioned registered address.

You may also contact us in matters concerning the processing of your personal data, in particular in order to exercise your rights, via e-mail: administratordanych@5s.com.pl.

Purposes and Legal Bases of Processing

The Company processes your personal data, in particular, for the following purposes:

• responding to your inquiries, including enabling contact for potential cooperation,
• taking steps prior to entering into a contract or for the performance of a contract, including conducting commercial negotiations,
• sending information about offers to purchase apartments or information about other investments and sales offers (subject to prior consent),
• marketing of the Company’s own products and services, as well as making them available to other entities within the group (subject to prior consent),
• sending newsletters to the indicated e-mail address,
• delivering personalized and targeted advertisements and online offers on social media platforms.

The legal basis for processing personal data, depending on the purpose, is:

1. Article 6(1)(a) GDPR – consent of the data subject (e.g. newsletter),
2. Article 6(1)(b) GDPR – necessity for the performance of a contract to which the data subject is party (e.g. cooperation inquiries, contract execution),
3. Article 6(1)(c) GDPR – compliance with a legal obligation imposed on the Controller,
4. Article 6(1)(f) GDPR – legitimate interests pursued by the Controller (e.g. marketing activities via contact forms or instant META/Google forms).

Contact form

The website provides a contact form service enabling Users to leave their details, including contact information, in order to initiate communication with the Controller and receive offers from the Controller or related entities. The User may provide an e-mail address or telephone number, depending on the preferred method of contact.

The User may choose whether they wish to receive only offers from the Controller or also commercial information about investments of entities belonging to the same group. This choice is made by selecting the appropriate checkboxes. For the initiation of contact, at least one checkbox must be selected.

Providing a name and at least one form of contact information (e-mail or telephone) is required to enable communication. Failure to provide such data will prevent the Company from responding.

The legal basis for processing in this context is the Company’s legitimate interest (Article 6(1)(f) GDPR) in establishing communication and providing requested information.

Communication by E-Mail

The Company enables contact via e-mail. Using this form of communication involves providing personal data, particularly an e-mail address, without which it is impossible to respond. Additional personal data may be provided voluntarily to facilitate correspondence.

The legal basis for processing personal data obtained through e-mail communication is the legitimate interest of the Company (Article 6(1)(f) GDPR), namely maintaining correspondence with you. Depending on the content of your message, the data may also be processed for purposes connected with pre-contractual measures or the performance of a contract (Article 6(1)(b) GDPR).

Personal data will be processed for the duration of the correspondence, until the matter is resolved, or until the expiration of limitation periods for potential claims.

Telephone Contact

When contacting the Company by telephone, you may be required to provide personal data necessary to carry out the purpose of the call, including identity verification. Telephone calls may be recorded for quality assurance and legal purposes, and you will be informed before the recording starts. Consent is required; if not granted, the call may be terminated.

The legal basis for such processing is the legitimate interest of the Company (Article 6(1)(f) GDPR). Data will be retained only for as long as necessary to fulfil the purposes arising from the telephone conversation or until limitation periods for claims expire.

Social Media

The Company maintains profiles (fanpages) on Facebook, Instagram, LinkedIn, and YouTube. Data processed via these platforms is primarily controlled by the operators of these services according to their privacy policies.

However, the Company may act as an independent controller when processing data on its fanpages. Data may be processed for:

• marketing activities, including posting content and responding to private messages;
• participation in discussions on posts;
• obtaining statistical data provided by platform operators;
• responding to job applications (LinkedIn);
• managing subscriptions (YouTube).

The legal basis for such processing is the legitimate interest of the Company (Article 6(1)(f) GDPR) or, in the case of subscriptions and recruitment, Article 6(1)(b) GDPR.

Data Processing in Connection with Contracts

When negotiating, entering into, and performing contracts, the Company processes data of individuals who are parties to contracts or represent such parties. This includes:

• taking pre-contractual measures and performing contracts (Article 6(1)(b) or (f) GDPR);
• fulfilling legal obligations, particularly in tax and accounting (Article 6(1)(c) GDPR);
• pursuing legitimate interests, such as pursuing or defending against claims, archiving, and direct marketing (Article 6(1)(f) GDPR).

Failure to provide data required for the conclusion or performance of a contract may make it impossible to establish or continue contractual relations.

Data Retention

Personal data is not retained longer than necessary for the purposes of processing. The retention period depends on the nature of the service provided and the legal grounds for processing, including statutory retention obligations (e.g., accounting documentation). Data processed based on legitimate interests is retained until those interests are fulfilled or until an effective objection is raised.

Data Recipients

Depending on the purpose of processing, personal data may be disclosed to:

• postal and courier service providers;
• IT service providers and software suppliers;
• entities providing mass mailing services;
• other entities within the same corporate group;
• public authorities, where required by law.

International Data Transfers

As a rule, personal data is not transferred outside the European Economic Area (EEA). If such transfer is necessary, the Company will ensure appropriate safeguards, including:

• reliance on adequacy decisions issued by the European Commission;
• use of Standard Contractual Clauses (SCCs);
• application of Binding Corporate Rules (BCRs).

Your Rights

You have the right to:

• access your personal data;
• request rectification, erasure, or restriction of processing;
• request data portability, where applicable;
• object to processing for direct marketing or based on legitimate interests;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office in Poland.

General Rules of Website Use

Use of the website is free, voluntary, and available to all Internet users. Users must comply with applicable laws, respect intellectual property rights, and avoid providing unlawful content.

The website is secured via HTTPS encryption to protect transmitted data. However, Users are also responsible for maintaining general online security measures.

Complaints

Complaints regarding services provided electronically through the website may be submitted in writing to the Company’s registered address or electronically via the e-mail address indicated above. Complaints should include details of the irregularities, the request, and contact information. The Company will respond within a reasonable period, in writing or via e-mail.

Updates

This Privacy Policy was last updated on 18 July 2025. It may be subject to future amendments. Where required by law, Users will be informed of significant changes in the manner normally used by the Company for communication.