DOMUS GLOBALPrivacy on this website
DOMUS GLOBAL contact-form privacy policy
This policy describes the processing of personal data in the English version of the DOMUS GLOBAL contact form.
1. Controller and personal-data contact
The controller of personal data submitted through the form is Jacek Stefański, conducting a sole proprietorship under the name DOMUS NOVA Nieruchomości JS, NIP 7581814764, REGON 141960860, address: al. Jerzego Waszyngtona 40A, unit 3, 03-910 Warsaw, hereinafter the “Controller”.
You may also write to the Controller’s postal address.
2. Form scope and purposes
The English version of the form is used to receive and handle one of four types of enquiry:
- an enquiry about a specified property;
- a description of an advisory need;
- notification of an intention to sell a property;
- an enquiry about possible financing scenarios.
The form is not used to create an account, send documents, or subscribe to marketing. The first EN release does not make WhatsApp or Telegram available. Enabling a messenger later requires a separate assessment, information notice, and release of this policy.
3. Data we process
Depending on the selected response method, the form processes:
- your name or preferred form of address;
- your e-mail address or telephone number;
- the enquiry type and message content;
- the language, source page, and public identifier or slug of a property or project if the enquiry started on such a page;
- the policy version, acknowledgement that it has been read, selected contact method, form start time, and a technical identifier for safe retry;
- the minimum technical data needed to protect the form, such as a hash of the IP address, browser information, request time and source address, and the result of the anti-spam mechanism.
In the first message, we do not ask for document scans, PESEL, identity-document numbers, banking data, complete financial documentation, or special-category data. If such information becomes necessary later, the Controller will indicate an appropriate channel and provide the required processing information.
4. Purposes and legal bases
- receiving the enquiry, replying, identifying needs, and taking steps at the person’s request before a possible contract is concluded — Article 6(1)(b) GDPR;
- protecting the form, limiting spam and abuse, preventing duplicates, ensuring service continuity, and establishing, pursuing, or defending claims — Article 6(1)(f) GDPR; the legitimate interest is service security and the ability to demonstrate that an enquiry was received correctly;
- compliance with a legal obligation imposed on the Controller if such an obligation arises during further handling of the matter — Article 6(1)(c) GDPR, to the extent resulting from the applicable provision.
Acknowledging that the policy has been read records that the information was provided and is not marketing consent. The form records the absence of marketing consent. The data is not used for a newsletter, behavioural advertising, or marketing profiling.
5. Voluntary provision of data
Providing data is voluntary, but without a message and the data required for the selected response method, the enquiry cannot be handled. Fields not marked as required remain optional. Instead of the form, you may use the telephone number or e-mail address published on the website.
6. Recipients, providers, and transfers outside the EEA
Data may be accessed by authorised DOMUS personnel handling the matter and by the following providers acting on the Controller’s instructions:
- OpenAI Ireland Ltd. — hosting, maintaining and supporting the published ChatGPT Site and processing Hosted Data required to provide that service;
- Supabase Pte. Ltd — the enquiry-intake function and PostgreSQL database of the DOMUS service system; the database is located in the eu-central-1 region, while functions, support, and subprocessors may involve global processing;
- Google Cloud Poland Sp. z o.o. — Google Workspace Gmail used to send an operational notification to the team about a new enquiry.
Providers and their subprocessors may process data outside the European Economic Area. In such a case, the Controller relies on a transfer mechanism provided for by the GDPR, in particular an adequacy decision or Standard Contractual Clauses (SCCs) forming part of the relevant data-processing agreement. Information about the safeguard used, or a copy of it, may be requested through [email protected], subject to protected commercial and security information.
Data may be disclosed to a mortgage adviser, lawyer, notary, or another partner only where required by the specific matter, an appropriate legal basis exists, and the person receives the required information.
7. Retention period
- the raw form-submission record and its technical identifier: up to 365 days after receipt, followed by a mandatory review, archiving, or deletion;
- the lead, conversation, and messages connected with the matter: for the duration of handling and, after closure, up to 730 days before a mandatory review;
- evidence that the policy version and selected channel were communicated: up to 1,095 days after the matter is closed or channel consent is withdrawn, if such consent is used later;
- security logs: for the period necessary to prevent abuse, detect and explain an incident, and demonstrate protection of the service, taking account of providers’ technical retention periods.
Data required by law or needed to establish, pursue, or defend claims may be retained longer — for the period resulting from the applicable provision, a legal hold, or until the limitation period expires. The periods above are mandatory review thresholds; automated destruction remains disabled until a deletion or anonymisation procedure has been approved and tested.
8. Data-subject rights
Within the limits set by the GDPR, a person may request access to their data, rectification, erasure, restriction of processing, and portability, and may object to processing based on Article 6(1)(f) GDPR. If particular processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
A request may be sent to [email protected] or by post to the Controller’s address. The Controller may request information necessary to verify identity securely. The person also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).
9. Automated decisions, marketing, and cookies
Form data is not used to make decisions about a person that produce legal effects solely by automated means. The anti-spam mechanism may reject a technical request; in that case, telephone or e-mail contact remains available.
Form data is not sent to analytics tools or used for advertising, marketing pixels, newsletters, or marketing profiling. Voluntary analytics for public website pages is described in the separate notice below and starts only after the user consents. The form does not request marketing consent.
10. Security
The form sends data over an encrypted connection to the protected DOMUS service system. The browser does not store draft form content in persistent storage or create a user account. Access to records is restricted according to role, and repeated requests are controlled by a technical identifier.
No technical measure eliminates risk completely. Documents, banking data, identifiers, and other sensitive information should be provided only after an appropriate secure channel has been agreed.
11. Version and changes
Version privacy-2026-08-02-en takes effect on 2 August 2026 for the English version of the form. A change to the purpose, data scope, provider, retention, messenger, or language requires an assessment and a new version. The PL, RU, UK, and EN editions apply as corresponding language versions of this package.
Deposit return
deposit-privacy-2026-09-18-en | 2026-09-18
For a deposit-return enquiry, we process your name, email address and description of the situation, together with the city of the property, withheld amount and telephone number if you choose to provide them. We use this information to respond, assess whether we can accept the matter and discuss the scope of services. The enquiry is registered in the existing DOMUS system; a full copy, including your account, is sent to the operational mailbox [email protected]. Access is limited to authorised team members. The existing retention rules apply, including to email copies. Sharing materials with a partner lawyer and any court stage are agreed separately with you. Acknowledging this information does not constitute marketing consent, acceptance of the matter or authority to represent you.
12. Website analytics and privacy settings
Google Analytics 4 (measurement ID G-JNB64WSPJF) is used only for statistical measurement of visits to public pages. The legal basis is voluntary consent under Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law.
- Until “Accept analytics” is selected, no Google tag is loaded and no data is sent to Google.
- After consent, only standard page-view data is sent: a random GA4 client identifier, device and browser information, language, page path and title, referral source, and approximate location derived by Google from the IP address. Google states that GA4 does not log or store the IP address.
- We do not send form contents, names, e-mail addresses, telephone numbers, user IDs, custom parameters containing personal data, or IP-derived custom fields to GA4.
- analytics_storage may be granted only after consent. ad_storage, ad_user_data, and ad_personalization always remain denied. Google Signals, advertising, remarketing, and marketing profiling are not used.
- The recipient is Google Ireland Limited. User and event data in standard GA4 is retained according to the service setting for no longer than 14 months; aggregated reports may remain available for longer.
- The choice is stored only locally in the browser. It can be changed at any time; after consent is withdrawn, no further page views are sent and available GA4 cookies for this domain are removed.
Direct contact
Choose the form or contact the office directly
In the first message, state only the purpose of the conversation. Share documents, bank details, and identifiers after a contact channel has been agreed.