Privacy policy

This English version is a courtesy translation. The legally binding version is the Polish Polityka prywatności.

1. Who is responsible for your data

The controller of your personal data is Peak Residences spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office in Warsaw, al. Niepodległości 235/237 lok. 76, 02-009 Warsaw, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, 12th Commercial Division, under KRS number 0001244345, NIP (tax ID) 7011316035, REGON 544871469 (the "Controller" or "we").

Contact for all personal-data matters: olga@peakresidences.co or by phone: +48 668 242 971. We have not appointed a data protection officer, as the law does not require us to.

2. In short

• We process your data only when you give it to us yourself: by writing through the contact form, ordering the guide and the newsletter, or booking a call online.
• We set cookies only with your consent and only to keep visit statistics (Google Analytics 4). Until you click “Accept” in the banner we set no cookies and send no data. You can withdraw consent at any time.
• We run no online advertising, no remarketing and no advertising pixels.
• We do not profile you, we make no automated decisions about you and we do not sell data.
• You can exercise all your rights with a single e-mail to olga@peakresidences.co.

3. What we do with data (table)

4. Contact form

When you write to us through the form on the contact page, we process your name (if you provide it), e-mail address and the message content in order to reply.

Where your message concerns an offer, a consultation or cooperation, the legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). In other cases the basis is our legitimate interest: handling correspondence and being able to evidence its course (Art. 6(1)(f) GDPR).

If you reach the form from the page of a specific residence, we also record which residence your enquiry concerns, together with the referring page address and any campaign tags contained in the URL (so-called UTM parameters). This information serves to prepare the offer and to settle our cooperation with the developer of that residence (Art. 6(1)(b) and (f) GDPR). We do not combine it with the visit statistics described in section 12.

Where your enquiry concerns a specific residence, we share the details needed to prepare an offer with its developer on the terms described in section 10a. Transfers outside the European Economic Area are described in section 11.

We keep correspondence for 12 months after the matter is closed, and correspondence concerning an offer or cooperation for up to 3 years, due to limitation periods for claims. Providing data is voluntary, but without an e-mail address we will not be able to reply.

5. Guide (PDF) and newsletter

By ordering the free guide you enter into the contract described in the Terms of Service: we deliver the guide and send the newsletter, and you provide us with your e-mail address. The legal basis for processing the address is that contract (Art. 6(1)(b) GDPR).

We process the address until you unsubscribe. You can unsubscribe at any time with one click in the footer of any message, or by writing to olga@peakresidences.co. After you unsubscribe, we keep only the fact that you were subscribed and when you unsubscribed, for 3 years, to be able to demonstrate the mailing was lawful (Art. 6(1)(f) GDPR).

6. Booking a call online

On the contact page you can book a free, thirty-minute consultation call yourself. For this we process your name, e-mail address, chosen time, your time zone and the topic of the call, if you provide one.

We process this data to arrange and hold the call at your request, i.e. to take steps before entering into a possible contract (Art. 6(1)(b) GDPR). A booking creates an event in our Google calendar together with a video-meeting link (Google Meet); we send you a confirmation and a reminder 30 minutes before the call by e-mail. You can reschedule or cancel the call at any time using the link in the confirmation message.

If you book the call from the page of a specific residence, we also record which residence the call concerns, together with the referring page and any campaign tags in the URL, on the same terms as for the contact form (section 4). Where the call concerns a specific residence, we may share the details needed to prepare an offer with its developer (section 10a).

We keep booking data until the call is held, and if it concerned an offer or cooperation, for up to 3 years, due to limitation periods for claims. Providing data is voluntary, but without an e-mail address and a chosen time we cannot complete the booking. The calendar and video meeting are provided by Google Ireland Limited (data recipient, section 10; transfer outside the EEA, section 11).

7. Contact via WhatsApp

The site contains links to chat with us on WhatsApp. If you use them, your data (phone number, conversation content, metadata) is processed by WhatsApp Ireland Limited as an independent controller, as described in its privacy policy. We treat the content of a conversation with us the same as form correspondence (section 4).

8. Investment map (OpenFreeMap)

The maps on the site use tiles provided by OpenFreeMap, a project run by Hyperknot Software Kft., based in Hungary (European Union), on servers located in the EU. When a map is displayed, your browser fetches tiles directly from OpenFreeMap's servers, which involves the technical transmission of your IP address, necessary to establish the connection. According to the OpenFreeMap privacy policy, IP addresses are not stored by default. The basis is our legitimate interest: presenting investment locations at your request (Art. 6(1)(f) GDPR).

9. Hosting, logs and security

The site runs on the infrastructure of Cloudflare, Inc. (hosting, CDN, form handling, file storage). Cloudflare processes standard connection logs on our behalf (including IP addresses), which serve the security and proper operation of the site (Art. 6(1)(f) GDPR) and are kept for up to 90 days.

10. Who we entrust data to

We entrust data only to the providers that operate our site:

1. Cloudflare, Inc. (USA): hosting, CDN, file storage;
2. Resend, Inc. (USA): sending e-mail messages (the guide, the newsletter, form notifications, booking confirmations and reminders);
3. Google Ireland Limited (Ireland): calendar and video meetings (Google Calendar, Google Meet) to run call bookings, and visit statistics (Google Analytics 4), only after you give consent;
4. Titan (provider of the olga@peakresidences.co mailbox): handling incoming and outgoing correspondence;
5. Hyperknot Software Kft. (Hungary, EU): map tiles (technical recipient, section 8).

Data may also be disclosed to legal or accounting advisers where necessary. We have data processing agreements (Art. 28 GDPR) in place with our processors.

10a. Sharing data with the developers of the residences

We are a broker. The residences presented on this site are sold by their developers, and the preparation of an offer, the reservation of a unit and the sale agreement take place on their side. Therefore, where your enquiry from the contact form or your call booking concerns a specific residence, we share with its developer the details needed to prepare an offer: your name, e-mail address, the content of the enquiry and the residence concerned. The developer receives this data as a separate controller and processes it on its own terms, set out in its own privacy policy.

The recipient is the developer of the residence your enquiry concerns, in particular OMNIYAT, based in Dubai (United Arab Emirates), the developer of ORLA, ORLA Infinity, The Lana Residences and The Alba. The full list of developers we work with is available in the investment catalogue.

The legal basis for sharing is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). Independently of that, under our partner agreement with the developer we inform the developer about the number and outcomes of enquiries concerning its residences that reached us through material about those residences. The basis for this settlement is our legitimate interest: performing the agreement with the developer and demonstrating that the enquiry originated from our site (Art. 6(1)(f) GDPR). You may object at any time to processing based on this ground (section 13).

We do not share the e-mail address provided when subscribing to the newsletter with developers. A developer may only receive the aggregate number of subscriptions from the page of its residence, without personal data.

If you do not want your enquiry to reach the developer, say so in your message or write to olga@peakresidences.co. We will then prepare information for you based on the materials we already hold, but we will not be able to obtain an individual offer or a reservation from the developer.

11. Transfers outside the European Economic Area

1. Cloudflare may process data in the USA. The basis is the European Commission's adequacy decision (EU-US Data Privacy Framework); Cloudflare holds an active DPF certification, and independently of it we rely on standard contractual clauses (SCCs) included in the data processing agreement.
2. Resend may process data in the USA. The basis is the European Commission's adequacy decision (EU-US Data Privacy Framework), with which Resend declares compliance in its data processing agreement, and independently of it standard contractual clauses (SCCs) forming part of that agreement.
3. Google may process data in the USA, both for the calendar and video meetings and for visit statistics (Google Analytics 4). The basis is the European Commission's adequacy decision (EU-US Data Privacy Framework), under which Google is certified, and independently of it standard contractual clauses (SCCs) included in Google's data processing terms. Should the adequacy decision be annulled, those clauses remain the basis for the transfer.
4. Titan is based outside the EEA. The transfer is safeguarded by standard contractual clauses (SCCs) forming part of the data processing agreement with this provider.
5. The developers of the residences, including OMNIYAT, are based in the United Arab Emirates. The European Commission has not issued an adequacy decision for that country, and the developer is not our processor but a separate controller. The transfer takes place under Art. 49(1)(b) GDPR: it is necessary to take steps at your request before entering into a contract with the developer (preparing an offer, reserving a unit). We share only the data necessary for that purpose and only where the enquiry concerns a specific residence. This involves a risk we want to state plainly: the law of the United Arab Emirates may not provide protection equivalent to the GDPR, and enforcing your rights against the developer may be more difficult than in the European Union. If you do not accept this risk, you may object to the transfer (section 10a) and we will prepare the information without involving the developer.

You can obtain a copy of the safeguards by writing to olga@peakresidences.co.

12. Cookies, analytics and browser local storage

We store information on your device in two modes: without consent, where it is necessary for the site you asked for to work, and with consent, where analytics is concerned. The legal basis is Art. 399 of the Polish Electronic Communications Law of 12 July 2024.

12.1. Local storage that requires no consent

For the site to work properly we use the browser's local storage (localStorage), in which we save on your device: 1) the selected theme (light or dark); 2) the fact that the welcome animation has already been shown; 3) the preferred catalog layout; 4) your decision on analytics consent together with its date.

This data is saved only in response to your actions, does not identify you, is not shared with anyone and never leaves your device. Storing your consent decision is necessary so that we do not ask you again on every visit. You can delete all of it by clearing the site data in your browser settings.

12.2. Analytics that requires consent

Only after you give consent in the banner do we load Google Analytics 4, a visit statistics tool provided by Google Ireland Limited. We use it to see how many people visit the site, which content is read and which sources bring visitors here. We do not combine this information with the data you provide in the contact form, in a call booking or when subscribing to the newsletter.

Before you consent, the Google Analytics script is not loaded: we set no cookies and send no data to Google. We use Google Consent Mode v2, in which all consent signals, analytics and advertising alike, are denied by default. Clicking “Accept” enables the analytics signal only; the advertising signals stay denied, because we run no remarketing and no online advertising.

Google Analytics 4 collects your IP address in truncated form and does not expose it in reports, and event data is deleted after 14 months. Cookies set by this tool:

Data from Google Analytics 4 may be transferred to the United States on the terms described in section 11.

12.3. How to change or withdraw consent

You can withdraw consent at any time by clicking “Cookie settings” in the footer of any page and choosing “Reject”. Rejecting is exactly as easy as accepting: both options take one click and sit next to each other in the banner. Withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3) GDPR). After withdrawing consent you can remove cookies already set by Google Analytics by clearing the site data in your browser settings.

13. Your rights

You have the right to: access your data, rectify it, erase it, restrict its processing, and port it (where processing is based on a contract).

Right to withdraw consent: to the extent we process data based on your consent (analytics, section 12), you may withdraw it at any time, without giving a reason. Withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3) GDPR).

Right to object: to the extent we process data based on legitimate interest, you may object at any time. An objection to direct marketing is always effective and requires no justification (Art. 21 GDPR).

You can exercise all rights by writing to olga@peakresidences.co. We reply within one month at the latest.

14. Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

15. Voluntary provision of data

Providing data is always voluntary. The only consequence of not providing it is that we will not be able to deliver the given service: reply to your message or deliver the guide and the newsletter. An objection to sharing data with the developer means that we will not be able to obtain an individual offer or a reservation for you from that developer.

16. Automated decisions and profiling

We make no decisions about you based solely on automated processing and we do not profile you.

17. Changes to this policy

We will inform newsletter subscribers of material changes by e-mail and update the date on this page. Previous versions are available on request.