Privacy Policy

Effective from: 14 October 2026

1. Who is the data controller

The controller of your personal data is 9AND7 spółka z ograniczoną odpowiedzialnością, with its registered office in Wrocław, ul. Podwale 63, 50-010 Wrocław, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Wrocław-Fabryczna in Wrocław, VI Commercial Division of the National Court Register, under KRS number 0000703834, NIP (tax ID) 8982238806, REGON 368744280 (“9AND7” or “we”).

For any matter concerning personal data, please write to biuro@9and7.com, call +48 517 642 133, or write to our registered office.

2. Where we get your data from

We receive most data directly from you: through the contact form on this website, by email, by telephone, at meetings, and when agreements are concluded and performed. If another person contacts us on your behalf, for example an attorney, a real estate agent or your employer, we receive the data from that person.

3. Why, on what legal basis and for how long we process data

Purpose	What data	Legal basis	How long
Replying to your message sent through the form, by email or by telephone: renting, buying a unit, selling a building, investment partnership and other matters	first and last name, email address, telephone number (if given), the matter selected, the message and its attachments	Article 6(1)(f) GDPR, our legitimate interest in answering enquiries; where the enquiry concerns entering into an agreement, Article 6(1)(b) GDPR (steps taken at your request before entering into an agreement)	until the matter is closed; if no agreement is concluded, no longer than 12 months from the last message
Preparing, concluding and performing an agreement to rent, sell or buy property, including service to tenants and buyers	the data above, plus address, PESEL number or identity document number, company name and tax ID (if applicable), bank account number	Article 6(1)(b) GDPR	for the term of the agreement and then until the limitation period for claims expires (as a rule 6 years, Article 118 of the Polish Civil Code)
Accounting and tax: invoices, bills, accounting records	data shown on invoices and agreements	Article 6(1)(c) GDPR, in connection with the Polish Accounting Act and Tax Ordinance	5 years from the end of the year to which the records relate, as those acts require
Establishing, pursuing and defending claims	the data above that is needed in the specific case	Article 6(1)(f) GDPR, our legitimate interest in protecting the company’s rights	until the limitation period expires and, in the event of a dispute, until it is finally resolved
Information about our new projects and offers (direct marketing)	first and last name, email address, telephone number; we send offers by email	Article 6(1)(f) GDPR; for sending such information by email and calling for this purpose we need your consent (Article 398 of the Polish Electronic Communications Law of 12 July 2024)	until you withdraw your consent or object
Website security (server logs)	IP address, date and time of the visit, browser and operating system, page visited	Article 6(1)(f) GDPR, our legitimate interest in protecting the website against misuse	the hosting provider keeps the logs in a monthly archive and deletes them at the latest at the end of the month following the visit

We do not process special categories of data, such as health data. Please do not send such data through the form or in messages.

4. Do you have to provide your data

• Contact form: your name and email address are needed so that we can reply. Your telephone number is optional.
• Agreement: providing data is a condition for concluding it. Without the data we cannot conclude or perform the agreement.
• Accounting records: the obligation to provide data follows from tax and accounting law.
• Consents to commercial information: entirely voluntary. We will reply to your message even if you do not tick them.

5. Who receives your data

Data may be received only by organisations that help us run our business and act on our instructions under a data processing agreement, or to which we must disclose data by law:

• the hosting provider we have a contract with, on whose server this website runs (server in Germany, in the European Union);
• the email providers we use for company matters: OVHcloud (email on the 9and7.com domain) and Google (Gmail);
• the accounting firm that keeps our books;
• the provider of the system we use to issue invoices;
• people and companies who carry out technical work on the website on our instructions, to the extent needed for that work;
• when agreements are concluded and performed: notaries and law firms, property valuers, banks;
• courts, authorities and other public bodies, where the law requires it.

We do not sell personal data and do not share it for advertising purposes.

6. Transfers outside the European Economic Area

The website runs on a server in the European Union. For company matters we also use Gmail, whose provider, Google, may process data outside the European Economic Area. This is based on a European Commission adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses approved by the Commission. You can obtain a copy of these safeguards by writing to the address given in section 1.

7. Your rights

• the right of access to your data and to receive a copy (Article 15 GDPR);
• the right to rectification (Article 16 GDPR);
• the right to erasure (Article 17 GDPR);
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability for data we process on the basis of an agreement or consent (Article 20 GDPR);
• the right to object to processing based on our legitimate interest (Article 21 GDPR); we always respect an objection to direct marketing;
• the right to withdraw consent at any time (Article 7(3) GDPR); withdrawal does not affect the lawfulness of processing carried out before it;
• the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (Article 77 GDPR).

Simply write to the address given in section 1. We reply without undue delay and within one month at the latest.

8. Automated decisions

We do not take decisions about you based solely on automated processing, including profiling.

9. Security

We protect data with technical and organisational measures appropriate to the risk. The website connects to your browser over an encrypted connection (HTTPS). Only authorised persons bound by confidentiality have access to the data. We sign data processing agreements with the companies that process data on our behalf.

10. Cookies

Cookies are small text files that a website stores in your browser. Today 9and7.com uses one cookie for visitors:

Name	What it does	How long	Set by
wp-wpml_current_language	remembers the language version you chose (Polish or English)	until you close the browser	9AND7 (this website)

This cookie is necessary for the website to display in the language you chose, so it does not require consent (Article 399 of the Polish Electronic Communications Law). People who log in to the website’s administration panel, which means only our own staff and contractors, also receive login session cookies.

We do not use analytics cookies, advertising cookies or third-party cookies. The website has no embedded maps, videos or social media buttons. If we add such tools in the future, we will update this policy and ask for your consent before using them.

You can delete or block cookies at any time in your browser settings. If the language cookie is blocked, the website may open in its default language.

11. Changes to this policy

The current version of this policy is always available on this page, and the date at the top shows when it took effect. We will announce important changes on the website.