Privacy Policy

This document (“Policy”) explains how we process and protect the personal data of users of the ercoding.pl website (“Service”). The Policy has been developed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), the Act of 18 July 2002 on the provision of electronic services, the Act of 11 August 2024 on electronic communications, and other applicable laws.

1. Definitions

Administrator / Operator – ZS Nieruchomości Sp. z o.o. 68-200 Żary, ul. Sportowa 10, Numer KRS 0001109771, NIP 9282111808, REGON 52884314900000 (“we”, “our”).
User – any natural person visiting the Service or using its functions.
Cookies – files saved on the User’s device in accordance with point 4.
GDPR – General Data Protection Regulation (EU 2016/679).

2. Data Controller and Contact

The controller of your personal data is ZS Nieruchomości Sp. z o.o. 68-200 Żary, ul. Sportowa 10, Numer KRS 0001109771, NIP 9282111808, REGON 52884314900000, e-mail: biuro@zsnieruchomosci.pl
The Controller has not appointed a Data Protection Officer. For all matters related to data processing, please contact us via the provided email address.

3. Purposes, Scope, and Legal Bases for Processing

In connection with the use of the Service, we may process your data for the following purposes:

Newsletter – first name and email address. Legal basis: consent (Art. 6(1)(a) GDPR). Data is stored until consent is withdrawn.
Blog comments – name or nickname, email address, comment content, IP address. Basis: consent (Art. 6(1)(a)). Stored until the comment is deleted or consent is withdrawn.
Online chat – name, email address, chat content. Basis: consent (Art. 6(1)(a)). Retention period: 24 months.
Contact form – name, email address, subject, and message content. Basis: steps taken at your request before entering into a contract (Art. 6(1)(b)). Deleted 12 months after correspondence ends.
Service and order fulfillment – name, surname, address, NIP, email, phone, order content. Basis: contract performance (Art. 6(1)(b)). Accounting data retained for 5 years.
Shipping – name, surname, address, phone number. Basis: contract performance (Art. 6(1)(b)). Deleted 6 months after delivery.
Accounting – data from invoices and accounting records. Basis: legal obligation (Art. 6(1)(c)). Period: 5 tax years.
Direct marketing (email, Facebook) – email address, FB nickname, interaction history. Basis: legitimate interest (Art. 6(1)(f)); a balancing test has been conducted. Data processed for up to 3 years or until objection is raised.
Traffic analysis (Google Analytics 4) – anonymized IP address, _ga identifier. Basis: consent (Art. 6(1)(a)). Raw GA data stored for 2 months, then anonymized.

4. Cookies and Similar Technologies

The Service uses the CookieYes CMP (IAB TCF v2.2) consent banner, allowing selection of “Accept all,” “Reject all,” or “Save preferences.”
Essential cookies are always installed, while analytical and marketing cookies only after obtaining your consent.
You can change or withdraw your consent at any time by clicking the “Manage cookies” button in the Service footer. The browser also allows manual deletion of cookies.
Commonly used cookies: • cookieyes-consent (ercoding.pl) – 1 year – essential cookie to remember consent choices; • PHPSESSID (ercoding.pl) – session – essential cookie for maintaining the user session; • _ga / _ga* (Google LLC) – 2 months – analytical cookie for GA4 statistics; • _fbp (Meta Platforms, Inc.) – 3 months – marketing cookie for Facebook ad personalization.

5. Data Recipients

Data may be accessed by:

hosting provider smarthost.pl (based on a data processing agreement),
marketing tool providers: Google LLC (GA4) and Meta Platforms Inc. (Facebook Pixel),
payment operator Stripe Payments Europe Ltd.,
courier companies and postal operators,
subcontractors and collaborators assisting us in contract fulfillment,
authorized state authorities, where required by law.

6. Data Transfer Outside the EEA

We use services from Google LLC and Meta Platforms, Inc. (USA). Both companies are certified under the EU-US Data Privacy Framework.
Data may be transferred to the USA only to the extent necessary to provide statistical and marketing services.
We have implemented Google Consent Mode v2 to limit data scope before consent is given.

7. Data Retention Period

We store data no longer than necessary for the purposes for which it was collected or as required by law. Detailed retention periods are listed in point 3.

8. Your Rights

You have the right to:

access your data and receive a copy,
rectify (correct) data,
delete data (“right to be forgotten”),
restrict data processing,
transfer data to another controller,
object to processing based on Art. 6(1)(f) GDPR,
withdraw consent at any time (without affecting the lawfulness of processing before withdrawal),
lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw).

9. Automated Decision-Making

The Controller does not make automated decisions, including profiling, as referred to in Art. 22 GDPR.

10. Security Measures

We apply appropriate technical and organizational measures, including but not limited to: encrypted SSL/TLS connections, hashed passwords (bcrypt), backups, regular software updates, the principle of least privilege, and monitoring of admin panel access.

11. Policy Changes

The Policy may change due to Service development or changes in legislation.
We will inform about significant changes at least 30 days in advance via a notice on the site or email.
The current version of the document is always available at https://ercoding.pl/polityka-prywatnosci.

12. Contact

For matters related to personal data protection, you can contact us via email at biuro@zsnieruchomosci.pl or by post:
ZS Nieruchomości Sp. z o.o. 68-200 Żary, ul. Sportowa 10