Information on cookies and how they are being used.

Who is the Controller of my personal data? The Controller of your personal data is the company called "Pro-Urba Invest" limited liability company, with its registered office in Warsaw at Kolejowa 43A / U1, ph.: +48 22 696 03 06.

What are the purposes (reasons) for processing my personal data by the Company? Your personal data will be processed for the purposes of: advertising, statistical analysis, direct marketing, promotion, information about the activities carried out by the Company, as well as for the purpose of performing the contract to which you are party or to take action upon your request which it may be necessary to conclude any contract with us, and finally for purposes arising from legitimate interests pursued by the company as a Data Controller – referred to hereinafter.

In each case of processing your personal data by our Company, at least, one of the above premises is fulfilled. The Company does not process personal data if it is unable to prove a need of processing for any of the above purposes.

Where does the Company have my personal data from? We have probably obtained personal data directly from you - this is the main source of data available to the Company. Therefore, most often data is acquired through direct contact between you and the Company, regardless of who initiated this contact.

However, it may happen that you did not provide us with your personal data - in this case your personal data most often comes from your closest friends or direct colleagues who, by contacting us for some reason, decided that we should also have your personal data. The most common is when the Company targets its offer not only directly to the person who has got in touch with the Company, but also upon the request of those persons - also to interested third parties who do not directly contact the Company or do not initiate any contact to this extent with the company (for example, refers to people indicated in the "cc" field on the mailing list in email inquiries addressed to the Company).

Often, we must also have the data of people who have not made it available to us in order to be able to enter into an agreement on the acquisition of the Company's products with all relevant entities (for example, if the spouses or several people purchase an apartment on co-ownership basis, at some point we have data of spouses or all future co-owners - even if only one of the spouses or one of the future co-owners directly applies to the Company). At the moment when we found your data in the manner described above, we can take action concerning you for achieving the objectives described in point. 2 hereinabove.

When the Company has not obtained my personal data from me, what categories of my data does the Company process? The company most often processes data of persons from whom it did not obtain it directly, in the scope of: identifying data (name(s), surname(s), sex, age, marital status, type of property regime prevailing in the marriage/if applicable/, Personal ID (PESEL) number, Tax ID (NIP) number, type and number of identity card) and contact details (contact address, e-mail address, contact telephone number). In the case of persons who are representatives of legal persons/office holders of a legal entity we also have information about the position held in the structures of such a legal person. The scope of personal data that the Company processes depends on the individual situation and need and may be vary from time to time; we do our best to minimize a need for holding certain categories of data.

What are the legal grounds for the processing of my personal data by the Company? The processing of personal data requires legal grounds. The GDPR provides for several types of such legal grounds, and in the case of the Company, we deal essentially with three legal grounds for the processing of personal data:

• Article 6 par. 1 letter a) of GDPR – consent of the data subject to data processing- this condition of the legality of personal data processing occurs in principle only if we want to provide marketing / commercial information from the Company or third parties (outside the Company and the Pro Urba Group*) or when we want to process special types of personal data (so-called sensitive data); However, we try to ensure that marketing, commercial or promotional content that we would like to provide is not addressed to people who do not want it - hence, before our company undertakes marketing, advertising or promotional activities, we will try to obtain your consent for the processing of personal data for the above permitted purposes;

• Article 6 par. 1 letter b) of GDPR – indispensability to perform the contract, to which the data subject is a party, or to take action upon the request of the data subject before entering into the contract - this condition of legality of processing personal data by the Company will occur relatively frequently when we enter into a contract with you to purchase a product or products of the Company, or we will take preparatory steps to conclude such a contract upon your request;

• Article 6 par. 1 letter f) of GDPR – legally justified interest pursued by the Data Controller – this premise will occur most often. It concerns cases where the processing of personal data is justified due to our justified needs.

What is the legitimate interest pursued by the controller? The legitimate interest of the Controller includes marketing of own products of the Company and member companies of the Pro Urba Group* and a need to run core business of the Company, which is the development activity. To this extent, we process your data to:

• be able to contact you, including as part of allowed marketing activities, in particular and for your consent - by e-mail and telephone;

• handle your requests, notices, inquiries, etc. transferred in particular to the Sales Department or (if applicable) to the Technical Department or via the contact form in a situation where they are not directly related to the performance of any contract concluded with the Company;

• be able to arrange loyalty programs, competitions and promotional campaigns in which you can take part;

• be able to improve our products and customize them to the needs and for the convenience of future users/buyers of residential/commercial units under our development projects;

• be able to collect debt; court, arbitration and mediation proceedings;

• be able to carry out statistical analyses;

• keep data for archiving purposes and to ensure accountability (i.e. demonstrate that the Company fulfils its obligations under the law);

• in addition, the law may require us to process your data for tax, accounting and reporting purposes.

Who are the eligible persons to whom the Company may disclose my personal data under the effective law? Your personal data, depending on the specific need justified by the legal or factual relationship between us, may be disclosed to: (1) direct marketing, legal and accounting advisors of the Company - for purposes related to the preparation of the offer to purchase a product or products of the Company and their legal and formal assessment; (2) auditing companies - for purposes related to the audit of annual reports on the Company's operations; (3) an IT company servicing (maintaining) the Company's IT system; (4) the CRM system operator used by the Company's Sales Department; (5) selected government institutions and industry organizations in accordance with the legislation in force in Poland; (6) other member companies of the Pro Urba Group*; (7) Company shareholders - for purposes under the Company's reporting or information obligations towards its shareholders and to ensure that shareholders will exercise their rights attached to the ownership rights in the Company or member companies of the Pro Urba Group*; (8) notarial offices, in order to conclude a preliminary, development or promised contract or extend powers of attorney, under the contracts concluded with you or in relation to preparation of such notarized declarations; (9) banks financing the execution of a development project, for which the contract has been concluded with you and keeping bank accounts related to the settlement of transactions resulting from the conclusion of a contract by you; (10) banks or institutions financing your purchase of the units covered by the concluded contract; (11) architectural offices under contracts concluded with you regarding the execution of the units, including in particular the so-called tenant changes to the unit; (12) companies working jointly with the company dealing with designing, arranging or interior finishing in your unit; (13) entities performing technical tasks upon the request of the Company or other member companies of the Pro-Urba Group* in the property development project, under the concluded contract (e.g. reception operations, repairs on premises or common areas, finishing/installation works on premises or in communal areas, warranty and warranty inspections); (14) companies – utility suppliers to the units and realestate properties covered by the contract concluded with you; (15) a housing community and property manager where the units referred to in the contract concluded with you are located; (16) Your direct consultants (legal, accounting, investment, intermediary in the purchase of premises, etc.) - at your request.

The above catalogue and listing is exemplary and in your specific situation your data will be transmitted only to selected recipients and in accordance with the justified need.

Is the Company going to transfer my personal data to a third country (i.e. outside the EEA) or to an international organization? Your personal data will not be transferred to a third country / international organization without your consent, but it is possible to transfer your data to a third country in a situation where the email controller you use in your contacts with the Company, uses servers located physically outside the EEA.

How long is the Company going to keep my personal data? Your personal data will be kept until there are grounds for processing - that is, if consent is given - until it is revoked, restricted or otherwise altered by you or actions taken by you to limit this consent; data is required to perform the contract - for the duration of its execution and the time necessary for the contracting parties to settle claims under the contract, and when the grounds for processing the data lie in the legitimate interest of the controller - until such justified interest exists (i.e. until the date at which your further processing personal data will prove unreasonable due to the purpose it was intended to serve).

What rights do I enjoy in connection with the processing of personal data by the Company? In relation to the processing of your personal data by the Company, you are entitled to:

• withdraw your consent to the processing of personal data at any time, if the processing of your data in the Company is carried out on such basis - without affecting the legality of the previous processing, which was made on the grounds of consent prior to its withdrawal, pursuant to Art. 13, par. 2, letter c) of GDPR,

• access the content of your data, pursuant to Art. 15 of GDPR,

• rectify your data, pursuant to Art. 16 of GDPR,

• delete your data, pursuant to Art. 17 of GDPR (this right may not be in conflict with legislation effective in Poland),

• limit the processing of your data, pursuant to Art. 18 of GDPR,

• protest against data processing, pursuant to Art. 21 of GDPR; the right to protest - at any time, free of charge to the processing of personal data - applies in particular to the situation in which your data is processed for direct marketing purposes,

• transfer your data, pursuant to Art. 20 of GDPR,

• if you acknowledge that the processing of your personal data violates the provisions of the GDPR, you also have the right to lodge a complaint with the President of the Office for the Protection of Personal Data.

Do I have to provide the Company with my personal data? Your delivery of required personal data is a condition for the Company to accomplish the goal referred to in point 2 hereinabove. Data delivery is voluntary, however, the consequence of failure to deliver data is Company’s inability to perform the activities referred to in point 2 hereinabove.

The voluntary nature of delivering personal data concerns in particular the so-called sensitive data, which - very often - we get from you upon your initiative. In the course of conversations regarding the sale of housing units, we receive various personal information from you, information about your family, your financial position and your occupational status. We will always ask you for permission to process this type of data. Lack of consent to the processing of this data (which may be sensitive data) will make it difficult or even impossible to adjust the offer to your individual expectations.

Does the Company automatically make decisions or carry out automated profiling (e.g. with the use of algorithms)? The company does not apply automated decision-making process, nor automatic profiling of personal data. The processing of your data will take place both manually and with the application of an ICT system.

Does the Company have in place any special procedures for personal data protection? In our Company, we attach great importance to the protection of personal data that we have acquired. To this extent, we implemented a Personal Data Protection Policy compliant with the requirements of the GDPR which ensures protection of personal data disclosed to us against unauthorized processing. Acting in accordance with the implemented Data Protection Policy is for us one of the most important priorities.