Privacy policy

The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) is JAY DESIGN sp. z o.o., with its registered address at ul. Żurawia 32/34, 00-515 Warszawa, NIP: 7011143913, tel. +48 600 631 082, e-mail: jay.dizstudio@gmail.com (hereinafter — the “Controller”).

The Controller has not appointed a Data Protection Officer. Any questions relating to the processing of personal data can be directed to the Controller at the e-mail address above.

Personal data is processed in accordance with GDPR requirements for the following purposes:

• concluding and performing contracts;
• providing design and construction services;
• handling inquiries, correspondence, and communications;
• fulfilling accounting, tax, and bookkeeping obligations;
• establishing, exercising, or defending potential legal claims.

The legal basis for processing personal data includes, in particular, Article 6(1)(b), (c), and (f) GDPR.

The Controller may process, among others, the following categories of personal data:

• first and last name;
• phone number;
• e-mail address;
• the address of the investment property or registered business address;
• other data necessary to perform the contract or execute the project.

Personal data is stored in electronic form and, where necessary, also in paper form.

The Controller applies appropriate technical and organizational measures to protect personal data, in particular against loss, unauthorized access, alteration, or disclosure.

Access to personal data is restricted to authorized persons, to the extent necessary to achieve the defined processing purposes.

Personal data may be disclosed to entities that process data on behalf of the Controller, in particular IT service providers, accounting firms, and cooperating contractors.

Personal data is transferred solely under data processing agreements concluded in accordance with GDPR requirements, or on other lawful grounds.

Personal data is retained:

• for the duration of the contract;
• after its termination — for the period required by applicable law;
• until the expiry of the limitation period for potential legal claims;
• or until an effective objection to the processing is submitted, where the processing is based on the Controller’s legitimate interest.

Persons whose personal data is processed have the right:

• to access their personal data;
• to rectify their personal data;
• to erase their personal data;
• to restrict the processing of their personal data;
• to data portability;
• to object to the processing of their personal data;
• to withdraw consent at any time — where processing is based on consent (without affecting the lawfulness of processing carried out before the withdrawal).

To exercise the above rights, a data subject may contact the Controller by sending a message to the e-mail address provided. The Controller will respond no later than within 30 days of receiving the request.

Persons whose personal data is processed have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if they believe that the processing of their personal data infringes GDPR.

Personal data is not transferred to third countries or international organizations, except where information tools are used whose providers apply standard contractual clauses compliant with GDPR requirements.

Personal data is not subject to automated decision-making, including profiling.

Providing personal data is voluntary; however, failure to provide it may make it impossible to conclude a contract or provide services.

The Controller reserves the right to make changes to this Privacy Policy. The current version of the document is always available on the Controller’s website.