1. Controller and scope
The controller of personal data supplied to REIH through correspondence and use of this website is REIH sp. z o.o., KRS 0000667076, REGON 366732030, with its registered office in Warsaw, Poland. Data protection contact: sekretariat@reih.pl. This policy covers the information website and enquiries sent to the company. Processing in a specific project or employment relationship requires separate information.
2. Data concerned
The enquiry form and correspondence may include your name, email address, telephone number, company details, property information and data in messages and attachments. The scope depends on what you send. Please provide only information needed to deal with your enquiry. Website infrastructure may process IP addresses, request times, resource addresses, browser information and connection error data.
Form submissions are sent to kontakt@reih.pl through the bHOST mail server and retained in protected website storage. Enquiries are handled by email. The form does not accept attachments. Technical anti-abuse controls use a temporary identifier derived from the connection address.
3. Purposes and legal bases
Handling enquiries and business correspondence relies on the controller’s legitimate interest in communication and business operations (Article 6(1)(f) GDPR). Steps requested by an individual before entering a contract in their own name rely on Article 6(1)(b). Contact with representatives of counterparties relies on Article 6(1)(f). Website security and establishing, exercising or defending legal claims may also rely on Article 6(1)(f). Specific statutory duties are fulfilled under Article 6(1)(c). Sending an enquiry does not constitute consent to marketing.
4. Voluntary provision and retention
Providing data in correspondence is voluntary, but insufficient contact or case details may prevent a response. Data should be retained for the time needed to handle the enquiry and any ensuing cooperation, and thereafter only insofar as justified by legal obligations or the protection of claims, until the relevant periods expire. Data no longer needed for those purposes should be deleted. Contact the controller for the period applicable to your case.
5. Recipients and external services
Data may be accessed by authorised staff handling the matter and by email, hosting and IT support providers to the extent necessary for their tasks. Advisers may receive data when involved in a specific matter, and competent authorities where a legal basis exists. Mentioning C&P Legisperiti does not mean that all enquiries are automatically forwarded to the law firm. Email, Craft and MEGA links open separate services with their own privacy rules. Processing involving transfers outside the EEA requires a valid basis under Chapter V GDPR; details of relevant recipients, countries and safeguards may be requested from the controller.
6. Your rights
Subject to Articles 15–22 GDPR, you have rights of access, rectification, erasure and restriction and, where applicable, data portability. You may object to processing under Article 6(1)(f) on grounds relating to your particular situation. If processing is based on consent, you may withdraw it without affecting the lawfulness of prior processing. You may complain to the President of the Polish Personal Data Protection Office: uodo.gov.pl. The website does not make automated decisions that produce legal effects for visitors or use profiling for advertising purposes.
7. Legal basis and updates
Regulation (EU) 2016/679 (GDPR), in particular Articles 6, 12–22 and 44–49, OJ L 119, 4 May 2016. Information may be updated when the website or processing activities change.