WEBSITE PRIVACY POLICY AT www.up2u-rent.pl 

effective from July 08, 2025 

(“Privacy Policy”) 

Introduction 

This Privacy Policy explains how we process your personal data when you use the website www.up2u-rent.pl (“Website”). 

The personal data will be processed in line with data protection laws, particularly Regulation (EU) 2016/679 of the European Parliament and of the EU Council on April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”) (referred to in Polish as the “RODO”) and following Polish regulations related to the GDPR, including the Law dated May 10, 2018, on the protection of personal data. The Trei Real Estate group of companies (“TREI”) retains your personal data and protects them against unauthorised third-party access, in accordance with the above regulations and this Privacy Police. 

Any terms not specifically defined in this Privacy Policy have the meaning given to them under the GDPR. 

Who are we? 

The personal data administrators are: 

Trei Real Estate Poland sp. z o.o., a limited liability company located in Warsaw (47/49 Wspólna Street, 00-684 Warsaw - ul. Wspólna 47/49, 00-684 Warszawa) and registered in the register of entrepreneurs maintained by the District Court of Warsaw, 12th Commercial Division of the National Court Register under KRS number: 183150, with authorised capital of PLN 147,125,000.00, REGON: 356782455, NIP: 1070010300, as the Website administrator. 

Winiary Residential sp.k., a limited partnership located in Warsaw (47/49 Wspólna Street, 00-684 Warsaw - ul. Wspólna 47/49, 00-684 Warszawa) and registered in the register of entrepreneurs maintained by the District Court of Warsaw, 12th Commercial Division of the National Court Register under KRS number: 0001049203, REGON: 525942856, NIP: 7011157306, as the project developer. 

(hereinafter referred to as the “Administrator”, “TREI”, we use first-person terms such as “we” and “us” in communication). 

How to Contact the Administrator 

You can contact the Administrator, Trei Real Estate Poland sp. z o.o. limited liability company and Winiary Residential sp.k. limited partnership by email at odo@treirealestate.com or by post at the Administrator’s address listed above. 

Who does the Privacy Policy apply to? 

The Privacy Policy is aimed at users of the Website, that is, any natural persons visiting the Website, including users who utilising the forms available at our Website. In the Privacy Policy, we may also speak directly to users, for example, using terms like “you” and “your”. 

Purposes, grounds and duration for the processing of personal data 

Any personal data processed within the Website are handled for the purposes outlined below, based on the legal grounds stated and for the period specified. We also clarified whether providing personal data is voluntary, a contractual condition or a legal requirement. 

CONTACTING THE ADMINISTRATOR 

Purpose: The Administrator processes your personal data to get in touch or correspond with you, whether through the online contact form, email, phone, regular post or messaging apps. 

Legal basis: The personal data will be processed under Article 6(1)(f) of the GDPR. It is necessary for the purposes arising from the Administrator’s legitimate interests, being maintaining contact with persons interested in the Administrator’s activities, responding promptly to any communications related to business activities and ensuring good cooperation with clients, contractors and other stakeholders. 

Duration of processing: The personal data will be processed for as long as needed to maintain contact (handle requests), unless you effectively object to such processing sooner. 

Voluntary nature of data provision: Providing your data is voluntary; however, failure to provide such data may limit the Administrator’s ability to fully respond / correspond with you. 

ADVERTISING COMMUNICATIONS BY EMAIL OR PHONE 

Purpose: The Administrator processes your personal data to promote their products, services or reputation (for direct marketing or sending commercial information). These actions may be performed using different communication methods, such as via email or phone (calls or SMS/MMS). In cases of advertising communication via email or phone, we need your consent for the chosen indicating the relevant method of contact. 

Legal basis: The personal data will be processed under Article 6(1)(f) of the GDPR. It is necessary for the purposes arising from the Administrator’s legitimate interests, being the promotion of the Administrator’s goods or services. In case of sending communications by email or phone, the Administrator’s legitimate interest is related to your consent, given in line with the Law dated July 18, 2002, on providing services by electronic means and the Law dated July 7, 2023, on electronic communications. You can change how you receive advertising communications (withdraw your consent to receiving it via relevant methods) at any time by contacting the Administrator by email. 

Duration of processing: The personal data will be processed for as long as we maintain the advertising communication, unless you effectively object to such processing sooner or unless withdraw your consent to receiving the advertising communication via a relevant channel. 

Voluntary nature of data provision: Providing your data is voluntary; however, failure to provide such data will preclude the receipt of advertising communications. 

SOCIAL MEDIA PRESENCE 

Purpose: The Administrator processes personal data to manage and run its pages (fan pages) on Facebook and Instagram. This includes replying to comments from visitors, ensuring good communication, analysing user activity such as the number of interactions (e.g. likes), tags, comments and shares of the fan page or its content (for analytical and statistical purposes, to better understand the market and user needs, helping to tailor content and communication strategies). It is also used for marketing and promoting the Administrator’s products and services (to identify users interested in particular topics and to run events aimed at growing the number of subscribers and active community members). Additionally, the Administrator monitors content (to keep the fan page safe and orderly, prevent fraud and protect the IT environment). 

Legal basis: Personal data will be processed under Article 6(1)(f) of the GDPR. It is necessary for the purposes arising from the Administrator’s legitimate interests, being the promotion of the Administrator’s products and services, as well as maintaining continuous business communication and protecting the brand’s reputation. 

Duration of processing: The Personal data collected within the fan page will be processed by the Administrator for as long as the page is active or while you remain a user (for example, until you unsubscribe), unless you effectively object to such processing sooner. 

Voluntary nature of data provision data: Providing your data when using the fan page is voluntary. However, failure to provide such data may preclude using certain functions (such as commenting). 

Co-administration: The Administrator and Meta Platforms Ireland Limited registered at: Serpentine Avenue, Block J, Dublin 4, Ireland («Meta Ireland»), will act jointly as co-administrators regarding the processing of statistical data about (i) your activity on the Facebook and Instagram fan pages, and (ii) your use of Messenger related to the fan page. You can find more information about how Meta Ireland processes data here: https://www.facebook.com/privacy/center/ and https://privacycenter.instagram.com/policy. The Administrator generally has no influence over the purposes, amount or duration of such processing and how Meta Ireland processes your personal data for its own purposes, arising from the Meta Ireland’s processing rules available on Facebook (listed in Privacy Policy and Regulations of Instagram and Facebook). Meta Ireland is responsible for enabling users to exercise their GDPR rights where it processes data independently or jointly for fan page statistics. 

ARCHIVING PURPOSES, CLAIMS 

Purpose: The personal data will be processed for the purpose of archiving documents and communications, including correspondence created by the Administrator in its business activities, as well as for raising, establishing and defending from claims. 

Legal basis: Personal data will be processed under Article 6(1)(f) of the GDPR. It is necessary for the purposes arising from the Administrator’s legitimate interests, being the need to document evidence of the activities conducted under the applicable law and to use the archived material for the purposes of raising, establishing and defending from claims. 

Duration of processing: Personal data will be processed for the duration of the relevant legal limitation periods, unless you effectively object to such processing earlier. 

Voluntary nature of data provision: Providing your data is voluntary; however, failure to provide such data may limit the ability to fully use the Website’s services and functions. 

INTERNAL ADMINISTRATIVE PURPOSES 

Purpose: Personal data will be processed for internal administrative purposes arising from the Administrator’s capital, staffing or organisational ties with other entities. As part of these purposes, certain data may be shared with other entities within the TREI group, specifically: Trei Real Estate Poland Sp. z o.o. (a limited liability company), Winiary Residential Sp. z o.o. sp.k. (a limited partnership) and Winiary Residential Sp. z o.o. (a limited liability company). 

Legal basis: The processing of personal data is based on Article 6(1)(f) of the GDPR. It is necessary for the purposes arising from the Administrator’s legitimate interests, being data sharing within the Administrator’s group for internal administrative needs. 

Duration of processing: Personal data will be processed until the intended purpose is fulfilled, unless an effective objection is raised earlier. 

Voluntary nature of data provision: Providing your data is voluntary; however, failure to provide such data may limit the ability to fully use the Website’s services and functions. 

ANALYTICAL AND STATISTICAL ACTIVITIES 

Purpose: The Administrator processes your personal data for analytical and statistical purposes (analysing user activity, monitoring Website traffic, identifying customer preferences, as well as improving functionality and the quality of services offered by the Administrator). 

The Administrator uses profiling – as part of the automated processing of personal data, certain factors and information relating to the user (e.g. browsing history) are evaluated to analyse behaviour or make predictions. This helps tailor displayed content to better match the user’s individual preferences and interests. 

The Administrator’s ability to process data collected via cookies or similar technologies for analytical and statistical purposes depends on your consent to store such information on your end-device (e.g. computer or phone). 

Legal basis: Personal data will be processed under Article 6(1)(f) of the GDPR, related to your consent to using cookies or similar technologies (under Law dated July 7, 2023, — the Law on Electronic Communications (Journal of Laws 2023, item 1703)). The processing is necessary for the purposes arising from the Administrator’s legitimate interest, being the analysis of user activity to improve functionality and enhance the quality of the Administrator’s services, including the development of Website features. You may withdraw your consent to the use of cookies or similar technologies for this purpose at any time by reopening the cookie banner and adjusting your preferences. 

Duration of processing: Personal data will be processed for the duration specified in the cookie banner, unless you effectively withdraw your consent to such processing or submit an effective objection on the use of cookies or similar technologies earlier. 

Voluntary nature of data provision: Providing your data is voluntary; however, failure to provide such data may limit the ability to fully use the Website’s services and functions. 

AFFILIATE PROGRAMMES AND PARTNER LINKS (EXTERNAL ADVERTISING) 

Purpose: The Administrator processes personal data to show marketing content (contextual and behavioural ads) on external advertiser platforms (such as Meta Ireland and Google Ireland Limited), which is tailored to your preferences and activity on the Website, such as content you have previously viewed. In this case, both the Administrator and external entities process your personal data, including information collected through cookies and similar technologies, for marketing purposes. In this context, we utilise so-called affiliate programmes that let us promote our products and services on third-party platforms. If you click a partner link and go on to use an offer on the Website after clicking the link, the external suppliers receive a commission from the Administrator. To track whether a user came through a partner link, the external supplier needs to know that the link was used. This transaction tracking is only for commission-related purposes. 

The Administrator uses profiling — as part of the automated processing of personal data, certain factors and information relating to the user (e.g. purchasing history, history  of reviewed goods) are evaluated to analyse behaviour or make predictions. This helps tailor displayed content to better match the user’s individual preferences and interests. 

The Administrator’s ability to process data collected via cookies or similar technologies for marketing purposes depends on your consent to store such information on your end-device (e.g. computer or phone). 

Legal basis: Personal data will be processed under Article 6(1)(f) of the GDPR, related to your consent to using cookies or similar technologies (under Law dated July 7, 2023, — the Law on Electronic Communications (Journal of Laws 2023, item 1703)). The processing is necessary for the purposes arising from the Administrator’s legitimate interest, being the promotion of the Administrator’s goods or services. You may withdraw your consent to the use of cookies or similar technologies for this purpose at any time by reopening the cookie banner and adjusting your preferences. 

Duration of processing: Personal data will be processed for the duration specified in the cookie banner, unless you effectively withdraw your consent to such processing or submit an effective objection on the use of cookies or similar technologies earlier. 

Voluntary nature of data provision: Providing your data is voluntary; however, failure to provide such data may limit the ability to fully use the Website’s services and functions. 

SECURITY 

Purpose: Personal data will be processed to ensure the security of the Website (the services provided electronically) and to prevent misuse, particularly actions that breach the Regulations or mandatory legal requirements. 

Legal basis: The processing of personal data is based on Article 6(1)(f) of the GDPR. It is necessary for the purposes arising from the Administrator’s legitimate interests, being ensuring the actual and legal security of the Website and its users. 

Duration of processing: Personal data will be processed for as long as you use the Website, unless you submit an effective objection to such processing earlier. 

Voluntary nature of data provision: Providing your data is voluntary; however, failure to provide such data may limit the ability to fully use the Website’s services and functions. 

TRANSFER AND DISCLOSURE OF PERSONAL DATA 

While processing your personal data, they may be shared with third parties, that is, entities that provide services to the Administrator, such as IT support, including website maintenance and servicing, data hosting and cloud services, as well as postal and courier operators, law firms, auditors, banks and payment service providers, insurance companies, entities responsible for archiving or destroying data and authorised employees of the Administrator. We may also share your personal data with other companies within our group, including Trei Real Estate Poland Sp. z o.o. (a limited liability company), Winiary Residential Sp. z o.o. sp.k. (a limited partnership) and Winiary Residential Sp. z o.o. (a limited liability company). 

Clicking on links within the Website may take you to other websites or services managed by entities that are independent of the Administrator. In these cases, the processing of your personal data will be subject to the policies of those websites or services. 

Processing Data in Third Countries 

If we process data in a third country (that is, outside the European Union (EU) or the European Economic Area (EEA)) or if processing involves using third-party services, sharing with or disclosing data to other persons, authorities or companies, this will always be done in full compliance with legal requirements. 

The Administrator performs the above processing based on standard contractual clauses (in line with Article 46(2)(c) or (d) of the GDPR) or ensures another lawful mechanism that complies with the law and legalises such transfer, guaranteeing an appropriate level of personal data protection under the relevant laws. Data transfers to the United States may take place under the European Commission’s decision dated July 10, 2023, which confirms that the EU-US Data Privacy Framework provides an adequate level of protection (Article 45 of the GDPR). 

Rights of Persons Related to the Data 

The individuals whose data are processed (you) have the following rights: 

• request access from the Administrator to your personal data or their copies, 

• the right to rectify the data, 

• the right to delete the data, 

• the right to limit the processing, 

• the right to transfer the data (if the Administrator processes personal data automatically based on your consent or to fulfil a contract, the relevant person (you) may ask to have your data provided in a structured, generally accepted, machine-readable format. If the person requests direct transfer of data to another Administrator, this will be done only if technically feasible), 

• the right to object against the processing of your personal data for the Afministrator’s legitimate interests. However, this right may not be exercised if there are overriding legitimate grounds for the processing that outweigh your interests, rights and freedoms. If you object to processing for direct marketing purposes, your personal data will no longer be processed for this purpose, 

• the right to withdraw the consent at any time, which will not affect the lawfulness of any processing done before the withdrawal. 

You also have the right to file a complaint with the relevant supervisory authorities, including in your country of residence, work or where the possible violation happened. In Poland, the supervisory authority is the Head of the Personal Data Protection Administration located at: ul. Moniuszki 1A, 00-014 Warsaw. 

Automated Decision-Making in Individual Cases 

No automated decisions will be made regarding the personal data processed through the Website. This means that decisions based solely on automated processing, including profiling, which produce legal effects concerning the data subject (such as yourself) or similarly significantly affect them, will not be taken. 

Use of Cookies 

Cookies are text files that store data from websites visited by the user and are saved in the user's browser on their computer. Cookies are primarily used to retain information about the user during or after their interaction with online services. The data retained may include, for example, website language preferences, login status, shopping cart contents or places where videos were reviewed. The term “cookies” also covers other technologies that serve similar functions (storing user information via online identifiers, also referred to as “user IDs”). 

Cookies Can Be Categorised According to Their Type and Function as Follows: 

• Temporary Cookies (also referred to as session files): These are temporary cookies that are deleted once the user leaves the website and closes their browser at the latest. 

• Persistent Cookies: These cookies remain stored on your device even after you close your browser. They can retain, for example, the login status, so preferred content may be displayed next time the user visits the website. Persistent cookies may also store information about the user’s interests for analytical or marketing purposes. 

• First-Party-Cookies: These first-category cookies are set directly by us. 

• Third-Party-Cookies: These cookies are set by third-party service providers, most commonly advertisers (so-called third parties), and are used to process user-related data. 

• Essential Cookies: These cookies are essential for the operation of the Website (for instance, for saving login data or other data entered by the user; they also may be security-related) and cannot be disabled via user-side cookie settings. While you may configure your browser to block these cookies or receive notifications about such cookies, doing so may result in parts of the Website not functioning properly. These cookies do not store any personal data. 

• Analytical and Statistical Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Website. They help us understand which pages are most and least popular and how visitors move around the website. All information collected by these cookies is aggregated and therefore is anonymous. If you disable these cookies, we will be unable to monitor your visits. 

• Functional Cookies: These cookies allow the online store to provide enhanced features and personalised content. They may be set by us or by third-party providers whose services are used on our pages. If you disable these cookies, some or all of these services may not function properly. 

• Marketing cookies: These cookies may be set through the Website by our advertising partners. They may be used by these companies to build a profile of your interests and to deliver relevant advertising across other websites. These cookies do not directly store personal data but operate by uniquely identifying your browser and device. Disabling these cookies may result in less personalised advertising content. 

• Social Media Cookies: These cookies are set by social media service providers used on the Website. They enable you to share our content with your friends and in social media. These cookies can track browsing behaviour across other websites and create a user interest profile, potentially affecting content and communications shown elsewhere. If disabled, certain social sharing functionalities may be unavailable. 

Before processing any data related to the use of cookies, we request the user’s consent, which may be withdrawn at any time via the cookie banner. Prior to obtaining consent, only those cookies that are essential for the proper functioning of the Website will be used, where required. 

Cookie Settings / Right to Object: 

You may adjust the Website’s cookie settings at any time via the cookie banner, your browser settings or by using the following link

Services Used and Service Providers: CoockieConsent released under the MIT License

Our website uses the following cookies: 

List of Cookies 

Changes and Updates of the Privacy Policy 

The Privacy Policy may be amended by the Administrator in case of actual or legal changes in how personal data are processed within the Website. You will be informed of any changes to the Privacy Policy, including by publishing the updated version on the Website.