Privacy Policy
Effective date: 07/17/2025
1. General Provisionsn
This Privacy Policy sets out the rules for the processing of personal data of individuals using the website available at: https://kochamgory.com/ and https://kochamgory-invest.com/ (the "Website").
The controller of personal data processed in connection with the use of the Website is:
KOCHAM GÓRY sp. z o.o.
ul. Marynarska 15
02-674 Warsaw
KRS [National Court Register number]: 0001161126
NIP [Tax Identification Number]: 5214109346
REGON [National Official Business Register number]: 541152768
e-mail: [email protected]
hereinafter referred to as the "Controller".
In matters related to the processing of personal data and the exercise of rights under the GDPR, you can contact the Controller by mail at the aforementioned address and via e-mail at: [email protected].
The Controller exercises due diligence to protect the privacy of individuals using the Website and processes personal data in accordance with applicable legal regulations, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR").
2. Scope and source of processed data
- • contact data, in particular e-mail address and telephone number; ,
- • data concerning correspondence and inquiries directed to the Controller;
- • data concerning reservations or interest in an offer, if provided via functionalities available on the Website;
- • technical data regarding the device and the use of the Website, including IP address, browser information, operating system, and data regarding activity on the Website;
- • information saved or read using cookies and similar technologies;
- • other data voluntarily provided to the Controller by the user in connection with the use of the Website.
Depending on the method of using the Website, the Controller may process in particular: identification data, such as first and last name;
Personal data may be collected directly from the data subject, in particular through contact with the Controller, as well as in connection with the use of the Website.
3. Purposes and legal bases for data processing
- 1. handling of inquiries and contact
- • handling the inquiry;
- • contacting the user;
- • presenting information regarding the investment;
- • preparing an individual offer;
- • taking steps aimed at entering into a contract, if the user is interested in the investment.
- 2. handling the sales and investment process
- 3. handling reservations and inquiries regarding stays
- 4. operating the Website and ensuring its security
- 5. keeping statistics and analyzing the use of the Website
- 6. marketing activities
- Newsletter
- 7. establishing, exercising, or defending legal claims
Personal data may be processed by the Controller for the following purposes:
If you contact the Controller via e-mail or in any other available manner, your data is processed for the purpose of answering the submitted inquiry, conducting correspondence, and taking action at your request. The legal basis for the processing is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller consisting in handling inquiries, and sometimes Article 6(1)(b) of the GDPR, provided the contact concerns taking steps prior to entering into a contract. The Website enables the user to provide data via contact forms in order to obtain information or an individual offer regarding an investment. Depending on the choice of the form, the user may be asked to provide their name or company name, telephone number, and e-mail address. Data provided via the form is processed for the purpose of:
The legal basis for the processing is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller consisting in handling inquiries and conducting activities prior to entering into a contract, and, to the extent appropriate, Article 6(1)(b) of the GDPR.
Personal data may be processed in connection with the sales process of investment products, in particular for the purpose of presenting an offer, conducting negotiations, preparing documents, taking steps prior to entering into a contract, and subsequently its conclusion and performance, contacting a potential or current investor, after-sales service, as well as establishing, exercising, or defending against legal claims. The legal basis for the processing is Article 6(1)(b) of the GDPR with regard to actions aimed at concluding and performing the Contract, and Article 6(1)(f) of the GDPR depending on the nature of the relationship with the data subject.
The Website enables users to use functionalities related to booking a stay in selected facilities (Hotels Tab). Within the reservation process, data necessary for making a reservation, handling it, and processing payments may be processed. Depending on the scope of the process and the entity being a party to the contract regarding the stay, the controller of data related to a specific reservation may be the relevant operator of the hotel facility. The legal basis for the processing is Article 6(1)(b) of the GDPR in connection with Article 6(1)(f) of the GDPR. The reservation system available on the Website is operated by an external provider – Profitroom Sp. z o.o., with its registered office in Poznań, at ul. Roosevelta 9, 60-829 Poznań, Poland. Profitroom acts as an independent personal data controller with regard to the processing of data entered during the reservation process (e.g., contact data, payment data). All data provided in the reservation forms is processed in accordance with Profitroom's privacy policy. In order to become acquainted with the rules of data processing by Profitroom, please visit the website: Privacy Policy - profitroom.
Technical data, including IP address, device data, and information on how the Website is used, may be processed to ensure the proper functioning of the Website, the security of the Website, the detection and prevention of abuse, the diagnosis of errors, and the maintenance and securing of technical infrastructure. The legal basis is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller consisting in ensuring the security and proper functioning of the Website.
If the Controller uses analytical tools, data may be processed to analyze the manner of using the Website, compile statistics, and improve functionality and content. The data is processed on the basis of the expressed consent, i.e., Article 6(1)(a) of the GDPR.
Data may be processed for the purpose of conducting direct marketing of the Controller's own products and services on the basis of Article 6(1)(f) of the GDPR, taking into account the provisions regulating the possibility of sending commercial information and conducting direct marketing via specific communication channels.
Subscription to the newsletter is voluntary and requires providing an e-mail address and granting consent. Personal data is processed on the basis of Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time, in particular by using the link enabling the cancellation of the subscription. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Data may also be processed to establish, exercise, or defend against legal claims. The legal basis is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller.
4. Cookies and similar technologies
The Website uses cookies and similar technologies to ensure the proper functioning of the site, remember user settings, conduct statistical analyses, and as part of the implementation of marketing purposes, in accordance with the consent granted. Cookies may be: :
In the case of cookies other than strictly necessary ones, the Controller applies an appropriate mechanism for managing user consents. The user may change their cookie settings at any time using the consent management mechanism available on the Website. Detailed information regarding the cookies used, their providers, purposes, storage periods, and the possibility of changing consent is available in the cookie settings panel.
5. Recipients of data
Depending on the purpose and scope of processing, personal data may be transferred to:
6. Transfer of data outside the European Economic Area
In connection with the use of external providers' services, personal data may be transferred outside the European Economic Area.
In such a case, the Controller ensures the application of an appropriate mechanism legalizing the data transfer in accordance with Chapter V of the GDPR, in particular an adequacy decision or standard data protection clauses, along with the application of supplementary measures if required.
Information on specific providers whose services involve the transfer of data outside the EEA should result from the current list of tools used on the Website and the Cookie Policy.
7. Data storage period
Personal data is stored for the period necessary to achieve the purpose for which it was collected. In particular:
8. Rights of data subjects
In connection with the processing of personal data, the data subject has the following rights – in the cases specified by the GDPR provisions:
The right to withdraw consent may be exercised at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
In order to exercise their rights, one may contact the Controller via the e-mail address indicated in this Policy.
9. Voluntary nature of providing data
Providing personal data is voluntary. However, providing certain data may be necessary for the provision of a specific service, i.e., handling an inquiry, making a reservation, concluding a Contract, or taking steps at the request of the data subject. Failure to provide the data required to carry out a given process may result in the inability to carry it out.
10. Automated decision-making and profiling
Personal data processed via the Website is not used by the Controller to make decisions concerning users that produce legal effects or similarly significantly affect them, based solely on automated processing. If profiling of Website users occurs within the framework of tools used by the Controller, information about such processing and the possibility of objecting or withdrawing consent will be presented in the appropriate information regarding the use of the given tool.
The Controller may use artificial intelligence tools in order to streamline internal processes, prepare analyses, reports, and statistical summaries. The tools are exclusively of an assistive nature. As a result of their use, the Controller does not make decisions concerning data subjects that produce legal effects or similarly significantly affect them within the meaning of Article 22 of the GDPR (profiling) The Controller has implemented appropriate organizational and technical measures aimed at ensuring the security of data processed using AI tools.
11. Links to other websites
The Website may contain links to third-party websites, including Companies belonging to the Kocham Góry group, business partners, or service providers.
The Controller is not responsible for the personal data processing rules applicable on third-party websites. Upon navigating to a third-party website, one should read the privacy policy applicable there.
12. Social media
The Controller maintains social media profiles, in particular for the purpose of communicating with users, promoting its activities, and presenting the offer of the Controller and entities belonging to the Kocham Góry Group.
The Controller may process personal data contained in the user's profile, information about their activity, including likes, comments, and reactions, as well as data provided in messages. The legal basis for the processing is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller consisting in conducting communication, promoting activities, and building relationships with users.
The operators of individual social networking sites may process users' data as independent controllers. Detailed information regarding data processing by these operators is available in their privacy policies.
13. Data security
The Controller applies appropriate technical and organizational measures aimed at protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. The scope of applied security measures is adapted to the risk associated with the processing of personal data.
14. Data of minors
If, as part of using the Website's functionalities or making a reservation, data concerning minors is provided, it should be provided by a parent, legal guardian, or another person authorized to perform such an act.
15. Changes to the Privacy Policy
The Controller may update this Privacy Policy, in particular in the event of a change in the manner in which the Website functions, the technologies used, the scope of data processing, or applicable legal provisions. The current version of the Privacy Policy is published on the Website along with an indication of its effective date.