This translation is provided for information. The binding version is the Polish one.
1. Who is the data controller for your personal data?
The data controller is Kostiantyn Buch, ul. Czarnomorska 17, 02-758 Warszawa, Polska, VAT number 5214134864 (hereinafter: “we”). The website is accessible at monerahome.com.
For all matters relating to personal data, you can email us at [email protected] or call us on +48503365775. We have not appointed a data protection officer — we are not obliged to do so.
2. Where do we get your data from?
- From you — whether you’re filling in a form, messaging us on WhatsApp or Messenger, emailing us, phoning us or meeting us in person.
- From your device — data on your use of the website collected via cookies and similar technologies, to the extent that you consent to this (see our cookie policy for details).
- From advertising platforms — if you fill in the contact form in an advert (e.g. on Facebook or Instagram), we receive the data you provide in it.
- From third parties — when someone recommends us and, with your knowledge, passes on your contact details to us.
3. Purposes, legal basis and retention period
Response to an enquiry and submission of tenders
Name, telephone number or WhatsApp number, email address, budget, the flat you are interested in, message content. Legal basis: Article 6(1)(b) of the GDPR (pre-contractual measures at your request) and Article 6(1)(f) of the GDPR (our legitimate interest — conducting correspondence). We retain this data until the discussions are concluded, and if no collaboration takes place — for up to 12 months from the last contact, so that we can resume the discussion you have requested.
Help with purchasing (partnership)
Data required to prepare and complete the purchase: full name, passport details, address, contact details, payment information, and the chosen flat. Legal basis: Article 6(1)(b) of the GDPR (performance of a contract). We retain this data for the duration of the business relationship and thereafter until the expiry of the limitation periods for claims (generally 6 years, calculated to the end of the calendar year).
Legal obligations
- Accounting and taxation — accounting documents. Legal basis: Article 6(1)(c) of the GDPR in conjunction with tax legislation and the Accounting Act. Retention period: 5 years from the end of the year in which the tax liability arose.
- Anti-money laundering — insofar as, in our capacity as a property agent, we are an obliged entity within the meaning of the Act of 1 March 2018 on the prevention of money laundering and the financing of terrorism, we may be required to identify the customer and determine the source of funds. Legal basis: Article 6(1)(c) of the GDPR. Retention period: 5 years from the end of the business relationship (or longer, if required by a competent authority).
Notifications about new offers
Your email address and the topic on which you would like to receive updates. Legal basis: Article 6(1)(a) of the GDPR (consent) and Article 398 of the Electronic Communications Act. We will retain your data until you withdraw your consent — simply reply to this message or email [email protected].
Contact via instant messaging apps and by telephone
When you message us on WhatsApp, Messenger or Instagram, or call us, we process the data visible in the conversation (number, profile name, message content). Legal basis: Article 6(1)(f) of the GDPR (to reply to your message). Retention period: as for enquiries.
Statistics and website optimisation
Visitor data: pages visited, clicks, approximate location (country, city), device and browser type, referral source. Only with your consent given via the cookie banner — Article 6(1)(a) of the GDPR and Article 399 of the Electronic Communications Act. We store data in analytics tools for up to 14 months, and session recordings for up to 30 days.
Advertising and measuring its effectiveness
Cookie and device identifiers, information about visits to the website, and whether you contacted us after clicking on an advert (e.g. clicking on WhatsApp or submitting a form — excluding the form’s content). On this basis, advertising platforms may show you our offers (remarketing) and reach people with similar interests. Only with your consent — Article 6(1)(a) of the GDPR and Article 399 of the Electronic Communications Act. Retention period: until consent is withdrawn; in advertising systems — in accordance with the policies of their providers (usually up to 13 months).
Safety and protection against abuse
IP address, technical details of enquiries, server logs. Legal basis: Article 6(1)(f) of the GDPR (ensuring the security of the website, protection against spam and attacks). Retention period: usually a few days, up to a maximum of 12 months.
Investigations and defence against claims
Data necessary to substantiate our case. Legal basis: Article 6(1)(f) of the GDPR. Retention period: until the expiry of the limitation periods.
Our social media profiles
If you follow our profiles (Facebook, Instagram, TikTok, YouTube) or comment on posts, we process your profile name and the content you publish. Legal basis: Article 6(1)(f) of the GDPR (profile management and communication). With regard to profile statistics on Facebook and Instagram, we are a joint controller together with Meta Platforms Ireland Ltd. — the rules are set out in the ‘Addendum on Joint Data Control for Page Insights’ provided by Meta.
4. Do you need to provide your details?
Providing your details is voluntary, but without a telephone number or email address we will not be able to respond to your enquiry, and without the details required by law, we will not be able to process your purchase. Consent to analytical and marketing cookies is entirely voluntary: the website also works without it.
5. Who we share data with
We do not sell your data. We only pass it on to the extent necessary:
- IT service providers (processors acting on our instructions): website hosting and security — Cloudflare; content management system — Sanity (stores website content, not data from forms); email; messaging service for notifications about new enquiries — Telegram; office and accounting tools.
- Providers of analytics and advertising tools — only with your consent: Google (Google Analytics, Google Ads), Microsoft (Clarity), Meta (Pixel), TikTok (Pixel). The current list with descriptions can be found in our cookie policy. With regard to the collection and transfer of data by Meta Pixel, we act as a joint controller with Meta Platforms Ireland Ltd. (Meta carries out further processing as a separate controller).
- The messaging services you use to contact us — WhatsApp Ireland Ltd., Meta Platforms Ireland Ltd. — in accordance with their terms and conditions.
- Parties involved in the transaction — only if you decide to make a purchase or request details of an offer: a partner estate agent in Turkey (or Spain), the developer or seller, a sworn translator, a valuer, a notary, a law firm, a bank and the relevant authorities in the country where the property is located (e.g. the Land Registry, the tax office).
- To our advisers — our accountant and law firm — to the extent necessary for them to carry out their work.
- To state authorities — where required by law.
6. Transfer of data outside the European Economic Area
- USA — Google, Microsoft, Meta and Cloudflare participate in the EU-US Data Privacy Framework, for which the European Commission has issued a decision recognising an adequate level of protection. In addition, they use standard contractual clauses.
- Turkey (and other countries where no Commission decision has been adopted, e.g. in the case of transaction partners) — we transfer data where this is necessary for the preparation or fulfilment of the purchase you have requested (Article 49(1)(b) of the GDPR), or on the basis of standard contractual clauses.
- Other providers (e.g. Telegram, TikTok) may process data outside the EEA on the basis of standard contractual clauses or other mechanisms provided for in the GDPR.
You can obtain a copy of the security measures by emailing [email protected].
7. Profiling
We do not make decisions about you based solely on automated processing that would have legal consequences. If you consent to marketing cookies, advertising services may create interest profiles to tailor the adverts displayed — you may withdraw your consent at any time.
8. Your rights
You have the right to:
- access to data and to receive copies of it,
- correction of incorrect data,
- the right to erasure (‘the right to be forgotten’),
- restrictions on processing,
- the transfer of the data you have provided to us,
- objection to processing on the basis of legitimate interests — and, in all cases, to direct marketing,
- to withdraw consent at any time, without this affecting the lawfulness of any processing carried out previously (cookies — the ‘Cookie settings’ link in the footer),
- to lodge a complaint with the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
To exercise your rights, please email [email protected]. We will reply without undue delay, within one month at the latest.
9. How we protect data
The website operates exclusively via an encrypted connection (HTTPS). Data from the forms is not stored in the website’s database — it is sent directly to us as a notification. Access to the data is restricted to those who need it for their work. We protect the forms from spam without using any external tracking tools.
10. Children
This website is intended for adults. We do not knowingly collect data from anyone under the age of 16.
11. Links to other websites
The website contains links to other services (e.g. WhatsApp, YouTube, maps). When you visit these sites, their respective privacy policies apply.
12. Policy changes
We update this policy when legislation, our services or the tools we use change. The date of the last update is shown at the bottom of the page.
Last updated: 10 October 2026.