Privacy Policy
Current version: June 2025
Pursuant to Article 13 and Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (“Personal Data”) and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “GDPR”).
Who is the controller of your personal data?
This information relates to companies in the High Capital Group (hereinafter: “High Capital Group”), namely:
- High Capital Management sp. z o.o. based in Warsaw,
- HCM SPV 1 sp. z o.o. based in Warsaw,
- HCM SPV 2 sp. z o.o. based in Warsaw,
- Renovation Wave SPV 1 sp. z o.o. based in Warsaw,
- Renovation Wave SPV 2 sp. z o.o. based in Warsaw,
- Value Assets sp. z o.o. based in Warsaw,
- High Capital Development sp. z o.o. based in Warsaw,
- High Capital Investments sp. z o.o. based in Warsaw,
- Renovation Wave SPV 3 sp. z o.o. based in Warsaw,
- Vanguard Properties SPV 4 sp. z o.o. based in Warsaw,
- HCM SPV 5 sp. z o.o. based in Warsaw,
- High Capital Funds sp. z o.o. based in Warsaw,
- Renovation Wave sp. z o.o. based in Warsaw,
- Vanguard Properties sp. z o.o. based in Warsaw,
- High Capital Properties sp. z o.o. based in Warsaw,
- Vanguard Properties SPV 1 sp. z o.o. based in Warsaw,
- High Capital Properties sp. z o.o. based in Warsaw,
- Four Corners sp. z o.o. based in Warsaw,
- Viva Park Cieszyn sp. z o.o. based in Warsaw,
- Four Corners SPV 1 sp. z o.o. based in Warsaw,
As a rule, each of the companies of the High Capital Group independently decides on the purposes and methods of processing Personal Data, which means that each of them is a separate controller (“Administrator”) – depending on which company you contract with or conduct business relations with, as a rule, this company will be the controller of your Personal Data.
The information contained herein applies to each of the companies in the High Capital Group to the extent that these companies are Administrators, with High Capital Management Sp. z o.o. being the Administrator for most processes within the High Capital Group.
It may also happen that a particular company performs activities for another High Capital Group company, e.g. related to logistics, marketing – in such a case, however, the company performing this work does not become the Administrator of your Personal Data, but processes it on the basis of the entrustment agreement it has concluded with the Administrator.
How to contact the Administrator?
You can contact the controller via:
- mailing address: ul. Wilcza 19/37, 00-544 Warsaw,
- e-mail address: compliance@highcapital.pl
What are the purposes and legal grounds for processing your personal data?
Please find below detailed information about the processing of Personal Data:
| Purpose of data processing | Legal basis | Scope of data processing | Data storage period |
|---|---|---|---|
| Conclusion and performance of a reservation agreement, developer agreement and final agreement (transfer of ownership) | Article 6(1)(b) GDPR | Name and surname PESEL number residential address NIP (tax identification number, if applicable) series and number of identity document contact details property information | For the duration of the agreement and 6 years after its termination (limitation period for claims) |
| Handling customer enquiries (helpline, contact form, e-mail) | Article 6(1)(f) GDPR | Name and surname e-mail address telephone number content of the enquiry | Up to 12 months after the end of the correspondence or conversation |
| Preparing an offer and sending commercial information | Article 6(1)(b) GDPR | Name and surname e-mail address telephone number property preferences | Up to 6 months after the last contact |
| Direct marketing (newsletter, commercial offers, telephone contact, presentations, open days, events) | Article 6(1)(a) GDPR Article 6(1)(f) GDPR | Name and surname e-mail address telephone number residential address | Until consent is withdrawn Until an objection is raised |
| Handling customer complaints and claims | Article 6(1)(c) GDPR | Name and surname e-mail address telephone number content of the complaint property details | 6 years after the matter is closed |
| Fulfilment of legal obligations (accounting, taxes, reporting to public institutions) | Article 6(1)(c) GDPR | Name and surname NIP (tax identification number) financial data property information | 5 years from the end of the tax year |
| Securing claims and debt recovery (e.g. in court proceedings) | Article 6(1)(f) GDPR | Name and surname PESEL number residential address property details, payment history | Until the claims become time-barred (maximum 6 years) |
| Video surveillance of development sites | Article 6(1)(f) GDPR | Image (CCTV recording) | Up to 3 months from recording (unless the recording constitutes evidence in proceedings) |
| Identity verification and anti-money laundering (AML) | Article 6(1)(c) GDPR in conjunction with the Act on Counteracting Money Laundering and Terrorist Financing | name and surname, PESEL number, residential address, series and number of identity document, transaction information, information on the source of funds | 5 years after the end of the business relationship (in accordance with the AML Act) |
| Preparing investment analyses and investor reports, and conducting due diligence processes | Article 6(1)(f) GDPR | customer identification data, information on concluded agreements and properties, financial data, transaction history | Until the purpose is achieved, but no longer than 6 years after the end of the legal relationship |
| Conducting recruitment and concluding an employment contract or contract of mandate | Article 6(1)(b) and (c) GDPR, Article 22¹ of the Labour Code | name and surname, contact details, education, professional experience, PESEL number, residential address, bank account number, data from CV and references | 6 months after the end of recruitment (if not employed) or 10 years after the end of employment (archiving obligation) |
| Establishing and performing cooperation with contractors, subcontractors and freelancers (B2B) | Article 6(1)(b) and (f) GDPR | name and surname, contact details, NIP, REGON, bank account number, contract data, identification data of representatives and attorneys-in-fact | For the duration of the agreement and 6 years after its termination (limitation period for claims and tax obligations) |
| Handling reports of irregularities (whistleblowing) | Article 6(1)(c) GDPR in conjunction with whistleblower protection legislation | name and surname (if not anonymous), contact details, content of the report, data of persons named in the report | Up to 5 years after the conclusion of the investigation |
Who are the recipients of your personal data?
Your personal data may be transferred to the following categories of recipients:
- Entities providing accounting, legal and consulting services – on the basis of agreements concluded for the entrustment of personal data processing.
- Banks and notaries – to the extent necessary for real estate transactions.
- Entities providing IT and hosting services – to ensure proper operation of IT systems.
- Public authorities – when required by law.
- Accounting and tax service providers – to ensure financial settlements.
- Law firms – for the purpose of pursuing claims and legal services.
- Courier and postal companies – for the purpose of sending documents.
- Real estate agents and loan advisers – for the purpose of handling the real estate purchase process;
- Other High Capital Group companies and their personnel.
- Our authorised personnel, as well as the authorised personnel of our subcontractors.
Your Personal Data is not transferred to third countries (outside the European Economic Area – EEA).
Personal data is not used for profiling or automated decision-making.
Processing of your data in social media
The Administrator maintains profiles in social media. When you visit these profiles, your personal data is processed to the extent resulting from the functionality and rules of these sites.
Your personal data may be processed for the following purposes:
- communication with users (responding to comments, private messages),
- informing about the Administrator’s activities, offered services and products,
- conducting statistical analysis and optimising content.
Your data may be processed both by the Administrator and by owners of social media platforms, who act as separate data controllers. Detailed information on the principles of processing Personal Data by these services can be found in their privacy policies.
The user may stop following the Administrator’s profile or delete his/her content (e.g. comments) at any time, and may exercise his/her rights in relation to data processing by contacting the administrator of the social network directly.
What rights do you have?
If your data is processed by High Capital Management Sp. z o.o., you have the following rights under the GDPR:
- Right of access to data (Article 15 GDPR) – the ability to obtain information about the data being processed and to receive a copy of the data.
- The right to rectification of data (Article 16 GDPR) – the possibility to correct inaccurate or incomplete data.
- Right to erasure of data (“right to be forgotten”, Article 17 GDPR) – the possibility to request the erasure of data if it is no longer necessary for the purpose of the processing, consent has been withdrawn or the data is being processed unlawfully.
- The right to restriction of processing (Article 18 GDPR) – the ability to request the temporary suspension of data processing in certain cases.
- Right to data portability (Article 20 GDPR) – the ability to receive your data in a structured format and send it to another controller (applies to processing on the basis of consent or contract).
- Right to object to data processing (Article 21 GDPR) – the ability to object to processing based on a legitimate interest of the controller or the use of data for marketing purposes.
- Right to withdraw consent (Article 7(3) GDPR) – where data is processed on the basis of consent, the ability to withdraw consent at any time.
- Right to lodge a complaint with a supervisory authority (Article 77 GDPR) – if you consider that the processing of your data violates the law, you can lodge a complaint with the President of the Office for Personal Data Protection (PUODO), ul. Stawki 2, 00-193 Warsaw, kancelaria@uodo.gov.pl.
Exercise of rights: Requests for the exercise of the above rights can be submitted to the e-mail address: compliance@highcapital.pl. The Administrator will process the request within 1 month, with the possibility of an extension of up to 2 months in special cases.
Is your data subject to profiling?
Your personal data is not used for profiling or automated decision-making.
This privacy policy may be subject to change. The current version will always be available on the Administrator’s website.
Cookies
Cookies are small text files stored on the device of a user browsing the Website. They make it possible to remember the user’s settings and choices and to collect information about the use of the Website.
We store cookies that are essential for the Website to work without consent. Other cookies – functional, analytical and marketing – are stored only after consent has been given in the cookie banner, separately for each category. Consent can be changed or withdrawn at any time in the (the “Cookie settings” link is also in the footer of every page). Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Your choice is remembered for 12 months, after which we will ask for consent again.
We use Google Consent Mode v2. Without consent, Google tools do not store or read cookies; however, they may send Google signals without identifiers (e.g. about a page view), which Google uses to estimate statistics in aggregate form.
Every choice made in the banner is recorded in the consent register: a random consent ID (shown in the cookie settings), the date, the selected categories, the settings version and the page language – without the IP address. The register serves to demonstrate that consent was given (Article 7(1) GDPR).
The following cookies may be stored on the Website:
| Cookie | Provider, purpose | Storage period | Category |
|---|---|---|---|
| hcg_consent | highcapital.pl – remembering your cookie choice | 12 months | Essential |
| vuid, __cf_bm | Vimeo (vimeo.com) – player for videos embedded on the Website; loaded only after clicking on a video | 30 min – 2 years | Functional |
| _ga | Google (Google Analytics 4) – distinguishing visitors for statistical purposes | 2 years | Analytical |
| _ga_* | Google (Google Analytics 4) – maintaining session state for statistical purposes | 2 years | Analytical |
We currently do not use marketing tools. If we enable them, we will update the list above and the banner will ask for consent again.
Cookies can also be deleted and blocked in your browser settings. Detailed information can be found at the following links: