Privacy policy
How AmberNest uses the data of people who get in touch about renting: flat owners and prospective tenants.
Who controls your data
The controller is Kamil Kamiński, who provides rental management under the AmberNest brand. Phone +48 509 375 274, email: kontakt@ambernest.pl. I have not appointed a data protection officer. For any matter concerning your data you can write to me or call me directly.
The website
The website uses no cookies or analytics tools and does not track visitors. Fonts and scripts are served from the website’s own server. If you turn on the readability settings (larger text, contrast), the website remembers them only in your browser (local storage); they are not sent anywhere and you can remove them by clearing your browser data. The hosting company Cloudflare, Inc. (Cloudflare Workers) may record IP addresses and browser information in server logs to keep the site running and secure.
Forms: free valuation and call-back request
The forms on this website do not send data to a server and store nothing. When you click the button, your browser opens WhatsApp or your text messaging app with a ready message, which you send yourself from your own phone. The message may contain your name, phone number, email address, location, number of rooms, size, availability date of the flat and anything you type.
| Purpose | Legal basis | How long |
|---|---|---|
| preparing a rental valuation, calling you back and contacting you about it | Art. 6(1)(b) GDPR – steps taken at your request before entering into a contract | until the conversation ends; if we do not work together, no longer than 12 months, after which I delete the message |
WhatsApp messages pass through WhatsApp Ireland Limited under that service’s terms; text messages through your and my mobile operators.
Phone and email contact
When you call, text or email me, I process the data you provide: your name, phone number, email address and the content of your message.
| Purpose | Legal basis | How long |
|---|---|---|
| answering your question and preparing an offer | Art. 6(1)(b) GDPR – steps before entering into a contract, or Art. 6(1)(f) – legitimate interest in answering your question | until the conversation ends, then no longer than 12 months |
Flat owners
When we work together I process the data needed for the rental management agreement: name, address, PESEL number (Polish ID number), contact details, bank account number, details of the flat and settlement information.
| Purpose | Legal basis | How long |
|---|---|---|
| concluding and performing the rental management agreement | Art. 6(1)(b) GDPR | for the term of the agreement |
| settlements and tax obligations | Art. 6(1)(c) GDPR | 5 years from the end of the tax year |
| establishing or defending legal claims | Art. 6(1)(f) GDPR | until the limitation periods expire |
Prospective tenants
When you ask about a flat from the listings, I process the data needed to choose a tenant: your name, contact details, number of occupants, information about pets, the planned start date and length of the lease and the general source of your income. I may ask to see detailed documents, such as proof of income, only after a viewing and only if you apply.
| Purpose | Legal basis | How long |
|---|---|---|
| arranging a viewing and assessing your application | Art. 6(1)(b) GDPR – steps at your request before entering into a lease | until a tenant is chosen; if you are not chosen, no longer than 30 days afterwards |
| preparing and administering the lease if you become the tenant | Art. 6(1)(b) and (f) GDPR | for the term of the lease and until the limitation periods expire |
I share a candidate’s data with the flat owner to the extent needed to choose a tenant. The owner then becomes a separate controller of that data.
Who receives your data
- flat owners, regarding the letting of their flat,
- my email provider (Google Ireland Limited, Gmail), the email forwarding service of Cloudflare, Inc. (addresses at ambernest.pl) and the website host Cloudflare, Inc. (Cloudflare Workers), which process data on my behalf,
- my accounting office, for settlements,
- public authorities, where the law requires it.
Google and Cloudflare may process data outside the European Economic Area. This is based on the European Commission’s decision on the EU–US Data Privacy Framework or on standard contractual clauses.
Your rights
- access to your data and a copy of it,
- rectification of your data,
- erasure of your data or restriction of its processing,
- objection to processing based on legitimate interest,
- portability of data I process under a contract,
- a complaint to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
Providing your data is voluntary, but without it I cannot arrange a viewing or prepare an agreement. I do not make automated decisions and I do not profile.