This privacy policy was last updated on 2026-10-04. It describes how we process the personal data of persons using the website tm-invest.com.pl (hereinafter: the “Website”) and of persons who contact us via the Website, by telephone, by e-mail or via messaging apps. The policy fulfils the information obligation arising from Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: the “GDPR”).
§1. Data controller
The controller of your personal data is AI BRESLAU Sp. z o.o., with its registered office in Warsaw, ul. Cybernetyki 9, 02-677 Warszawa, operating under the TM Invest brand (hereinafter: the “Controller” or “we”).
- KRS: 0001001487
- NIP: 8971914184
- REGON: 523636612
§2. Data protection contact
In all matters relating to the processing of personal data, including in order to exercise your rights, you can contact us:
- by e-mail: info@tm-invest.com.pl;
- by telephone: +48 573 568 888;
- in writing: AI BRESLAU Sp. z o.o., ul. Cybernetyki 9, 02-677 Warszawa.
The Controller has not appointed a Data Protection Officer. In all matters concerning personal data, please contact the Controller directly — preferably by e-mail at info@tm-invest.com.pl.
§3. What data we process and where we obtain it
We process only the data that you provide to us yourself and technical data relating to the use of the Website:
- Contact forms on the Website (including “Ask about an apartment”, “Contact us” and the “Send” form on a listing or development page): first name (and surname, if provided), telephone number, e-mail address and message content. Together with the enquiry, we record the address of the page from which it was sent (e.g. the listing or development you are asking about), the name of the form and the date of the enquiry.
- User account (if you create one): first name, e-mail address, password (stored only in encrypted form) and, when signing in with Google, also the Google account identifier and information that Google has verified the e-mail address; favourite listings, saved searches (selected filters, e.g. location, number of rooms, budget), notification settings, the date of acceptance of the Terms of Use and the Privacy Policy, and the history of your consent to be contacted about offers (the date on which it was given or withdrawn).
- Contact by telephone, e-mail and via messaging apps (WhatsApp, Telegram and other channels through which you write to us): telephone number, messaging app profile name, e-mail address, the content of the correspondence and information provided in its course (e.g. city, type of property sought, budget). Telephone calls may be recorded, and some calls may be initially handled by a voice assistant based on artificial intelligence — we inform you of this at the beginning of the call.
- Technical data: IP address, information about the browser and device, cookies and similar technologies — to the extent described in §11 and in the Cookie Policy.
§4. Purposes, legal bases and retention periods
The table below shows for what purposes we use your data, on what legal basis and how long we keep it. Details of retention periods are set out in §9.
| Purpose of processing | Legal basis | How long we keep the data |
|---|---|---|
| Responding to an enquiry and presenting an offer — selecting an apartment, information about a development, getting back to you (telephone, e-mail, messaging app), arranging a consultation | Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); where the enquiry is not aimed at concluding a contract — Art. 6(1)(f) GDPR (legitimate interest: handling enquiries addressed to us) | up to 3 years from the last contact with you or until an effective objection is lodged |
| Concluding and performing a contract for the provision of services (e.g. assistance with purchasing an apartment, assistance in obtaining a mortgage loan) | Art. 6(1)(b) GDPR | for the term of the contract and thereafter until the limitation period for claims expires |
| Disclosure of data to a developer in connection with the development you have chosen (e.g. reservation of a unit, a viewing, preparation of a reservation agreement (umowa rezerwacyjna) or developer agreement (umowa deweloperska)) | Art. 6(1)(b) GDPR — solely at your request and to the extent necessary to prepare the transaction | data disclosed to the developer are stored by the developer as a separate controller, in accordance with its own privacy policy; by us — as in the row “Responding to an enquiry” |
| Disclosure of data to a bank or credit intermediary in order to submit a loan application or obtain a loan offer | Art. 6(1)(a) GDPR (your consent to the disclosure of data to the bank or intermediary indicated), and within the framework of a contract concluded with us for assistance in obtaining a loan — Art. 6(1)(b) GDPR | by the recipient — in accordance with its privacy policy (separate controller); by us — as above or until consent is withdrawn |
| Maintaining a customer database (CRM), documenting contacts, organising information about the enquiry and ensuring quality of service | Art. 6(1)(f) GDPR (legitimate interest of the Controller) | up to 3 years from the last contact with you or until an effective objection is lodged |
| Direct marketing of our own services (e.g. presenting further offers in the course of an ongoing conversation). Commercial information by electronic means (e-mail, SMS, messaging apps) and marketing telephone calls — only after obtaining the consent required by the Electronic Communications Law of 12 July 2024 (ustawa z dnia 12 lipca 2024 r. — Prawo komunikacji elektronicznej) | Art. 6(1)(f) GDPR; with regard to electronic communication — consent (Art. 6(1)(a) GDPR) | until an objection is lodged or consent is withdrawn, but no longer than 3 years from the last contact |
| Operation of the user account — signing in (including with Google), saving favourite listings and searches, account-related messages (e-mail address confirmation, password change, account deletion) | Art. 6(1)(b) GDPR | until the account is deleted |
| E-mail notifications about new apartments and price reductions for saved searches — sent at your request, no more than once a day; they can be switched off at any time using the link in the message or in “My account” | Art. 6(1)(b) GDPR | until the notifications are switched off or the search or account is deleted |
| Contact regarding offers (telephone, e-mail) after you tick the consent box at registration or in “My account” — for this purpose we transfer to the CRM system your first name, e-mail address, and the favourite listings and saved searches from your account | consent — Art. 6(1)(a) GDPR (and the Electronic Communications Law of 12 July 2024) | until consent is withdrawn, but no longer than 3 years from the last contact |
| Security of the Website and protection of forms against spam (including Google reCAPTCHA) | Art. 6(1)(f) GDPR | for the period necessary to ensure security; for cookies — in accordance with the Cookie Policy |
| Cookies and tools that are not necessary for the operation of the Website | Art. 6(1)(a) GDPR (consent given in the cookie banner, which can be changed or withdrawn using the “Cookie settings” button in the Website footer) | until consent is withdrawn, but no longer than the periods specified in the Cookie Policy |
| Establishment, exercise or defence of legal claims | Art. 6(1)(f) GDPR | until the limitation period for claims expires |
| Compliance with legal obligations (e.g. accounting and tax obligations and, in cases provided for by law, obligations arising from the legislation on anti-money laundering and counter-terrorist financing) | Art. 6(1)(c) GDPR | for the periods required by law (e.g. accounting documents — 5 years from the end of the calendar year in which the tax payment deadline expired) |
§5. Voluntary provision of data
Providing data is voluntary. However, without the data marked as required in the form (first name, telephone number, e-mail), we will not be able to respond to your enquiry. Whether you provide data via messaging apps and during a conversation is entirely up to you.
§6. Automation and artificial intelligence tools
To handle enquiries, we use automation tools, including an assistant based on artificial intelligence which helps prepare replies to messages (e-mail, messaging apps), organise information about the enquiry in the CRM system and — in the case of telephone calls — may conduct an initial conversation. For this purpose, the content of your messages may be transferred to the AI service provider (see §7 and §8). We do not make decisions concerning you based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). You may ask to be contacted by a member of our staff at any time.
On the basis of the information you provide to us (e.g. city, district, number of rooms, budget, method of financing), we organise enquiries in the CRM system and match offers to them. To that extent, this may constitute profiling within the meaning of Art. 4(4) GDPR. We do this on the basis of our legitimate interest (Art. 6(1)(f) GDPR) — in order to present you with relevant proposals; you have the right to object to such processing (§10).
§7. Recipients of data
We do not sell your data. Data may be transferred to entities which process them on our behalf (processors) under data processing agreements, solely to the extent necessary to provide the services:
- hosting of the Website and e-mail — home.pl S.A. (Poland);
- CRM system provider (Bitrix24), in which we record enquiries and contact history;
- providers of server infrastructure and process automation tools (transferring enquiries between systems), using servers located in the European Union;
- artificial intelligence service providers (language models supporting the preparation of replies and the organisation of information about the enquiry);
- communication service providers — including WhatsApp Business (Meta Platforms Ireland Limited), Telegram (if you contact us via Telegram), an internet telephony operator and a voice assistant technology provider;
- services embedded on the Website — Google Ireland Limited (reCAPTCHA, Google Fonts, display of Google reviews), Mapbox (maps);
- signing in with Google — Google Ireland Limited (Google Sign-In), only if you choose the “Continue with Google” button; we receive your first name, e-mail address and account identifier from Google, and we do not receive your password;
- providers of accounting, legal and IT services, and public authorities — where required by law.
In addition — solely in connection with your enquiry and at your request — we transfer data to entities which process them as separate controllers, under their own privacy policies:
- developers — when you decide on a specific development or unit: in order to introduce you as an interested client, reserve the unit, arrange a viewing and prepare a reservation agreement or developer agreement. We transfer only the data needed for this purpose (usually first name and surname, telephone number, e-mail and information about the selected unit). Legal basis: Art. 6(1)(b) GDPR;
- banks and credit intermediaries — when you wish to take out a mortgage loan: in order to prepare and submit a loan application or obtain a loan offer. We transfer the data needed to assess the application, including information about your income and financial situation that you provide to us for this purpose. Legal basis: your consent (Art. 6(1)(a) GDPR) and, where you have concluded a contract with us for assistance in obtaining a loan, Art. 6(1)(b) GDPR.
We do not transfer your data to developers or banks without your knowledge and explicit request.
§8. Transfer of data outside the European Economic Area
Some of our providers (e.g. providers of artificial intelligence services, Google services, maps and messaging apps) may process data outside the European Economic Area, in particular in the United States. In such a case, the transfer takes place on the basis of a decision of the European Commission finding an adequate level of protection (e.g. the EU–US Data Privacy Framework — in respect of certified entities) or of standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). A copy of the safeguards applied can be obtained by contacting us (§2).
§9. Data retention period
- Data from enquiries and correspondence — for the time necessary to handle the enquiry and thereafter for up to 3 years from the last contact with you or until an effective objection is lodged.
- Data of clients with whom a contract has been concluded — for the term of the contract and, after its termination, until the expiry of the limitation period for claims and of the retention periods required by law (e.g. accounting and tax legislation — 5 years from the end of the calendar year in which the tax payment deadline expired).
- Data processed on the basis of consent — until consent is withdrawn.
- User account data — until the account is deleted. You can delete your account yourself at any time: “My account” → “Delete account”. We then delete the account, favourite listings and saved searches. Consent to be contacted about offers can be withdrawn in “My account” (by unticking the consent) or by writing to info@tm-invest.com.pl — withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
- Cookies — for the periods specified in the Cookie Policy.
- Recordings of telephone calls — 12 months from the date of the call and, if handling of the enquiry takes longer, until it is completed, but no longer than 24 months from the date of the call.
§10. Your rights
In connection with the processing of personal data, you have:
- the right of access to your data and to obtain a copy of them (Art. 15 GDPR);
- the right to rectification of data (Art. 16 GDPR);
- the right to erasure of data (Art. 17 GDPR);
- the right to restriction of processing (Art. 18 GDPR);
- the right to data portability (Art. 20 GDPR) — with regard to data processed on the basis of consent or a contract, by automated means;
- the right to object to processing based on legitimate interest (Art. 21 GDPR) and, in the case of processing for direct marketing purposes, at any time and without giving reasons;
- the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR);
- the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO; ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) if you consider that the processing infringes the GDPR.
To exercise your rights, please contact us as indicated in §2. We respond without undue delay, and in any event within one month of receipt of the request.
§11. Cookies and third-party services on the Website
The Website uses cookies and similar technologies. We use cookies necessary for the operation of the Website without consent; all others only after you have given consent in the cookie banner. After you sign in, the Website stores the necessary login session cookies; without them, it is not possible to use the account. A detailed list of cookies, their purposes and retention periods can be found in the Cookie Policy. Consent settings can be changed at any time using the “Cookie settings” button in the Website footer.
The Website embeds services of third parties which, when the page is displayed, may receive your IP address and information about your browser:
- Google reCAPTCHA — protection of forms against spam and abuse;
- Google Fonts — fonts downloaded from Google servers;
- Mapbox — interactive maps showing the locations of developments and listings;
- Google reviews — display of customer reviews from the company’s Google profile;
- WhatsApp and Telegram — the contact buttons on the Website redirect to these messaging apps; once you click them, data are also processed by the messaging app provider in accordance with its own privacy policy.
Google tools (analytics and advertising). With your consent (cookie banner, “Analytics” and “Marketing” categories), we use services of Google Ireland Limited: Google Analytics 4 (visit statistics), Google Tag Manager (script management) and Google Ads (measurement of advertising effectiveness, conversions, remarketing — displaying ads to people who have visited our Website). With the “Marketing” category, we also store our own cookie tm_attr (for up to 90 days) containing information about the campaign or site from which you came to the Website (including the Google Ads click identifier, UTM parameters and landing page); this information is attached to the submitted form and recorded in our CRM system so that we can assess the effectiveness of our advertising. Without consent, we store these data only in the browser tab’s memory until the tab is closed.
After a form has been submitted, with your marketing consent, we may transfer to Google your e-mail address and telephone number in hashed form (using the SHA-256 hash function) for the purpose of conversion matching (so-called enhanced conversions); Google does not receive these data in plain text. Without consent, Google tools operate in a restricted mode (Consent Mode): they do not store cookies and send only anonymised signals without identifiers. Legal basis: consent (Art. 6(1)(a) GDPR) — it can be withdrawn at any time in the cookie settings. Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework. More information: How Google uses data from partner sites. A detailed list of cookies can be found in the Cookie Policy.
§12. Data security
We apply technical and organisational measures appropriate to the risk, including an encrypted connection (HTTPS), restriction of access to data to authorised persons only, and data processing agreements with service providers.
§13. Links to other websites
The Website contains links to the websites of other entities (e.g. developers, banks, social networks and messaging apps). We are not responsible for the privacy practices applied on those websites — we encourage you to read their privacy policies.
§14. Changes to this privacy policy
This policy may be updated, in particular in the event of changes in legislation, in the services available on the Website or in the tools used. The current version is always available on this page together with the date of the last update.
Last updated: 4 October 2026