1. General Provisions
   1. We respect the privacy of every individual visiting the website of SCL POLAND – Society of Construction Law Poland and ensure the security of data at all times while using any of our websites. This document sets out the principles for the collection, processing, and use of personal data, as well as information regarding the cookies and other similar technologies used on the website.
   2. This Privacy Policy describes matters related to the protection of personal data within the meaning of Article 4(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, p. 1) (hereinafter referred to as the “GDPR”).
   3. Personal data refers to information about an identified or identifiable natural person, which may be identified directly or indirectly by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity, including name, phone number, email address, device IP, location data, online identifiers, or information collected through cookies and similar technologies related to the use of the SCL POLAND – Society of Construction Law Poland website.
   4. The Association’s activities are subject to the provisions of law applicable to the protection of personal data, in particular the GDPR and the Polish Personal Data Protection Act of 10 May 2018 (consolidated text: Journal of Laws of 2019, item 1781).
2. Data Controller
   1. Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, we inform you that the controller of your personal data is the Society of Construction Law Poland, with its registered office in Wrocław (50-106), ul. Rynek 7, entered into the National Court Register – Register of Associations – maintained by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register under KRS number 0001153917, NIP 8971949082 (hereinafter referred to as the “Controller”).
   2. For any questions or concerns regarding the methods and principles of processing personal data, or to exercise your rights, please contact the Controller at [email protected] or in writing at the address: Society of Construction Law Poland, ul. Rynek 7, 50-106 Wrocław, Poland.
   3. The Controller has not appointed a Data Protection Officer, as its core activities do not consist of processing operations that, by virtue of their nature, scope, or purposes, require regular and systematic monitoring of data subjects on a large scale, nor does it involve large-scale processing of special categories of personal data.
3. Personal Data
   1. The personal data processed by the Controller primarily includes your name, email address, telephone number, and information provided by your browser or device used to connect to the Controller’s website, such as IP address, browser type, and operating system.
   2. Your personal data may be obtained directly from you through membership applications, agreements with the Controller, visits to the Association’s office, participation in conferences, training sessions, and other events, through forms on the website, by phone, in writing, by email, or from publicly available sources (such as CRIDG or KRS).
   3. The Controller processes the data of its members as well as individuals who use or may potentially use the Controller’s services.
4. Purpose, Legal Basis, and Period of Data Processing
   1. Your personal data will be processed for the following purposes:
      • Contact purposes – based on the Controller’s legitimate interest (Article 6(1)(f) GDPR), to respond to an inquiry submitted through the contact form or to perform a service – until contact is completed, unless another legal basis applies.
      • Marketing purposes – based on your consent to receive marketing information electronically or by phone (Article 6(1)(a) GDPR) – until you withdraw your consent or object to the processing of your data for marketing purposes.
      • Analytical and statistical purposes – until you object.
      • Compliance with GDPR obligations – such as responding to data subject rights, reporting data breaches, and conducting data protection impact assessments – for the period required by law.
      • Membership management – including maintaining membership records and servicing statutory bodies, based on performance of obligations under the Association’s Statute (Article 6(1)(b) GDPR) and on member consent (Article 6(1)(a) GDPR) – during the membership period and thereafter until potential claims expire.
      • Contractual purposes – related to entering into and performing contracts, handling offers, and ensuring proper execution of agreements, based on necessity for contract performance (Article 6(1)(b) GDPR) and legitimate interest (Article 6(1)(f) GDPR) – during the contract term and thereafter until potential claims expire.
      • Legal and registry obligations – in connection with compliance with legal duties towards courts or public authorities (Article 6(1)(c) GDPR) – for the period required by law.
      • Cooperation with experts – for preparing legal opinions, based on legitimate interest (Article 6(1)(f) GDPR), to ensure reliable execution of statutory activities and research projects – for the duration of the assignment and potential further cooperation or settlements.
      • Research and publication purposes – for conducting studies, working groups, and publishing results in the field of construction law and technology, based on tasks carried out in the public interest (Article 6(1)(e) GDPR) – for the period required by law.
      • International cooperation – for maintaining relations with national and international organizations of similar profile, based on legitimate interest (Article 6(1)(f) GDPR) – to build a network of cooperation and knowledge exchange.
      • Statutory and educational purposes – for promoting education, research, and best practices in construction law and the investment process, based on tasks carried out in the public interest (Article 6(1)(e) GDPR) – for the period required by law.
   2. Providing personal data for the purpose of membership is voluntary but necessary for processing the membership application and exercising rights and obligations under the Association’s Statute. Failure to provide data will prevent membership consideration. Providing data for other purposes (unless required by law) is voluntary.
5. Data Recipients
   1. Your personal data may be transferred to entities processing data on behalf of the Controller, such as IT service providers, archiving companies, hosting providers, and email delivery services – based on agreements and only in accordance with the Controller’s instructions.
   2. Data may also be disclosed to public authorities or other entities entitled by law, in particular courts, supervisory, administrative, or registry authorities.
   3. All data transfers are carried out with due diligence and appropriate technical and organizational safeguards.
6. Security Measures
   1. The Controller has implemented appropriate technical and organizational measures compliant with legal requirements to ensure the protection of processed personal data.
   2. All data obtained through the SCL POLAND – Society of Construction Law Poland website are processed in accordance with national legislation and Regulation (EU) 2016/679 (GDPR).
7. Rights of Data Subjects
   1. The controller informs you that you have the right to:
      • withdraw your consent to the processing of your data (to the extent that the processing of your personal data is based on your consent); withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal; consent may be withdrawn at any time (Article 7(3) of the GDPR);
      • access your personal data (Article 15 of the GDPR);
      • request the rectification of data (Article 16 of the GDPR);
      • erasure of personal data, i.e. “the right to be forgotten” (Article 17 of the GDPR);
      • restriction of the processing of personal data (Article 18 of the GDPR);
      • transfer of personal data, i.e. to receive personal data in a structured, commonly used, machine-readable format (Article 20 of the GDPR);
      • object to the processing of personal data (to the extent that the basis for the processing of your personal data is a legitimate interest) (Article 21 of the GDPR).
      • lodge a complaint with a supervisory authority responsible for personal data protection, i.e. the President of the Personal Data Protection Office (https://uodo.gov.pl/pl).
8. Transfer of data to third countries, profiling, automated processing
   1. With the help of entities supporting its activities in the field of promotional, marketing, and analytical services, the Administrator may transfer selected personal data to other third countries, i.e., countries outside the European Economic Area. However, this applies only to third countries or entities for which the European Commission has determined that they provide an adequate level of data protection.
   2. The Administrator does not intend to profile or automatically process your personal data, including your name, email address, telephone number, or other contact details.
   3. However, the Administrator may use cookies stored on your devices for analytical and statistical purposes, in accordance with the information below, as well as Google Analytics, Facebook Pixel, and others.
9. Information about cookies
   1. The Administrator's website uses cookies. These are small pieces of information that are stored on the User's end device (e.g., laptop, phone) when browsing the Administrator's websites. The Administrator's websites may also use other tools with functions similar to cookies (e.g., pixels, beacons, tags).
   2. The Administrator may use cookies stored on your devices for analytical and statistical purposes. Types of cookies used:
      • Necessary cookies, which enable, among other things, the correct display and functioning of the website and ensure the security of its use.
      • Optional cookies (Marketing, Measurement, Other), which enable, among other things, the personalization of advertisements, the provision of content tailored to the User's preferences on the website and on other websites, the integration of content, the analysis of website traffic, the creation of measurements and statistics, and the development and improvement of services based on User interactions. The User may consent to the use of optional cookies.
   3. Cookies used on the website are divided into:
      • persistent cookies – stored on the end device until the User deletes them or until the time specified in the parameters of a given cookie expires;
      • session (temporary) cookies – stored on the end device until the software is turned off or the browser session ends (until it is closed).
   4. Depending on who uses cookies, there are:
      • own cookies – these are cookies that are placed by the Administrator and to which only the Administrator has access;
      • cookies from external providers (such as Google Ireland Ltd, Consentmanager AB, LiveChat, Inc., Meta Platforms Ireland Limited)
   5. Users can manage their cookie preferences directly in the settings of their own end device. Users can withdraw their consent using the “Data protection settings” widget.
   6. In addition, Users can, in particular, allow all cookies, disable the installation of cookies, delete cookies, or block cookies via their web browser. Disabling, deleting, or blocking cookies may adversely affect the quality of use of the website.
10. Server logs
    1. Information about certain activities and behaviors of Users is logged at the server level. This data is used solely for the purpose of administering the portal.
    2. The resources viewed are identified by their URL addresses. In addition, the following may be recorded:
       • the time of the request;
       • the URL of the page previously visited by the user (referrer link) – if the user accessed the portal via a link;
       • information about the user's browser;
       • information about the IP address.
    3. The above data is used solely for the purposes of server administration.
11. Rules for changes and updates

In accordance with our needs and applicable privacy rules, we may change, supplement, and adapt the Privacy Policy at any time. We will inform you of any changes by posting relevant information on our websites, and in the case of significant changes, we may also send separate notifications to the email address provided.