Privacy Policy

1. Data controller

The data controller responsible for your personal data is:

• TAVEXO sp. z o.o. (Polish limited liability company — spółka z ograniczoną odpowiedzialnością)
• Address: Ludomira Różyckiego 1, Warsaw, 02-505, Poland
• Email: Tavexo@op.pl
• Website: https://tavexo-renovations.com

We have not appointed a Data Protection Officer (DPO) as we are not currently required to do so under Article 37 GDPR. For all data protection matters, please contact us at the email address above.

2. Scope of this policy

This policy applies to personal data processed through:

• our Website and any forms on it (contact form, newsletter subscription, call-to-action forms);
• email and other electronic correspondence with us;
• the provision of renovation and related services;
• cookies and similar technologies (see our Cookie Policy).

This policy does not apply to third-party websites linked from our Website. We encourage you to read the privacy policies of any external sites you visit.

3. Categories of personal data we collect

Depending on how you interact with us, we may process the following categories of personal data:

• Identity and contact data — name, email address, postal address, and any contact details you provide in forms or correspondence.
• Project and enquiry data — description of your renovation project, property location, service type selected, messages, photos or documents you voluntarily send us.
• Newsletter data — email address and subscription preferences when you sign up for updates.
• Technical data — IP address, browser type, device information, operating system, referring URLs, pages viewed, and approximate location derived from IP (where collected through server logs or cookies).
• Communication data — records of emails and messages exchanged with our team.
• Contract and billing data — if you become a client, we may process data necessary to perform the contract, issue invoices, and comply with tax and accounting obligations (e.g. company name, tax ID/NIP where applicable, billing address).

We do not intentionally collect special categories of personal data (Article 9 GDPR) such as health data, unless you voluntarily provide such information in project communications and we have a lawful basis to process it. We do not knowingly collect data from children under 16 without parental consent.

4. How we collect personal data

We collect personal data when you:

• fill in and submit forms on our Website;
• send us an email or otherwise contact us;
• subscribe to our newsletter;
• request a quote or enter into a service agreement;
• browse our Website (through cookies and server logs, where applicable);
• visit our office or communicate with us in person or by phone (if you choose to share personal data).

5. Purposes and legal bases for processing

We process your personal data only where we have a valid legal basis under Article 6 GDPR:

6. Recipients of personal data

We may share personal data with the following categories of recipients, only where necessary and subject to appropriate safeguards:

• Hosting and IT providers — companies that host our Website and provide email or technical infrastructure.
• Professional advisers — lawyers, accountants, or auditors where required for legal or financial compliance.
• Subcontractors and trade partners — where relevant to deliver your renovation project (e.g. specialists), under data processing agreements where they act as processors.
• Public authorities — courts, tax offices, UODO, or other bodies when required by law.

We do not sell your personal data. We require processors to handle data only on our documented instructions and in compliance with GDPR Article 28.

7. International data transfers

We primarily process personal data within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards under Chapter V GDPR — such as an European Commission adequacy decision, Standard Contractual Clauses (SCCs), or Binding Corporate Rules — and inform you where required.

8. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

• Enquiry and contact form data — typically up to 24 months after last contact, unless a contract follows.
• Contract and project data — for the duration of the contract and thereafter as required by Polish tax and commercial law (generally up to 5 years after the end of the tax year in which the obligation arose, and up to 6 years for accounting records under the Polish Accounting Act).
• Newsletter data — until you unsubscribe or withdraw consent, plus a short period to process the unsubscribe request.
• Server logs — typically up to 12 months unless needed for security investigations.
• Cookie consent records — as described in our Cookie Policy.

After retention periods expire, data is securely deleted or anonymised.

9. Security measures

We implement appropriate technical and organisational measures under Article 32 GDPR to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction. Measures may include access controls, secure hosting environments, encryption in transit (HTTPS), staff confidentiality obligations, and procedures for incident response.

While we take security seriously, no method of transmission over the Internet is completely secure. We cannot guarantee absolute security but will notify you and the UODO of a personal data breach where required under Articles 33 and 34 GDPR.

10. Your rights under GDPR

As a data subject, you have the following rights, subject to conditions and exceptions in the GDPR:

• Right of access (Art. 15) — obtain confirmation whether we process your data and receive a copy.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion where grounds apply (“right to be forgotten”).
• Right to restriction (Art. 18) — limit processing in certain circumstances.
• Right to data portability (Art. 20) — receive data you provided in a structured, machine-readable format where processing is based on consent or contract and carried out by automated means.
• Right to object (Art. 21) — object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, without affecting prior lawful processing.
• Right not to be subject to automated decision-making (Art. 22) — we do not use automated decision-making or profiling with legal or similarly significant effects.

To exercise your rights, contact us at the email address in Section 1. We will respond within one month, extendable by two further months where necessary under Article 12(3) GDPR. We may request proof of identity to protect your data.

11. Right to lodge a complaint

If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

In Poland, the supervisory authority is:

• Urząd Ochrony Danych Osobowych (UODO) — Personal Data Protection Office
• ul. Stawki 2, 00-193 Warsaw, Poland
• Phone: +48 22 531 03 00
• Website: uodo.gov.pl

We encourage you to contact us first so we can try to resolve your concern directly.

12. Provision of data and consequences

Where personal data is required to enter into or perform a contract, or to respond to your enquiry, failure to provide it may prevent us from providing estimates, services, or newsletter communications. Mandatory fields on forms are marked accordingly. Other fields are voluntary but help us serve you better.

13. Direct marketing

We may send marketing emails only where you have given consent or where permitted under applicable law (including the Polish Act on Provision of Electronic Services and implementation of the ePrivacy rules). Each marketing email includes a simple way to unsubscribe. You may also object to direct marketing at any time by contacting Tavexo@op.pl.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page with an updated “Last updated” date. Where changes materially affect your rights, we will provide additional notice where appropriate.

15. Contact

For questions about this Privacy Policy or to exercise your rights, contact:

TAVEXO sp. z o.o.
Ludomira Różyckiego 1, Warsaw, 02-505, Poland
Email: Tavexo@op.pl