General provisions
This document has two parts:
- Part I — rules for processing personal data
- Part II — cookie policy
This Privacy Policy describes how MAXON Nieruchomości protects and processes the personal data of users of the MAXON.pl website. Data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and with Polish data protection law.
Data controller
MAXON Nieruchomości sp. z o.o.
Registered office
ul. Skierniewicka 10a
01-249 Warszawa
MAXON is responsible for using your data safely and in line with applicable law. We have appointed a Data Protection Officer, whom you may contact on any matter relating to the processing of your personal data and the exercise of your rights.
Send written correspondence to our registered office marked "Data Protection Officer".
The detailed rules for processing your data may differ depending on the stage and nature of your relationship with MAXON. Below we describe the situation of each group of individuals whose data we process.
Categories of individuals whose data we process
3.1. People we contact to propose working together
Purposes of processing:
- presenting our services under Article 6(1)(f) GDPR (the controller's legitimate interest) — we process your data only for the duration of the conversation.
Who we share your data with:
- entities that support our IT and telecommunications systems or supply us with IT tools;
- entities providing legal assistance;
- entities providing postal or courier services (for correspondence).
Source of the data: we obtained your data (first name, surname, phone number, email address) from the portal on which you posted a listing for your property.
3.2. People interested in working with MAXON
Purposes of processing:
- presenting our services in response to your enquiry (Article 6(1)(b) GDPR) — until a contract is concluded or you tell us you are not interested;
- pursuing the legitimate interests of the controller (Article 6(1)(f) GDPR):
- direct marketing and promotion of services — including by email and telephone, if you consent — until you lodge a justified objection or withdraw consent;
- establishing, pursuing or defending against claims — until any claims become time-barred (for example claims arising from an agency agreement not being concluded);
- identifying and verifying the client and the beneficial owner (Article 6(1)(c) GDPR) — under the Polish Act of 1 March 2018 on counteracting money laundering and terrorist financing.
Who we share your data with:
- entities that support our IT and telecommunications systems;
- entities providing legal assistance;
- entities providing postal or courier services.
Is providing data mandatory? Providing personal data is voluntary, but without it we cannot present you with an offer. Taking steps towards concluding an agency agreement requires the data required by statute (the AML act).
3.3. People who have signed an agency agreement with MAXON (their representatives, attorneys and contact persons)
Purposes of processing:
- performing the agency agreement, including carrying out the property transaction (Article 6(1)(b) GDPR for a party to the agreement, or Article 6(1)(f) GDPR for representatives and contact persons) — for the term of the agreement;
- applying financial security measures (identifying and verifying the client and the beneficial owner) — under Article 6(1)(c) GDPR and the AML act — for the period required by law (Article 49 of that act);
- pursuing MAXON's legitimate interest (Article 6(1)(f) GDPR):
- direct marketing — until the date you object or withdraw consent;
- establishing, pursuing or defending against claims — until they become time-barred and, if proceedings are under way, for their duration;
- matching the parties to a transaction and reducing risk and safeguarding the planned transaction — for the term of the agreement.
Additionally:
- if you are interested in buying a property — we may process your data on the basis of your consent (Article 6(1)(a) GDPR) in order to share it with mortgage brokers or advisers, with Platforma Mieszkaniowa S.A. or with Moovin Sp. z o.o. — until you withdraw your consent;
- if you are interested in renting a property — we may process your data on the basis of your consent in order to share it with providers of tenant verification and rental insurance services, namely Simpl Sp. z o.o. and PZU S.A., as part of the "Landlord Package" — until you withdraw your consent.
Who we share your data with:
- the counterparties to the transaction (the seller or buyer of the property) and, in justified cases, estate agencies cooperating on that transaction;
- property agents cooperating with MAXON;
- the notary handling the transaction or other parties directly involved in the process;
- providers of accounting, audit, legal, tax or bookkeeping services;
- entities that support our IT systems;
- entities providing postal or courier services;
- in justified cases: to Biuro Informacji Gospodarczej InfoMonitor S.A. (under the Polish Act of 9 April 2010 on the disclosure of business information);
- developers when looking for buyers (in the case of a purchase);
- Platforma Mieszkaniowa S.A. / Moovin Sp. z o.o. — where consent has been given;
- Simpl Sp. z o.o. / PZU S.A. — in the case of the "Landlord Package".
Is providing data mandatory? Yes, to the extent required by the AML act and necessary to perform the agreement. Without it we cannot conclude an agreement or provide services.
If you are a client's representative or a person designated to perform the agreement: we obtain your data (first name, surname, phone, email) from the MAXON client. For agreements signed electronically with a qualified signature (mObywatel / mSzafir) we also obtain: middle name, PESEL number, citizenship, home address, and the type, number and issue date of your identity document.
3.4. People looking for a property (interest forms, viewing records)
Purposes of processing:
- Article 6(1)(f) GDPR — MAXON's legitimate interests:
- meeting your expectations (presenting offers) — until the date you object;
- enabling us and developers to meet our obligations — until you object;
- matching the parties to a transaction and reducing risk — until you object;
- establishing, pursuing or defending against claims — until they are time-barred or for the duration of proceedings;
- direct marketing — until you object or withdraw consent;
- Article 6(1)(a) GDPR — based on your consent:
- sharing data with Platforma Mieszkaniowa S.A. (and cooperating developers) — in order to present primary-market offers — until you withdraw consent;
- sharing data with mortgage advisers — until you withdraw consent.
Who we share your data with:
- the counterparties to the transaction (the selling party) and cooperating estate agencies;
- developers when looking for buyers;
- the notary handling the transaction;
- providers of accounting, audit, legal, tax or bookkeeping services;
- entities that support our IT systems;
- entities providing postal or courier services;
- mortgage advisers — where consent has been given;
- Platforma Mieszkaniowa S.A. — where consent has been given.
Is providing data mandatory? It is voluntary, but without it we cannot present offers or arrange viewings.
3.5. People contacting MAXON by phone, through forms or via a listings portal
Your personal data is processed in order to answer your enquiry, which is our legitimate interest (Article 6(1)(f) GDPR). We will process it for as long as needed to deal with your matter (no longer than 30 days) or until you raise a justified objection.
Who we share the data with: providers of services or IT solutions for MAXON, property agents cooperating with MAXON, and legal service providers — depending on the subject of the enquiry.
Source of the data: for people who contact us through a listings portal, we process the data given in the contact form (first name, surname, phone, email); the source is the portal to which you sent the enquiry.
Is providing data mandatory? It is voluntary, but without it we cannot answer your question.
Exercising your rights under the GDPR
Purposes of processing:
- giving effect to your right under the GDPR and answering your request (Article 6(1)(c) GDPR — legal obligation);
- pursuing MAXON's legitimate interest in establishing, pursuing or defending against claims (Article 6(1)(f) GDPR).
Who we share your data with:
- entities that support our IT systems;
- entities providing postal or courier services;
- providers of advisory, audit and legal services;
- public authorities entitled to request access to the data under applicable law.
Retention period: for as long as needed to answer the request and, thereafter, until any claims connected with it become time-barred.
Is providing data mandatory? Yes, it is a statutory requirement. Without it we cannot act on your request.
Candidates taking part in recruitment
Purposes of processing:
- running the recruitment process to the extent required by law (Article 221 § 1 of the Polish Labour Code in the case of an employment contract) — Article 6(1)(c) GDPR;
- taking the steps needed to conclude an employment or cooperation contract — Article 6(1)(b) GDPR;
- pursuing MAXON's legitimate interest (establishing, pursuing or defending against claims) — Article 6(1)(f) GDPR;
- where you provide data beyond what the law requires — on the basis of your consent (Article 6(1)(a) GDPR).
Who we share your data with:
- HR service providers and recruitment agencies;
- entities that support our IT systems;
- entities providing postal or courier services;
- providers of advisory and legal services;
- occupational health clinics carrying out medical examinations (in the case of an employment contract).
Retention period: for the duration of the recruitment process (no longer than 3 months). If we learn that claims may arise — until they become time-barred.
Is providing data mandatory? Data required by law is mandatory; anything beyond it is voluntary. If the statutory data is not provided, the application will be rejected.
Your rights — general information
Under the GDPR you have the following rights in relation to the processing of your personal data:
Right of access
You can obtain information about how your data is processed and a copy of that data.
Rectification
Correction and updating of data that is inaccurate or incomplete.
Erasure of data
The "right to be forgotten" in specific situations.
Data portability
Where processing is based on consent or a contract and is carried out by automated means.
Restriction of processing
Suspension of certain operations until accuracy is verified or a dispute is resolved.
Objection
Against processing based on legitimate interest or carried out for direct marketing.
If your data is processed on the basis of consent, you also have the right to withdraw that consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
Exercising your rights: to exercise the above rights, contact MAXON or the Data Protection Officer: inspektor@maxon.pl. We may ask for additional information to authenticate you.
Right to lodge a complaint
Regardless of the above, you have the right to lodge a complaint with the President of the Polish Personal Data Protection Office if you believe your data is being processed unlawfully. We would, however, ask you to contact us first so that we can try to resolve the matter amicably.
Automated decision-making
MAXON does not use automated decision-making or profiling.
Will your data leave the European Economic Area (EEA)?
At present we do not transfer, and do not plan to transfer, your data outside the EEA (the European Union, Norway, Liechtenstein and Iceland).
Cookie policy
We are glad you are visiting our site. We want you to feel comfortable here, which is why we have prepared this cookie policy. It explains, among other things:
- What are cookies?
- Which cookies do we use and why?
- How do they affect your privacy?
- What rights you have under the GDPR and electronic communications law.
What are cookies?
Cookies are small text files stored on your computer or phone while you view our site. We divide them into two groups:
- Necessary for using the site — stability, remembering your privacy preferences, forms. We use them by default (Article 173(3) of the Polish Telecommunications Act).
- All others — we use them only if you give your consent.
Which cookies do we use?
Necessary cookies
They keep the site and its core functions working. Without them you cannot use our online services properly. They are exempt from the consent requirement (Article 173(3) of the Polish Telecommunications Act).
| Name | Purpose | Retention period |
|---|---|---|
| Cookiebot | Stores the user's cookie consent state for the current domain. | 13196 days |
| Criteo | Detects whether the visitor has opted out of any cookies, trackers or other targeting tools. | session |
| Pending | 1 day | |
| ID5 | Records whether the visitor accepted the cookie consent banner, so it is not shown again on a return visit. | session |
| Nativo | Detects whether the visitor accepted the marketing category in the cookie banner. Required for GDPR compliance. | 1 year |
| YouTube |
CONSENT — detects consent to the marketing category in the cookie banner. VISITOR_PRIVACY_METADATA — stores the cookie consent state for the current domain. |
2 years 180 days |
| embed.lendi.pl |
AWSALB / AWSALBCORS — records which server cluster is serving the visitor (load balancing). |
7 days |
Functional cookies
They let the site "remember" your settings (for example language or font size).
| Name | Purpose | Retention period |
|---|---|---|
| maps/gen_204 — stores user interactions with the embedded map in order to optimise how it works. | session |
Statistics cookies
The site uses cookies supplied by Google and Media.net. They let us track how many visits we get and where they come from, so we can measure and improve the site's performance. If you refuse them, your visit will not appear in the statistics, but nothing on the site will stop working.
| Name | Purpose | Retention period |
|---|---|---|
| _ga — a unique identifier used to generate statistical data on how the website is used. | 2 years | |
| _ga_# — Google Analytics: number of visits, dates of the first and most recent visit. | 2 years | |
| td — statistical data on user behaviour (internal analysis). | session | |
| Media.net | cksync.php — synchronises cookie data across domains. | session |
| visitor-id — identifies the visitor for internal analysis. | 1 year |
Marketing cookies (expand the full list)
We use these cookies to personalise content. They may be used in our advertising campaigns on third-party sites. If you consent, you may receive information about our trusted partners' sites. If you decline, you will simply see generic, non-personalised advertising.
| Provider | Purpose | Period |
|---|---|---|
| Meta Platforms (Facebook) | lastExternalReferrer / lastExternalReferrerTime — detect how the user reached the site. | Persistent |
| _fbp — Facebook advertising products (RTB). | 3 months | |
| (2 cookies, 3 entries in total) | ||
| Adform | pixel — cross-site behaviour for advertising optimisation. | Session |
| Adobe Inc. | demconf.jpg — a unique identifier for advertisers (RTB). | Session |
| demdex — semantic content analysis; targeted advertising. | 180 days | |
| dpm — a unique identifier (RTB). | 180 days | |
| Appnexus | anj / uuid2 — device identifier for a returning user. | 3 months |
| setuid — synchronises visitor data. | Session | |
| (3 cookies) | ||
| Casale Media | CMID — visit data for targeted advertising. | 1 year |
| CMPRO — cross-site behavioural data; ad frequency capping. | 3 months | |
| CMPS — visit data for targeted advertising. | 3 months | |
| rum — visit data for targeted advertising. | Session | |
| Criteo | uid — visit data for targeted advertising. | 1 year |
| iex — tracks visitors across multiple sites. | Session | |
| cto_bundle — relevant content and advertising (RTB). | 13 months | |
| cto_tld_test [x2] — identification across separate visits. | 1 day | |
| cto_bundle (LocalStorage) — relevant content and advertising. | Persistent | |
| criteo_write_test — a unique identifier (RTB). | 1 day | |
| IDE — pending. | 1 year | |
| ads/ga-audiences — Google AdWords: re-engaging visitors. | Session | |
| pagead/1p-conversion/# — pending. | Session | |
| _gcl_au — Google AdSense: advertising effectiveness. | 3 months | |
| ID5 | callback / car / cf / cip / cnac — relevant content and advertising (RTB), unique identifier. | Session |
| (5 cookies) | ||
| Improve Digital | match — a unique identifier (RTB). | Session |
| Media.net | data-c / data-c-ts — relevant content and advertising. | 30 days |
| (2 cookies) | ||
| Nativo | suid/1017 — relevant content and advertising (RTB). | Session |
| Salesforce | _kuid_ — device identifier for a returning user. | 180 days |
| Teads | um — identification across separate visits (RTB). | Session |
| Telaria | tv_UICR / tvid — user behaviour used to optimise advertising. | 30 days / 1 year |
| (2 cookies) | ||
| Triplelift | xuid — relevant content and advertising (RTB). | Session |
| YouTube (embedded video) | 14 cookies (LAST_RESULT_ENTRY_KEY, remote_sid, VISITOR_INFO1_LIVE, YSC, yt-remote-* and similar) — embedded video functionality and player preferences. | Session / 180 days / Persistent |
| bidswitch.net / matching.ivitrack.com | sync [x2] — advertising optimisation. | Session |
| exchange.mediavine.com | am_tokens / am_tokens_eu-v1 / criteo / mv_tokens / mv_tokens_eu-v1 — relevant content and advertising (RTB). | 14 days |
| omnitagjs.com | ayl_visitor / visitor/sync — visitor segmentation, advertising optimisation. | 30 days / Session |
| thebrighttag.com | cs — advertising optimisation (ad exchange). | Session |
A detailed description of the cookies is also available in the cookie banner, where consent is given.
Consent to the installation of cookies
When you visit our site, a banner appears telling you that it uses cookies. If you choose "Allow all", you accept every cookie placed on the site. Necessary cookies do not require consent (Article 173(3) of the Polish Telecommunications Act).
No consent / refusal
If you do not want cookies stored on your device, choose "Reject" — this declines everything except the technically necessary ones.
Changing your settings
You can manage your preferences in detail by selecting particular cookie categories ("Functional", "Statistics", "Marketing") or by opening "Show details" — a full list where each cookie can be accepted or rejected individually.
Personal data (cookies)
Some cookies constitute personal data. The controller is MAXON Nieruchomości sp. z o.o., with its registered office in Warsaw. The data is processed to provide the site's basic functions (Article 6(1)(f) GDPR). Once you consent, it is also processed to personalise offers and analyse traffic (Article 6(1)(a) GDPR).
Withdrawing consent
You can change your consents at any time through the cookie consent management platform or by contacting us:
- By post: MAXON Nieruchomości sp. z o.o., ul. Skierniewicka 10a, 01-249 Warsaw, Poland
- By email: Data Protection Officer — inspektor@maxon.pl
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Changes to the cookie policy
We reserve the right to change this cookie policy at any time. Any changes will be published at https://www.maxon.pl/polityka-prywatnosci.
Please get in touch if you have any questions or doubts.
Thank you for the trust you have placed in us.
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).
2 The Polish Electronic Communications Law Act of 12 July 2024 (Journal of Laws 2024, item 1221, as amended).