Data protection statement
PRIVACY POLICY OF THE SERVICE
PRIVACY POLICY OF THE PANATTONIEUROPE.COM/PL-PL WEBSITE
I. INTRODUCTION
1. This Privacy Policy of the https://panattonieurope.com/pl-pl and https://panattonieurope.com/en-pl website ("Policy") sets out the rules for the processing of personal data in connection with the use of the website https://panattonieurope.com/pl-pl and https://panattonieurope.com/en-pl by the companies listed in section II.1 below.
2. The Joint Controllers ensure that the processing of personal data in their companies complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).
3. The Joint Controllers care about User privacy, and it is important to the Joint Controllers that the personal data collected about Users is stored and processed securely and in accordance with the GDPR. In this Policy, the Joint Controllers provide information about the types of personal data that may be processed, for what purposes, on what legal basis, how personal data is collected, to whom it may be disclosed and how long it may be stored. The Joint Controllers also inform Users about their rights and how to contact them.
4. In the event of cooperation with a third party that involves the processing of personal data, the Joint Controllers ensure that such third party undertakes to guarantee an adequate level of personal data protection, taking into account the provisions of the Policy.
II. DEFINITIONS
1. Joint Controllers:
a) PDE Shared Services sp. z o.o. with its registered office in Warsaw, address: Plac Europejski 1, 00-844 Warsaw, entered in the Register of Business Entities of the National Court Register under KRS No. 0000310363, NIP: 5252437526, REGON: 141338824, hereinafter also referred to as "PDE";
b) Panattoni BTS sp. z o.o. with its registered office in Warsaw, address: Plac Europejski 1, 00-844 Warsaw, entered in the Register of Business Entities of the National Court Register under KRS No. 0000945553, NIP: 5252892058, REGON: 521009489, hereinafter also referred to as “Panattoni BTS”;
c) Panattoni sp. z o.o. with its registered office in Warsaw, address: Plac Europejski 1, 00-844 Warsaw, entered in the Register of Business Entities of the National Court Register under KRS No. 0000895634, NIP: 5252859606, REGON: 388775565, hereinafter also referred to as “Panattoni”,
d) Panattoni Poland sp. z o.o. with its registered office in Warsaw, address: Plac Europejski 1, 00-844 Warsaw, entered in the Register of Business Entities of the National Court Register under KRS No. 0000244253, NIP: 5252347220, REGON: 140296160, hereinafter also referred to as "Panattoni Poland"
separately also as "Joint Controller" or collectively as "Joint Controllers". For more information, please refer to section III of the Policy.
2. Personal Data – information about a natural person who is identified or identifiable by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity, including device IP, location data, internet identifier and information collected through cookies and other similar technologies.
3. Policy – this Privacy Policy.
4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
5. Website – the website operated by the Joint Controllers at https://panattonieurope.com/pl-pl and https://panattonieurope.com/en-pl.
6. User – any natural person visiting the Website or using one or more services or functionalities described in the Policy.
III. DATA PROCESSING IN CONNECTION WITH THE USE OF THE WEBSITE
In connection with the User's use of the Website, the Joint Controllers (or each of the Controllers individually) collect data to the extent necessary to provide the individual services offered, as well as information about the User's activity on the Website. Below are described the detailed rules and purposes of the processing of Personal Data collected during the User's use of the Website.
IV. JOINT CONTROL
1. In connection with the processing of Users' Personal Data in the scope of operating the Website, the Joint Controllers cooperate with each other in determining the purposes and means of such processing (joint control of personal data).
2. The scope of joint control includes activities such as: operating the Website, operating social media, as well as the use of cookies and similar technologies. More information on joint control can be found in the Joint Control Agreement.
3. Notwithstanding the above, with regard to certain services provided on the Website, the Joint Controllers may act separately (individually as the "Controller" or jointly as the "Controllers"). In each such case, the Policy will indicate the relevant Controller responsible for the performance of the given process.
V. TRANSFER AND STORAGE OF PERSONAL DATA
1. The Joint Controllers do not disclose, sell, transfer or otherwise disseminate the User's Personal Data to third parties and will not do so in the future, unless:
a) it is required by law,
b) it is required for the purposes of the contract, or
c) the User has given their explicit consent to the processing of personal data.
For example, it may be necessary to transfer address and order details to our contractors when the User orders services. Each Controller may disclose the User’s personal data to other entities. Such recipients may include service providers cooperating with the Joint Controllers, i.e. external consultants, IT solution providers, etc.
2. Personal Data collected by the Controllers is stored within the European Economic Area (EEA), but may also be transferred and processed in a country outside the EEA ("Third Country"). After such transfer, the processing of the User’s Personal Data continues to be carried out in accordance with the GDPR. In cases where the processing of the User’s Personal Data takes place outside the EEA, this is based on the European Commission's determination that the Third Country provides an adequate level of protection or provides appropriate safeguards to ensure the protection of the User’s rights.
VI. USE OF THE WEBSITE
1. In relation to the use of the Website, the Joint Controllers of Users' Personal Data are: PDE Shared Services, Panattoni BTS, Panattoni and Panattoni Poland.
2. The Personal Data of all persons using the Website (including IP addresses or other identifiers and information collected through cookies or other similar technologies) are processed by the Joint Controllers:
a) for the purpose of providing electronic services in the scope of making the content collected on the Website available to Users – in which case the legal basis for processing is the necessity of processing for the performance of the contract (Article 6(1)(b) of the GDPR);
b) for analytical and statistical purposes – in which case the legal basis for processing is the legitimate interest of the Joint Controllers (Article 6(1)(f) of the GDPR), consisting in analysing the activity of Users and their preferences in order to improve the functionalities and services provided;
c) for the purpose of possible establishment and pursuit of claims or defence against claims – in which case the legal basis for processing is the legitimate interest of the Joint Controllers (Article 6(1)(f) of the GDPR), consisting in the protection of their rights.
3. Users' Personal Data may also be processed for the Joint Controllers' marketing purposes – the rules for the processing of Personal Data for marketing purposes are described in the MARKETING section.
4. The User's activity on the Website, including their Personal Data, is recorded in system logs (a special computer program used to store chronological records containing information about events and actions that relate to the IT system used to provide services by the Controller). The information collected in the logs is processed primarily for purposes related to the provision of services. The Joint Controllers also process it for technical and administrative purposes, to ensure the security of the IT system and to manage this system, as well as for analytical and statistical purposes – in which case the legal basis for processing is the legitimate interest of the Joint Controllers (Article 6(1)(f) of the GDPR).
VII. CONTACT FORM
1. With regard to the use of the contact form on the Website, depending on the subject of the enquiry, the controller of Users' personal data will be PDE Shared Services, Panattoni BTS, Panattoni or Panattoni Poland.
2. Each of the Controllers provides the means to contact them using an electronic contact form. Using the form requires the provision of Personal Data necessary to contact the User and respond to the enquiry. The User may also provide other data to facilitate the handling of the enquiry. The provision of data marked as mandatory is required in order to receive and handle the enquiry, and failure to provide such data will result in the inability to handle the enquiry. The provision of other data is voluntary.
3. Personal Data is processed:
a) for the purpose of identifying the sender and handling their enquiry sent via the form provided – the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) of the GDPR); in the case of data provided on an optional basis, the legal basis for processing is consent (Article 6(1)(a) of the GDPR);
b) for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Controllers (Article 6(1)(f) of the GDPR), consisting in keeping statistics on enquiries submitted by Users via the Website in order to improve its functionality.
VIII. MARKETING
1. In the scope of marketing activities, depending on the scope of consent given by the User, the controller of the Users' personal data will be PDE Shared Services, Panattoni BTS, Panattoni or Panattoni Poland.
2. The Personal Data of Users who have consented to receive messages from the Joint Controllers via the selected communication channel (e-mail; telephone call) are processed for the purpose of sending marketing communications about interesting offers or content promoting the services offered by individual Controllers. Data processing is carried out on the basis of the Controller's legitimate interest (Article 6(1)(f) of the GDPR) on the basis of the consent given. The legitimate interest of the Controller consists in sending marketing content to the User by telephone or e-mail, in connection with the User's consent to receive marketing communications promoting the services offered by the Controllers.
IX. SOCIAL MEDIA
1. With regard to the operation of social media, the Joint Controllers of Users' personal data are PDE Shared Services, Panattoni BTS, Panattoni or Panattoni Poland.
2. The Joint Controllers process the Personal Data of Users visiting the Joint Controllers' profiles on social media (Instagram, YouTube, LinkedIn). This data is processed solely in connection with the maintenance of the profile, including for the purpose of informing Users about the activities of the Joint Controllers and promoting various events, services and products. The legal basis for the processing of Personal Data by the Joint Controllers for this purpose is their legitimate interest (Article 6(1)(f) of the GDPR), consisting in promoting their own brand.
3. The above information does not apply to the processing of data by social media operators (Instagram, YouTube, LinkedIn). Detailed information on the purpose and scope of data collection by social media platforms can be found at the following links:
a) Instagram: https://privacycenter.instagram.com/policy
b) YouTube: https://policies.google.com/privacy
c) LinkedIn: https://www.linkedin.com/legal/privacy-policy
X. COOKIES AND SIMILAR TECHNOLOGY
1. Cookies are small text files installed on the device of a User browsing the Website. Cookies collect information that facilitates the use of a website, e.g. by remembering the User's visits to the Website and the actions they take.
2. With regard to the management of cookies and similar technologies on the Website, the Joint Controllers of Users' personal data are PDE Shared Services, Panattoni BTS, Panattoni or Panattoni Poland.
3. On the Website, the Joint Controllers use their own files, which are installed directly by the Website. Third-party cookies are also used – these are cookies from a domain other than the domain of the website visited – primarily for the Joint Controllers' analytical and advertising activities.
4. The Joint Controllers use the following categories of cookies: essential, functional, analytical, advertising cookies and social media cookies.
ESSENTIAL COOKIES
5. Essential cookies are necessary for the proper functioning of the Website. These cookies are installed in particular for the purpose of remembering login sessions or filling in forms, as well as for purposes related to privacy settings.
6. The legal basis for the processing of data in connection with the use of essential cookies is the necessity of processing for the performance of a contract (Article 6(1)(b) of the GDPR).
7. For more information on specific cookies, like their names, what they do, how long they last, and where they come from, please click on "Manage cookies" in section XII of this Policy or the button with the same name at the bottom of every page on the Website. When the cookie banner appears, select the "Manage cookies" button and then expand the list "Essential cookies" and then the "Details" button below.
FUNCTIONAL AND ANALYTICAL COOKIES
8. Functional cookies are used to remember and adapt the Website to the User's choices, including language preferences. Functional cookies may be installed by the Joint Controllers or their partners via the Website.
9. Analytical cookies enable the collection of information such as the number of visits and traffic sources to the Website. They are used to determine which pages are more or less popular and to understand how Users navigate the Website by compiling statistics on Website traffic. Data processing is carried out to improve the performance of the Website. The information collected by these cookies is aggregated and therefore does not intend to identify the User. Analytical cookies may be installed by the Joint Controllers or their partners via the Website.
10. The legal basis for data processing in connection with the use of functional and analytical cookies is the legitimate interest of the Joint Controllers (Article 6(1)(f) of the GDPR), consisting in ensuring the highest quality of services provided on the Website, in connection with the User's consent to their storage (separate for analytical cookies, separate for functional cookies).
11. The processing of data in connection with the use of functional and analytical cookies is subject to the User's consent to the use (separately) of functional and analytical cookies via the cookie consent management platform . This consent may be withdrawn at any time via this platform.
12. For more information on specific cookies, like their names, what they do, how long they last, and where they come from, please click on "Manage cookies" in section XII of this Policy or the button with the same name at the bottom of every page on the Website. When the cookie banner appears, select the "Manage cookies" button and then expand the list "Analytical cookies" or “Functional cookies”, and then the "Details" button below each list.
ADVERTISING COOKIES
13. Advertising cookies allow the advertising content displayed to be tailored to the interests of Users within and outside the Website. Based on the information from these cookies and the User's activity on other websites, a profile of the User's interests is created. Advertising cookies may be installed by the Joint Controllers or their partners via the Website.
14. The legal basis for the processing of data in connection with the use of advertising cookies is the legitimate interest of the Joint Controllers (Article 6(1)(f) of the GDPR), consisting in promoting the Joint Controllers' brands and informing about the Joint Controllers' current offer, including by providing the User with marketing information corresponding to their interests, in connection with the User's consent to the storage of advertising cookies.
15. Data processing in connection with the use of advertising cookies is possible after obtaining the User's consent to the use of advertising cookies via the consent management platform. This consent may be withdrawn at any time via this platform.
16. For more information on specific cookies, like their names, what they do, how long they last, and where they come from, please click on "Manage cookies" in section XII of this Policy or the button with the same name at the bottom of every page on the Website. When the cookie banner appears, select the "Manage cookies" button and then expand the list "Advertising cookies”, and then the "Details" button below.
SOCIAL MEDIA COOKIES
17. These cookies are installed by the Joint Controllers' partners to tailor the advertising content displayed on the social media platforms used by the User. Based on information from these cookies and activity on other websites or social media, the User’s profile of interests is created. This allows the content displayed to be tailored to individual needs. Social media cookies do not directly store Personal Data, but they identify the User's web browser and device. If the User does not consent to the use of these cookies, the Joint Controllers will not be able to prevent the same advertisement from being displayed or enable the User to like and share content posted by the Joint Controllers on social media.
18. For more information on specific cookies, like their names, what they do, how long they last, and where they come from, please click on "Manage cookies" in section XII of this Policy or the button with the same name at the bottom of every page on the Website. When the cookie banner appears, select the "Manage cookies" button and then expand the list " Social media cookies”, and then the "Details" button below.
XI. SOCIAL MEDIA PLUGINS
1. The Joint Controllers use plugins on the Website that allow the User to interact
with the Joint Controllers’ content posted on their profiles on social media (so-called plugins for Instagram, YouTube, and LinkedIn). Through these plugins, the User can easily react to content published on the Website or on the Joint Controllers’ profiles or share it on these social media platforms. In connection with the use of plugins on the Website, the User's Personal Data is transferred to these social media platforms in the scope of information about the User's use of the Website, which will allow this information to be linked to the Personal Data in the User's profile on these social media platforms. The Joint Controllers are not responsible for determining the purpose and scope of data collection on these social media platforms. Detailed information on this subject can be found at the following links:
a) Instagram: https://privacycenter.instagram.com/policy
b) YouTube: https://policies.google.com/privacy
c) LinkedIn: https://www.linkedin.com/legal/privacy-policy
XII. MANAGING COOKIE SETTINGS
1. The use of cookies to collect data, including access to data stored on the User's device, requires the User's consent. On the Website, the Joint Controllers obtain consent from the User via a cookie consent management platform. This consent may be withdrawn at any time in accordance with the rules described in section XII.4 below.
2. Consent is not required only for cookies that are necessary to provide a telecommunications service (data transmission for the purpose of displaying content). The User cannot opt out of these cookies if they want to use the Website.
3. In order to receive advertisement tailored to the User's preferences, in addition to consenting to the installation of cookies via the cookie consent management platform, it is necessary to maintain appropriate browser settings that allow cookies from the Website to be stored on the User's end device.
4. Withdrawal of consent to the collection of cookies on the Website is possible via the cookie consent management platform. The User may return to the cookie banner by clicking on the button below "Manage cookies " or the button with the same name at the bottom of every page on the Website.
5. After the cookie banner is displayed, the User may withdraw their consent by clicking on the "MANAGE COOKIES" button. Then, move the slider next to the selected cookie category and press the "SAVE SETTINGS" button.
6. The User may also withdraw their consent by changing their browser settings. Detailed information on this subject can be found at the following links:
a) Microsoft Edge: https://support.microsoft.com/en-us/windows/manage-cookies-in-microsoft-edge-view-allow-block-delete-and-use-168dab11-0753-043d-7c16-ede5947fc64d
b) Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
c) Google Chrome: https://support.google.com/chrome/answer/95647?hl=en
d) Opera: https://help.opera.com/en/latest/web-preferences/
e) Safari: https://support.apple.com/en-mk/guide/safari/sfri11471/mac
7. The User can check their current privacy settings for their browser at any time using the tools available at the following links:
a) http://www.youronlinechoices.com
b) http://optout.aboutads.info/?c=2&lang=EN
8. To exercise the rights to access, rectification, erasure, restriction of processing, data portability, as weel as the right to object, and the right to file a complaint, or to ask any other question regarding cookies, please send request to the contact details of the Joint Controllers indicated in the Policy.
XIII. PERIOD OF PERSONAL DATA PROCESSING
1. The period of data processing by the Joint Controllers or each of the Controllers separately depends on the type of service provided and the purpose of processing. As a rule, data is processed for the duration of the service or order, until the consent is withdrawn or an effective objection to data processing is lodged in cases where the legal basis for data processing is the legitimate interest of the Joint Controllers or each of the Controllers individually.
2. The data processing period may be extended if processing is necessary to establish and pursue possible claims or defend against claims, and after that time only if and to the extent required by law. After the processing period has expired, the data is irrevocably deleted or anonymised.
XIV. USER RIGHTS
1. The User has the right to access to the data and request its rectification, erasure, restriction of processing, the right to data portability and the right to object to the processing of data, as well as the right to lodge a complaint with the supervisory authority responsible for the protection of personal data.
2. To the extent that the User's data is processed on the basis of consent (i.e. in the case of providing optional data when filling in the contact form), this consent may be withdrawn at any time by contacting the Controller responsible for handling the form (Section "Contact").
3. The User has the right to object to the processing of data for reasons related to the User's particular situation – in cases where the legal basis for data processing is the legitimate interest of the Joint Controllers or each of the Controllers separately (e.g. in connection with the pursuit of analytical and statistical purposes).
XV. DATA RECIPIENTS
1. In connection with the provision of services, Personal Data will be disclosed to external entities, including in particular IT service providers and entities related to the Joint Controllers or to each of the Controllers separately, including companies from their capital group.
2. The Joint Controllers and each of the Controllers individually reserve the right to disclose selected information about the User to competent authorities or third parties who request such information, based on an appropriate legal basis and in accordance with applicable law.
XVI. TRANSFER OF DATA OUTSIDE THE EEA
1. The level of protection of Personal Data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, as a rule, the Joint Controllers do not transfer Personal Data outside the EEA. Such transfer may only take place if it is necessary and with an adequate level of protection, primarily through:
a) cooperation with Personal Data processors in countries for which the European Commission has issued an appropriate decision confirming the adequacy of the level of protection of Personal Data;
b) the use of standard contractual clauses issued by the European Commission;
c) the use of binding corporate rules approved by the competent supervisory authority.
2. Joint Controllers and each Joint Controller individually always inform the User of their intention to transfer Personal Data outside the EEA at the time of collection.
XVII. PERSONAL DATA SECURITY
1. The Joint Controllers and each of the Controllers individually conduct risk analysis on an ongoing basis to ensure that Personal Data is processed in a secure manner, ensuring in particular that access to the data is limited to authorised persons and only to the extent necessary for the performance of their tasks. The Joint Controllers and each of the Controllers individually ensure that all operations on Personal Data are recorded and carried out only by authorised employees and associates.
2. The Joint Controllers and each of the Controllers individually take all necessary measures to ensure that their subcontractors and other cooperating entities also guarantee the application of appropriate security measures whenever they process Personal Data on their behalf.
XVIII. CONTACT
1. The Joint Controllers or each of the Controllers individually can be contacted by sending a message to the following postal address: Plac Europejski 1, 00-844 Warsaw.
2. In addition, the following e-mail addresses have been designated for contacting the selected Controller:
a. PDE Shared Services sp. z o.o. – iod@panattoni.com;
b. Panattoni BTS sp. z o.o. – kodo-bts@panattoni.com
c. Panattoni sp. z o.o. – kodo-panattoni@panattoni.com
d. Panattoni Poland sp. z o.o. – kodo-poland@panattoni.com
PDE Shared Services sp. z o.o. has appointed a Data Protection Officer who can be contacted by email: iod@panattoni.com, in any matter relating to the processing of Personal Data.
XIX. CHANGES TO THE PRIVACY POLICY
1. The Policy is reviewed on an ongoing basis and updated as necessary.
2. The current version of the Policy was adopted and is effective as of 6 February 2026.
PERSONAL DATA PROTECTION RULES APPLICABLE TO JOINT CONTROLLERS
Joint controllers ensure the security of personal data and compliance with regulations governing its processing. Below is a summary of the personal data processing rules applicable to individual Joint Controllers:
· Summarized Personal Data Protection Policy at PDE Shared Services sp. z o.o.
· Summarized Personal Data Protection Policy at Panattoni BTS sp. z o.o.
· Summarized Personal Data Protection Policy at Panattoni sp. z o.o.
· Summarized Personal Data Protection Policy at Panattoni Poland sp. z o.o.