Privacy policy

Velora Real Estate · effective from 27 October 2026

This privacy notice explains which personal data the Velora Real Estate website collects, why we use it, the lawful basis we rely on and the rights you have. It is based on the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679); visitors in the United Kingdom will find the UK-specific information in a separate section below.

Who we are (controller)

The controller of your personal data is Velora Real Estate (“we”). For any matter concerning your data, contact us via the contact form on this website and write “Personal data” in your message. We reply without undue delay and at the latest within one month.

For any question about your data or to exercise your rights, use the contact form and write “Personal data” in your message. We respond without undue delay and in any case within one month.

Contact form

When you send an enquiry, we process the data you enter: name, company name, email address, number of units, project location (optional) and your message, together with the date of submission and the language version of the page.

Purpose: answering your enquiry and preparing a proposal.
Lawful basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Ticking the box in the form confirms that you have read this policy.
Voluntary provision: providing data is voluntary, but without an email address we cannot reply.
Retention: until the correspondence is completed, then for a maximum of 12 months after the last contact. The copy of the enquiry on the server is deleted automatically after 12 months. If a contract is concluded, we keep the data for the periods required by tax and accounting law.
Protection against abuse: we store a pseudonymised, one-way hash of your IP address and limit the number of submissions from one address, based on our legitimate interest in the security of the form (Art. 6(1)(f) GDPR).

Recipients and transfers

We use service providers who process data only on our instructions under a data processing agreement (Art. 28 GDPR):

Hosting provider — the server on which the website and the form run, located in Canada. Canada is covered by an adequacy decision of the European Commission (Decision 2002/2/EC; Art. 45 GDPR).
Email delivery service established in the EU — sends us a notification of a new enquiry.
Mailbox provider — the mailbox that receives these notifications. The provider may transfer data to the USA on the basis of the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR).

We do not sell personal data or share it with third parties for their own marketing. The names of our service providers are available on request.

Server logs

Each time the website is accessed, the server automatically records technical data: IP address, date and time, the requested page and information about the browser. This data is used to operate the website and keep it secure (Art. 6(1)(f) GDPR — legitimate interest) and is kept only as long as necessary for these purposes. We do not combine it with other data.

Cookies and browser storage

The website does not use cookies, advertising pixels or social media plugins. Fonts and scripts are served from our own servers, so no connection to third-party services such as Google Fonts is made. For this reason there is no cookie banner.

The language version is selected automatically from the language settings of your browser and, where these are not conclusive, from its time zone; no location service is used. Only if you choose a language yourself in the language menu does the website save that choice in your browser’s local storage (entry “lang_pref”, e.g. “de”), so that the website opens in that language on your next visit. The entry contains no identifier, is not sent to us and remains until you delete it in your browser settings.

Links to external services open only when you click them and are subject to the policies of those services.

Your rights

You have the right to request access to your personal data (Art. 15 GDPR), to have inaccurate data rectified (Art. 16), to have your data erased (Art. 17), to restrict processing (Art. 18) and to data portability (Art. 20). You do not normally have to pay a fee to exercise these rights. If we need to confirm your identity before acting on a request, we will ask only for the information necessary for that purpose.

Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (server logs, protection of the form against abuse). A message via the contact form is sufficient.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority competent for the operator of the website is the President of the Personal Data Protection Office in Poland (UODO, uodo.gov.pl).

We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR).

Visitors from the United Kingdom

If you are in the United Kingdom, your data is also protected by the UK GDPR and the Data Protection Act 2018. The purposes, lawful bases, retention periods and rights described above apply in the same way. Transfers from the UK to Canada rely on UK adequacy regulations; any transfer to the USA by our mailbox provider may rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) or on other appropriate safeguards.

If you are unhappy with how we have handled your data, please raise it with us first via the contact form: we will acknowledge your complaint within 30 days and deal with it without undue delay. You also have the right to complain to the Information Commissioner’s Office (ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk) or to the body that succeeds it.

The website sets no cookies. The only information it stores on your device is the language you chose yourself; this is strictly necessary to provide the function you requested, so no consent under the Privacy and Electronic Communications Regulations (PECR) is requested.

Changes to this policy

Whenever the way we use personal data changes, we will update this notice and its effective date. See also the terms of use.