Privacy Policy Foksal Palace

Privacy Policy

Information on the processing of personal data of people using www.palacnafoksal.pl, contacting Pałac na Foksal, and submitting enquiries through online forms and Meta advertising forms.

Updated: 26 October 2026

1. Data controller and contact

The controller of personal data is Pałac Na Foksal Spółka z ograniczoną odpowiedzialnością with its registered office at ul. Foksal 2, 00-366 Warsaw (hereinafter: the “Controller”).

For matters concerning personal data, you can contact the Controller at kontakt@palacnafoksal.pl or in writing at its registered office address.

2. Who and what data this policy covers

This policy applies to people visiting the website, using the contact form or offer enquiry form, contacting us by email or telephone, and people providing data in a Meta advertising form (Facebook or Instagram).

Depending on which feature you use, we may process:

identification and contact details, e.g. first and last name, email address and telephone number;
information entered in the message or form, e.g. the type of event, preferred date, expected number of guests and other details of the enquiry;
data concerning correspondence and the handling of the enquiry;
technical data related to your use of the website, e.g. IP address, connection date and time, browser and device information, and events recorded in server logs;
information about cookie settings and similar technologies—to the extent determined by your choices and the tools operating on the website.

We receive the data directly from you. In the case of a Meta instant form, some contact details may be pre-filled by Meta using information from your profile; you can check and correct them before submitting the form.

3. Purposes and legal bases for processing

Handling messages and enquiries — to answer a question, contact you regarding a submitted enquiry and provide the information requested. The legal basis is Article 6(1)(b) GDPR when we take steps at your request before entering into a contract, or Article 6(1)(f) GDPR when we handle general correspondence and ensure efficient communication.
Preparing and performing a contract — when an enquiry leads to a reservation or the conclusion of a contract. The legal basis is Article 6(1)(b) GDPR; for legal obligations, in particular tax and accounting obligations, it is Article 6(1)(c) GDPR.
Establishing, pursuing or defending against claims — on the basis of the Controller’s legitimate interest, Article 6(1)(f) GDPR.
Website security and proper operation — including detecting errors, misuse and attempts at unauthorised access. The legal basis is the Controller’s legitimate interest, Article 6(1)(f) GDPR.
Analytics, personalisation or advertising using optional cookies — only if such tools are enabled on the website and you consent to them. The legal basis for processing personal data is consent, Article 6(1)(a) GDPR; storing or accessing information on your terminal device is carried out in accordance with the rules set out in legislation concerning electronic communications.

We use the data provided in a form to handle the matter to which the form relates. We do not use it to send unrelated marketing communications without the separate consent required.

4. Voluntary provision of data

Providing data is voluntary. However, fields marked as required are necessary for us to receive and handle your enquiry. Failure to provide this data may make it impossible to contact you or prepare a response. Providing any other information is voluntary and up to you.

5. Recipients of data

Data may be accessed by authorised persons acting on behalf of the Controller and by service providers supporting its operations—only to the extent necessary to provide their services. These may include, in particular, providers of hosting and website maintenance, email, enquiry management or CRM systems, analytics and advertising tools, as well as entities providing IT, legal or accounting services. Providers processing data on behalf of the Controller act under appropriate agreements.

Data may also be disclosed to authorised public authorities where required by law.

6. Meta and advertising forms

If you fill in an instant form in an advertisement on Facebook or Instagram, the form is provided by Meta. Meta may process data as a separate controller in accordance with its own policies. You can read Meta’s information in its Privacy Policy. Upon receiving the data, the Controller uses it for the purpose described in this policy, in particular to respond to the enquiry submitted.

If Meta Pixel or another advertising tool is used on the website, it should not store or read optional advertising identifiers before the required consent has been obtained. Details of the tools used should be provided in the cookie settings panel.

7. Transfers of data outside the European Economic Area

Some service providers, including Meta and providers of cloud solutions, may process data outside the European Economic Area. Where such a transfer takes place, it is carried out using a mechanism required by the GDPR, such as an adequacy decision or standard contractual clauses, together with the required safeguards. You can obtain information about the specific provider and mechanism used by contacting the Controller.

8. Data retention period

We retain data from enquiries and correspondence for as long as necessary to handle the matter, and thereafter for the period necessary to establish, pursue or defend against claims. As a rule, this period does not exceed 3 years from the end of the calendar year in which the enquiry was handled, unless a longer period is required by law or necessary in connection with specific proceedings.
We retain data related to a contract for the duration of its performance, and thereafter for the periods required by law or necessary for settlements and the handling of claims.
We retain technical data in logs for as long as necessary to ensure the security and proper functioning of the website, in accordance with the server settings and the Controller’s procedures.
We retain data relating to cookie consents for the period specified by the settings of the consent management tool or until you change your settings.

9. Cookies and similar technologies

The website may use cookies and similar technologies. Some are necessary for the website to function, ensure its security or remember selected settings. Others—for example, analytics, functional or advertising technologies—may only be activated after obtaining your consent, where required.

On your first visit, you can give or refuse consent, or adjust your cookie settings. You can later withdraw your consent or change your settings in the cookie settings panel available on the website. Withdrawing consent does not affect the lawfulness of actions carried out before it was withdrawn. You can also change your browser settings; however, restricting certain necessary cookies may affect how the website functions.

The current list of cookies, their providers, purposes and duration should be available in the cookie settings panel on the website and reflect the actual configuration of the service.

10. Your rights

Within the limits and under the terms set out in the GDPR, you have the right to:

access your data and obtain a copy of it;
rectify inaccurate data or complete incomplete data;
request the erasure of data or restriction of its processing;
data portability—in the cases specified in the GDPR;
object to processing based on the Controller’s legitimate interests, on grounds relating to your particular situation;
withdraw your consent at any time, if processing is based on it.

To exercise your rights, write to kontakt@palacnafoksal.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office.

11. Automated decision-making

The Controller does not make decisions concerning you based solely on automated processing, including profiling, which would produce legal effects or similarly significantly affect you. Advertising platforms may use their own ad-matching mechanisms in accordance with their policies.

12. Changes to the policy

This policy may be updated if the way the website operates or the scope of data processing changes. The current version will be published at the same address.

Privacy Policy

Information on the processing of personal data of people using www.palacnafoksal.pl, contacting Pałac na Foksal, and submitting enquiries through online forms and Meta advertising forms.

Updated: 26 October 2026

1. Data controller and contact

The controller of personal data is Pałac Na Foksal Spółka z ograniczoną odpowiedzialnością with its registered office at ul. Foksal 2, 00-366 Warsaw (hereinafter: the “Controller”).

For matters concerning personal data, you can contact the Controller at kontakt@palacnafoksal.pl or in writing at its registered office address.

2. Who and what data this policy covers

This policy applies to people visiting the website, using the contact form or offer enquiry form, contacting us by email or telephone, and people providing data in a Meta advertising form (Facebook or Instagram).

Depending on which feature you use, we may process:

identification and contact details, e.g. first and last name, email address and telephone number;

information entered in the message or form, e.g. the type of event, preferred date, expected number of guests and other details of the enquiry;

data concerning correspondence and the handling of the enquiry;

technical data related to your use of the website, e.g. IP address, connection date and time, browser and device information, and events recorded in server logs;

information about cookie settings and similar technologies—to the extent determined by your choices and the tools operating on the website.

We receive the data directly from you. In the case of a Meta instant form, some contact details may be pre-filled by Meta using information from your profile; you can check and correct them before submitting the form.

3. Purposes and legal bases for processing

Preparing and performing a contract — when an enquiry leads to a reservation or the conclusion of a contract. The legal basis is Article 6(1)(b) GDPR; for legal obligations, in particular tax and accounting obligations, it is Article 6(1)(c) GDPR.

Establishing, pursuing or defending against claims — on the basis of the Controller’s legitimate interest, Article 6(1)(f) GDPR.

Website security and proper operation — including detecting errors, misuse and attempts at unauthorised access. The legal basis is the Controller’s legitimate interest, Article 6(1)(f) GDPR.

We use the data provided in a form to handle the matter to which the form relates. We do not use it to send unrelated marketing communications without the separate consent required.

4. Voluntary provision of data

Providing data is voluntary. However, fields marked as required are necessary for us to receive and handle your enquiry. Failure to provide this data may make it impossible to contact you or prepare a response. Providing any other information is voluntary and up to you.

5. Recipients of data

Data may also be disclosed to authorised public authorities where required by law.

6. Meta and advertising forms

If Meta Pixel or another advertising tool is used on the website, it should not store or read optional advertising identifiers before the required consent has been obtained. Details of the tools used should be provided in the cookie settings panel.

7. Transfers of data outside the European Economic Area

8. Data retention period

We retain data related to a contract for the duration of its performance, and thereafter for the periods required by law or necessary for settlements and the handling of claims.

We retain technical data in logs for as long as necessary to ensure the security and proper functioning of the website, in accordance with the server settings and the Controller’s procedures.

We retain data relating to cookie consents for the period specified by the settings of the consent management tool or until you change your settings.

9. Cookies and similar technologies

The website may use cookies and similar technologies. Some are necessary for the website to function, ensure its security or remember selected settings. Others—for example, analytics, functional or advertising technologies—may only be activated after obtaining your consent, where required.

The current list of cookies, their providers, purposes and duration should be available in the cookie settings panel on the website and reflect the actual configuration of the service.

10. Your rights

Within the limits and under the terms set out in the GDPR, you have the right to:

access your data and obtain a copy of it;

rectify inaccurate data or complete incomplete data;

request the erasure of data or restriction of its processing;

data portability—in the cases specified in the GDPR;

object to processing based on the Controller’s legitimate interests, on grounds relating to your particular situation;

withdraw your consent at any time, if processing is based on it.

To exercise your rights, write to kontakt@palacnafoksal.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office.

11. Automated decision-making

The Controller does not make decisions concerning you based solely on automated processing, including profiling, which would produce legal effects or similarly significantly affect you. Advertising platforms may use their own ad-matching mechanisms in accordance with their policies.

12. Changes to the policy

This policy may be updated if the way the website operates or the scope of data processing changes. The current version will be published at the same address.

FOLLOW US