Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is Cityroom Sp. z o.o., with its registered address at ul. Krótka 1, 64-140 Włoszakowice, Poland, NIP 6972336535.

Our operational office is located at ul. Pogodna 10, 60-275 Poznań, Poland. You can reach us at contact@citymate.pl for any privacy-related queries.

2. Data We Collect

When you submit a contact form or rental enquiry on this website, we collect the information you provide, which may include your name, email address, phone number, and the content of your message.

When you browse the website, we also collect technical data automatically, including your IP address, browser type, device information, pages visited, and time spent on the site. This data is gathered through cookies and similar tracking technologies.

On rent.citymate.pl, after analytics consent, we assign random first-party visitor and session identifiers and record product events such as listing views, filter or map use, gallery interactions, enquiry and reservation steps, Checkout outcomes, payments and refunds. This event log contains listing, enquiry or reservation identifiers where needed to measure the funnel, but it does not contain your name, email address, phone number or the free text of your message.

After analytics consent, we also store first-touch and last-touch campaign attribution with an enquiry or reservation and its payment outcome. This is limited to whitelisted UTM parameters, advertising click identifiers, the referring hostname, landing path and capture time; we do not store the full referring URL or arbitrary query parameters for this purpose.

Microsoft Clarity may record a replayable representation of how you interact with the rental portal, including clicks, scrolls, navigation and page rendering, and aggregate those interactions into heatmaps. It is not a video or screen capture. Form areas are explicitly masked and the project uses Strict masking, so names, contact details, messages and reservation form contents are not sent as readable content in recordings.

We do not collect sensitive personal data (such as health data or financial account details) through this marketing website. Payment processing in connection with a rental agreement is handled separately through Stripe on our rental portal.

3. Purposes and Legal Bases

We process your contact and enquiry data to respond to your questions and to take pre-contractual steps at your request, on the legal basis of Article 6(1)(b) GDPR (performance of a contract or pre-contractual steps).

We process technical and analytics data for our legitimate interests in understanding how the website is used, improving our services, and protecting the security of our systems, on the legal basis of Article 6(1)(f) GDPR (legitimate interests).

Where we use non-essential cookies or marketing tracking tools (such as Google Analytics, Google Ads, or Meta Pixel), we do so only on the basis of your freely given consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time.

Microsoft Clarity session replay, heatmaps and campaign attribution are activated only after analytics consent, on the basis of Article 6(1)(a) GDPR. Advertising storage and Microsoft Ads data sharing remain disabled in our Clarity configuration.

We may also process your data where necessary to comply with a legal obligation binding on us, on the basis of Article 6(1)(c) GDPR.

4. Cookies and Analytics

This website uses cookies. Essential cookies are strictly necessary for the website to function and are placed without your consent. Non-essential cookies (including analytics and marketing cookies) are placed only after you grant consent via our cookie consent banner, managed through CookieYes.

After you consent, we may activate Google Analytics, Google Ads, and Meta Pixel through Google Tag Manager. These tools collect data about your visit to help us measure website performance and deliver relevant advertising.

On the rental portal, consent also enables the first-party cm_rent_vid identifier for up to 90 days and a session identifier kept for the current browser tab. They let us connect anonymous on-site behaviour with an enquiry or reservation and its commercial outcome. Withdrawing consent removes these browser identifiers and stops new first-party product events.

The same analytics choice controls Microsoft Clarity. The Clarity script is not requested before consent. After consent, it provides session replay and click, scroll, area and attention heatmaps. We pass pseudonymous visitor and session identifiers and non-personal campaign labels to make recordings filterable; we do not send a customer's name, email address or phone number as a Clarity identifier.

We use Google Consent Mode v2, which means Google advertising and analytics storage is denied by default until you provide consent. Vercel Web Analytics and Speed Insights may still collect limited, cookie-free and aggregated page-performance data; Vercel does not use third-party cookies for Web Analytics and discards its visitor-session identifier after 24 hours.

You can change or withdraw your cookie consent at any time using the cookie settings link in the footer of this website. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.

5. Recipients of Your Data

We share your data only with trusted service providers who act as data processors on our behalf. These include our website hosting and performance-analytics provider (Vercel), database provider (Supabase), analytics and advertising platforms (Google), Microsoft Clarity for consent-gated behavioural analytics, Meta Platforms (Meta Pixel), the Stripe payment infrastructure used on the rental portal, and email service providers including Resend.

Some of these providers are based outside the European Economic Area (EEA), including in the United States. In such cases, data transfers are carried out with appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission.

We do not sell your personal data to third parties.

6. Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law.

Enquiry and contact data is generally kept for up to 2 years from the date of your last contact, unless a rental agreement is concluded, in which case data is retained for the period required by tax and civil law. Raw first-party rental-portal analytics events are automatically deleted after 14 months. Microsoft Clarity playback data is retained for 30 days, while aggregated heatmap and click data is retained for up to 13 months; a session deliberately labelled or favourited in Clarity may also be retained for up to 13 months. Other technical and analytics data is retained in accordance with the retention policies of the respective service providers.

7. Your Rights

Under the GDPR you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure of your data (the right to be forgotten) where applicable; request restriction of processing; receive your data in a portable format; object to processing based on legitimate interests; and withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at contact@citymate.pl. We will respond within one month of receiving your request.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl.

8. Contact

For any questions or requests regarding this Privacy Policy or the processing of your personal data, please contact us at contact@citymate.pl.

We will always do our best to address your concerns promptly and transparently.