Privacy

The controller of personal data on cenostat.pl is Aliaksei Kashynski, the author of the service. For any matter concerning personal data, write to prywatnosc@cenostat.pl.

For each sale of a unit: the building address and unit number, the district and the City Information System area (the area on the map), transaction date, property price and price of the whole transaction, price per m², floor area, number of rooms, storey, unit use, market type, type of title to the unit, the building's position on the map and the record number in the city's map service.

The service's database also holds, but does not publish: the share in the title to the unit, the transaction type (e.g. sale at a discount), VAT amount and rate, the area of ancillary rooms, the cadastral precinct, the date the entry was updated and identifiers from the register (including those of the document, the transaction and the unit in the land and building register).

The register we use contains no names or other details of the parties to a transaction. Data about a specific unit may still be personal data if it can be linked to the person who bought or sold the unit. We therefore treat it as personal data.

From the Property Price Register kept by the Mayor of the City of Warsaw, part of the state geodetic and cartographic resource. We download it from the city's publicly available map service mapa.um.warszawa.pl. The boundaries of the areas we use to assign transactions to map areas come from the same service. We do not collect the data from the people it concerns.

The price register is made available free of charge, and no licence is issued for its materials (Art. 40a(2)(1)(k) and Art. 40c(5) of the Polish Act of 17 May 1989 – Geodetic and Cartographic Law).

We do not know the people who bought or sold the units, so we cannot inform them individually. We therefore make this information publicly available on this page (Art. 14(5)(b) GDPR).

To show what flats in Warsaw sold for: on the map, in the statistics, in the transaction list and in the API. The legal basis is the legitimate interest of the controller and of the users of the service in a transparent property market (Art. 6(1)(f) GDPR).

We do not combine transactions with data about people, and transactions cannot be searched by person in the service.

Transaction data is public: anyone visiting the service or using its API can see it.

It is processed on our behalf, as processors, by OVHcloud (the service's server, in Poland) and Cloudflare (database backups, R2 service). We encrypt the backups on our server before sending them; Cloudflare does not hold the key to read them. Cloudflare may store them outside the European Economic Area. Transfers to the USA rely on the European Commission's decision on the EU-U.S. Data Privacy Framework, in which Cloudflare participates, and transfers to other countries on standard contractual clauses in the data processing agreement with Cloudflare (Art. 46(2)(c) GDPR). We will send you a copy on request.

For as long as the service runs, because prices cannot be compared without earlier years.

If you object to the processing of a transaction, we delete it from the database without undue delay. Backups that contain it expire within 2 months at the latest.

If a transaction concerns you, e.g. as the buyer or the seller, object to the processing of its data (Art. 21 GDPR). Write to prywatnosc@cenostat.pl and give:

• the building address and unit number;
• the transaction date, if you mean one of several sales of that unit. Without a date we remove all of them.

You do not need to give reasons or send documents: we accept every objection from a person the transaction concerns. If we have reasonable doubts whether it concerns you, we may ask for more information (Art. 12(6) GDPR). We may refuse manifestly unfounded or excessive requests (Art. 12(5) GDPR).

We delete the transaction from the service's database, so it disappears from all pages of the service and from the API, and we do not load it again in later data updates. To keep it from coming back, we keep its identifiers from the register and the date of the objection for as long as the service runs (Art. 6(1)(f) GDPR).

We reply without undue delay and within one month at the latest. In a complex case the period may be extended by two months; we will then let you know within the first month.

The objection applies only to cenostat.pl. The same transaction stays in the city's register and in other services that publish it. We also cannot delete copies that someone downloaded earlier through the API.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and objection (Art. 21). This also applies to the visitor data described below.

If transaction data is wrong, at your request we will remove the entry from the service or restrict its processing until the matter is clarified (Art. 18(1)(a) GDPR). An error in the register itself is corrected by the office that keeps it, so report it there as well.

We do not use profiling or automated decision-making (Art. 22 GDPR).

You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl).

The server logs every request: IP address, time, page address (URL with filter parameters), response code and size, browser identifier (User-Agent) and referring page, and for encrypted connections also the domain name. The logs are used to run the service and protect it from abuse (Art. 6(1)(f) GDPR). They are kept on the OVHcloud server, are not included in backups and are deleted after 15 days at the latest.

The server counts requests and simultaneous connections from each IP address so that one client cannot overload the service. These counters exist only in the server's memory and are not saved.

We use no cookies, analytics or advertising. The app stores the selected language and whether the map panel is open in the browser (localStorage). These settings are needed for the interface to work; they are not sent to the server and you can delete them in your browser settings.

The map background in the app comes from OpenStreetMap Foundation (OSMF) servers. Your browser connects to them directly and sends them its IP address, browser identifier, the address of the service (cenostat.pl) and which part of the map you are viewing. We do this in our legitimate interest, because the map is unreadable without a background (Art. 6(1)(f) GDPR). OSMF is based in the United Kingdom, for which the European Commission has found an adequate level of data protection; it delivers the background through a network of cache servers, including outside the European Economic Area. From there OSMF processes the data as a separate controller: OSMF privacy policy.

If you write to us, we process your e-mail address and the content of your message to deal with your request. Giving your address is voluntary, but we cannot reply without it. For the rights described above the legal basis is an obligation under the GDPR (Art. 6(1)(c) in conjunction with Art. 12–22 GDPR), for other matters our legitimate interest (Art. 6(1)(f)). After the matter is closed we keep the correspondence for 3 years so that we can show how it was handled (the limitation period under Art. 442¹ § 1 of the Polish Civil Code). E-mail is handled on our behalf by Zoho (Zoho Mail): the data is stored in the European Union, in data centres in the Netherlands and Ireland. Access from outside the European Economic Area, e.g. by Zoho technical support in India, relies on standard contractual clauses (Art. 46(2)(c) GDPR).