Privacy Policy

Last updated: 29 September 2026

This policy explains how D&S Investment Group sp. z o.o. processes the personal data of people who use the website dsinvestment.pl, send enquiries, express interest in working with us as a subcontractor or submit a job application. The document also covers the rules for using cookies and analytics tools.

1. Data controller

The data controller is D&S Investment Group spółka z ograniczoną odpowiedzialnością with its registered office in Katowice, ul. Warszawska 40/2A, 40-008 Katowice, entered in the register of entrepreneurs of the National Court Register under number KRS 0001264407, NIP 9542914652, REGON 54563537000000.

For matters concerning personal data, you can contact the Controller at biuro@dsinvestment.pl or by post at the address of the registered office.

2. What data we process

The scope of data depends on how the Website is used. The Controller may process:

• data provided in the contact form or in a message, in particular first and last name or company name, telephone number, email address, subject and content of the message;
• data provided in a subcontractor registration, in particular company name or first and last name, NIP or VAT number, contact details, scope of work performed, experience, area of operation, availability and content of the message;
• data provided in a job application, in particular first and last name, contact details, position or specialisation, experience, reasons for applying and data contained in the CV;
• technical data related to the use of the Website, such as IP address, date and time of the request, device type, operating system, browser type, address of the subpage visited, traffic source and information stored in cookies;
• statistical data on how the Website is used, collected after obtaining the required consent.

The data comes directly from the user or is transmitted automatically by the user's device and browser while using the Website.

3. Purposes and legal bases of processing

The Controller processes data for the following purposes:

• responding to enquiries and conducting correspondence: on the basis of Art. 6(1)(b) GDPR, where the contact is aimed at concluding a contract with the data subject, or Art. 6(1)(f) GDPR, where the basis is the Controller's legitimate interest in handling correspondence and communication with persons acting on behalf of other entities;
• taking steps prior to entering into a contract and holding discussions with a potential client or subcontractor: on the basis of Art. 6(1)(b) or (f) GDPR, depending on whether the person submitting the data is to be a party to the contract or is acting on behalf of another entity;
• conducting recruitment: on the basis of Art. 6(1)(c) GDPR for data required by employment law, Art. 6(1)(b) GDPR for steps prior to entering into a civil-law contract, and Art. 6(1)(a) GDPR for additional data provided voluntarily;
• ensuring the security of the Website, diagnosing errors, preventing abuse and protecting against claims: on the basis of Art. 6(1)(f) GDPR, as the Controller's legitimate interest;
• compiling statistics and analysing the use of the Website with Google Analytics 4: on the basis of the user's consent, in accordance with Art. 6(1)(a) GDPR;
• remembering cookie choices: in order to implement the user's decision and ensure the proper functioning of the consent management mechanism.

Data sent via the forms is not used for a newsletter or telephone marketing without a separate legal basis and the required consent.

4. Voluntary provision of data

Providing data is voluntary. Fields marked as required are needed to handle the enquiry or application. Failure to provide the required data may make it impossible to send the form, reply to it, assess the possibility of cooperation or take part in recruitment.

The Controller asks that messages and CVs do not include data that is not needed for the given purpose, in particular data concerning health, origin, opinions, beliefs, sex life or other special categories of data. If such data is provided voluntarily, it will be processed only where there is an appropriate legal basis; otherwise it will be deleted or disregarded.

5. Forms and email

Messages sent via the forms are forwarded to the Controller by email. The current configuration of the Website does not store the content of submissions in the WordPress dashboard as a separate form database. Copies of messages may be kept in the mailbox for the period specified in section 10.

The forms use local anti-spam protection that helps distinguish user submissions from automated submission attempts.

6. Recruitment and CVs

Candidates' data is used to conduct the current recruitment process and to contact candidates about their application. Data may be retained for future recruitment processes only on the basis of separate consent. Consent can be withdrawn at any time, without affecting the lawfulness of earlier processing.

The CV file is sent to the Controller by email. The Controller does not make CVs publicly available.

7. Data recipients

Data may be disclosed to entities that support the Controller in maintaining the Website, hosting, email handling, security and IT support. These entities receive the data only to the extent necessary to perform their tasks and process it on the basis of appropriate contracts or their own legal obligations.

Data may be disclosed to public authorities where required by law. The Controller does not sell personal data.

8. Google services and analytics

Google Analytics 4

The Website uses Google Analytics 4, implemented via the MonsterInsights tool. The service is used to compile visit statistics, assess the effectiveness of content and improve the usability of the Website. Google Analytics may process cookie identifiers, device and browser information, approximate location, the address of the page visited, the traffic source and events describing interactions with the Website.

Google Analytics is activated only after consent to analytics cookies has been given. The Controller does not send Google Analytics the content of forms, CVs, or the phone numbers or email addresses entered by users. Consent can be changed or withdrawn at any time in the cookie settings.

Google Maps and Google Fonts

The Website may use maps from Google Maps and fonts provided by Google Fonts. When a map or font is loaded, the browser connects to Google servers, which may involve the transfer of the IP address and information about the device and the requested resource. Google Maps may use its own cookies and similar technologies.

As a rule, Google services in the European Economic Area are provided by Google Ireland Limited. Detailed information can be found in the Google Privacy Policy.

9. Transfers of data outside the EEA

Using Google services may result in data being processed outside the European Economic Area, in particular in the United States. Google states that it uses the legal mechanisms required for such transfers, including the EU-US Data Privacy Framework and standard contractual clauses where a given transfer is not covered by an adequacy decision.

Information on the mechanisms used by Google is available on the page Data transfer frameworks.

10. Data retention period

• data from enquiries and correspondence is kept until the matter is closed and then for the period necessary to establish, exercise or defend claims;
• data relating to business discussions or cooperation with a subcontractor is kept until the discussions end and, if a contract is concluded, for the duration of its performance and for the period required by law and by the limitation periods for claims;
• candidates' data is kept until the current recruitment process ends and, where separate consent to future recruitment processes has been given, until that consent is withdrawn or the purpose for which it was given no longer applies;
• technical logs are kept for the period necessary to ensure security, diagnose errors and protect against abuse;
• user-level and event-level Google Analytics data is kept in accordance with the service settings, for no longer than 14 months;
• cookies are kept until the period specified in section 12 expires or until the user deletes them earlier.

Data may be kept longer where required by law or where necessary to establish, exercise or defend claims.

11. Rights of data subjects

Under the terms set out in the GDPR, the data subject may have the right to:

• access their data and obtain a copy;
• rectification of inaccurate data;
• erasure of data;
• restriction of processing;
• data portability, where processing is carried out by automated means on the basis of consent or a contract;
• object to processing based on the Controller's legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Requests can be sent to biuro@dsinvestment.pl. Before handling a request, the Controller may ask for information to confirm the identity of the person making it.

The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO). Information on how to lodge a complaint is available at uodo.gov.pl.

12. Cookies

Cookies are small pieces of information stored on or read from the user's device while using the Website. The Website uses necessary cookies and, once consent has been obtained, analytics and functional cookies.

Necessary cookies

• cookieyes-consent stores the consent choices for individual cookie categories; provider: dsinvestment.pl; standard duration: 1 year.

Necessary cookies are required for the consent mechanism to work and cannot be disabled from the banner. They can be deleted in the browser settings, which will cause the banner to be displayed again.

Analytics cookies

• _ga helps distinguish users for Google Analytics 4 statistics; default duration: up to 2 years;
• _ga_<identifier> helps maintain the Google Analytics 4 session state; default duration: up to 2 years.

Analytics cookies are optional and are activated only after consent has been given. The actual duration may be shorter due to the Website settings or browser restrictions.

Functional cookies and external content

Embedded services such as Google Maps may use their own cookies needed to display the map and remember settings. Their availability depends on the user's choices and the consent configuration.

Consent management

On the first visit, the user can accept all optional cookies, reject them or choose specific categories. Consent can later be changed or withdrawn via the link Cookie settings. Withdrawing consent does not affect the lawfulness of earlier processing.

Cookies can also be blocked or deleted in the browser settings. Restricting necessary cookies may affect the availability of some features of the Website.

13. Data security

The Controller applies technical and organisational measures appropriate to the nature of the data processed and the risk. The Website uses an encrypted HTTPS connection, access control, up-to-date software and safeguards that limit automated and unauthorised attempts to submit forms.

14. Automated decision-making and profiling

The Controller does not make decisions about users that produce legal effects or similarly significant effects based solely on automated processing. Google Analytics is used to compile aggregate statistics on the use of the Website, not to make automated decisions about specific individuals.

15. Changes to the policy

The policy may be updated if there are changes to the Website's features, the tools used, providers or legislation. The current version is published on this page together with the date of the last update.