Privacy policy

1. Who is responsible for your data

The controller for expressions of interest, invitations, RSVPs, guest lists, website analytics, marketing and image use on the terms below is XPADIA LTD, a company incorporated under Cyprus law, registered on 6 March 2023 under HE 444439; registered office: Mykinon 12, Floor 6, 1065 Nicosia (Lefkosia), Cyprus; correspondence address: Labs Tower, 4 Fotie Pitta, 1065 Nicosia, Cyprus; EU VAT: CY60014811J. Contact for personal data and consent: info@xpadia.com.

AVATARLAND sp. z o.o., ul. Trybunalska 46, 60-325 Poznań, Poland, KRS 0000099765, NIP 7792167451, operates the website and registration on XPADIA's behalf and according to its instructions. Event contact and assistance forwarding requests to XPADIA: info@MocneStronyCypru.pl.

AVATARLAND is also the formal Event organiser. It acts as a separate controller only to the extent necessary to meet its own legal obligations, handle complaints and establish, pursue or defend its own claims. This does not permit its own marketing based on consents given to XPADIA.

“Participating Developers and Partners” means exclusively real estate developers and partners that cooperate with XPADIA for the purposes of the specific Event.

2. What we receive and where it comes from

• From the person completing the form: the attendee's first and last name; company, position and reasons for attending in the application form; email, telephone number with country and calling code, preferred contact method and whether the form is completed by the attendee or an authorised representative.
• When contacting an office or assistant: that person's name and contact details instead of the attendee's contact details.
• RSVP declarations, including acceptance of the Terms, separate choices concerning image consent and marketing consent, including consent to marketing by Participating Developers and Partners, the communication channels covered by any marketing consent, the date and time, the versions and wording of the declarations and the submission reference.
• During administration: correspondence, invitation, RSVP and attendance status, and information necessary to deal with a request or issue.
• Technical data: HTTP request data, including IP address, date and browser information as needed to operate and secure the server; session identifier and form security data. We do not use these for advertising tracking.
• For analytics: page, device and performance statistics described in section 8, without registration contents.
• With separate consent: an identifiable image recorded in Event photographs or videos. Publication of an interview or statement is agreed separately.

If someone other than the attendee supplies details, the source is the person making the registration or nominating the office contact. We ask them to pass this information to the person concerned; independently, the controller meets its own information obligations, no later than first contact and within the limits in Article 14 GDPR. Application statements should not include health information, identity document details or other particularly sensitive information.

• In RSVP, a meal preference (regular, vegetarian, vegan or another meal request) if provided. Only describe the meal, not medical diagnoses, health history or religious beliefs. We do not infer those matters from a meal choice.

3. Purposes and lawful bases

1. Applications, guest selection, invitations, RSVPs, organisational communications and entry lists: Article 6(1)(f) GDPR, XPADIA's legitimate interest in organising a private business event, processing voluntary applications and keeping guests safe.
2. Contacting a nominated office or assistant: Article 6(1)(f) GDPR, the legitimate interest in providing organisational communications according to the attendee's preference. This is not consent to marketing to that person.
3. XPADIA marketing after the Event: Article 6(1)(a) GDPR and the Participant's consent. We use your data to present XPADIA's services, business cooperation opportunities, future events concerning investment and business activity in Cyprus. Where you have provided the required consent, we may contact you through any communication medium or channel permitted by applicable law, including telephone, email, SMS, MMS, WhatsApp and other electronic or messaging services. Where the marketing consent includes the Participating Developers and Partners, XPADIA may provide your name, telephone number and email address to those developers and partners so that they may contact you directly for their own marketing and promotional purposes concerning their real estate, investment and related business opportunities, through the communication channels covered by your consent.
4. Recording and publishing an image in Event coverage as part of XPADIA's marketing communications: Article 6(1)(a) GDPR and separate permission to publish the image under § 6 of the Event Terms.
5. Protecting the website and forms against abuse: Article 6(1)(f) GDPR, the legitimate interest in security and continuity of service.
6. AVATARLAND's own attendance-related obligations and complaints: Article 6(1)(b) GDPR where the person is a contracting party, and Article 6(1)(f) GDPR as necessary to deal with other applicants or representatives. Its own statutory duties: Article 6(1)(c) GDPR only where a legal obligation actually applies.
7. Evidence of consents and withdrawals and establishing, pursuing or defending claims: Article 6(1)(f) GDPR, the relevant controller's legitimate interest in demonstrating proper administration and protecting its rights. Such records are not used to continue marketing after consent is withdrawn.
8. Website traffic and performance measurement: XPADIA's legitimate interest in understanding content popularity and improving the website (Article 6(1)(f) GDPR insofar as personal data are involved). We do not link statistics to registrations or use them for advertising profiling. Analytics is independent of Event consents.
9. A limited confirmed participant list may be shared with the Participating Developers and Partners before the Event solely to prepare for and participate in it: Article 6(1)(f) GDPR, the legitimate interest in preparing relevant business meetings. This organisational list is not a marketing database. You may object on grounds relating to your particular situation. Meal preferences are used only to arrange catering on the same legitimate-interest basis and are shared only with authorised Event and catering staff, not developers or partners.

Providing basic form information is voluntary but necessary to process an application or RSVP. Missing required details prevent the form from being processed. The expression-of-interest form does not require acceptance of the Terms or collect image or marketing consent. After receiving an invitation, the guest confirms attendance through RSVP, accepts the Terms and may select consents. Image consent, XPADIA marketing consent and consent to marketing by Participating Developers and Partners are optional, not pre-selected and independent. Each marketing choice covers the purposes, recipients and communication channels stated next to it and in § 7 of the Terms, subject to valid consent and applicable law. The collective control selects all three choices, which can also be selected or cleared individually. Refusing or withdrawing marketing consent does not affect applications, invitations or attendance. Earlier consents remain limited to their original scope under § 10.2 of the Terms. Acceptance of the Terms does not replace these consents.

4. Recipients

XPADIA can access the applications needed for guest selection and the complete list of confirmed attendees. AVATARLAND and authorised staff use data within their assigned responsibilities. Hosting and email are provided by dhosting. For analytics, Cloudflare, Inc., USA, provider of Cloudflare Web Analytics, also receives technical data. Other recipients may include the Participating Developers and Partners, in advance and as needed only to prepare for and participate in the Event, as well as technical providers, Skyfall Warsaw reception and security personnel, photographers, videographers and legal advisers, only as necessary for a specific service or obligation. Processors act on documented instructions under the arrangements required by law.

If WhatsApp is used within a valid consent, its provider also processes contact and communication data under its own privacy policy. Providers of telephone, email and messaging services receive data only as necessary for the selected communication. XPADIA must verify the provider’s terms, data protection role and appropriate transfer safeguards before use; consent alone does not replace these requirements.

Where a Participant’s consent to marketing includes the Participating Developers and Partners, XPADIA may provide that Participant's name, telephone number and email address to those developers and partners for their own marketing and promotional purposes concerning their real estate, investment and related business opportunities, in accordance with the scope of the Participant's consent. XPADIA does not otherwise publish participant lists or application statements. Competent authorities may receive data where required by applicable law.

The organisational list shared before the Event contains only confirmed Participants’ first and last names and, where known, their company and position. It does not include telephone numbers, email addresses, dietary preferences or application statements and may not be used for marketing. The separate consent to marketing by Participating Developers and Partners is independent of XPADIA marketing consent. Adding a different recipient later does not extend an earlier consent.

Each developer or partner acts as an independent controller for its own subsequent marketing and must meet its own transparency and other legal obligations.

5. Photographs, video and external services

Image consent covers Event coverage as part of XPADIA's marketing communications exclusively on www.xpadia.com and the official XPADIA LinkedIn profile, until consent is withdrawn or the relevant purpose ends, whichever occurs first. It excludes print, paid advertisements, other profiles or websites, and AVATARLAND's or other partners' own marketing. Detailed rules and early withdrawal are set out in § 6 of the Event Terms.

Public posts can be accessed worldwide. LinkedIn also processes data under its own privacy policy. Global providers of publication and messaging channels may process data outside the European Economic Area. The controller may use such services only with appropriate safeguards, such as an adequacy decision or standard contractual clauses and any additional measures required. Information about the mechanism used and how to obtain a copy of the safeguards is available from info@xpadia.com. Sending data from Poland to XPADIA in Cyprus is not itself a transfer outside the EEA.

The Event website does not embed social plugins or external videos. Social links do not load social plugins. Separate Cloudflare analytics rules are set out in section 8. Any venue security CCTV is covered by its controller's separate notice and not by marketing image consent.

6. Retention periods

1. XPADIA retains personal data for as long as necessary for the purposes for which they were collected, including Event administration, maintaining records and fulfilling legal or contractual obligations. Personal data collected for Event administration will normally be retained until that administration is completed, expected by 6 November 2026, after which only data that remain necessary for another lawful purpose will be retained.
2. Personal data processed for marketing purposes on the basis of the Participant's consent will be processed until that consent is withdrawn or the relevant marketing purpose ends, whichever occurs first. Limited information necessary to demonstrate consent history, deal with claims, comply with legal obligations and respect an opt-out may be retained under a separate lawful basis; such information will not be used to continue marketing.
3. Personal data contained in Event photographs or other images processed on the basis of the Participant's image consent will be processed for the purposes described in this Privacy Policy until that consent is withdrawn or the relevant purpose ends, whichever occurs first. Withdrawal will not affect processing carried out before the withdrawal.
4. Consent evidence, complaints and claims records: as necessary to demonstrate proper conduct and no longer than the applicable limitation period, taking account of any legally effective suspension or interruption. Only necessary records are kept, not automatically all data.
5. Temporary form data: for session handling and correction of errors. Security records and backups are subject to the provider's retention cycle and restricted access and are not used for marketing. Details of the period applicable to a particular category of logs or backups can be obtained from the controller. In an incident, records may be preserved only for the investigation and relevant proceedings.
6. According to Cloudflare documentation, unsampled measurements are retained for 7 days and then sampled; reports cover the previous 6 months. Report availability is not a statement that all provider technical data are deleted at that point.

The private JSON archive described in section 8 follows the same purpose-based periods, not indefinite retention. After Event administration, unnecessary application and meal details are deleted; only the minimum data required for continuing lawful purposes remain. Developer and partner recipients set their own lawful retention periods and provide their own privacy information. XPADIA forwards applicable withdrawals or restrictions to recipients to whom it disclosed the data.

7. Your rights and withdrawing consent

Where provided by the GDPR, you have rights of access and a copy of your data, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time, with effect for that purpose.

Each consent may be withdrawn separately, without charge or giving a reason, via info@xpadia.com, through info@MocneStronyCypru.pl, by replying to a marketing email or during a marketing call. You may also use an unsubscribe link where provided or withdraw through the relevant messaging service where available. Withdrawal may cover all marketing channels or specified ones. Withdrawal does not affect lawful processing before withdrawal or attendance at the Event. Organisational messages necessary to arrange attendance may still be sent.

Requests must be handled without undue delay, normally within one month. If an extension is permitted because of complexity or the number of requests, you will be told about it and the reasons. Identity is checked only as necessary; a copy of an identity document is not routinely required.

You may complain to a competent supervisory authority, particularly the Polish Personal Data Protection Office or the Cyprus data protection authority. Under the GDPR, you may choose the authority for your habitual residence, place of work or the alleged infringement.

8. Sessions, analytics and security

The website uses the necessary CYPRUSEVENT session cookie to secure forms and display errors or confirmation. It is a session cookie with HttpOnly, SameSite=Lax and Secure on HTTPS. Blocking cookies may prevent submissions. Fonts and images remain local; no advertising cookies or advertising profiling are used.

Cloudflare Web Analytics runs by default during visits, without a consent banner. Its script comes from static.cloudflareinsights.com and measurements go to cloudflareinsights.com. According to Cloudflare's description, measurement uses neither cookies nor browser storage. The provider receives the IP address during connection but states that it discards it at the data centre without keeping it in the service's core databases or logs.

Reports cover visited pages, referral sources, country, device type, browser, operating system, loading times and performance. We do not send form contents, names, phone numbers or emails, or link statistics to registrations. Cloudflare reporting dimensions.

We do not store analytics choices in cookies or localStorage. For data matters, including an objection to processing based on legitimate interests, contact info@xpadia.com. You can also block the measurement script in your browser without preventing use of the forms. Aggregate reports are not used to identify specific attendees.

Cloudflare operates globally; technical data may be processed outside the EEA, including in the USA. Cloudflare's data processing terms provide transfer mechanisms, including standard contractual clauses where safeguards are required. Information about the applicable mechanism and copies of safeguards are available via info@xpadia.com. See also Cloudflare's privacy policy.

Forms use transport encryption on HTTPS, protection against forged requests, validation and anti-spam limits. Submissions are sent to Event staff by email with a JSON attachment, not placed in a public file or directory. Access must be restricted to authorised people. Invitations are decided individually by people; the form does not make solely automated attendance decisions or use advertising profiling.

Each successfully submitted form is first saved as a separate JSON file in a private server directory outside the website’s public directory, accessible only to authorised staff through hosting access. It records the submitted fields, declarations, their wording and version, time, reference and mail-notification status. An email with a JSON attachment is then sent to the Event team. If email fails, the saved submission remains available for staff to process; the archive is not a public directory or an automatic transfer to developers and partners.