Privacy Policy (GDPR)

v2026-10-31

Last updated: 31 October 2026.

This policy explains which personal data LEX ESTATES collects, why we need it, who receives it, how long we keep it and which rights you have. It applies to lex-estates.com and to every property selection ordered through it.

1. Who controls your data

The controller is RAZMIK KHACHATRIAN LEX AGENCY, NIP 8971947077, REGON 540489158, ul. Długa 57c, 53-633 Wrocław, Poland ("we", "us"). LEX ESTATES is our brand.

For any privacy question or request, write to request@lex-estates.com or call +48 572 288 621.

2. What we collect

We collect only what is needed to prepare your selection, take payment and keep lawful records:

• Identity and contact data: first name, surname, email address, phone or messenger contact.
• Request data: country, city, property type, budget, number of properties and any comments you add.
• Billing data: postal address and, for companies, company name and tax number.
• Payment data: order number, amount, currency, status and PayPal transaction reference. We never see or store your card or PayPal login details.
• Technical data: a salted hash of your IP address for abuse protection, plus standard hosting logs (browser, date and time, pages requested).
• Correspondence: messages you send us by email, phone, WhatsApp or Telegram.

3. Why we use it and on what legal basis

• To prepare and send the selection you ordered and to answer your questions: performance of a contract or steps before a contract (GDPR Art. 6(1)(b)).
• To issue accounting documents and keep tax records: legal obligation (Art. 6(1)(c)).
• To protect the site, prevent fraud and defend legal claims: legitimate interests (Art. 6(1)(f)).
• To use analytics or marketing cookies, if we ever enable them: your consent (Art. 6(1)(a)), which you can withdraw at any time.

4. Who receives your data

We do not sell personal data. We share it only as far as each recipient needs it:

• PayPal, which processes your payment as an independent controller.
• Cloudflare, which provides the Turnstile anti-abuse check on the form.
• Our hosting provider 1Gb.ua and our email provider Google Workspace, as processors.
• Our lawyers and agents and, where your request requires it, local professionals or sellers, but only after you ask us to take the matter further.
• Authorities and courts, where the law requires it.

5. Transfers outside the EEA

Some recipients operate outside the European Economic Area, including Ukraine and the United States. Where no adequacy decision applies, we rely on the European Commission's standard contractual clauses or another safeguard allowed by the GDPR. You can ask us for a copy of the safeguards.

6. How long we keep it

• Requests that did not lead to an order: up to 12 months.
• Orders and related correspondence: up to 5 years after the order.
• Accounting records: for the period required by Polish tax law, normally 5 years from the end of the tax year.
• Technical logs: up to 12 months.

After these periods data is deleted or anonymised, unless we must keep it for a legal claim.

7. How we protect it

The site uses encrypted connections. Request data is stored on the server in encrypted form, and the decryption key is not kept on the server. Access is limited to the people who work on your order, and our lawyers and agents are bound by confidentiality. If a breach is likely to put your rights at risk, we will notify you and the supervisory authority within the legal time limits.

8. Your rights

Under the GDPR and, where they apply, RODO, the UK GDPR, the CCPA and PIPEDA, you can:

• Ask for access to your data and a copy of it.
• Have inaccurate data corrected.
• Have data erased where there is no longer a lawful reason to keep it.
• Restrict processing or object to it.
• Receive your data in a portable format.
• Withdraw consent at any time, which does not affect earlier processing.

9. Complaints

Please contact us first, and we will reply within 30 days. You may also complain to your local data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes UODO), ul. Moniuszki 1A, 00-014 Warszawa.

10. Automated decisions and children

We make no decisions with legal effect about you solely by automated means. The site is intended for adults, and we do not knowingly collect data from anyone under 18.

11. Changes

We may update this policy. The current version and its date are always published on this page.

PayPalCloudflare Turnstile

RAZMIK KHACHATRIAN LEX AGENCY