Privacy Policy and Terms of use.

1. The controller

The controller of personal data processed through urba.com is URBA Sp. z o.o., ul. Zabłocie 23/25, 30-701 Kraków, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000378692, NIP (tax ID) 6772354669, REGON 121461687, share capital PLN 35,000,000 paid in full ("URBA", "we"). For anything about your personal data, write to [email protected] or to the address above.

This policy covers urba.com. It is written under the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and Polish law, which apply to URBA wherever you read the site from.

2. When you email us

The forms on the Contact and Build with URBA pages, and the "Write to us" buttons across the site, do not send anything through the site: they prepare an email in your own email app, and nothing reaches us until you send it. We then receive what you chose to write: usually your name, your email address and your message, and, if you add them, your phone number, your company, your region, the home or project you are asking about and anything else you include.

We use it to answer you and, if you ask, to prepare an offer, check a plot, give a presentation or start a partnership conversation. The legal basis is Article 6(1)(b) GDPR where you ask for something before a possible contract (an offer for a home, a project, a partnership), and Article 6(1)(f) GDPR, our legitimate interest in answering the messages we receive, in every other case. Once a contract follows, it governs the data, together with our legal obligations (Article 6(1)(c) GDPR), such as accounting and tax rules. We may also keep correspondence to establish or defend legal claims (Article 6(1)(f) GDPR).

Writing to us is voluntary, but without your contact details we cannot answer. We do not add you to any mailing list, we do not sell or share your data for advertising, and we make no decisions about you by automated means.

3. When you visit the site

Like every website, ours receives technical data with each request: the IP address, the date and time, the page or file requested, the response, the referring page and the browser and device type. Our hosting and network providers (section 5) process these records to deliver the pages, to keep the site available and to protect it from attacks and abuse. The network provider also uses the country of your IP address to send visitors in Poland to urba.pl, URBA's Polish website. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in running a secure website.

The site uses no analytics, no advertising or social-media trackers and no embedded content from other services: its fonts, films, pictures and 3D models are served from our own servers.

4. What the site keeps in your browser

The site sets no tracking or advertising cookies. To make the features you use work, it keeps a few notes in your browser's storage; they are not sent to us or to anyone else:

urba-market, urba-state (local storage, until you clear it): the market and, in the United States, the state you chose, so that prices and units stay in your market from page to page.

urba-coll-view (local storage, until you clear it): whether you look at the catalog as cards or as a list.

nsl5_lens, nsl6_story (local storage, until you clear it): the story and the reader you chose on the Stories page.

urba31:ctx (session storage, deleted when you close the tab): the home, project, market or partnership you were looking at when you opened the contact form, so the form can show it.

urba32j (session storage, deleted when you close the tab): the path you chose in the menu.

urba_stay (a cookie, one year): set only if you open urba.com with ?stay=1 from Poland, so the site no longer sends you to urba.pl. Our network provider may also set a strictly necessary security cookie (such as __cf_bm) to tell people from automated traffic.

Under EU and Polish law (Article 5(3) of Directive 2002/58/EC and Article 399 of the Polish Electronic Communications Law), storage that is strictly necessary for a feature you use does not need your consent; this is why the site shows no cookie banner. You can delete these notes at any time in your browser's settings; the site then simply asks again.

5. Who receives the data

We share personal data only as far as needed for the purposes above, with:

Service providers who process it on our behalf and under a data processing agreement: Railway Corporation (United States), which runs the servers of urba.com; Cloudflare, Inc. (United States), which provides its domain name service, network delivery and protection against attacks; and the provider of our email hosting in Poland.

Companies of the URBA group, where your message concerns them, so that they can answer you: for example MABUDO for catalog homes in Poland, UCUBER for modular buildings or URBA Architects for design. Each then processes your data as a controller under its own privacy policy.

Authorities and advisers, where the law requires it or where it is needed to establish or defend legal claims.

6. Data outside the European Economic Area

Railway and Cloudflare are based in the United States, so technical data may be processed there. Such transfers rely on the EU–U.S. Data Privacy Framework where the recipient is certified under it, or on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can ask us for a copy of the safeguards.

7. How long we keep it

Correspondence: as long as the conversation needs, then up to three years after our last exchange to answer follow-up questions and to establish or defend claims, unless a contract follows, in which case the periods required by law for that contract apply (for accounting records, five years from the end of the year in question). Technical logs: for a short period, as a rule no longer than 30 days, unless they are needed to investigate a security incident. Browser storage: as described in section 4.

8. Your rights

You have the right to access your data and receive a copy, to have it corrected, to have it erased, to restrict its processing, to data portability where processing is based on a contract, and to object at any time to processing based on our legitimate interest (Articles 15 to 21 GDPR). To use them, write to [email protected]; we answer within one month. You also have the right to lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority of the country where you live or work.

Visitors from the United States: we do not sell or share personal information for cross-context behavioral advertising, and the same rights to know, correct and delete apply to you.

9. Other websites, children, changes

The site links to other websites, including those of the group's companies and projects (for example mabudo.com or urba.pl); each has its own privacy policy, and this one covers urba.com only. The site is not directed at children under 16. We will publish any change to this policy on this page, with its date.

This policy is in effect from 27 October 2026.