EN

Privacy policy

PRIVACY POLICY

Website for booking and renting a holiday house

Effective date: [do-uzupełnienia]

Website address: [do-uzupełnienia]

This Privacy Policy describes how personal data are processed in relation to people visiting the Website, contacting the Accommodation Provider, and making bookings and payments for stays at the holiday house.

1. Personal data controller

The controller of personal data is [do-uzupełnienia], with its registered office or business address at [do-uzupełnienia], Tax Identification Number (NIP): [do-uzupełnienia], registration details: [do-uzupełnienia], hereinafter the “Controller”.

Contact the Controller regarding personal data protection:

  • email address: [do-uzupełnienia];
  • postal address: [do-uzupełnienia];
  • other contact details, if designated: [do-uzupełnienia].

Data Protection Officer, if appointed: [do-uzupełnienia].

2. What data do we process and where do we obtain them?

The scope of data depends on how you use the Website:

  • Contact and enquiry form: name or business name, email address, telephone number, message content and other information you provide voluntarily.
  • Booking a stay: data needed to handle the Booking, in particular contact details, stay dates, number of Guests, information about the service ordered, billing details and payment information. Detailed form fields: [do-uzupełnienia].
  • Invoices and settlements: data required by tax and accounting regulations, including, where applicable, a tax identification number and business details.
  • Website use: technical data, such as an IP address or related technical information, cookie identifiers, device and browser information, visit date and time, pages visited and events on the Website, depending on the configuration of the tools and consent settings.
  • Correspondence and claims: information contained in messages, complaints or documents needed to clarify a matter or pursue claims.

As a rule, we obtain data directly from you. If one person makes a Booking and provides information about other Guests, that person should inform those Guests about the processing of their data where required. We may receive payment-status information from the Payment Operator. As a rule, we do not receive full payment instrument details, such as the full card number, where these are handled by the Operator.

3. Purposes and legal bases for processing

The Controller processes data only for specified purposes and on an appropriate legal basis:

  • Handling messages from the contact form, answering questions and taking steps before entering into an agreement — Article 6(1)(b) GDPR, where the message concerns steps taken at the data subject's request before entering into an agreement, or Article 6(1)(f) GDPR, namely the Controller's legitimate interest in handling correspondence and responding to enquiries.
  • Accepting Bookings, concluding and performing accommodation agreements, communicating about the stay, and handling changes and cancellations — Article 6(1)(b) GDPR.
  • Processing payments and settlements, issuing sales documents and complying with tax or accounting obligations — Article 6(1)(b) and/or (c) GDPR, depending on the specific activity.
  • Establishing, pursuing or defending claims and demonstrating how an agreement was performed — Article 6(1)(f) GDPR, namely the Controller's legitimate interest.
  • Ensuring the security and proper functioning of the Website, preventing abuse and handling technical logs — Article 6(1)(f) GDPR, to the extent necessary and proportionate.
  • Visitor statistics and analysis of Website use through Google Analytics — after obtaining any consent required for the relevant cookies or similar technologies: Article 6(1)(a) GDPR for processing based on consent and Article 399 of the Polish Electronic Communications Law for storing information on, or accessing information from, the user's terminal equipment.

If data are processed on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, nor does it affect processing based on another legal basis.

4. Do you have to provide your data?

Providing data marked as required in a form is necessary to handle an enquiry or Booking. Failure to provide required data may make it impossible to respond, conclude or perform an agreement, or issue the appropriate settlement document. Providing additional data is voluntary unless they are required by law or objectively necessary to provide the service ordered.

Marketing consent is not required to submit an ordinary enquiry or make a Booking. The Controller will not use contact details to send electronic marketing without the legal basis and consents required by law.

5. Recipients of data

Data may be disclosed only to the extent necessary to the following categories of recipients:

  • hosting, server, email, backup and IT service providers;
  • provider of the booking system and/or Website software: [do-uzupełnienia];
  • electronic payment operator: [do-uzupełnienia];
  • accounting office, accountants, legal and tax advisers, to the extent necessary to provide their services;
  • Google Ireland Limited and/or other Google group entities, to the extent determined by the configuration of Google Analytics and the service documentation;
  • public authorities or other authorised entities, where disclosure is required by law.

Where required, the Controller enters into data processing agreements with providers processing data on its behalf. List of providers and their roles in processing: [do-uzupełnienia].

6. Transfers of data outside the European Economic Area

Some providers of online tools may process data outside the European Economic Area or enable access to data from third countries. This may apply in particular to global technology providers. Where such a transfer takes place, the Controller ensures that it is based on a mechanism provided for in Chapter V GDPR, such as an adequacy decision or standard contractual clauses, together with additional safeguards where required.

The scope and basis of any transfers related to Google Analytics depend on the account configuration, the service terms and the provider's current documentation. Details of transfer mechanisms should be checked in Google's documentation and the documents of providers used on the Website: [do-uzupełnienia].

7. Data retention period

Data are retained no longer than necessary for the purpose for which they were collected, taking into account legal obligations and limitation periods for claims. The following criteria apply:

  • Enquiries without an agreement: for the time needed to handle the correspondence and afterwards for the period necessary to demonstrate proper handling of the matter or defend against claims, generally no longer than [do-uzupełnienia].
  • Data related to a Booking and the stay: for the duration of the agreement and afterwards until the relevant limitation periods expire.
  • Accounting and tax documents: for the period required by applicable tax and accounting regulations.
  • Data processed to pursue or defend claims: until the relevant limitation periods expire or, if proceedings have been initiated earlier, until those proceedings are finally concluded.
  • Google Analytics data: according to the retention setting in the service and Google's rules; current configured period: [do-uzupełnienia].
  • Cookie consent records: for the period needed to demonstrate the consent status and manage changes or withdrawal; details and retention period for consent records: [do-uzupełnienia].

8. Cookies and Google Analytics

The Website may use cookies and similar technologies. Cookies are small pieces of information stored on a user's device that help the Website function properly or enable certain features.

  • Essential cookies — support basic Website functions, such as maintaining a booking session, protecting forms or remembering settings needed for a selected feature to work.
  • Analytics cookies — may be used to compile visitor statistics and analyse how the Website is used through Google Analytics.
  • Other cookies — if introduced in the future, their purposes and categories will be described in the consent panel and cookie notice before they are activated.

Cookies or similar technologies that require prior consent will not be used until consent has been obtained. You can accept, reject or customise optional cookie categories using the consent panel. You can later withdraw or change your consent using the cookie settings panel available via this link: [do-uzupełnienia].

The Website uses Google Analytics, an analytics tool provided by Google, to analyse traffic, popular pages and how Website features are used. Depending on the configuration, the tool may process online identifiers, device and browser information, event and page-view data, referral source and approximate location. The scope of data and retention period depend on the service configuration and current settings.

Google's information about data processing in Google Analytics is available in the provider's documentation: https://support.google.com/analytics/answer/12017362?hl=en

Google Analytics is configured so that technologies requiring consent are not activated before consent is obtained. Consent Mode alone does not replace a mechanism that allows users to make a choice. Cookie categories, providers and retention periods: [do-uzupełnienia].

9. Your rights

Subject to the conditions set out in the GDPR, you have the following rights:

  • the right to access your data and obtain a copy;
  • the right to rectify inaccurate data or complete incomplete data;
  • the right to erasure where the legal conditions are met;
  • the right to restrict processing;
  • the right to data portability, in cases specified by the GDPR;
  • the right to object to processing based on legitimate interests, for reasons relating to your particular situation;
  • the right to withdraw consent at any time where processing is based on consent;
  • the right to lodge a complaint with the President of the Polish Personal Data Protection Office.

To exercise your rights, contact the Controller at [do-uzupełnienia]. The Controller will respond without undue delay, generally within one month of receiving the request. This period may be extended under the GDPR; you will be informed if this happens. Not every right applies in every situation; its scope depends, among other things, on the legal basis and purpose of processing and the Controller's legal obligations.

A complaint may be lodged with the President of the Polish Personal Data Protection Office. Information on exercising your rights is available at: https://uodo.gov.pl

10. Automated decision-making and profiling

The Controller does not make decisions concerning Customers that produce legal effects or similarly significantly affect them solely on the basis of automated processing, including profiling. Google Analytics may automatically analyse statistical data about Website use but is not used to automatically decide whether to conclude an agreement with a particular Customer.

11. Data security

The Controller applies appropriate technical and organisational measures to protect data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access to data is limited to persons and entities that need it to perform specific tasks. However, no method of data transmission or storage can guarantee absolute security.

12. Links to other websites

The Website may contain links to external services, including payment operators and social media services. Once you visit another service, its operator's privacy rules apply. We recommend reviewing its documents before using external services.

13. Changes to this Privacy Policy

This Privacy Policy may be updated if the operation of the Website, the scope of data processing, service providers or applicable law changes. The current version will be published on the Website with the date of the latest update. A change to this Privacy Policy may not deprive data subjects of rights granted by law.