Privacy policy

2. Scope of processed data

We collect only data necessary to complete the booking and contact you. Depending on the interaction, this may include:

• Booking data — full name, e-mail address, phone number, stay dates, number of guests, selected apartment.
• Payment data — processed solely by Stripe (payment gateway operator). We do not have access to full card numbers — we only receive payment confirmation and the last 4 digits of the card.
• Contact form data — name, e-mail, message content.
• Technical data — IP address (anonymised in analytics), browser type, operating system, country — collected automatically by the server and Google Analytics (if you consent to analytics cookies).

3. Purposes and legal bases of processing

We process your data for the following purposes:

4. Data recipients

We share your data with the following processors, only to the extent necessary to fulfil a specific purpose:

Data may also be made available to authorities authorised by law (tax offices, courts, police) — only to the extent prescribed and following the proper procedure.

We have a data processing agreement (Art. 28 GDPR) or equivalent contractual and technical safeguards with each of the listed entities.

5. Retention periods

• Booking and payment data — 5 years from the end of the financial year in which the agreement was performed (required by Art. 70 of the Polish Tax Ordinance and the Accounting Act).
• Contact form data — until the correspondence ends or consent is withdrawn, no longer than 12 months.
• Technical data (server logs) — 30 days from generation, unless a longer period is necessary to investigate a security incident.
• Analytics data (Google Analytics) — up to 14 months (default GA4 setting, compliant with GDPR Art. 5(1)(e)).
• Cookie consents — until withdrawn or the scope of processing changes (after which we will ask for renewed consent).

6. Your rights

In connection with the processing of your data, you have the following rights:

• Right of access — you can find out what data we process about you.
• Right to rectification — you can request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — you can request deletion, provided it does not conflict with legal obligations (e.g. tax law).
• Right to restriction of processing — in defined situations.
• Right to data portability — receiving data in a structured format, including transfer to another controller.
• Right to object — to processing based on legitimate interest.
• Right to withdraw consent — at any time, without affecting the lawfulness of earlier processing.

To exercise these rights, contact us at biuro@pietrynaapartments.pl. We respond within 30 days.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

7. Cookies and similar technologies

The site uses cookies in four categories: necessary, functional, analytics and marketing. A detailed description — including the list of specific cookies, providers and retention periods — is available in our Cookie policy.

On your first visit we show a consent banner. You can change your choice at any time by clicking "Cookie settings" in the footer.

8. Data security

We apply appropriate technical and organisational measures to protect data from accidental or unlawful destruction, loss, modification or disclosure. This includes:

• Connection encryption (HTTPS/TLS) — all traffic on the site
• Backup encryption
• Data access limited to authorised personnel
• Payments processed by Stripe — certified PCI DSS Level 1
• Regular software updates and security incident monitoring

9. Automated decision-making

We do not make decisions based solely on automated processing which would produce legal effects concerning you or similarly significantly affect you. We do not use profiling.

10. Changes to the policy

We reserve the right to make changes to this policy. For significant changes (e.g. adding a new data recipient) we will notify you appropriately — via a banner on the site or an e-mail. Each change will be published with the date of update.