1. Data of the Administrator of Personal Data
We kindly inform you that the administrator of personal data of Users of Real Estate in the holiday complex “Rest in Nature” and the website www.odrestwajwnaturze.pl (” Service”) is a company under the company Rest w Naturze Limited Liability Company with registered office in Wieliczka, entered in the Register of Entrepreneurs under KRS no.: 0000471813, TIN: 6832081704, REGON: 122914760 (hereinafter “Administrator” or “Company”).
Data subjects may contact the Controller using the following contact information:
(a) e-mail address: kontakt@odpoczywajwnaturze.pl,
b) address Physical: Brother Alojze Kosiba Street 8/4, 32-020 Wieliczka.
2. Purposes and basics of personal data processing
In order to provide services according to the business profile, the Administrator processes your personal data — for various purposes, but always in accordance with the law. Personal data provided will be processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC ( General Data Protection Regulation), (“GDPR”). We obtain personal data from you in the process aimed at concluding a contract (booking your stay and performing services related to your stay at the Cottage). Below you will find the specific purposes of processing your personal data together with legal grounds.
A. In order to make the valuation of the service, reservation of the service and the performance of the service, as well as in the case of concluding other agreements related to the business profile, we may process such personal data as:
• Name and Surname;
• Address (street, house/apartment number, zip code and city);
• Telephone number;
• Email address;
• Company details including TIN (in case of issuing f-ry VAT to the enterprise);
• Registration number of the vehicle belonging to the Customer (in case of use of parking);
• Basic bank account details to confirm the transfer;
• Identity Document/PESEL No;
• Nationality information;
• Your payment card number and other card details, as well as credentials and other billing and account data related to mobile billing;
• Reservation number. The
legal basis for such data processing is Art. 6 para. 1 (b) GDPR, which allows you to process personal data if they are necessary to perform the contract or take actions aimed at concluding a contract.
Children 's data such as name, surname, nationality and date of birth shall only be collected from their parents or legal guardians to determine their age and their discounts, and for statistical purposes.
B. In order to contact you via the contact form, we will process such data as:
• Name,
• Email address,
• Phone No, if specified. The
legal basis for such data processing is Art. 6 para. 1 lit. f GDPR, which allows you to process personal data, if in this way the Administrator of Personal Data realizes his legitimate interest (in this case, the Administrator's interest is to perform and maintain contact with Customers);
C. In order to process the complaint, we process personal data such as:
• Name;
• Address (street, house/apartment number, zip code and city);
• Telephone number;
• Email address;
• Booking number;
• Possible number bank account — if there is a refund. The
legal basis for such data processing is Art. 6 para. 1 (b) GDPR, which allows you to process personal data if they are necessary to perform the contract or take actions aimed at concluding a contract.
D. In order to issue an invoice and fulfill other obligations under tax law, such as, for example, keeping accounting records for 5 years, we process such personal data as:
• Name;
• Company;
• Address of residence or address registered office;
• TIN number;
• Reservation number. The
legal basis for such data processing is Art. 6 para. 1 lit. c GDPR, which allows you to process personal data if such processing is necessary to comply with the Personal Data Controller's obligations under the law;
E. In order to examine satisfaction with Our services, audits, enhancement and modification of our services we process personal data such as:
• Email address;
• Booking number;
• Name;
• Comments or suggestions of guests. The
legal basis for such data processing is Art. 6 para. 1 lit. f GDPR, which allows you to process personal data, if in this way the Administrator of Personal Data realizes his legitimate interest (in this case, the Administrator's interest is to know the opinions of clients about services provided to adapt them to the needs and expectations of those interested);
F. For direct marketing purposes via e-mail or physical address of the
Customer If you express your consent, personal data in the form of an email address may be used for transfer marketing information about the offer of the Administrator. The legal basis for the processing of Personal Data in this case is the legitimate interest of the Administrator — Art. 6 para. 1 lit. f GDPR, implemented in connection with your consent, consisting in advertising and marketing of the services of the Administrator and his offer. The Administrator will only pursue this purpose if you agree to receive commercial information at the specified e-had address. You may withdraw this consent at any time, which, however, is without affecting the lawfulness of the processing of your personal data before withdrawing your consent. The withdrawal of consent may be carried out by sending an email to: kontakt@odpoczywajwnaturze.pl.
The administrator may also carry out the marketing of his services via traditional mail to the address provided by you. The basis for the processing of Personal Data in this case will be the legitimate interest of the Administrator, consisting in marketing the services of the Administrator and its offer. You may at any time object to the processing of Personal Data for this purpose by sending an email to: Contact @odpoczywajwnaturze .p l.
G. For the creation of records and records related to the GDPR, including e.g. the register of customers who objected in accordance with the GDPR, we process such personal data as:
• Name;
• Email address.
GDPR regulations impose specific documentation obligations on us to demonstrate compliance and accountability. If you object, for example, to the processing of your personal data for marketing purposes, we need to know who you do not apply direct marketing. The
legal basis for such data processing is Art. 6 para. 1 lit. c GDPR, which allows you to process personal data if such processing is necessary to comply with the Personal Data Controller's obligations under the law (provisions contained in the GDPR); and, Art. 6 paragraph. 1 lit. f GDPR, which allows you to process personal data, if this means the Administrator of Personal Data realizes his legitimate interest (in this case, the Administrator's interest is to have knowledge about persons who exercise their rights under the GDPR).
H. In order to establish, investigate or defend against claims, we process personal data such as:
• Name (if given) or possibly company;
• Address of residence (if specified);
• PESEL number or TIN number (if specified) );
• Email address;
• IP address;
• Reservation number. The
legal basis for such data processing is Art. 6 para. 1 lit. f of the GDPR, which allows you to process personal data, if in this way the Administrator of Personal Data realizes his legitimate interest (in this case, the Administrator's interest is to have personal data, which allow to establish, assert or defend against claims, including customers and third parties);
I. For analytical purposes, i.e. examining and analyzing activity on the website owned by the Controller, we process such personal data as:
• Data and time of site visits;
• Operating system type;
• Approximate location;
• IP address
• Type of web browser used to view the site;
• Time spent on the site;
• Subpages visited;
• Subpage where completed the contact form. The
legal basis for such data processing is Art. 6 para. 1 lit. f GDPR, which allows you to process personal data, if in this way the Administrator pursues his legitimate interest (in this case, the Administrator's interest is to know the activities of clients on the website );
J. In order to use cookies on the website of the Website we process such text information (cookies will be described in a separate section). The legal basis for such processing is Art. 6 para. 1 lit. a GDPR, which allows you to process personal data on the basis of voluntarily granted consent (upon first entry to the website, a request for consent
to the use of cookies appears); K. we process such personal data as:
• IP address;
• Server date and time;
• Information about the web browser;
• Information about the operating system
— This data is stored automatically in the so-called server logs, every time you use the site belonging to the Administrator. Administration of the Service without the use of the server and without this automatic save would not be possible. The legal basis for such data processing is Art. 6 para. 1 lit. f GDPR, which allows you to process personal data, if this way the Administrator of Personal Data realizes his legitimate interest (in this case the Administrator's interest is to administer the Service);
4. The right to withdraw consent
A. If the processing of personal data is carried out on the basis of consent, you may withdraw this consent at any time.
B. If you would like to withdraw your consent to the processing of personal data, then for this purpose you should follow point 10 of point F. If the processing of your personal data took place on the basis of consent, its withdrawal does not result in the processing of personal data. up until that point it was illegal. In other words, until the withdrawal of your consent, we have the right to process your personal data and its cancellation does not affect the lawfulness of the existing processing.
5. The requirement to provide personal data
A. Providing any personal data is voluntary and depends on your decision. However, in some cases, the provision of certain personal data is necessary in order to meet your expectations regarding the use of the services.
B. In order to use the Administrator's services, it is necessary to provide the data indicated in paragraph 2 A of this Privacy Policy.
C. In order for you to receive an invoice for services, it is necessary to provide all the data required by tax law — without this we are unable to issue an invoice properly.
D. In order to be able to contact you by phone about matters related to the implementation of the service, you need to provide a telephone number and e-mail address — without this we are unable to make a phone contact or send a confirmation of your reservation.
6. Automated decision making and profiling
We kindly inform you that we do not make automated decision-making, including based on profiling. The content of the query, which is sent through the form, is not subject to evaluation by the IT system.
7. Recipients of personal data
A. Like most entrepreneurs, in our business we use the help of other entities, which often involves the need to provide personal data. Accordingly, if necessary, we provide your personal data to lawyers who cooperate with us, fast payment companies, accounting firm, hosting company, IT services companies, the company responsible for sending sms messages, and also the insurance company (if there was a need to repair the damage).
B. In addition to this, it may be that, for example, on the basis of the relevant law or decision of the competent authority, we will also have to provide your personal data to other authorities or entities.
C. We will provide you with additional clarification at any time regarding the transfer of personal data, in particular when this issue is of concern to you.
8. The period of processing of personal data
A. In accordance with applicable law, we do not process your personal data “indefinitely”, but for the time that is needed to achieve the stated goal. After this period, your personal data will be irreversibly deleted or destroyed.
B. In a situation where we do not need to perform other operations on your personal data than the storage of your personal data (e.g. when we store the contents of the order for defense against claims), we additionally secure it until permanent deletion or destruction — through pseudonymization. Pseudonymization consists in such an encryption of personal data, or a set of personal data that without an additional key it cannot be read, and therefore such information becomes completely useless for an unauthorized person.
C. Regarding individual periods of processing of personal data, we kindly inform you that we process personal data for a period of:
• duration of the contract — in relation to personal data processed for the conclusion and performance of the contract;
• 3 years or 6 years + 1 year — in respect of to personal data processed for the purpose of establishing, investigating or defending claims (the length of the period depends on whether or not both parties are traders);
• 6 months — with regard to personal data that was collected at the valuation of the service and at the same time did not occur immediate conclusion of the contract;
• 5 years +1 year — in respect of personal data involving the fulfillment of the obligations under tax law;
• until the consent is withdrawn or the purpose of processing is reached, but not more than 5 years — in relation to personal data processed on the basis of consent;
• until effective objection or achievement of the purpose of processing, but not more than 5 years — in relation to personal data processed on the basis of the legitimate interest of the Controller of Personal Data or for the purposes of marketing;
• until deupdated or unusable, but not more than 3 years — for personal data processed mainly for analytical purposes, use of cookies and website administration.
D. Periods in years we count from the end of the year in which we started processing personal data to improve the process of deleting or destroying personal data. Separate counting of the deadline for each contract concluded would involve significant organisational and technical difficulties as well as significant financial expenditure, so establishing a single date for the deletion or destruction of personal data allows us to manage this process more efficiently. Of course, if you exercise your right to forget, such situations are dealt with individually.
E. An additional year related to the processing of personal data collected for the performance of the contract is dictated by the fact that you may hypothetically make a claim just before the limitation period expires, the request may be served with a significant delay or you may be able to claim misstate the deadline of limitations on your claim.
9. Powers of data subjects
A. We kindly inform you that you have the right to:
• access your personal data;
• rectification of personal data;
• erasure of personal data;
• restriction of the processing of personal data;
• objection to the processing of personal data;
• to be forgotten in the event that other laws permit;
• receipt of a copy of data
• transfer of personal data.
B. We respect your rights under the data protection laws and strive to facilitate their implementation to the highest extent possible.
C. We indicate that these powers are not absolute, and therefore, in some situations, we may lawfully refuse you to comply with them. However, if we refuse to take into account the request, it is only after careful analysis and only if the refusal to take into account the request is necessary.
D. Regarding the right to object, we clarify that at any time you have the right to object to the processing of personal data on the basis of the legitimate interest of the Controller of Personal Data (these are listed in point III) in connection with you special situation. However, you must remember that in accordance with the rules we may refuse to take into account your objection if we demonstrate that:
• there are legitimate grounds for processing which are overriding your interests, rights and freedoms or
• there are grounds for determining, to pursue or defend claims.
E. Moreover, you may object at any time to the processing of your personal data for marketing purposes. In such a situation, after receiving an objection, we will cease processing for this purpose.
10. Right to lodge a complaint
if you believe You may lodge a complaint with the President of the Office for Personal Data Protection.
12. Final provisions
A. To the extent not regulated by this Privacy Policy, the provisions on the protection of personal data apply.
B. The Administrator may make amendments to this Privacy Policy subject to the provision that the services made prior to the amendment of the Privacy Policy applies its version applicable at the time of booking of the service.
C. Changes to the Privacy Policy shall not infringe upon the rights acquired by the guests.
D. Information about the amendment of the Privacy Policy will be published on the Website for 14 calendar days prior to the entry into force of these changes.
34-602 Laskowa 986