PRIVACY POLICY

I. General information

This Privacy Policy sets out the rules for processing personal data and using cookies in connection with the use of the apartamentydora.pl website, operated on the WordPress system, and in connection with the provision of short-term Apartment rental services.

II. Data controller

The controller of personal data is:

• TYRCHAN SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in [address], KRS: 0000956017, NIP: 7872138612, REGON: 521306721,
• or the private rental operator – depending on the entity indicated in the booking confirmation.

Contact for personal data matters: biuro@apartamentydora.pl.

III. Data Protection Officer

The controller has not appointed a Data Protection Officer. For matters concerning personal data, please contact the controller directly.

IV. Purposes and legal bases of processing

Personal data is processed for the following purposes:

• conclusion and performance of the rental agreement (Article 6(1)(b) GDPR),
• payment processing (Article 6(1)(b) GDPR),
• fulfilment of legal obligations (Article 6(1)(c) GDPR),
• handling complaints and pursuing claims (Article 6(1)(f) GDPR),
• ensuring website security and preventing abuse (Article 6(1)(f) GDPR),
• website traffic analysis (Article 6(1)(a) GDPR – consent),
• keeping statistics and optimising the website (Article 6(1)(f) GDPR).

V. Scope of processed data

The controller processes in particular:

• identification data (first name, surname),
• contact data (e-mail, phone),
• address and invoicing data (including Tax ID/NIP),
• booking and payment data,
• IP address, online identifiers, data on website activity.

VI. Source of data

Personal data is obtained directly from the Customer through booking and contact forms, the reservation system, or during contact with the controller.

VII. Data recipients

Data may be transferred to:

• the payment operator Tpay (Krajowy Integrator Płatności S.A.),
• the hosting and IT service provider,
• providers of analytics systems (Google),
• the accounting office,
• entities authorised under the law.

VIII. Transfer of data outside the EEA

In connection with the use of Google services (Google Analytics, Google Search Console), data may be transferred outside the European Economic Area.

The transfer takes place on the basis of standard contractual clauses approved by the European Commission.

IX. Data retention period

• data related to the agreement – for the duration of the agreement and its settlement,
• accounting data – for the period required by law (at least 5 years),
• marketing data – until consent is withdrawn,
• technical data – until the limitation of claims.

X. Rights of the data subject

The data subject has the right to:

• access to data,
• rectification of data,
• erasure of data,
• restriction of processing,
• data portability,
• object to processing,
• withdraw consent,
• lodge a complaint with the President of the Personal Data Protection Office (UODO).

XI. Cookies and tracking technologies

The website uses cookies and similar technologies.

Cookies are divided into:

• necessary – ensuring the correct operation of the website,
• analytical – used by Google Analytics,
• functional – remembering user settings.

The user can manage cookies through browser settings and the cookie banner.

XII. Google tools

The website uses:

• Google Analytics – traffic analysis,
• Google Search Console – website visibility analysis.

Data collected by these tools may include the IP address, device data, and user behaviour on the website.

XIII. WordPress and website functionalities

The website is based on the WordPress system, which may process data in the following areas:

• server logs (IP address, date, browser),
• system cookies,
• contact and booking forms,
• any comments (if the function is active).

Plugins and components may process data in accordance with their privacy policies.

XIV. Data security

The controller applies technical and organisational measures appropriate to the risk, including:

• connection encryption (SSL),
• access control,
• regular software updates.

XV. Automated decision-making

Personal data is not used for automated decision-making or profiling within the meaning of the GDPR.

XVI. Changes to the policy

The policy may be updated in connection with changes in regulations or the manner of data processing.

XVII. Final provisions

In matters not regulated herein, the provisions of the GDPR and Polish law apply.