Privacy Policy and GDPR Information Notice

This policy sets out the rules for processing personal data in connection with the use of the website Noclegi Ostrów Wielkopolski.

1. Controller of personal data

The controller of your personal data is the owner of the property Noclegi Ostrów Wielkopolski.

Contact details of the controller:

• Address: 63-400 Ostrów Wielkopolski
• Phone: +48 456 701 458
• Email: biuro@noclegi-ostrow.pl

2. Purposes and legal bases for processing

We process your personal data for the following purposes:

a) Handling an accommodation booking

• Purpose: Conclusion and performance of the apartment rental agreement (accepting the booking, contact regarding the stay, settlement).
• Legal basis: Art. 6(1)(b) GDPR — processing necessary for the performance of a contract.
• Scope of data: first name, surname, email address, phone number, company details (VAT ID, name) if you request an invoice, IP address.

b) Issuing a VAT invoice

• Purpose: Issuing and storing accounting documents.
• Legal basis: Art. 6(1)(c) GDPR — legal obligation arising from accounting and VAT legislation.

c) Defence against claims

• Purpose: Establishing, pursuing and defending against any claims related to the agreement.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest of the controller.

3. Data retention period

• Data related to the booking is kept for the duration of the agreement and 3 years after it ends (limitation period for claims).
• Data on invoices is kept for 5 years counted from the end of the calendar year (tax obligation).
• IP address and server logs — 90 days from the last visit.

4. Recipients of the data

Your data may be shared with the following categories of recipients:

• Website hosting provider (IQHost / IQ PL Sp. z o.o.)
• Email service provider (Google / Microsoft / other)
• The accounting office handling the bookkeeping of the property
• State authorities — where required by law

Data is not transferred outside the European Economic Area.

5. Your rights

In connection with the processing of your personal data, you have the following rights:

• Right of access to your data (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure of data — the „right to be forgotten” (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to lodge a complaint with the President of the Personal Data Protection Office (PUODO, ul. Stawki 2, 00-193 Warsaw)

6. Voluntary nature of providing data

Providing personal data is voluntary, but necessary to conclude the agreement for renting the apartment. Without these data it is not possible to process the booking.

Providing data for a VAT invoice (VAT ID, company name) is voluntary, but necessary to receive a VAT invoice instead of a receipt.

7. Profiling and automated decision-making

Your data is not subject to profiling or automated decision-making within the meaning of Art. 22 GDPR.

8. Cookies

The website uses cookies for the following purposes:

• Essential: session handling, form protection (CSRF), language preferences — without them the site does not work correctly.
• Statistical: if Google Analytics is installed — anonymous traffic statistics for the site.

You can disable cookies in your browser settings, but some features of the site may then not work correctly.

9. Data security

We apply appropriate technical and organisational measures to protect your data:

• Encrypted connection (HTTPS / TLS)
• Secured administrator passwords (bcrypt with cost 12)
• CSRF tokens protecting forms
• Limited number of login attempts (5 attempts / 15 minutes)
• Regular database backups

10. Changes to the privacy policy

We reserve the right to make changes to this privacy policy. We will inform you of any changes by publishing an updated version on this page.