1. Data controller
The controller of personal data is Ewa Biernacka-Fröhlich, who runs the establishment Radość – rooms and apartments, ul. Warszawska 8, 72-344 Rewal, NIP 8511550303, REGON 320040405.
In matters relating to privacy, you can write to rewal_radosc@wp.pl or send correspondence to the address given above.
2. What data we process
The scope of data depends on how you use the website:
- enquiry about a stay or contact – first name and surname, email address, optionally a telephone number, the selected room type, the planned dates, the number of adults and children, and the content of the message;
- telephone or email correspondence – data you provide during a conversation or in a message;
- use of the website – technical data that may appear in server logs, such as the IP address, the date and time of the request, the address of the page visited, information about the browser and device, and error data;
- language selection – information about the selected language version, stored locally in the browser.
Please do not provide any data in the form that is not needed to respond to your enquiry.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Handling an enquiry about availability, presenting an offer and taking steps prior to entering into an accommodation contract | Art. 6(1)(b) GDPR |
| Answering other questions and conducting ordinary correspondence | Art. 6(1)(f) GDPR – legitimate interest consisting in communicating with persons who contact the establishment |
| Performance of a concluded contract and fulfilment of tax and accounting obligations, if a booking is made | Art. 6(1)(b) and (c) GDPR |
| Ensuring the security of the website, detecting abuse, and establishing and defending claims | Art. 6(1)(f) GDPR |
| Activities requiring separate, voluntary consent – only if such consent is expressly given | Art. 6(1)(a) GDPR |
Providing data in the form is voluntary, but your name and email address are needed to send an enquiry and receive a reply. The other fields are optional, although they may make it easier to prepare an offer.
We do not make decisions about you based solely on automated processing, and we do not profile users for marketing purposes.
4. Data recipients and external services
Data may be entrusted to entities that support the operation of the website and communication, solely to the extent necessary for them to perform their tasks:
- Vercel – hosting and technical maintenance of the website;
- Cloudflare – protection of the form using Turnstile and technical handling of the form;
- Resend – technical transmission of email messages from the form;
- RoomAdmin — online booking system: the availability calendar and booking form embedded in the website; the system processes the data provided when booking (including first name and surname, contact details, dates and the room selected);
- the email service provider and entities providing IT services;
- authorised public authorities – where an obligation to disclose data arises from the law.
Typefaces are loaded directly from the website’s own server, without connecting to Google Fonts. The Contact page contains an embedded Google Map (Google Maps), which loads content from Google’s servers. The Reservations page contains an embedded booking form and availability calendar (the form may also open in a window on other subpages) — both elements are loaded from the servers of the RoomAdmin system and may store their own cookies necessary to handle bookings. The 3D virtual tour (home page, the Virtual tour page and the “Step inside” buttons next to the rooms) is provided by Treedis, a service using technology from Matterport; the tour loads only after it is launched and may store its own cookies in accordance with the rules of these providers. When you follow a link to Google Maps, you leave this website, and further processing takes place under Google’s rules. Details can be found in the following privacy policies: Vercel, Cloudflare, Resend and Google.
Some providers also operate outside the European Economic Area. If their services involve a transfer of data outside the EEA, it takes place using the mechanisms required by Chapter V of the GDPR, in accordance with the information published by the provider concerned.
5. How long we keep data
- enquiry data – for the time needed to reply and to conduct discussions about a booking, and thereafter until the expiry of the period in which claims may arise or be pursued;
- data related to a concluded contract – for the period of its performance, and thereafter for the period required by the provisions on tax, accounting and the limitation of claims;
- data processed on the basis of consent – until consent is withdrawn or the purpose ceases earlier;
- technical logs – for the period necessary to ensure security, diagnose errors and protect against abuse.
In each case, we delete or anonymise data when it is no longer needed, unless further storage is required by a legal obligation.
6. Your rights
To the extent provided for by the GDPR, you may request access to your data, a copy of it, its rectification or erasure, restriction of processing, or data portability. You may also object to processing based on legitimate interest.
If processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before its withdrawal.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO). The authority’s contact details are available at uodo.gov.pl.
7. Cookies and similar technologies
The website does not currently use any analytics or advertising tools. The selected language is saved in the browser’s local storage under the name radosc_lang. This entry serves solely to remember the setting and can be deleted in your browser settings.
On the contact page, the Cloudflare Turnstile protection may use necessary technical data to assess whether the form is being used by a human. External resources such as the Google Map, the booking form or the virtual tour cause the browser to connect to the provider’s server and transmit the technical data necessary to establish the connection.
Note: if statistics, advertising or other tools using additional technologies are launched in the future, this policy will be updated and, where required by law, an option to give consent will be provided.
8. Changes to the policy
This policy may be amended when the way the website operates, the scope of services or the law changes. The current version and its effective date are always published on this page.