Draft – pending owner approval. The controller’s details (highlighted in yellow) and the list of services used by the website must be completed before publication. The Polish version is the binding one.
Privacy policy
We respect your privacy. Below we explain what data we collect, why, and what rights you have (in accordance with Article 13 GDPR).
1. Data controller
The controller of your personal data is: [to be confirmed: full name or company name, tax ID], running the guest house Kasztanówka – dom gościnny na Podlasiu, Średnica-Jakubowięta 23, 18-210 Szepietowo, Poland. Data protection contact: kontakt@kasztanowka.pl, phone +48 517 292 905.
2. What data and why
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your enquiry (form, e-mail, phone) | name, e-mail, phone, dates, number of guests and pets, message | Art. 6(1)(b) GDPR (steps prior to entering a contract) or (f) (legitimate interest – answering your question) |
| Handling your booking and stay | contact details, payment details, dates of stay | Art. 6(1)(b) GDPR (contract) |
| Accounting, receipts and invoices | data required for accounting documents | Art. 6(1)(c) GDPR (legal obligation) |
| Guest register / registration duties, where applicable | data required by law | Art. 6(1)(c) GDPR |
| Establishing or defending legal claims | data related to the stay | Art. 6(1)(f) GDPR |
Providing your data is voluntary, but without contact details we cannot reply to your enquiry or accept a booking.
3. Recipients
We only share data with providers who help us run the website and handle bookings:
- Cloudflare, Inc. – website hosting, form handling and spam protection (Cloudflare Turnstile);
- the e-mail delivery provider for the form [e.g. Resend – to be confirmed];
- LH.pl – our e-mail provider;
- Booking.com and other portals – if you book through a portal (the portal is then a separate controller), and for synchronising the availability calendar (no personal data);
- accounting office [if applicable], bank or payment operator;
- public authorities – only where required by law.
4. Transfers outside the EEA
Some providers (e.g. Cloudflare) may process data outside the European Economic Area, including in the USA. This is based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
5. How long we keep data
- enquiries that did not result in a booking – up to 12 months from the last contact;
- booking and stay data – for the limitation period for claims (generally up to 6 years);
- accounting documents – for 5 years from the end of the tax year, as required by tax law.
6. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. To exercise these rights, e-mail kontakt@kasztanowka.pl.
You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or with the supervisory authority in your country of residence.
We do not make automated decisions or profile our guests.
7. Cookies and statistics
This website does not use cookies for tracking or advertising. Fonts are hosted on our own server, and the OpenStreetMap map on the contact page only loads after you click. Links to Google Maps, Booking.com, Facebook or Instagram lead to external services with their own privacy policies.
If we enable visitor statistics or other tools requiring consent in the future, we will ask for it in a banner and update this policy.
8. Changes
We may update this policy, e.g. when we change service providers. The current version is always available on this page.
Version dated [date – to be completed after approval].