Privacy Policy

1. Personal data administrator
   The personal data controller is PHU Krzysztof Łukaszczyk, ul. Jana Pawła II 145a, 34-425 Biały Dunajec, NIP: 7361720819. Contact: krzysiek.lukaszczyk@gmail.com.

2. What data do we collect and for what purpose?
   We collect personal data provided voluntarily by Guests and those who contact us, in particular: name and surname, email address, telephone number, home address (if provided), and data required for reservations and billing (e.g., invoice details). We process this data for the following purposes:

• processing reservations and providing apartment rental services (legal basis: performance of the contract) – processing includes contacting you regarding the reservation, accepting payments via the reservation system and issuing sales documents;
• payment and settlement processing (basis: contract performance and legal obligations);
• communication related to booking, customer service and responding to inquiries (basis: performance of the contract / legitimate interest of the controller);
• fulfillment of legal obligations (e.g. storing accounting documents) - basis: legal obligation;
• sending commercial information only after express consent (basis: consent).

3. Reservation system and data recipients
   We use the external Hotres reservation system (panel.hotres.pl) to process reservations and payments. Data related to reservations and payment processing may be processed by the Hotres system operator as a data processor under a data processing agreement. Data may also be transferred to other entities necessary for the provision of the service (e.g., email providers, accounting).

4. Payments
   Payments for reservations are processed by Hotres (the reservation system provider). We do not collect or store payment card details directly on the folkova21.pl website—payment information is processed by the reservation system operator in accordance with its security policies.

5. Data storage period
   We retain reservation and billing data for the period necessary to fulfill the contract and for the period required by law (e.g., accounting records—usually 5 years). Contact and communication data may be retained for up to 2 years, unless you demonstrate a need for earlier deletion or we delete it after you withdraw your consent (if processing was based on consent).

6. Your rights
   You have the right to:

• access to your data;
• rectification of data;
• deletion of data ("right to be forgotten"), unless there is a legal obligation to do so;
• processing restrictions;
• data portability (if processing is based on a contract or consent and is carried out by automated means);
• object to the processing of data for marketing purposes or in the case of processing based on a legitimate interest;
• withdraw consent at any time.

To exercise your rights, please contact the Administrator: krzysiek.lukaszczyk@gmail.com.

7. Complaint to the supervisory authority
   You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe that the processing of your data violates the law.

8. Cookies and tracking technologies
   The website may use cookies and similar technologies to maintain user sessions, for analytics, and to improve the website. Details about cookies are available in the Cookie Policy/cookie banner on the website.

9. Data security
   We use appropriate technical and organizational measures to protect data against unauthorized access, loss, modification, or disclosure. Access to data is limited to authorized individuals and entities we have contracted to process it.

10. Data transfer outside the EEA
    If data needs to be transferred to third countries (outside the European Economic Area), this will be done in accordance with applicable regulations. We will inform you about any transfer outside the EEA if this occurs.

11. Changes to the statement
    The Administrator reserves the right to make changes to this declaration. We will inform you about any significant changes on the website.

12. Contact details for data protection
    In matters concerning data processing or the exercise of rights related to personal data, please contact: krzysiek.lukaszczyk@gmail.com.