Privacy policy

§1. Who is responsible for your data

The controller of personal data collected through apartamentyprzemysl.pl is P.P.H.U. "CHOMBUD" Mariusz Chomik, ul. Aleksandra Dworskiego 11, 37-700 Przemyśl, Poland, VAT ID (NIP) 795-101-98-53, REGON 650148564 (“we”, “us”).

For anything concerning your personal data write to biuro [at] apartamentyprzemysl.pl or call +48 791 782 791.

§2. What data we collect and why

a) Technical data from your visit. The web server logs your IP address, date and time of the visit, the page you opened, browser and system type. We do this to keep the site working and secure - the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Logs are deleted automatically when the retention period set by our hosting company ends.

b) Data you give us yourself. If you e-mail us, message us on WhatsApp or Telegram, or call, we process the data in that message (e.g. name, phone number, e-mail, dates of stay) to answer your enquiry and - if it comes to that - to conclude and perform a contract (Art. 6(1)(b) and (f) GDPR). We keep correspondence for as long as the matter is open, then for the limitation period of possible claims.

Contact form. A message sent through the form on the contact page (name, e-mail, optionally phone and the text) is forwarded by the web server by e-mail to our mailbox and not stored on the server. We treat it like any other correspondence (purpose, legal basis and retention as above). To limit spam, the server keeps an irreversible hash of your IP address with a message counter for about two hours - without the message or any form data.

c) Bookings. You book in the Hotres booking system embedded on the site. There you enter the data needed for the booking (including name, e-mail, phone, dates, number of guests and, for an invoice, company details). We process them to accept and carry out your booking (Art. 6(1)(b) GDPR), to issue accounting documents and keep them for as long as tax law requires (Art. 6(1)(c) GDPR), and to establish or defend claims (Art. 6(1)(f) GDPR). The operator of the Hotres system processes these data on our behalf. If you pay online, the payment is handled by a payment operator under its own rules.

d) Bookings through other services. If you follow a link from our site to Booking.com and book there, Booking.com passes us the data needed to carry out that booking; Booking.com itself processes them under its own privacy policy.

§3. Do you have to give us your data

Giving us your data is voluntary. Without contact details, however, we cannot answer your enquiry or accept a booking.

§4. Cookies and third-party services

Strictly necessary. The site stores one cookie of its own - apartamentyprzemysl_pl_consent, which remembers your choice in the cookie banner so we do not ask on every visit (Article 399(2) of the Polish Electronic Communications Law - no consent required).

Statistics - only with your consent. If you accept analytics cookies in the banner, we run Google Analytics 4. It shows us how many people visit the site, where they come from and which pages are useful, as well as events from the booking calendar (e.g. moving to the next step and completing a booking, with its value). The legal basis is your consent (Article 6(1)(a) GDPR and Article 399(1) of the Polish Electronic Communications Law). Without consent, Google Analytics scripts do not load at all. You can withdraw or change your consent at any time with the Cookie settings link in the footer. We do not use advertising tools (such as Meta Pixel).

Some elements on the site come from third parties:

• Hotres booking calendar (home page and booking pages) - it loads from Hotres servers, so your IP address reaches the system operator. Hotres stores one strictly necessary session cookie (PHPSESSID) that remembers the rooms you picked until the booking is finished.
• Google Maps directions map - it loads only after you click it. Until then you see a plain image from our server and no data goes to Google. Once you click, you connect to Google servers and Google’s privacy rules apply.
• Links to WhatsApp, Telegram, Facebook, Instagram, YouTube and Booking.com - plain links. Nothing loads from these services until you click; after that their own privacy rules apply.

The check-in videos, photos and fonts are served from our own server, without any third-party service.

§5. Who we share data with

Processors acting on our behalf - under a contract that obliges them to protect your data and to act only on our instructions:

• the hosting company that runs the web server and the mailboxes,
• the IT service provider that maintains this website,
• the operator of the Hotres booking system (booking data),
• Google Ireland Limited - Google Analytics (visit statistics), only if you consent,
• whoever keeps our accounts - for sales documents.

Independent controllers - responsible for the data under their own rules, described in their privacy policies:

• Google Ireland Limited - the directions map you open by clicking,
• the payment operator - if you pay online,
• Booking.com - if you book through that service,
• WhatsApp Ireland Limited and Telegram - if you message us through them.

We may also disclose data to authorities entitled to it by law, if they request it.

§6. Transfers outside Europe

Google and WhatsApp (Meta) may also process data outside the European Economic Area, including in the United States. This is based on the European Commission decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework and, otherwise, on standard contractual clauses approved by the European Commission. This only applies when you use these services yourself (click the map, message us on WhatsApp) or consent to Google Analytics statistics.

§7. How long we keep data

• server logs - for the retention period set by the hosting company, then deleted automatically,
• Google Analytics statistics - up to 14 months, then deleted automatically; cookies - see §11,
• correspondence - while the matter is open, then for the limitation period of claims,
• booking data - for the duration of the stay, then for the limitation period of claims,
• accounting documents - 5 years from the end of the year in which the tax payment deadline passed.

§8. Your rights

You have the right to:

• access your data and get a copy,
• have incorrect data corrected,
• have your data erased,
• restrict processing,
• data portability,
• object to processing based on our legitimate interest,
• withdraw consent where we rely on it - without affecting what we did before,
• lodge a complaint with the Polish supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.

To exercise these rights, write to biuro [at] apartamentyprzemysl.pl. We reply within one month. If the matter is complex we may extend this by two more months - we will tell you within the first month.

§9. Automated decisions and profiling

We do not make automated decisions and do not profile visitors.

§10. Changes to this policy

If we change how we process data, we will update this policy and put a new date below. This version applies from 7 October 2026.

§11. List of cookies