Privacy policy
This page explains what we collect when you book, why, and how long we keep it. It fulfils the information duty under art. 13 GDPR.
1. Data controller
- Controller
- Zofia Demska
- Address
- ul. Rzemieślnicza 7, 49-300 Brzeg
- Tax ID (NIP)
- 7471336447
- Data contact
- pensjonat_brzeg@op.pl
- Phone
- +48 601 185 127
We have not appointed a data protection officer — please write to the address above with any data-related request.
2. What we collect
- From the booking form: your name, e-mail address, phone number, dates of stay, number of guests, and any notes you add.
- Automatically: the date and time you gave your consent and the version of the documents you accepted.
- In server logs: IP address, browser type and request time — recorded by our hosting provider for security purposes.
We do not collect special categories of data (art. 9 GDPR); please do not enter any in the notes field.
3. Purposes and legal bases
- Handling your booking and stay
- art. 6(1)(b) GDPR — necessary for the performance of a contract to which you are a party, and for steps taken before entering into it.
- Tax and accounting obligations
- art. 6(1)(c) GDPR — a legal obligation under Polish tax and accounting law.
- Establishing, exercising or defending legal claims
- art. 6(1)(f) GDPR — our legitimate interest.
Providing your data is voluntary, but without it we cannot accept a booking or contact you.
4. Who receives the data
- Cloudflare, Inc. — website hosting and the booking database (Cloudflare Workers and D1).
- Resend — delivery of booking confirmation e-mails.
- Our accountant and the tax authorities — to the extent required by law.
Technical providers act as processors under data processing agreements. Some are established in the United States — transfers outside the European Economic Area rely on the Standard Contractual Clauses approved by the European Commission (art. 46(2)(c) GDPR).
We do not sell your data and do not share it for marketing purposes.
5. How long we keep it
- Completed bookings — 5 years after the end of the stay, matching the limitation period for tax liabilities.
- Cancelled bookings and ones that never went ahead — 365 days.
After that, contact details are deleted automatically and the booking record is anonymised, by a job that runs every day.
6. Your rights
You have the right to:
- access your data and receive a copy (art. 15 GDPR),
- rectification (art. 16),
- erasure (art. 17),
- restriction of processing (art. 18),
- data portability (art. 20),
- object to processing based on legitimate interest (art. 21).
Just write to us at pensjonat_brzeg@op.pl. We reply within one month. Some data may have to be kept despite an erasure request, where tax law requires it.
You also have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.
7. No profiling
We do not make automated decisions about you and we do not profile your data within the meaning of art. 22 GDPR. Assigning a particular room when we confirm the booking is an organisational step and has no legal effect on you.
8. Cookies and browser storage
This site uses no analytics or advertising cookies. There is no Google Analytics, no advertising pixel, no tracking tool.
We store one thing in your browser (localStorage) — the language you chose — so the site opens in the same language next time. It never reaches our server and you can clear it at any time in your browser settings.
The location map loads only when you click it. Only then does your browser connect to Google Maps, and Google may set its own cookies — as described in Google's privacy policy. Until you click the map, the site makes no requests to any external server.
9. Changes to this policy
If we change how we handle data, we will publish a new version here with the current date. Bookings already made are governed by the version in force on the day they were made — we store the version number with the booking.