Privacy policy (GDPR)
We care about the privacy of our Guests and visitors to this website. Below we explain who processes your personal data, for what purpose, on what basis and what rights you have — in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Polish law.
1. Data controller
The controller of your personal data is P&J Apartamenty s.c. Przemysław Więcek, Michał Więcek, tax ID (NIP) 6772261034, registered office at ul. Lubicz 17e, unit 8, 31-503 Kraków, Poland. Guest service office: ul. Floriańska 39, 31-019 Kraków. Contact for personal data matters: info@apartmentcracow.com, phone +48 798 242 424.
We have not appointed a data protection officer — please send all data-related matters directly to us.
2. What data, for what purpose and on what basis we process it
| Purpose | Scope of data | Legal basis | Retention period |
|---|---|---|---|
| Booking and performance of the stay (short-term rental agreement, check-in, settlement, deposit) | name, contact details, identity document details provided on check-in, dates and number of guests, payment details | Art. 6(1)(b) GDPR (contract or steps prior to entering into it) | until the agreement has been performed, then until claims become time-barred |
| Tax and accounting obligations | data on sales documents | Art. 6(1)(c) GDPR (legal obligation) | 5 years from the end of the tax year |
| Replying to a message from the contact form, email or phone | name, email address, content of the message | Art. 6(1)(f) GDPR (our legitimate interest — communicating with customers) | until the matter is closed, then until potential claims become time-barred |
| Establishing, pursuing and defending claims, protecting property (e.g. damage to an apartment) | data from the agreement and correspondence | Art. 6(1)(f) GDPR | until claims become time-barred |
| Additional services (airport transfer, parking, breakfast) | contact details, flight number, arrival time, vehicle details | Art. 6(1)(b) GDPR | until the service has been provided and settled |
| Website statistics (Google Analytics) and marketing (Meta Pixel) — only with your consent | online and device identifiers, data on use of the website, event data (e.g. an availability search) | Art. 6(1)(a) GDPR (consent) and the rules on electronic communications | until consent is withdrawn, no longer than the validity of the identifiers (up to approx. 2 years) |
| Confirmation of your choice in the cookie banner | consent categories, date of choice | Art. 6(1)(c) and (f) GDPR (obligation to demonstrate consent) | until you change your choice or clear your browser data |
Providing data is voluntary, but necessary to conclude and perform the rental agreement and to reply to your message. We do not make decisions about you by automated means and we do not profile you.
3. Recipients of data
Data may be entrusted or disclosed to entities that help us run our business, only to the extent necessary:
- the provider of the booking system and channel manager Previo (data entered in the booking window on the website),
- providers of hosting and technical infrastructure of the website and email,
- Google Ireland Ltd. (Google Analytics) and Meta Platforms Ireland Ltd. (Meta Pixel) — only to the extent and with the consents described in section 4,
- OpenStreetMap Foundation (the map on the website) — to the extent described in section 4,
- payment operators and banks,
- our accounting firm and legal advisers,
- platforms through which we receive bookings (e.g. Booking.com, Airbnb) — when you book through their service, their own privacy policies describe the processing of your data,
- entities cooperating on additional services, e.g. drivers carrying out a transfer,
- public authorities — where such an obligation results from the law.
We do not sell personal data. If any provider processes data outside the European Economic Area (in particular Google and Meta — USA), this takes place on the basis of a European Commission decision confirming an adequate level of protection (EU-U.S. Data Privacy Framework) or standard contractual clauses.
4. Cookies and similar technologies
Cookies are small files stored on your device; local browser storage and tracking pixels work similarly. We use them in accordance with the Polish Electronic Communications Law and the GDPR.
You give your consent in the banner that appears on your first visit. The “Accept all” and “Reject” buttons carry equal weight, and under “Settings” you can choose individual categories. Not consenting does not limit your use of the website or booking. You can change or withdraw your consent at any time via the link in the website footer. Withdrawing consent does not affect the lawfulness of processing before its withdrawal. We store your choice (categories and date) in your browser’s local storage — it is needed to demonstrate consent and does not require separate consent.
| Category | Tool / provider | Purpose | Basis |
|---|---|---|---|
| Necessary | P&J Apartments website (local browser storage, admin panel session) | Remembering your consent choice and settings, security | No consent required (service provided electronically at your request) |
| Necessary for booking | Previo (booking window) | Checking availability and making a booking | Art. 6(1)(b) GDPR |
| External content | OpenStreetMap map (OpenStreetMap Foundation) | Displaying a map with the location of the apartments. The map does not store tracking cookies, but when it loads, OpenStreetMap servers receive your IP address and browser data. | Art. 6(1)(f) GDPR (our legitimate interest — showing the location) |
| Statistics | Google Analytics 4 (Google Ireland Ltd.) | Anonymous visit statistics: pages visited, traffic source, device type, approximate location. IP address anonymisation is enabled. | Your consent (Art. 6(1)(a) GDPR) |
| Marketing | Meta Pixel (Meta Platforms Ireland Ltd.) | Measuring the effectiveness of ads on Facebook and Instagram, showing ads to people who have visited the website, events such as an availability search or starting a booking | Your consent (Art. 6(1)(a) GDPR) |
We launch statistics and marketing tools only after you consent to the given category. Until then they are not loaded, and Google Analytics and Google advertising run in Consent Mode with consents denied. These tools may store identifiers in cookies for a period from a few minutes to approx. 2 years (depending on the tool).
Providers established outside the EU. Google and Meta belong to groups headquartered in the USA, so data may be transferred outside the European Economic Area — on the basis of a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses.
Joint controllership with Meta. In the case of the Meta Pixel we are joint controllers, together with Meta Platforms Ireland Ltd., of the data collected via the pixel and transmitted to Meta (Art. 26 GDPR). We are responsible for obtaining your consent and informing you about this processing, and Meta for further processing and for fulfilling your rights in this respect. Information about Meta: facebook.com/privacy/policy. Information about Google: policies.google.com/privacy.
You can also delete or block cookies in your browser settings; this may limit some functions. In addition, Google and Meta provide their own ad settings and opt-out tools.
5. Your rights
You have the right to: access your data, rectify it, erase it, restrict processing, data portability and object to processing based on our legitimate interest. Where we process data on the basis of consent, you may withdraw it at any time — without affecting the lawfulness of processing before withdrawal.
To exercise these rights, write to the email address given in section 1. We will reply without undue delay, at the latest within one month.
You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
6. Security
We apply technical and organisational measures appropriate to the risk: an encrypted HTTPS connection, restricted access to data and a secured administration panel.
7. Changes to this policy
We may update this policy, e.g. when the law or the way the website works changes. The current version is always available on this page, with the date of the last update.
See also: Terms of stay.