Privacy policy
This is a translation for information. In case of any doubt, the Polish version is binding.
PRIVACY POLICY OF TOP GARDEN APARTHOTEL
1. Data controller and definitions
1. The controller of the personal data of Guests/Users of the Service is: OTRO INVESTMENTS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, Mineralna 16 25-759 Kielce, NIP (tax number): 9592070995, entered in the National Court Register (KRS) under number 0001093473
2. The data controller can be contacted:
1. by post: Mineralna 16 25-759 Kielce
2. by e-mail: hello@topgardenaparthotel.com
3. User of the Service – a natural person visiting the website/websites presenting the Offer and enabling the conclusion of an accommodation rental agreement, or using the services or functions described in this Privacy and Cookie Policy;
4. Service Provider – OTRO INVESTMENTS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, Mineralna 16 25-759 Kielce, NIP: 9592070995
5. Offer – accommodation offered by the Service Provider for the purpose of concluding an accommodation rental agreement through the Service.
6. Guest – a natural person with full legal capacity, a legal person or an organisational unit referred to in Article 331 of the Polish Civil Code, concluding an accommodation rental agreement with the Service Provider;
7. Service – the website topgardenaparthotel.com presenting the Service Provider’s Offer, together with the booking system available on it, enabling an accommodation rental agreement to be concluded online;
8. Booking System – the Mews booking and property management system, through which the Guest makes a booking in the Service and pays, and the Service Provider handles bookings and stays;
9. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
2. Purposes, legal bases and duration of data processing
1. Using the Service website. Each time the website is visited, the server records technical data in its logs: IP address, date and time, the address of the page visited, and information about the browser and device. This data is processed to keep the Service working and secure (including protection against attacks and abuse), on the basis of the controller’s legitimate interest (Article 6(1)(f) GDPR), for as long as the logs are kept by the hosting provider and the Service’s security tools. Visitor statistics are collected only with consent, as described in section 10.
2. Contact form, e-mail, telephone and WhatsApp. When a User contacts the controller, the controller processes the data provided (in the form: name, e-mail address, phone number and message) in order to reply and to continue the correspondence. The legal basis is the consent given in the form (Article 6(1)(a) GDPR) and, for contact through other channels, the controller’s legitimate interest in answering enquiries (Article 6(1)(f) GDPR); if the message concerns a booking, also steps taken prior to entering into a contract (Article 6(1)(b) GDPR). The contact form is protected against spam by the Cloudflare Turnstile service, which analyses technical browser and device data for this purpose. Messages from the form are sent to the controller’s e-mail inbox. The data is kept for as long as needed to handle the enquiry and then until any claims become time-barred; if the enquiry leads to a booking, the periods given in point 3 apply.
3. Booking and stay. To conclude and perform the accommodation rental agreement, the controller processes the data provided during the booking process and before check-in, in particular: first name, surname, e-mail address, phone number, address, invoice details (including company name and tax number), booking and stay details, details of accompanying persons, identity confirmation data during online check-in, and payment data. The legal basis is the contract (Article 6(1)(b) GDPR), obligations under the law, in particular tax and accounting law (Article 6(1)(c) GDPR), and the controller’s legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f) GDPR). If the booking was made through a booking portal (e.g. Booking.com), the controller receives the Guest’s data from that portal. The data is kept for the duration of the contract, then until claims arising from it become time-barred, and for the period required by tax and accounting law (as a rule 5 years from the end of the calendar year in which the tax payment deadline expired).
4. Payments. The Guest enters payment card details directly in the payment form of the Booking System. Payments are handled by Mews and the payment service providers it works with, who may also process the data as separate controllers, e.g. to execute the payment and prevent fraud.
5. Video surveillance. The common areas of the Property and the underground garage are covered by video surveillance (the cameras do not cover the inside of the apartments). The image of people in these areas is processed to ensure the safety of people and property, on the basis of the controller’s legitimate interest (Article 6(1)(f) GDPR). Recordings are kept for as long as necessary for this purpose and, if they may serve as evidence in proceedings, until those proceedings are concluded.
6. Marketing information. If the Guest consents to this in the Booking System, the controller may send them commercial information electronically (Article 6(1)(a) GDPR), as described in section 11.
7. Providing data is voluntary but necessary to reply to a message or to make a booking and carry out the stay. The controller does not make decisions about Guests/Users based solely on automated processing, including profiling.
8. The controller undertakes to take all measures required under Article 32 GDPR, i.e. taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
3. Marketing activities of the controller
The data controller may publish marketing information about its products or services on the Service website. This content is displayed by the data controller in accordance with Article 6(1)(f) GDPR, i.e. on the basis of the data controller’s legitimate interest in publishing content related to the services it provides and content about promotional campaigns in which the data controller is involved. At the same time, this activity does not infringe the rights and freedoms of Guests/Users; Guests/Users expect to receive content of this kind, even look forward to it, or it is the direct purpose of their visit to the Service website(s).
4. Recipients of Users’ data
The data controller discloses the personal data of Guests/Users to entities processing it on its behalf under data processing agreements, in particular:
1. the provider of the Booking System (Mews) and its sub-processors;
2. providers of hosting, e-mail and IT services;
3. Google – for visitor statistics (Google Analytics, only with consent);
4. Cloudflare – for protecting the contact form against spam;
5. entities providing accounting and legal services to the controller.
Recipients of the data may also include: payment service providers (section 2 point 4), Meta Platforms (WhatsApp) – when a Guest/User contacts the controller via WhatsApp, the portal through which the booking was made, and public authorities where required by law.
5. Transfer of personal data to third countries
Some recipients of the data (in particular Google, Cloudflare, Meta and some sub-processors of the Mews Booking System) may process personal data outside the European Economic Area, including in the United States. In that case, the transfer is based on a European Commission adequacy decision (the EU-US Data Privacy Framework – for entities certified under it) or on standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR). A copy of the safeguards can be obtained by contacting the controller.
6. Rights of data subjects
1. Every data subject has the right:
1. of access (Article 15 GDPR) – to obtain from the data controller confirmation as to whether their personal data is being processed. If the data is processed, they are entitled to access it and to obtain the following information: the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom the data has been or will be disclosed, the data retention period or the criteria used to determine it, the right to request rectification, erasure or restriction of processing of personal data concerning the data subject, and to object to such processing;
2. to receive a copy of the data (Article 15(3) GDPR) – to obtain a copy of the data being processed; the first copy is free of charge, and for further copies the data controller may charge a reasonable fee based on administrative costs;
3. to rectification (Article 16 GDPR) – to request the rectification of inaccurate personal data concerning them, or the completion of incomplete data;
4. to erasure (Article 17 GDPR) – to request the erasure of their personal data if the data controller no longer has a legal basis for processing it or the data is no longer necessary for the purposes of processing;
5. to restriction of processing (Article 18 GDPR) – to request the restriction of processing of personal data where:
1. the data subject contests the accuracy of the personal data – for a period enabling the data controller to verify the accuracy of the data,
2. the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of its use instead,
3. the data controller no longer needs the data, but the data subject needs it for the establishment, exercise or defence of legal claims,
4. the data subject has objected to processing – pending the verification whether the legitimate grounds of the controller override those of the data subject;
6. to data portability (Article 20 GDPR) – to receive the personal data they have provided to the controller in a structured, commonly used and machine-readable format and to transmit it to another controller, where the processing is based on consent or a contract and is carried out by automated means;
7. to object (Article 21 GDPR) – to object, on grounds relating to their particular situation, to the processing of their personal data for the legitimate purposes of the controller, including profiling. The data controller then assesses whether there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subjects, or grounds for the establishment, exercise or defence of legal claims. If, according to this assessment, the interests of the data subject outweigh those of the controller, the data controller will be obliged to stop processing the data for those purposes;
8. to withdraw consent at any time and without giving reasons, although the processing of personal data carried out before the withdrawal of consent remains lawful. Withdrawing consent will cause the data controller to stop processing personal data for the purpose for which the consent was given.
2. To exercise the above rights, the data subject should contact the data controller using the contact details provided and state which right they wish to exercise and to what extent.
7. President of the Personal Data Protection Office
The data subject has the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office (UODO), based in Warsaw, ul. Stawki 2, who can be contacted as follows:
1. by post: ul. Stawki 2, 00-193 Warszawa;
2. via the electronic inbox available at: https://www.uodo.gov.pl/pl/p/kontakt;
3. helpline: +48 606 950 000.
8. Contact on data protection matters
In all matters relating to the processing of personal data, the data subject may contact the controller by e-mail or in writing at the data controller’s address given in section 1 point 2 of this Privacy and Cookie Policy.
9. Changes to the Privacy Policy
The privacy and cookie policy may be supplemented or updated according to the current needs of the controller in order to provide Guests/Users with up-to-date and reliable information.
10. Cookies
1. Cookies are IT data, in particular text files, which are stored on the end device of the Guest/User of the Service and are intended for using the Service website. Cookies usually contain the name of the website they come from, how long they are stored on the end device and a unique number. The Service also uses a similar technology – the browser’s local storage (localStorage).
2. The Service uses two types of cookies:
1. necessary – they remember the selected website language and the Guest’s/User’s cookie choice and, in the Booking System, the data needed to complete a booking. They are always active, because without them the Service would not work properly (Article 399(3) of the Polish Electronic Communications Law);
2. statistics – Google Analytics on the Service website and the statistics tools of the Mews Booking System (Gainsight PX). They show which pages are viewed, where Guests/Users come from, which devices they use and how the booking process goes, so that the Service can be improved. They are used only with the Guest’s/User’s consent (Article 6(1)(a) GDPR and Article 399(1) of the Polish Electronic Communications Law).
3. On the first visit to the Service, a cookie notice is displayed. The Guest/User can choose “Accept all”, “Reject”, or select chosen categories and click “Save choices”. Until a choice is made, and after clicking “Reject”, the Service does not use statistics cookies. Refusing does not limit the use of the Service or the ability to make a booking.
4. Consent can be changed or withdrawn at any time by clicking “Cookie settings” at the bottom of every page of the Service. When consent is withdrawn, Google Analytics cookies are deleted. Cookies can also be deleted and blocked in the web browser settings.
5. Statistics cookies are stored on the Guest’s/User’s device as follows: Google Analytics (_ga, _ga_*) – up to 2 years; Gainsight PX in the Booking System (apt.uid) – up to 1 year, (apt.sid) – until the end of the session. Google Analytics statistics data is kept in the service for no longer than 14 months. More information: Google privacy policy.
6. The Service does not use advertising cookies and does not profile Guests/Users for advertising purposes. If this changes, the controller will update this Policy and ask for separate consent.
11. Marketing information
1. When booking in the Booking System, the Guest may tick an optional consent to receive commercial information (e.g. special offers) from the Service Provider at the e-mail address provided. Not giving consent does not affect the booking.
2. Consent can be withdrawn at any time by clicking the unsubscribe link in a message received or by contacting the data controller (section 1 point 2). Data processed for this purpose is kept until consent is withdrawn.