Home/Privacy Policy

GDPR

Privacy Policy

Last updated: 5 June 2026

1. Personal data administrator

The controller of your personal data is:

PrzystańMy
Karszewo, 14-420 Młynary, warmińsko-mazurskie
NIP: 12345678
REGON: 6543258
Tel: +48531559680
E-mail: kontakt@karszewo.pl

The Controller has not appointed a Data Protection Officer (DPO/Inspector). For matters regarding data processing, please contact us directly using the above details.

2. Scope, data sources and obligation to provide data

We collect the following categories of personal data:

  • Identity data – first name, last name,
  • Contact data – email address, phone number,
  • Correspondence data – message content, inquiry details,
  • Booking data – dates of stay, number of guests, preferences,
  • Automatically collected data – IP address, browser type, operating system, pages visited.

All personal data is obtained directly from you when you fill out forms on the website, contact us via email or phone, or make a reservation.

Providing personal data is voluntary but necessary to use the contact form, receive a response to an inquiry, or complete a reservation. Failure to provide data will prevent us from handling your request.

3. Purpose and legal basis for data processing

We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) for the following purposes:

a) Contact and booking form

Data provided in the contact form (name, email, phone number, message content) is processed to respond to your inquiry and handle bookings. Legal basis: Article 6(1)(b) GDPR (necessary for pre-contractual measures) and Article 6(1)(f) GDPR (legitimate interest of the controller).

b) Cookies and analytics

Our website uses cookies for: ensuring proper website operation (essential cookies), website traffic analysis using Google Analytics – legal basis: Article 6(1)(a) GDPR (consent), and remembering your preferences. Detailed information is in the Cookies section below.

c) Website hosting

The website is hosted on OVH servers. Server logs may contain your IP address, browser type and operating system. This data is used solely for technical and administrative purposes. Legal basis: Article 6(1)(f) GDPR.

d) Accommodation service and registration obligation

Data related to bookings (name, contact details, dates of stay, number of guests) is processed to provide accommodation services and fulfill legal obligations (registration duty, tax regulations). Legal basis: Article 6(1)(b) GDPR (contract performance) and Article 6(1)(c) GDPR (legal obligation).

4. Data retention period

We store personal data for the following periods:

  • Email correspondence and form inquiries – up to 12 months from the end of correspondence,
  • Booking-related data – for the period necessary to perform the service and as required by tax and accounting regulations,
  • Analytics cookies – up to 14 months from the last visit,
  • Server logs – up to 14 days.

5. Data recipients

Your data may be transferred to entities processing it on our behalf, in particular:

  • hosting provider (OVH),
  • analytics service providers (Google Ireland Limited),
  • email operators.

Google Analytics may transfer data to servers located in the United States. This transfer is based on Standard Contractual Clauses (SCC) adopted by the European Commission, ensuring an adequate level of data protection. For other data, no transfer to third countries outside the EEA occurs without appropriate safeguards.

6. Your rights

Under the GDPR you have the right to:

  • access your personal data (Article 15 GDPR),
  • rectification (Article 16 GDPR),
  • erasure ("right to be forgotten", Article 17 GDPR),
  • restriction of processing (Article 18 GDPR),
  • data portability (Article 20 GDPR),
  • objection to processing (Article 21 GDPR),
  • withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, contact us via the contact form, email or phone. We will respond within 30 days. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) if you believe that data processing violates GDPR provisions.

7. Cookies

Our website uses cookies (small text files stored on your device while browsing).

Types of cookies:

  • Essential – enable proper website operation (e.g. admin panel session). Do not require consent.
  • Analytics (Google Analytics) – help us understand how you use the website, which helps us improve it. Require your consent.

Managing cookie consent

During your first visit, a banner asks for consent to analytics cookies. You can accept all cookies, reject analytics cookies (the site will work without them), or manage cookie settings directly in your browser. You can change your cookie preferences at any time through your browser settings.

8. Profiling

Your data is not used for automated decision-making or profiling for marketing purposes.

9. Video surveillance

The premises are not monitored by video surveillance (CCTV).

10. Final provisions

We reserve the right to change this privacy policy. Any changes will be announced by updating the date at the top of the page. Matters not regulated by this policy are governed by the GDPR and Polish data protection law.