Privacy

• I Introduction to the Privacy Policy.

This document contains the Privacy Policy, i.e. the rules we follow when processing your personal data. It also contains the information obligations which, pursuant to generally applicable laws, should be presented to the persons whose data is concerned, i.e. to you.

1. This Privacy Policy defines the principles of processing and protecting personal data provided by users of the services provided by Turówka Hotel & SPA**** (hereinafter Turówka Hotel or the Controller). It applies to:
   – use of our products and services,
   – visits to our websites and social media profiles.
2. In order to ensure the security of entrusted personal data, Turówka Hotel operates on the basis of internal procedures and recommendations compliant with the relevant legal acts concerning personal data protection, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the GDPR). In its activities, Turówka Hotel uses only data necessary to achieve each of the purposes for which personal data is processed.
3. Turówka Hotel takes particular care to protect the interests of the persons whose data is concerned and, in particular, ensures that personal data is:
   1. processed lawfully;
   2. collected for specified, legitimate purposes and not subjected to further processing incompatible with those purposes;
   3. factually correct and adequate in relation to the purposes for which it is processed;
   4. stored in a form permitting identification of the persons to whom it relates, for no longer than is necessary to achieve the purpose of processing.

• II Controller of personal data

The Controller of personal data, i.e. the entity deciding how your personal data will be used, is Mireallum Sp. z o.o., ul. Warszawska 152 a, 25-414 Kielce, entered in the Register of Entrepreneurs of the National Court Register, whose registration files are maintained by the District Court in Kielce, 10th Commercial Division of the National Court Register, under no. 000872933, NIP 6572956398, REGON 387670114.

• III Contact details

For all matters related to the processing of personal data, you may contact us by email at manager@turowka.pl or in writing at Turowka Hotel, ul. Żeromskiego 1, 32-020 Wieliczka.

• IV Source of personal data

We received it from you or other persons/entities authorised by you in connection with our business activities, as well as automatically, e.g. through the collection of “cookies”.

• V Purposes and legal bases for processing personal data

1. Your personal data will be processed by Turówka Hotel for the purpose of:
   1. Marketing of our own services, sending newsletters electronically, saving data in “cookies”, organising competitions and promotional campaigns in which you may participate.
   2. Taking steps prior to entering into a contract, at the request of the person whose data is concerned, or performing a contract for the provision of services by Turówka Hotel to which the data subject is a party (Article 6(1)(b) GDPR).
   3. Fulfilment of the legal obligation incumbent on Turówka Hotel (including tax and archiving obligations, handling complaints, reporting conduct bearing the characteristics of a crime or offence or generally considered reprehensible) – pursuant to Article 6(1)(c) GDPR.
   4. Protection of vital interests (life, health) and the interests of the person whose data is concerned (including processing the data of accompanying persons, including children using hotel services) – pursuant to Article 6(1)(d) GDPR.
   5. Pursuing the legitimate interests of Turówka Hotel (including pursuing or securing claims, ensuring the safety and protection of persons and property, conducting direct marketing other than on the basis of consent, e.g. discount cards, loyalty programmes, sending occasional gifts or Christmas cards) – pursuant to Article 6(1)(f) GDPR.
2. Providing personal data is voluntary and consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. When entering into civil-law contracts, providing personal data is necessary. If, for any reason, you do not provide the required personal data, we may refuse to enter into the contract.
3. Publicly available personal data – provided, for example, on social media or review websites when posting comments, opinions, etc. – is available to all visitors to the pages containing such data. Turówka Hotel is unable to prevent private individuals or companies from using this data to send users unspecified information. Therefore, this data is not subject to this Privacy Policy.

• VI. Categories of processed data

We process the following personal data:

1. In the case of actions prior to entering into a contract, entering into and performing a contract for the provision of services:
   – first and last name,
   – residential address,
   – document number,
   – date of birth,
   – telephone number,
   – email address,
   – image,
   – vehicle registration number,
   – dates of ordered events and personal data contained in correspondence,
   – information about the stay and type of services ordered,
   – other necessary data, e.g. for returning forgotten items.

1. In the case of marketing activities:
   – first and last name
   – email address
   – telephone number
   – username on a social networking website
2. In the case of automatically collected information:
   – device information,
   – cookie files,
   – IP addresses,
   – browser information.
   – other information about users and their behaviour.

• VII. Profiling

Your data may be processed in an automated manner, including profiling; however, this will not produce any legal effects or similarly significantly affect your situation. Automated processing may be carried out to assess and determine the personal characteristics or needs of users. To provide content tailored to your needs on various services, we use the Facebook pixel code, which helps us manage advertising on Facebook and conduct remarketing activities. For newsletter statistics, we track the history of your email opening rates in order to subsequently send you the most useful information. Data processed for the purpose of entering into contracts is not subject to profiling. Entities receiving your personal data in connection with visiting the Controller’s websites may use it to display similar content tailored to your previous online activity (profiling). This is based on the websites previously visited. This applies in particular to Google and Facebook services.

• VIII. Transfer of data to third countries

We inform you that we do not transfer your personal data to third countries or international organisations, subject to point IX.1i.

• IX Recipients of personal data

1. We may disclose your data to entities providing services to us:
   1. hosting and IT services,
   2. legal and insurance services,
   3. courier and postal services,
   4. management of the newsletter contact database and sending newsletters,
   5. operation of the booking module on our website,
   6. marketing for Turówka Hotel & SPA****,
   7. state authorities and services, pursuant to applicable regulations authorising them to obtain personal data, provided that they have an appropriate legal basis for requesting personal data,
   8. entities performing tasks in connection with cooperation with Turówka Hotel,
   9. owners of websites/search engines Google, YouTube, Facebook and other services whose plugins may be present on Turówka Hotel’s websites and social media profiles.
2. Personal data is not sold or rented to other entities.

• X. Processing period

1. In the case of contracts for the provision of services, personal data will be stored for the duration of the contract and, after its expiry, for the period necessary to:
   1. secure or pursue any claims, for no longer than the limitation period for claims under Polish law or until the criminal proceedings have ended with a final judgment;
   2. fulfil legal obligations, including tax and accounting obligations; under applicable law, this is a period of 5 years calculated from the end of the calendar year in which the tax obligation arose;
   3. fulfil statistical and archiving purposes;
   4. for a maximum period of 5 years from the date of completion of the contract.
2. In other cases, personal data will be processed:
   1. until consent is withdrawn, an objection to its processing is submitted, or it is no longer necessary to achieve the purpose. After that period, until the limitation period for any claims expires.
   2. video surveillance recordings – for a period not exceeding 3 months, unless, due to special circumstances, it is necessary to retain the recording for a longer period, e.g. until the proceedings have been finally concluded.

• XI. Rights related to the processing of personal data

1. Rights of the persons whose data is concerned.

You have the right to:

1. 1. access your data and obtaining copies thereof, obtaining information about the processing of your data,
   2. rectification (correction and completion) of data,
   3. restriction of data processing,
   4. deletion of data,
   5. objecting to the processing of data,
   6. data portability,
   7. lodging a complaint with a supervisory authority,
   8. withdrawing consent to the processing of personal data at any time, whereby withdrawal of consent will not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.
2. Submitting requests related to the exercise of rights.

A request concerning the exercise of the above rights may be submitted in writing to the addresses indicated in the Contact details section. The request should precisely indicate: – the right that the person submitting the request wishes to exercise,
– the processing purposes to which the request relates,
– the processing activities and scope of data. The Controller may request additional information from the person submitting the request if they are unable to identify that person. A response to the request should be provided within 30 days in the same form as the request. If it is necessary to extend this deadline, the Controller will inform the person submitting the request of this fact.

1. Data processed by Turowka Hotel as part of monitoring, which does not allow the identification of a natural person.

We inform you that, based solely on the image from the monitoring system, Turowka Hotel is unable to identify a natural person, which means that, pursuant to Article 11 of the GDPR, processing not requiring identification takes place; furthermore, in connection with Article 11 of the GDPR, Articles 15, 16, 17, 18, 19 and 20 of the GDPR do not apply – an unidentified person does not have the right to: access the content of their personal data within the scope of monitoring or obtain information, including about the categories of data and the purposes of their processing, or obtain copies of the data; rectify inaccurate data and complete missing data; be forgotten, i.e. have data processed without grounds and unlawfully deleted; restrict the processing of their data, i.e. suspend operations on the data or refrain from deleting the data, in accordance with the submitted request; be notified of the rectification or deletion of personal data or of the restriction of processing; request that their personal data be transferred by us directly to another controller, where technically feasible. At the same time, we inform you that you will have the right to request from the Controller access to your personal data, its rectification, deletion or restriction of processing, and the right to data portability, provided that you provide the Controller with additional information enabling the identification of the aforementioned unidentified natural person. An unidentified natural person, based on the image from the Controller's monitoring system, has the right to object to the processing of data (provided that they provide the Controller with additional information enabling the identification of the aforementioned unidentified natural person) and the right to lodge a complaint with the supervisory authority, namely the President of the Personal Data Protection Office.

• XII. Cookie Policy

1. On the first visit to the website www.turowka.pl the user is informed about the use of “cookies”. By remaining on the website, the user accepts the use of standard “cookies” on the website. Failure by users to change their browser settings is tantamount to consenting to the use of “cookies”.
2. The installation of “cookies” is necessary for the proper provision of services on our website. “Cookies” contain information necessary for the proper functioning of the website, particularly those requiring authorisation. The user may change their browser settings at any time so that “cookies” are either accepted or rejected, or so that the user is notified when these files are not placed on their computer.
3. The following types of “cookies” are used on the website
   1. session cookies – remain in the browser until it is closed or the user logs out of the website on which they were placed,
   2. persistent cookies – remain in the device's web browser until they are deleted by the user or until the predetermined period specified in the “cookie” parameters expires.
4. Third-party “cookies”:
   1. Google Analytics – allows us to analyse how our websites are used; more information is available in Google's Privacy Policy.
   2. Google AdWords – we may commission advertisements targeted at selected groups of recipients, but we do not have access to data from “cookies” stored on your device. More information is available in Google's Privacy Policy.
   3. Facebook – our websites use the so-called “Facebook conversion pixel” to manage our advertisements on Facebook and conduct marketing activities. More information is available in Facebook's Privacy Policy.
5. You may independently change the settings concerning “cookies” at any time, specifying the conditions for their storage and the scope of their use. Settings may be changed using the settings of your web browser or mobile device. Detailed information on the possibilities and methods of managing “cookies” is available in the browser settings of your web browser.

• XIII. Collection of Personal Data of Persons Under 18 (Children)

We do not knowingly collect or solicit any personal data from persons under 18 years of age, nor do we knowingly permit such persons to make reservations at our hotel. If we learn that we have obtained the personal data of a person under 18 years of age without the consent of a parent or legal guardian, we will immediately proceed to delete such data. If you believe that we have or may have data concerning or originating from a person under 18 years of age, please contact us at manager@turowka.pl.

• XIV. Changes to the Privacy Policy

Turowka Hotel reserves the right to make changes to the Privacy Policy, which may be caused by the development of internet technology, possible changes in data protection legislation, and the development of the website. Each customer is subject to the current Privacy Policy available on the website as of the date of use of the services of Turowka Hotel.

• XV. Links to Other Websites

The website may contain links to other websites that operate independently of the website and are in no way supervised by Turowka Hotel. These websites may have their own privacy policies and regulations, which we recommend that you read carefully.

• XVI. Contact Us

In summary, we make every effort to ensure that the processing of your personal data interferes with your individual sphere of privacy to the least possible extent; however, if at any stage of the processing of your personal data there is any doubt as to the compliance of these activities with the law, please contact us. Regardless of the above, we encourage you to send questions, comments, feedback, requests or complaints regarding this Privacy Policy to the following email address: manager@turowka.pl.