Privacy

PRIVACY POLICY

This Privacy Policy sets out the rules for the processing of personal data obtained through the website www.logos-zakopane.pl, operated by Biuro Turystyki ZNP LogosTour Sp. z o.o.

Personal data collected by the Data Controller through the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the “GDPR”.

WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?

The Controller of your personal data is Biuro Turystyki ZNP LogosTour Sp. z o.o., with its registered office in Warsaw at ul. Wybrzeże Kościuszkowskie 31/33 (00-379), email: biuro@logostour.pl, telephone: +48 22 39 75 219 (hereinafter referred to as the “Data Controller”, “Controller” or “Company”), which operates Hotel Logos Zakopane.

DATA PROTECTION OFFICER

The Company has appointed a Data Protection Officer (DPO), who may be contacted in matters relating to the processing of personal data:

- in writing, at the Company`s address indicated above, with the note "For the attention of the DPO"

- by email at iod@logostour.pl

DEFINITIONS

For the purposes of this Privacy Policy, the following definitions shall apply:

Data Controller (Controller, DPO) – means Biuro Turystyki ZNP LogosTour Sp. z o.o., with its registered office in Warsaw at ul. Wybrzeże Kościuszkowskie 31/33, 00-379 Warsaw, being the entity that determines the purposes and means of processing personal data;

Regulation/GDPR – means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

Data Protection Officer (DPO) – means the person appointed to supervise and monitor data protection matters, possessing the competences described in the GDPR and the Company's internal documents;

User – means a natural person, legal person or natural person conducting sole proprietorship who uses the Website and on whose behalf, in accordance with the Terms and Conditions and applicable law, electronic services may be provided, or with whom LogosTour may conclude an agreement for the provision of services;

Personal Data – means any information relating to an identified or identifiable natural person (including a natural person conducting business activity), processed by the Data Controller both in an IT system and in traditional form (paper form);

Special Categories of Personal Data – means information referred to in Article 9 of the GDPR, in particular personal data revealing religious or philosophical beliefs and data concerning health;

Processing of Personal Data – means any operation performed on personal data, such as collection, recording, storage, organisation, modification, disclosure and deletion of personal data, in particular in an IT system;

Website – means the website www.logostour.pl operated by the Data Controller, or an application through which the Controller operates websites functioning under the logostour.pl domain, designed so that they may be visited without the need to disclose personal data, excluding the use of access to the newsletter, user account and booking of a tourist event;

Device – means an electronic device through which the User accesses the Website.

FOR WHAT PURPOSE AND TO WHAT EXTENT DO WE PROCESS THE PERSONAL DATA YOU PROVIDE ?

1. Personal data provided by you is processed by the Data Controller for the purposes indicated below and on the following legal bases arising from the GDPR:

a) for the purpose of making a reservation and managing the reservation process (Article 6(1)(b) GDPR);

b) for the purpose of performing the reservation agreement (Article 6(1)(b) GDPR);

c) for the purpose of responding to an enquiry submitted via the contact form or contacting you at your request (Article 6(1)(a) and (f) GDPR);

d) for the purpose of fulfilling obligations arising from applicable laws, which may include, among other things, maintaining financial records and reporting (Article 6(1)(c) GDPR);

e) for the purpose of pursuing the Company's legitimate interests, which may include, among other things:

- establishing, pursuing and defending claims;

- handling complaints;

- archiving activities;

- analytical and statistical activities;

- debt collection activities.

The legal basis for processing personal data for the purpose of pursuing the Company's legitimate interests is Article 6(1)(f) GDPR;

f) in connection with the recording of video surveillance footage for the purpose of ensuring the safety of persons and protecting property located on the hotel premises (Article 6(1)(f) GDPR);

g) for the purpose of conducting marketing activities, including direct marketing of the Company's products and services – all types of newsletters and information sent electronically are based on consent to the processing of personal data (Article 6(1)(a) GDPR), while sending a catalogue in paper form constitutes a legitimate interest of the Controller understood as direct marketing of its own services (Article 6(1)(f) GDPR);

h) for the purpose of protecting the vital interests of the data subject, which may include, among other things, purposes related to the necessity of saving life, protecting health or property, i.e. the Company may contact you in connection with an incident that occurred on our premises involving you or causing harm to you or a third party, if you were or may have been a participant or witness to such an incident (Article 6(1)(d) GDPR).

2. The Company may prosess the personal data of minors for the following purposes:

a) for the purpose of fulfilling obligations arising from applicable laws (in connection with the Standards for the Protection of Minors) – the Act of 13 May 2016 on Counteracting Threats of Sexual Crime and the Act of 28 July 2023 amending the Family and Guardianship Code and certain other acts, pursuant to Article 6(1)(c) GDPR and Article 9(1)(b) GDPR;

b) for the performance of a reservation agreement for the benefit of or involving a minor, based on the consent of the legal guardian responsible for the care of the minor (Article 6(1)(b) GDPR);

c) for the purpose of verifying the age of a minor using the Company's services in order to pursue the Company's legitimate interests (Article 6(1)(f) GDPR).

FOR HOW LONG DO WE PROCESS YOUR PERSONAL DATA ?

Personal data processed for the above-mentioned purposes will be processed for the period necessary to achieve those purposes, taking into account the retention periods specified by applicable law, i.e.:

a) personal data processed for the purpose of performing an agreement will be processed for the duration of the agreement and, after its termination, for the period of limitation of any claims arising from the agreement;

b) personal data processed for the purpose of fulfilling obligations arising from applicable laws, which may include, among other things, maintaining financial records and reporting, will be processed for a period of 5 years, calculated from the end of the calendar year in which the tax obligation arose;

c) for the purpose of pursuing the Company's legitimate interests, i.e. establishing, pursuing and defending claims, handling complaints and archiving activities, personal data will be processed until the expiry of the limitation period for all claims specified by law;

d) for the purpose of conducting marketing activities, including direct marketing of the Company's products and services, personal data will be processed until consent is withdrawn;

e) for the purpose of protecting the vital interests of the data subject, personal data will be processed until the expiry of the limitation period for all claims specified by law.

Providing personal data is voluntary, but necessary to conclude and perform an agreement.

TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA ?

Personal data may be disclosed to entities providing support to the Company on the basis of outsourced services and in accordance with concluded data processing agreements, including entities providing IT, payroll and HR, legal and debt collection, administrative, postal, courier, marketing and insurance services.

Personal data may also be transferred to entities affiliated with the Company.

When making a payment for a reservation, you provide us with your bank account number. If you make an online payment, you are redirected directly to the website of the payment operator go.przelewy24.pl, owned by PayPro S.A., with its registered office in Poznań at ul. Pastelowa 8, 60-198 Poznań. This entity will also be a recipient of the User's data and an independent controller of such data.

WHAT RIGHTS DO YOU HAVE ?

You have the right to:

a) access your personal data and rectify it (Articles 15 and 16 GDPR). You may exercise this right whenever you notice that your data is incorrect or incomplete;

b) have your data erased and restrict its processing (Articles 17 and 18 GDPR). You may exercise these rights when the data is no longer necessary for the purposes for which it was collected;

c) data portability (Article 20 GDPR), where processing is based on your consent or an agreement concluded with you and where the processing is carried out by automated means;

d) object to the processing of your personal data, including the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal;

e) lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe that the processing of your personal data violates the provisions of the GDPR.

The above rights may be exercised, among other ways, by contacting the Data Protection Officer at iod@logostour.pl.

COOKIES

The Website uses cookies and similar technologies (hereinafter referred to as “cookies”) to ensure its proper functioning, adapt content to user preferences, conduct statistics and improve the functionality of the Website, as well as for marketing purposes.

Cookies may constitute personal data only if they allow the identification of a natural person. In such cases, their processing is carried out in accordance with the GDPR.

1. Legal basis for the use of cookies

- Article 6(1)(f) GDPR - for cookies necessary for the functioning of the Website;

- Article 6(1)(a) GDPR - for cookies requring consent ( analytical, marketing and functional cookies );

- Article 399 of the Act of 12 July 2024 - Electronic Communications Law - with regard to storing information or gaining access to information stored on the User`s Device.

2. Types of cookies used

a) Necessary (technical) cookies

These cookies enable the Website to function properly and cannot be disabled in the administrator's system. They are installed pursuant to Article 399(3) of the Electronic Communications Law and do not require consent.

b) Analytical and statistical cookies

These cookies make it possible to analyse how the Website is used, including the number of visits, time spent on the Website and sources of traffic. They are processed only after the User has given prior consent.

c) Functional cookies

These cookies enable the Website to remember the User's preferences, such as language and website appearance. They are processed only after the User has given prior consent.

d) Marketing / advertising cookies

These cookies enable advertisements to be displayed based on the User's behaviour on the Internet. They are processed only after the User has given prior consent.

3. Managing consent

The User may give, refuse or withdraw consent to the use of individual categories of cookies through the consent banner displayed during the first visit to the Website and through the “Cookie Settings” tab.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

4. Cookie retention period

The retention period depends on the type of cookies:

- Session cookies - temporary files stored on the User`s Device until the User logs out, leaves the Website or closes the web browser;

- Persistent cookies - files stored on the User`s Device for the period specified in the cookie parameters or until they are by the User.

A detailed list of cookies, together with their lifespan, is available under the “Cookie Details” tab in our consent management tool.

5. Data recipients

Where external tools are used, in particular Google Analytics, Meta, advertising tools and social media plugins, data may be transferred to the providers of these services in accordance with the principles set out in their respective privacy policies.

Where data is transferred outside the European Economic Area (EEA), appropriate safeguards are applied in accordance with Article 46 GDPR, such as Standard Contractual Clauses or European Commission adequacy decisions.

6. How can cookies be disabled in your browser ?

The User may also manage cookies through the settings of their web browser. Detailed instructions are available on the websites of software providers, for example:

- Chrom, Microsoft EDGE, Firefox, Opera, Safari

AUTOMATED DECISION-MAKING AND PROFILING

Your data may be processed by the Data Controller by automated means, including profiling. However, decisions concerning an individual person resulting from such processing will not be made solely by automated means.

FINAL PROVISIONS

In matters not regulated by this Privacy Policy, the applicable EU and national data protection laws shall apply.

The Privacy Policy may be updated by the Data Controller, in particular to reflect changes in applicable laws, improve security, protect Users and the Data Controller, or make editorial corrections.

Updates shall be made by publishing a new version of the Privacy Policy on the Website.

Date of the last update of the Privacy Policy: 01.09.2026 r.