§1. Personal Data Administrator

1. The personal data Administrator is:
Ozimek Hubert – Klubokawiarnia “GRAMOFON”
ul. Grzybowa 31, 21-500 Biała Podlaska, Lubelskie Voivodeship,
NIP: 5372298926, REGON: 060214504
(hereinafter: the “Administrator”).
2. In matters related to the processing of personal data, contact can be made via e-mail at: kontakt@bpbooking.pl or by phone at: 600 055 930.

§2. Scope and Purposes of Data Processing

1. The Administrator processes personal data including: first name, last name, e-mail address, telephone number, residential address, and invoicing details.
2. Personal data is processed for the following purposes:

• conclusion and performance of the apartment rental agreement (Art. 6 sec. 1 lit. b GDPR),
• handling online payments (Art. 6 sec. 1 lit. b GDPR),
• fulfilling legal obligations, especially accounting and tax duties (Art. 6 sec. 1 lit. c GDPR),
• asserting claims or defending against claims (Art. 6 sec. 1 lit. f GDPR),
• conducting marketing activities, including a newsletter, online advertising, and profiling using analytical and advertising tools (Art. 6 sec. 1 lit. a and f GDPR).

§3. Legal Basis for Processing

1. Personal data is processed based on:

• necessity for the performance of a contract (reservation and rental),
• a legal obligation incumbent on the Administrator (accounting, taxes),
• the legitimate interest of the Administrator (asserting claims, marketing),
• the consent of the data subject (newsletter, marketing cookies).

§4. Data Recipients

1. Recipients of personal data may include:

• online payment operator Przelewy24,
• accounting office cooperating with the Administrator,
• hosting company Dhosting.pl,
• providers of IT services and technical support,
• providers of analytical and advertising tools (Google, Meta).

§5. Data Retention Period

1. Data related to reservations is stored for a period of 1 year from the end of the stay.
2. Accounting and tax data is stored for the period required by law (usually 5 years).
3. Data processed for marketing purposes – until the user withdraws consent.

§6. Rights of Data Subjects

1. Every data subject has the right to:

• access their data,
• rectify their data,
• erase their data (“right to be forgotten”),
• restrict processing,
• data portability,
• object to data processing,
• withdraw consent at any time (if processing is based on consent).

2. To exercise their rights, the data subject may contact the Administrator using the contact details provided in §1.
3. Every person also has the right to lodge a complaint with the President of the Personal Data Protection Office.

§7. Cookies and Tracking Technologies

1. The Service uses cookies for the purposes of:

• ensuring the correct operation of the service (technical cookies),
• analytics (Google Analytics),
• marketing (Google Ads, Meta Pixel).

2. The user has the ability to manage cookie settings using the displayed cookie banner and their browser settings.
3. Consent to analytical and marketing cookies may be withdrawn at any time.

§8. Transfer of Data Outside the EEA

1. Personal data may be transferred to third countries in connection with the use of Google and Meta services, which may process data on servers located outside the European Economic Area (EEA).
2. The transfer is carried out based on compliance mechanisms provided for in the GDPR (e.g., Standard Contractual Clauses).

§9. Final Provisions

1. The Administrator reserves the right to introduce changes to this Privacy Policy, of which users will be informed by publishing a new version on the Service.
2. The Privacy Policy is effective from the date of publication on the website www.bpbooking.pl