Privacy

Information clauses:

Marketing consents

Information clause on personal data processing
when booking and entering into an apartment rental agreement

Information clause on email correspondence

Information clause on the contact form

General provisions
Personal data controller
Scope of data processed
Personal data processing principles
Purposes of personal data processing
Data provision requirement
Data processing when using the contact form
Data processing in electronic correspondence
Data processing for apartment reservations
Data processing for contract conclusion and performance
Data processing for issuing accounting documents
Data processing for marketing activities
Data processing to establish, pursue or defend claims
Data processing to meet legal obligations
Personal data recipients
Entrusting personal data processing
Transfers of personal data outside the EEA
Personal data retention period
Personal data sharing rules
Personal data processing security
Data subject rights
Exercising data subject rights
Automated decision-making and profiling
Confidentiality and security measures
Links to third-party websites
Contact on personal data protection matters
Privacy Policy changes
Final provisions

1. General provisions

This Privacy Policy sets out the rules for processing personal data by Meta Apartments spółka z ograniczoną odpowiedzialnością spółka komandytowa in connection with users’ use of the website and electronically provided services, and the conclusion and performance of agreements concerning apartment reservations and rentals.

This Policy aims to provide clear information on personal data processing, fulfil the information obligations under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), and present the data protection principles applied by the Controller.

The Controller exercises due care to ensure that personal data are processed in accordance with the principles set out in Article 5 GDPR, in particular lawfulness, fairness, transparency, data minimisation, purpose limitation, accuracy, integrity, confidentiality and accountability.

Using the website does not require providing personal data, except when users voluntarily use available features, such as the contact or booking form, contact by email or phone, or enter into an agreement with the Controller.

2. Personal data controller

The personal data controller is:
Meta Apartments spółka z ograniczoną odpowiedzialnością spółka komandytowa
ul. Willowa 14
43-370 Szczyrk
KRS: 0000730401
NIP: 9372711759
REGON: 380078536

You may contact the Controller:

by post: ul. Willowa 14, 43-370 Szczyrk,
by email: daneosobowe@metaapartments.pl,

The Controller has not appointed a Data Protection Officer because Article 37 GDPR conditions do not apply.

3. Scope of data processed

The Controller processes only personal data necessary to achieve specific processing purposes.

The scope of data processed depends on how the services are used and the type of contact with the Controller, and may include in particular:

first and last name,
email address,
phone number,
residential or mailing address,
identification data needed for accounting documents,
booking and stay details,
information in correspondence,
information provided during phone contact,
information needed to handle complaints or reports.

The Controller does not process special categories of personal data referred to in Art. 9(1) GDPR, unless required by law or voluntarily provided by the data subject.

4. Personal data processing rules

The Controller processes personal data only as permitted by law and to the extent necessary to achieve specific purposes.

Legal bases for processing include in particular:

taking steps before entering into a contract and performing the contract (Art. 6(1)(b) GDPR),
compliance with the Controller's legal obligations (Art. 6(1)(c) GDPR),
pursuing the Controller's legitimate interests (Art. 6(1)(f) GDPR),
the data subject's consent – only where required by law (Art. 6(1)(a) GDPR).

The Controller assesses the legal basis for processing each time and applies data minimisation, limiting processed information to what is necessary to achieve a specific purpose.

5. Purposes of personal data processing

The Controller processes personal data in connection with business activities and website operation.

Data may be processed for the following purposes:

responding to enquiries sent via the contact form;
conducting email and telephone correspondence;
providing information on apartment availability;
accepting and handling bookings;
entering and performing short-term rental agreements;
financial settlements and issuing accounting documents;
complying with legal obligations, particularly tax and accounting obligations;
handling complaints and Guest reports;
ensuring the security of services provided;
establishing, pursuing or defending against claims;
marketing its own services, where conducted in compliance with applicable law;
demonstrating compliance with applicable personal data protection laws.

The Controller does not use personal data for purposes incompatible with the purpose of collection or process it beyond what is necessary to achieve the stated purposes.

6. Requirement to provide data

Providing personal data is voluntary; however, in many cases it is necessary to act on the data subject's request, enter into or perform a contract, or comply with legal obligations.

Failure to provide required data may prevent responding to an enquiry, making a booking, entering into a contract, issuing an invoice or performing other actions expected by the user.

The Controller does not make website use conditional on consent to personal data processing, unless such consent is required by separate legal provisions.

7. Data processing when using the contact form

Website users may contact the Controller via the contact form available on the website.

Using the form is voluntary and requires data needed to identify the person contacting us and respond to the enquiry. The required data is limited to information necessary for correspondence.

Data submitted via the contact form is processed solely to respond to the enquiry, conduct further correspondence and take action at the request of a person interested in the Controller's offer.

The legal basis is Art. 6(1)(b) GDPR, i.e. taking steps before entering into a contract at the data subject's request. If correspondence is retained to protect the Controller's rights or pursue claims, the legal basis is Art. 6(1)(f) GDPR.

8. Data processing in electronic correspondence

The Controller processes personal data contained in messages sent by email.

The scope of processed data depends on the correspondence and includes only information provided by the sender or necessary to respond.

Email correspondence is conducted to provide information, present an offer, negotiate, enter into or perform a contract, comply with legal obligations and ensure proper communication between the Controller and the person making contact.

If correspondence serves as evidence of a contract or may be relevant to establishing, pursuing or defending against claims, it may be retained for the period required by law or until any claims become time-barred.

9. Data processing for apartment bookings

Making a booking requires personal data needed to identify the person making the booking and provide the service.

The scope of processed data depends on how the booking is made and the contact channel selected.

Data is processed in particular to:

accepting the reservation,
confirming apartment availability,
contacting the Guest before the stay begins,
preparing the stay,
providing accommodation-related services,
contacting the Guest during the stay,
settling charges for services provided.

The legal basis is Article 6(1)(b) GDPR.

Where processing certain data is required by law, the legal basis is also Article 6(1)(c) GDPR.

10. Data processing for concluding and performing the agreement

If an apartment rental agreement is concluded, the Controller processes personal data as necessary to conclude and perform it and properly settle the services provided.

Processing includes, in particular:

preparing the agreement,
identifying the parties,
settling accounts,
issuing accounting documents,
fulfilling tax and accounting obligations,
correspondence related to performing the agreement,
handling complaints,
archiving documentation.

The legal basis is Article 6(1)(b) and (c) GDPR.

After the agreement is performed, data may continue to be processed only as required by law or necessary to establish, pursue or defend against claims.

11. Data processing related to issuing accounting documents

The Controller processes personal data contained in invoices, bills and other accounting documents to fulfil obligations under tax and accounting laws.

The data processed is limited to information required by applicable law.

Accounting records are retained for the period required by applicable law.

12. Data processing related to marketing

The Controller may conduct marketing activities solely concerning its own services.

Marketing is conducted with respect for privacy rights and applicable electronic communications laws.

Where the law requires consent to send commercial information by email or SMS or to make telephone calls, the Controller obtains the user's separate consent each time in accordance with the Electronic Communications Act.

Consent is voluntary and is not a condition for using the Controller's services.

Anyone who has given marketing consent may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

13. Pursuing and defending against claims

After cooperation ends, the Controller may also process personal data as necessary to protect its rights and pursue or defend against claims.

This applies especially to situations involving:

Agreement: non-performance/improper performance,
complaints,
court proceedings,
administrative proceedings,
enforcement proceedings,
pursuing amounts due.

The legal basis is the Controller's legitimate interest referred to in Article 6(1)(f) GDPR.

Data is processed only for as long as necessary for this purpose, taking into account limitation periods for claims under applicable law.

14. Fulfilling legal obligations

The Controller also processes personal data to fulfil obligations under generally applicable law.

This applies in particular to obligations under tax and accounting laws, laws governing business activity, obligations to provide data to authorised bodies, and obligations under data protection laws.

Where required by law, the Controller may provide personal data to competent public authorities solely under applicable law and to the extent necessary for them to exercise their statutory powers.

15. Recipients of personal data

The Controller ensures that personal data is accessible only to authorised persons and entities to which data is disclosed under applicable law or agreements.

In connection with its activities, personal data may be disclosed or entrusted only to entities whose involvement is necessary to properly provide the services.

In particular, data recipients may include:

website hosting service providers;
website and IT system administrators;
booking system providers;
electronic payment operators;
banks processing financial settlements;
accounting firms;
law firms and advisory service providers;
IT and maintenance service providers;
postal operators;
telecommunications service providers;
document archiving service providers;
marketing service providers – only to the extent resulting from consents given and applicable law;
public administration bodies, law enforcement authorities, courts and other entities entitled by law to receive data.

The Controller only provides the data necessary to achieve the specific purpose.

16. Entrusting personal data processing

When using processors handling personal data on the Controller’s behalf, data are transferred only under a data processing agreement concluded in accordance with Art. 28 GDPR.

The Controller selects processors with due diligence, assessing in particular their technical and organisational measures ensuring data security.

Each processor is obliged to:

process data only on the Controller’s documented instructions;
ensure confidentiality of persons with data access;
apply security measures meeting Art. 32 GDPR requirements;
cooperate in exercising data subjects’ rights;
immediately report personal data breaches;
delete or return data after services end, as decided by the Controller.

17. Transfers of personal data outside the European Economic Area

As a rule, the Controller processes personal data within the European Economic Area.

If using certain technology services entails transferring data outside the European Economic Area, the transfer will comply with Chapter V GDPR requirements.

The Controller ensures that data are transferred outside the European Economic Area only with appropriate safeguards required by law, in particular:

an European Commission adequacy decision;
standard contractual clauses adopted by the European Commission;
other mechanisms permitted by the GDPR.

Information on transfers outside the European Economic Area may be provided to the data subject upon request.

18. Personal data retention period

The Controller stores personal data only as long as necessary for the purpose collected, and thereafter for the period required by law or necessary to secure potential claims.

The retention period depends on the legal basis and processing purpose.

In particular:

data processed via the contact form are stored during correspondence and until potential claims become time-barred;
data processed in electronic correspondence are stored for the period determined by the matter’s nature;
data related to an apartment booking are stored as necessary to fulfil the booking and perform the agreement;
data processed to perform an agreement are stored for its duration and as required by tax and accounting law;
data in accounting records are stored for the period required by applicable law;
data processed based on consent are stored until consent is withdrawn or the processing purpose ends;
data processed based on the Controller’s legitimate interest are stored until an effective objection or the end of that interest.

After the retention periods expire, data are deleted or anonymised unless further storage is required by law.

19. Rules for sharing personal data

The Controller does not sell personal data or share it with third parties for their own marketing purposes.

Data are shared only:

under applicable law;
at authorised authorities' request;
processors acting on behalf of the Controller;
with the consent of the data subject, where required by law.

Each disclosure respects the data minimization principle and is limited to what is necessary to achieve the purpose for which the data is shared.

20. Data Processing Security

The Controller implements appropriate technical and organizational measures to ensure security proportionate to the risk of infringing individuals’ rights or freedoms.

In particular, measures are used to:

protect data from unauthorized access;
protect against accidental data loss;
ensure data confidentiality, integrity and availability;
secure IT systems against external threats;
control access to personal data;
perform backups;
regularly update IT systems;
monitor IT infrastructure security;
ensure accountability for personal data operations.

The Controller periodically reviews the security measures used and takes steps to continually improve them, considering changing threats and technological developments.

21. Rights of Data Subjects

Every data subject whose personal data is processed by the Controller has the rights provided under the GDPR, subject to the conditions and limitations set out therein.

The data subject has the right to:

obtain information on processing of their personal data;
access their personal data and receive a copy;
rectify inaccurate data or complete incomplete data;
request erasure of personal data (the “right to be forgotten”) where the conditions in Article 17 GDPR are met;
request restriction of personal data processing;
data portability for data processed automatically based on consent or a contract;
object to processing based on the Controller’s legitimate interest;
withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
lodge a complaint with the President of the Personal Data Protection Office if they believe processing violates the GDPR.

The Controller handles data subject requests without undue delay and no later than one month from receipt, with the possibility of extending this period in cases provided for in Article 12(3) GDPR.

22. Exercising Rights

The data subject may exercise their rights by contacting the Controller in writing or electronically.

The Controller may request additional information necessary to verify the applicant’s identity where required to ensure personal data security and protect others’ rights.

Exercising GDPR rights is generally free of charge, unless the data subject’s requests are manifestly unfounded or excessive.

23. Automated Decision-Making and Profiling

The Controller does not make decisions producing legal effects or similarly significantly affecting individuals based solely on automated processing of personal data.

The Controller does not use profiling as defined in Article 22 GDPR, unless the data subject is separately informed in accordance with applicable law.

24. Data Confidentiality and Security

The Controller exercises due care to secure personal data and protect it against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

Access to personal data is limited to persons authorized by the Controller who are bound by confidentiality.

The Controller applies organizational and technical measures appropriate to current technical knowledge, the nature of processing and the risk to individuals’ rights and freedoms.

Security measures are periodically reviewed and updated to reflect technological, organizational and legal changes.

25. Contact Regarding Personal Data Protection

For matters concerning personal data processing and exercising GDPR rights, the Controller may be contacted at:
Meta Apartments spółka z ograniczoną odpowiedzialnością spółka komandytowa
ul. Willowa 14
43-370 Szczyrk
e-mail: daneosobowe@metaapartments.pl

The Controller answers questions about personal data processing and handles data subject requests in accordance with applicable law.

26. Privacy Policy Changes

The Controller reserves the right to amend this Privacy Policy in the event of:

changes in applicable law;
changes to the website’s operation;
expansion or changes in the services provided;
implementation of new organizational or technical measures affecting personal data processing;
issuing new guidelines or interpretations on personal data protection.

Each new version of the Privacy Policy is published on the Controller’s website and takes effect upon publication, unless another effective date is specified.

Final Provisions

This Privacy Policy is for information purposes and was prepared to fulfill obligations under Articles 12–14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

Matters not covered by this Policy are governed by the GDPR, the Personal Data Protection Act and other generally applicable laws on personal data protection.

This Privacy Policy is reviewed and updated periodically to ensure compliance with applicable law and the Controller’s actual personal data processing practices.