Privacy Policy

Data controller

The controller of personal data collected through the Apartamenty Cyrhla 43e website is TATRY 2022 spółka z ograniczoną odpowiedzialnością, registered at ul. Cyrhla 24A, 34-500 Zakopane, Polska. For personal data enquiries, contact luxhouse@op.pl or +48 880 835 897. The apartments are located at Cyrhla 43E, 34-500 Zakopane.

Polish tax ID (NIP): 7361740762. REGON: 522296730. KRS: 0000976938. Registry court: Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XII Wydział Gospodarczy Krajowego Rejestru Sądowego. Share capital: PLN 50,000.00.

Data we process

The enquiry form collects your name, email, arrival and departure dates, numbers of adults and children, and preferred apartment. Phone number and an additional message are optional. We do not request children’s names, identity document numbers, payment details or health information. Please do not include such details in your message. Providing data is voluntary, but required fields are needed to submit the form. You can also contact us by phone. The server may record your IP address, request time, visited URL and browser information.

Purposes and legal bases

We handle enquiries about a planned stay to take steps at your request before entering into a contract, under GDPR Article 6(1)(b). Other correspondence is handled under Article 6(1)(f); our legitimate interest is communicating with people interested in the property. Website security, prevention of misuse, and establishing, pursuing or defending legal claims may rely on Article 6(1)(f). Submitting the form does not confirm a booking. If a stay is subsequently agreed, information about any additional processing for the contract and legal duties will be provided separately.

Data retention

We keep correspondence for as long as necessary to handle the enquiry. Where data is needed to establish, exercise or defend legal claims, we retain it until the applicable limitation period expires, taking account of circumstances affecting that period. Server logs: for the time needed to diagnose faults, secure the website and investigate incidents, followed by the hosting service’s log rotation cycle; records preserved for a specific legal claim may be retained until the applicable limitation period expires. Backups: SEOHOST’s rotating daily, weekly and monthly backups; data expires when a copy is overwritten. Under SEOHOST’s published data-processing agreement template, the final backup after termination is deleted within 6 months. The submission limit stores a hashed IP address and a request counter for 10 minutes. The form sends the enquiry by email; the current configuration does not create a separate enquiry database in WordPress.

Who may receive data

Authorised staff handling enquiries and hosting, email and technical support providers may have access where needed for their tasks and on an appropriate legal basis. Hosting: SEOHOST sp. z o.o., ul. Obornicka 330, 60-689 Poznań, Poland, servers in Poland; SEOHOST data protection information. Email: Wirtualna Polska Media S.A., Polska (WP Poczta, op.pl). Technical support: providers maintaining the website on the controller’s behalf. Data may be disclosed to competent authorities where required by law.

Google Maps and Tourmkr tour

Google Maps and the Tourmkr 360° tour are optional external content. Before consent, the website does not create their embeds or connect your browser to their providers. You can accept both, reject both or choose each separately. Once enabled, a provider may receive your IP address, browser and page information and use its own cookies. Our activation of the embed and transmission of data rely on your consent (GDPR Article 6(1)(a)). Google: Google Ireland Limited, Ireland, policy: policies.google.com/privacy. Tourmkr: GoThru Media Inc., Canada; GoThru privacy policy. Withdrawal stops the embed; it does not erase information previously received or provider cookies. Ordinary external links open a third-party website only when selected.

Cookies and privacy settings

We store your privacy choices only in browser localStorage under cyrhla_privacy_v1 for up to 180 days. It records map and tour choices, settings version, save time and expiry, without your name or email. It is used to remember and apply your privacy settings. Change them anytime through “Privacy settings” in the footer. We ask again after expiry. Languages are selected through page URLs; pll_language has been disabled and any old copy is removed. WordPress may use necessary administrator login cookies. There are no guest accounts and we have added no analytics or advertising tools of our own. External services may use cookies only after consent to load them: information about the types, purposes and lifetimes of these technologies is published by Google and GoThru. Their scope depends on the service loaded, browser settings and user choices. You can also delete site data and cookies in your browser. If browser settings prevent saving choices, another choice may be needed on the next page.

Transfers outside the EEA

Optional Google and GoThru services may process data outside the EEA, including in the USA and Canada. GoThru’s policy cites an adequacy decision for transfers to Canada (GDPR Article 45). Google describes relying on adequacy decisions and, where needed, standard contractual clauses; details and how to obtain safeguards are in Google’s data transfer information. SEOHOST states that it may use IT providers outside the EEA under binding corporate rules or standard contractual clauses. For further information about recipients and safeguards, contact luxhouse@op.pl.

Your rights

Subject to the GDPR, you may request access, rectification, erasure and restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. You may complain to the President of the Polish Personal Data Protection Office; information: https://uodo.gov.pl. Contact the controller to exercise your rights. In our own handling of the form, we do not make decisions producing legal or similarly significant effects based solely on automated processing, including profiling.

Effective date: 2026-10-26.