Privacy

The Polish text of this privacy policy is binding; the versions in other languages are translations.

PRIVACY POLICY OF THE ChikApart WEBSITE AND SERVICES

§ 1. Controller

  1. The controller of personal data is AR Regal Rise spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office in Kraków, entered in the register of entrepreneurs of the KRS under number 0001219525, NIP (tax identification number) 9452324415, REGON (statistical number) 543830847 (hereinafter: the "Controller").
  2. The Controller operates, under the designation "ChikApart", apartments in Szczyrk at ul. Turystycznej 15, 43-370 Szczyrk, and a website (hereinafter: the "Website").
  3. In matters concerning personal data the Controller may be contacted by e-mail: arregalrise@gmail.com, through the WhatsApp messenger or by telephone: +48 577 774 949.
  4. The Controller has not appointed a data protection officer, because it is not obliged to do so under art. 37 GDPR.

§ 2. Definitions and legal acts

Wherever the Privacy Policy refers to:

  1. GDPR (in the Polish text: RODO) – this means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
  2. PKE – this means the Act of 12 July 2024 – Electronic Communications Law (ustawa z dnia 12 lipca 2024 r. – Prawo komunikacji elektronicznej);
  3. Terms – this means the Terms of Booking and Stay and of Services Provided by Electronic Means of ChikApart;
  4. User – this means a person using the Website;
  5. Guest – this means a person who submits an Enquiry, concludes an Agreement or stays in an Apartment, within the meaning of the Terms;
  6. terminal device – this means the User's device by means of which the User uses the Website.

§ 3. General principles

  1. The Controller processes personal data in accordance with the principles set out in art. 5 GDPR, in particular the principle of data minimisation.
  2. The Website does not use cookies for tracking, nor analytical or advertising tools. The Controller does not create profiles of Users, does not sell personal data and does not take decisions concerning Users or Guests based solely on automated processing, including profiling (art. 22 GDPR).
  3. The Website does not accept payments and does not process payment card data.

§ 4. Information stored in the User's terminal device

  1. The Website stores in the User's browser memory (localStorage and sessionStorage) information necessary to provide the services by electronic means that the User uses. This consists of:
    1. the Apartments, dates, number of persons and other choices concerning the offer selected by the User and, if the User has entered it, an e-mail address – in order to complete the Enquiry;
    2. content entered on the booking page – solely until the message is transmitted or the browser tab is closed;
    3. the music playback setting and the point at which it was stopped;
    4. the selected language version;
    5. information that a hint has been displayed in the photo viewer;
    6. the latest weather forecast for Szczyrk together with the time it was retrieved, so that the browser retrieves it no more often than once an hour;
    7. for a brief moment – the name of the page to which the User is navigating, in order to ensure a smooth page transition;
    8. the selected colour scheme of the Website.
  2. Information about the Apartments and pages viewed, the viewing time and earlier visits, used by the "Your stay so far" card, is stored solely in the browser's session memory and is deleted when the visit ends.
  3. The information referred to in paras. 1 and 2 is not sent to the Controller or to third parties. Its storage is necessary for the provision of the service by electronic means requested by the User and therefore does not require the User's consent (art. 399 para. 3 PKE).
  4. The information referred to in para. 1 point 1 is deleted automatically after 30 days without a visit to the Website. The User may delete all the information at any time in the browser settings, in the section on website data.

§ 5. Data processed in connection with the use of the Website

  1. The Website is hosted by Cloudflare, Inc., with its registered office in the United States, under the Cloudflare Workers service. Cloudflare, Inc. processes on behalf of the Controller, as a processor (art. 28 GDPR), the User's IP address and the technical data of each request in the server logs, in order to deliver the pages and protect them against attacks.
  2. After a page has loaded, the User's browser retrieves the weather forecast for Szczyrk from the service of the Norwegian Meteorological Institute (MET Norway, api.met.no) in Oslo, no more often than once an hour. MET Norway receives the User's IP address, the technical data of the request and the address of the Website, and processes them as a separate controller, in accordance with its own privacy policy. The request indicates the location of the Building, not the location of the User.
  3. The User's browser retrieves open-source scripts from the jsDelivr network, operated by Prospect One sp. z o.o. with its registered office in Kraków. That entity receives the User's IP address and the technical data of the request and processes them in accordance with its own privacy policy.
  4. Links to maps, to the pages of other entities and to the authors of photographs lead outside the Website. Data is transmitted to those entities only if the User uses the link. The share button uses the sharing menu of the User's device or opens the WhatsApp messenger with the address of the page.
  5. A User who wishes to join the Cercle ChikApart, that is, to receive the ChikApart letters sent by e-mail (§ 23 of the Terms), enters in the form in the Website an e-mail address and, if he or she so wishes, a first name. The form transmits these data, together with the language version of the Website, directly to Sendinblue SAS, with its registered office in Paris (France), which operates the Brevo service and processes the data on behalf of the Controller as a processor (art. 28 GDPR); in doing so, Sendinblue SAS receives the User's IP address and the technical data of the request.
  6. Brevo sends to the e-mail address provided a message containing a confirmation link. The User becomes a member of the Cercle ChikApart (hereinafter: a "Member") only after clicking that link (double opt-in). Brevo records the date and time of joining and of the confirmation and, for each letter, whether it has been delivered and opened and which of the links it contains have been used. The Controller uses this information solely to send the letters and to assess their reach, and does not use it to evaluate individual Members.
  7. In respect of each Member, the Controller records the personal welcome code assigned to that Member (§ 23 para. 5 of the Terms) and whether the code has been used.

§ 6. Data provided by the Guest

  1. The enquiry form and the booking page do not send data to the Website and do not store it in the Website. They prepare a message that the Guest transmits to the Controller personally by means of:
    1. the WhatsApp messenger, provided in Europe by WhatsApp Ireland Limited, which processes the message as a separate controller, in accordance with its own terms and privacy policy;
    2. e-mail, handled by Google Ireland Limited (Gmail);
    3. a telephone call.
  2. The Controller processes the following categories of data:
    1. in connection with an Enquiry: first name and surname, dates of the stay, number of adults and children, the selected Apartment, the content of the message, the e-mail address (if provided) and the telephone number visible in the messenger;
    2. in connection with the conclusion of an Agreement, additionally: telephone number, e-mail address, country, expected time of arrival, special requests and, where an invoice is requested, the business name, NIP number and address of the entrepreneur;
    3. in connection with the performance of the Agreement: the content of the Booking Confirmation, payment data, the invoice and correspondence concerning the stay.
  3. If the Guest, on his or her own initiative, provides information about his or her health, in particular about an allergy or the need for step-free access, the Controller processes it solely in order to prepare the stay and on the basis of the Guest's explicit consent.
  4. Payments are handled by Stripe Payments Europe, Limited, with its registered office in Dublin (Ireland), which processes payment data as a separate controller, in accordance with its own privacy policy. The Controller does not receive the payment card number. In the case of payment by transfer, the Controller's bank receives the Guest's first name and surname and bank account number.

§ 7. Purposes and legal bases of processing

The Controller processes personal data:

  1. in order to reply to an Enquiry and make an Offer, at the request of the data subject – on the basis of art. 6 para. 1 point (b) GDPR;
  2. in order to conclude and perform an Agreement – on the basis of art. 6 para. 1 point (b) GDPR;
  3. in order to issue invoices, keep accounting records and settle taxes – on the basis of art. 6 para. 1 point (c) GDPR in conjunction with the Act of 29 September 1994 on accounting (ustawa z dnia 29 września 1994 r. o rachunkowości), the Act of 11 March 2004 on goods and services tax (ustawa z dnia 11 marca 2004 r. o podatku od towarów i usług) and the Act of 29 August 1997 – Tax Ordinance (ustawa z dnia 29 sierpnia 1997 r. – Ordynacja podatkowa);
  4. in order to collect the local fee, if it is introduced by the Town Council of Szczyrk, and to perform other legal obligations incumbent on the Controller as a provider of accommodation services – on the basis of art. 6 para. 1 point (c) GDPR;
  5. in order to ensure the operation and security of the Website – on the basis of art. 6 para. 1 point (f) GDPR, the Controller's legitimate interest being the maintenance of the Website and its protection against abuse;
  6. in order to establish, pursue or defend claims connected with the Agreement – on the basis of art. 6 para. 1 point (f) GDPR, the Controller's legitimate interest being the protection of its rights;
  7. in order to take into account health information voluntarily provided by the Guest – on the basis of art. 9 para. 2 point (a) GDPR;
  8. in order to send the Cercle ChikApart letters and the welcome code to a Member and to assess the reach of the letters – on the basis of the Member's consent (art. 6 para. 1 point (a) GDPR), which also covers the use of the Member's telecommunications terminal equipment for direct marketing and for that assessment (arts. 398 and 399 PKE); the record of the consent and of its withdrawal is kept on the basis of art. 6 para. 1 point (f) GDPR, the Controller's legitimate interest being the ability to demonstrate the consent (art. 7 para. 1 GDPR) and to refrain from sending letters to persons who have withdrawn it.

§ 8. Recipients of data

  1. Personal data may be transferred only to the extent necessary to achieve the purposes set out in § 7:
    1. to entities processing data on behalf of the Controller, on the basis of a data processing agreement (art. 28 GDPR): Cloudflare, Inc. (hosting of the Website) and Sendinblue SAS (the Brevo service, used for the Cercle ChikApart);
    2. to entities processing data as separate controllers: WhatsApp Ireland Limited, Google Ireland Limited (e-mail), Stripe Payments Europe, Limited (payments) and the Controller's bank;
    3. to public authorities, in particular tax authorities and the Mayor of the Town of Szczyrk, solely where the obligation to transfer data arises from legal provisions.

§ 9. Transfers of data outside the European Economic Area

  1. Cloudflare, Inc., Meta Platforms, Inc., Google LLC and Stripe, Inc. have their registered offices in the United States and may process personal data in that country. These entities participate in the EU-U.S. Data Privacy Framework, in respect of which the European Commission has found an adequate level of protection by implementing decision (EU) 2023/1795 of 10 July 2023 (art. 45 GDPR). WhatsApp Ireland Limited additionally applies the standard contractual clauses approved by the European Commission (art. 46 para. 2 point (c) GDPR).
  2. MET Norway has its registered office in Norway, in the European Economic Area.
  3. Sendinblue SAS has its registered office in France, in the European Economic Area. If Members' data is processed by its sub-processors outside the European Economic Area, this takes place on the basis of a decision of the European Commission finding an adequate level of protection (art. 45 GDPR) or of the standard contractual clauses approved by the European Commission (art. 46 para. 2 point (c) GDPR).

§ 10. Data retention period

  1. Personal data is retained:
    1. in the case of an Enquiry that did not lead to the conclusion of an Agreement – for 12 months from the date of the last message, and then deleted;
    2. in the case of invoices and accounting documentation – for the period required by tax law and the Act on accounting, as a rule for 5 years from the end of the calendar year in which the tax payment deadline expired;
    3. in the case of other documentation of the Agreement, including the Booking Confirmation and correspondence – until the limitation period for claims under the Agreement expires, as set by the Kodeks cywilny (Civil Code) (KC) for each type of claim (in particular arts. 118, 848 and 851 KC), but no longer than 6 years, counted to the end of the calendar year;
    4. in the case of health information – until the end of the stay or until the earlier withdrawal of consent;
    5. in the case of server logs – for the period specified in the policy of Cloudflare, Inc.; the Controller does not keep copies of them;
    6. in the case of the Cercle ChikApart – until the consent is withdrawn, and in the case of an e-mail address that has not been confirmed – for no longer than 30 days; after the consent has been withdrawn, the e-mail address is kept solely on the list of addresses to which no letters are sent, and the record of the consent and of its withdrawal is kept until the limitation period for claims expires, but no longer than 6 years from the withdrawal.
  2. Messages in the WhatsApp messenger and e-mail messages are retained for the periods set out in para. 1 that are appropriate to the given category.
  3. Information stored in the terminal device is retained for the periods set out in § 4.

§ 11. Rights of data subjects

  1. On the terms set out in the GDPR, the data subject has the right to:
    1. access the data and obtain a copy of it (art. 15 GDPR);
    2. rectify the data (art. 16 GDPR);
    3. erase the data (art. 17 GDPR);
    4. restrict processing (art. 18 GDPR);
    5. data portability of data processed on the basis of a contract or consent, by automated means (art. 20 GDPR);
    6. object to processing based on the Controller's legitimate interest, on grounds relating to his or her particular situation (art. 21 GDPR).
  2. Consent may be withdrawn at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal (art. 7 para. 3 GDPR).
  3. Requests should be directed to the contact details indicated in § 1 para. 3. The Controller replies without undue delay, and no later than within one month of receiving the request; in the cases set out in art. 12 para. 3 GDPR this period may be extended by a further two months.
  4. The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl), if he or she considers that the processing of the data infringes the GDPR (art. 77 GDPR).
  5. A Member withdraws the consent referred to in § 7 point 8 by means of the link contained in each letter or by a message sent to the contact details indicated in § 1 para. 3. The withdrawal is made at no charge and takes effect without delay.

§ 12. Voluntary nature of providing data

Providing personal data is voluntary. However, it is a condition for replying to an Enquiry and concluding an Agreement (a contractual requirement), and, as regards the data necessary to issue an invoice, a statutory requirement. Failure to provide the data makes it impossible to reply, to conclude the Agreement or to issue the invoice.

Joining the Cercle ChikApart is voluntary and is not a condition of concluding an Agreement. Providing an e-mail address is necessary in order to receive the letters.

§ 13. Changes to the Privacy Policy

  1. The Privacy Policy is subject to change in the event of a change in legal provisions or in the way the Controller processes personal data.
  2. Date of the last amendment: 6 November 2026.

Last updated:

ContactTerms of stay