Data processing instructions (GDPR)

The capitalized terms used in the Manual have the following meaning:

  • The operator of the facility– KACZE STAWY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Nowącin ul. Żwirowa 24, 84-360 Nowacin. NIP: 8411740754, REGON: 540529550, KRS: 0001147087. Share capital: 5,000.00. PLN.
  • Object – Holiday Park Kacze Stawy is located in Nowęcin at Żwirowa 24
  • Guest – a person who has entered into an agreement with the Operator for the provision of services offered within the facility.
  • Accompanying Person – accompanying the Guest during their stay in the facility, accommodated in the facility on the basis of a reservation made by the Guest in the same or another room/cottage as the Guest.
  • Visitor – a person visiting the Guest in the facility, not being accommodated in the facility.

The GDPR Instruction

I. Administrator of personal data of Guests, Accompanying Persons and Visitors

1. The administrator of personal data of Guests, Accompanying Persons and Visitors is the Facility Operator – KACZE STAWY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Nowącin ul. Żwirowa 24, 84-360 Nowacin. NIP: 8411740754, REGON: 540529550, KRS: 0000596565. Share capital: 5,000.00. PLN.

2. The operator of the facility makes every effort to protect personal data from being shared with unauthorized persons, taken by unauthorized persons, processed in violation of applicable laws and altered, lost, damaged or destroyed and to respect the privacy of any person whose personal data is processed.

3. Personal data are processed by the Facility Operator in compliance with the requirements of generally applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as GDPR), as well as the Act of 29 August 1997 on the provision of accommodation services and the services of tour pilots and tour guides.

II. Acquisition of personal data by the Facility Operator

1. The property operator obtains personal data primarily directly from Guests, Accompanying Persons and Visitors. Where personal data has not been collected directly from the person concerned (e.g. by obtaining it during the making of a reservation), it may have been transmitted by another entity e.g. the Guest’s employer or obtained from publicly available sources such as public records (e.g. National Court Register).

2. The facility operator obtains personal data, in particular:

  • Contact information (such as name, address of residence/residence/correspondence/business, e-mail and telephone number);
  • Service contact information (such as position, department and name of institution);
  • Information needed to issue a VAT invoice (such as NIP, REGON);
  • Account number, payment, debit and credit card number;
  • other personal data relating to the Guest, Accompanying Person or Visitor necessary for the performance of the contract concluded with the Facility Operator and to fulfill the legal obligations incumbent on the Facility Operator, e.g. in the scope of the dietary preferences of the aforementioned persons;
  • vehicle registration numbers;
  • image due to the used video surveillance.

III. Purposes of processing personal data by the Facility Operator

1. The facility operator processes personal data for the following purposes:

  • the provision of services or the execution of contracts, in particular accommodation services, offered by the Facility Operator, administering them and informing the Facility Operator about them; in the case of the processing of personal data of the person at whose request actions aimed at concluding a contract with the Facility Operator or the execution of a contract concluded with them are undertaken, on the basis of Article 6(1)(b) of the GDPR; this includes processing activities such as:
    • booking and reservation of accommodation, events, events;
    • payment processing, including electronic payments;
    • activities on site, check-in, check-out,
    • preparation and coordination of services in accordance with the instructions, expectations and preferences of the Guests;
    • facilitating check-in and check-out;
    • providing consistent and personalised service and advice on on-site services (based on past uses or preferences expressed);
    • storage of luggage;
    • provision of parking services;
    • administering and facilitating access to Wi-Fi, television and other communications services;
    • spożywanie posiłków;
    • provision of cleaning services;
  • Implementation of the legal obligations incumbent on the Facility Operator, which result from the provisions governing the provision of services or activities of the Facility Operator as well as the provisions on accounting and tax (pursuant to Art. 6 para. 1 lit. c GDPR);
  • Conducting electronic and traditional correspondence; the personal data contained in this correspondence are processed exclusively for the purpose of communication and resolution of the matter to which the correspondence relates, which constitutes the legitimate interest of the Operator (on the basis: Art. 6 para. 1 lit. f GDPR);
  • Conducting telephone contacts; The Facility Operator may request the provision of personal data only if this is necessary to handle the matter to which the telephone contact relates, which constitutes a legally justified interest of the Facility Operator (on the basis: Art. 6 para. 1 lit. f GDPR);
  • Monitoring: in the event of personal access to the facility, the facility operator processes personal data in the form of an image in the form of visual monitoring, which constitutes as a measure of security the legitimate interest of the facility operator (on the basis: Art. 6 para. 1 lit. f GDPR), as well as taking other security measures, such as: fraud prevention, response, handling and documentation of on-site accidents and medical and other emergencies, calling emergency services;
  • Collection of personal data in connection with the activity of the Facility Operator: in connection with the Facility Operator may also collect personal data for other purposes, e.g. establishing and maintaining business contacts, which in any case will be based on the legitimate interest of the Facility operator (on the legal basis: Art. 6 para. 1 lit. f GDPR).
  • Risk assessment and improvement of the activity of the Facility Operator (including the development of the services provided, communication management, analysis and improvement of the services provided), which constitutes the legitimate interest of the Facility operator (on the basis of Art. 6 para. 1 lit. f GDPR); this includes such activities as: handling applications, inquiries and complaints; administering the facility service (in person, via telephone lines, e-mail or social media); in this respect, the Facility Provider may use profiling tools, but it will not lead to automated decision-making regarding Guests, Companions, Visitors.
  • Estimation of interest in the use of services by the Facility Operator and contact on the possibility of providing services by the Facility’s Operator, which constitutes a legally justified interest of the Facility Operator, pursuant to Art. 6 para. 1 lit. f GDPR, and in the case of sending commercial information by electronic means or conducting direct telephone marketing on the basis of consent (Art. 6 para. 1 lit. a) GDPR, in conjunction with Art. 7 GDPR;
  • Estimation of interest in the use of services by the Facility Operator and contact on the possibility of providing services by the Facility’s Operator, which constitutes a legally justified interest of the Facility Operator, pursuant to Art. 6 para. 1 lit. f GDPR, and in the case of sending commercial information by electronic means or conducting direct telephone marketing on the basis of consent (Art. 6 para. 1 lit. a) GDPR, in conjunction with Art. 7 GDPR;
  • To ensure compliance of the processing with the personal data protection regulations and internal regulations of the Facility Operator in this respect, which constitutes the legitimate interest of the Facility operator within the meaning of Art. 6 para. 1 lit. f GDPR, in particular by administering online services (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).

2. The provision of personal data is voluntary, but failure to provide them will make it impossible to achieve the purposes mentioned above.

IV. Period of storage of personal data by the Facility Operator

1.Personal data will be stored by the Facility Operator for the period necessary to achieve the aforementioned purposes, but not longer than is required by the provisions of generally applicable law. The period for which the Facility Operator’s personal data is stored depends on the basis and purpose of processing this data.

2. The object operator indicates that the personal data being processed:

  • For the purpose of direct marketing, they will be stored until you receive an objection to the processing of this data.
  • On the basis of consent to the processing of this data, they will be stored until its withdrawal.
  • In order to fulfil the obligations arising from the provisions of the generally applicable law (e.g. to issue an invoice) will be stored for the period required by these provisions, e.g. accounting and tax law.
  • To enable the provision of services at the facility, the data will be retained until the potential establishment, exercise, or defense of claims by the Operator – in accordance with the applicable statutory limitation periods;
  • For the purpose of visual monitoring for a maximum period of three months from the date of recording;
  • For other purposes based on the legitimate interest of the Facility Operator for the period of implementation of this purpose or until a positive consideration of the objection to the processing of this data.

V. Sharing and entrusting the processing of personal data by the Facility Operator

1. The Facility Operator may disclose personal data of Guests, Accompanying Persons or Visitors to service providers, in particular electronic, booking, accounting, legal, courier, postal, catering, advisory services related to the services provided by the Facility Operator.

2. The Facility Operator requires these service providers to comply with the law, a high degree of privacy protection and security of personal data processed by them on behalf of the Facility Operator.

3. The operator of the facility does not intend to transfer personal data of Guests, Accompanying Persons or Visitors to recipients outside the European Economic Area. obiektu nie zamierza przekazywać danych osobowych Gości, Osób Towarzyszących, Osób Odwiedzających odbiorcom spoza Europejskiego Obszaru Gospodarczego.

VI. Rights of persons whose data is processed by the Operator

1. Within the limits of the law, Guests, Accompanying Persons and Visitors have the right:

  • Access to your personal data, in particular to obtain information about the purpose, scope and manner of data processing;
  • Making changes, additions, corrections and updates of the personal data processed by the Operator;
  • Request the deletion of your personal data processed by the Operator of the facility;
  • Withdraw consent to the processing of personal data by notifying the Operator of the facility in any way. In such situations, the Operator of Facility will comply with the decision of the Guest, Companion or Visitor in relation to future activities, which means that the withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal of consent;
  • Requests from the Operator to restrict the processing of your personal data.
  • Object to the processing of your personal data by the Facility Operator based on the implementation of its legitimate interest;
  • To receive in a structured, commonly used machine-readable format the personal data relating to him that he has provided to the Facility Operator and to transmit this personal data to another administrator. However, the Facility Provider will only do this if such transmission is technically possible. The right to transfer personal data only applies to those data that the Facility Owner processes on the basis of a contract or on the basis of his consent.

2. The above rights can be exercised by sending an e-mail to: kontakt@kaczestawy.pl

3. If you consider that the processing of personal data by the Operator violates the law, you can submit a complaint to the supervisory authority, in the case of the Republic of Poland – the President of the Office for Personal Data Protection.ch.

VII. Contact with the Facility Operator regarding the processing of personal data

1. Regarding the processing of personal data, you can contact the Facility Operator at any time in order to obtain information about whether and how the Facility Operator’s uses or intends to use your personal data. Contact details: kontakt@kaczestawy.pl

2. The operator of the facility has appointed a personal data protection officer, who can be contacted using the e-mail address: kontakt@kaczestawy.pl