This is an auxiliary translation. The Polish version of the document is binding. Polski
Privacy Policy
version effective from 23 June 2021
WHAT IS THE PRIVACY POLICY?
We would like to familiarise you with the details of how we process your personal data, so that you have full knowledge and peace of mind when using our website.
As we operate in the internet industry ourselves, we know how important it is to protect your personal data. That is why we take particular care to protect your privacy and the information you provide to us.
We carefully select and apply appropriate technical measures, in particular those of a programming and organisational nature, to ensure the protection of the personal data we process. Our website uses encrypted data transmission (SSL), which ensures the protection of data that identifies you.
In our Privacy Policy you will find all the key information about how we process your personal data.
Please read it — we promise it will take no more than a few minutes.
Joint controllers of the website www.volahostel.pl
The joint controllers of the website volahostel.pl are Karolina Borowska, conducting business under the business name Karolina Borowska KB INVESTMENTS wspólnik spółki cywilnej, entered in the Central Register and Information on Business kept by the minister competent for the economy, at the address ul. Górczewska 30, 01-147 Warszawa, NIP: 1231470918, REGON: 386419949
and
Krzysztof Bogdanowicz, conducting business under the business name KB INVESTMENTS KRZYSZTOF BOGDANOWICZ WSPÓLNIK SPÓŁKI CYWILNEJ, entered in the Central Register and Information on Business kept by the minister competent for the economy, at the address ul. Górczewska 30, 01-147 Warszawa, NIP: 5213111996, REGON: 146530236
jointly conducting business under the name KB INVESTMENTS SPÓŁKA CYWILNA, on the basis of a civil-law partnership agreement, at the address ul. Górczewska 30, 01-147 Warszawa, NIP 5272932418, REGON 386526473 (i.e.: we/us).
PERSONAL DATA
What legal act governs the processing of your personal data?
Your personal data is collected and processed by us in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1), commonly referred to as the GDPR. To the extent not regulated by the GDPR, the processing of personal data is governed by the Personal Data Protection Act of 10 May 2018.
Joint controllers of your personal data
The joint controllers of your personal data are:
1) Karolina Borowska, conducting business under the business name Karolina Borowska KB INVESTMENTS wspólnik spółki cywilnej
e-mail: recepcja@volahostel.pl
tel.: +48 786 86 94 68
2) Krzysztof Bogdanowicz, conducting business under the business name KB INVESTMENTS KRZYSZTOF BOGDANOWICZ WSPÓLNIK SPÓŁKI CYWILNEJ
e-mail: recepcja@volahostel.pl
tel.: +48 786 86 94 68
In matters concerning your personal data, you can contact us by:
– e-mail: recepcja@volahostel.pl
– post: ul. Górczewska 30, 01-147 Warszawa
– telephone: +48 786 86 94 68
Under the personal data joint controllership agreement, the areas of responsibility for fulfilling obligations under the GDPR have been defined. In particular, it has been agreed that:
– both Joint Controllers are responsible for fulfilling the information obligations arising from the GDPR,
– both Joint Controllers are responsible for fulfilling obligations in relation to your exercise of the rights to which you are entitled.
HOW WE PROCESS THE PERSONAL DATA YOU PROVIDE TO US
What personal data do we process and for what purposes do we process it?
On our website we offer you a range of services, for the purposes of which we process different personal data on different legal bases.
Purpose | Personal data | Legal basis for processing | Data retention period |
conclusion and performance of a stay Reservation agreement | first name, surname, NIP, company, telephone number, e-mail address, residential address/registered office address or business address | Article 6(1)(b) GDPR, i.e. processing for the purpose of taking steps at your request prior to entering into a contract and processing necessary for the performance of a contract to which you are a party | until the limitation period for claims expires |
contact form | e-mail address, first name | Article 6(1)(f) GDPR, i.e. processing for the purposes of our legitimate interest, consisting in maintaining continuity of communication and enabling contact with us in matters relating to our business activity | until an objection to the processing of personal data is lodged |
fulfilment of legal obligations arising from legal provisions, in particular tax and accounting regulations | first name, surname, company, NIP, e-mail address, telephone number, residential address/registered office address or business address | Article 6(1)(c) GDPR, i.e. processing is necessary for compliance with legal obligations incumbent on the Joint Controllers, arising from legal provisions, in particular tax and accounting regulations | until the legal obligations incumbent on the Joint Controllers that justified the processing of personal data expire |
establishment, pursuit and enforcement of claims and defence against claims in proceedings before courts and other state authorities | first name, surname, company, residential address/registered office address or business address, NIP or REGON, e-mail address, telephone number, bank account number, payment card number | Article 6(1)(f) GDPR, i.e. processing for the purposes of our legitimate interest, consisting in the establishment, pursuit and enforcement of claims and in defence against claims in proceedings before courts and other state authorities | until the limitation period for claims relating to the performance of the contract expires |
analysis of traffic on the website | IP address | Article 6(1)(f) GDPR, i.e. processing for the purposes of the legitimate interest of the Joint Controllers consisting in analysing user traffic on the website | For 12 months from the collection of the data or until an objection to the processing of personal data is lodged |
marketing of own services, including remarketing | IP address, first name, surname | Article 6(1)(f) GDPR, i.e. processing for the purposes of the legitimate interest of the Joint Controllers consisting in conducting marketing activities, including remarketing activities | For 12 months from the collection of the data or until an objection to the processing of personal data is lodged |
Purpose | Personal data | Legal basis for processing | Data retention period |
conclusion and performance of a stay Reservation agreement | first name, surname, NIP, company, telephone number, e-mail address, residential address/registered office address or business address | Article 6(1)(b) GDPR, i.e. processing for the purpose of taking steps at your request prior to entering into a contract and processing necessary for the performance of a contract to which you are a party | until the limitation period for claims expires |
contact form | e-mail address, first name | Article 6(1)(f) GDPR, i.e. processing for the purposes of our legitimate interest, consisting in maintaining continuity of communication and enabling contact with us in matters relating to our business activity | until an objection to the processing of personal data is lodged |
fulfilment of legal obligations arising from legal provisions, in particular tax and accounting regulations | first name, surname, company, NIP, e-mail address, telephone number, residential address/registered office address or business address | Article 6(1)(c) GDPR, i.e. processing is necessary for compliance with legal obligations incumbent on the Joint Controllers, arising from legal provisions, in particular tax and accounting regulations | until the legal obligations incumbent on the Joint Controllers that justified the processing of personal data expire |
establishment, pursuit and enforcement of claims and defence against claims in proceedings before courts and other state authorities | first name, surname, company, residential address/registered office address or business address, NIP or REGON, e-mail address, telephone number, bank account number, payment card number | Article 6(1)(f) GDPR, i.e. processing for the purposes of our legitimate interest, consisting in the establishment, pursuit and enforcement of claims and in defence against claims in proceedings before courts and other state authorities | until the limitation period for claims relating to the performance of the contract expires |
analysis of traffic on the website | IP address | Article 6(1)(f) GDPR, i.e. processing for the purposes of the legitimate interest of the Joint Controllers consisting in analysing user traffic on the website | For 12 months from the collection of the data or until an objection to the processing of personal data is lodged |
marketing of own services, including remarketing | IP address, first name, surname | Article 6(1)(f) GDPR, i.e. processing for the purposes of the legitimate interest of the Joint Controllers consisting in conducting marketing activities, including remarketing activities | For 12 months from the collection of the data or until an objection to the processing of personal data is lodged |
Voluntary provision of personal data
Providing the required personal data by you is voluntary, but it is a condition for us to provide services to you (e.g. placing an order).
Recipients of personal data
You can find the current list of entities to which we disclose your personal data here
Automated decision-making (including profiling)
We do not make decisions about you by automated means and we do not use profiling.
Will we transfer your personal data outside the EEA or to an international organisation?
In order to use Google measurement, statistical and marketing tools, your personal data may be transferred to the United States, where the servers of Google LLC are located.
Google LLC is listed as a participant in the Privacy Shield programme (link: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active) and also applies standard contractual clauses concerning data security approved by the European Commission.
In order to use Facebook measurement, statistical and marketing tools, your personal data may be transferred to the United States, where the servers of Facebook Inc. are located.
Facebook uses standard contractual clauses approved by the European Commission and relies, where applicable, on European Commission adequacy decisions regarding certain countries in respect of transfers of data from the EEA to the United States and other countries.
WHAT RIGHTS DO YOU HAVE IN CONNECTION WITH OUR PROCESSING OF YOUR PERSONAL DATA?
Under the GDPR, you have the right to:
- request access to your personal data
- request rectification of your personal data
- request erasure of your personal data
- request restriction of processing of personal data
- object to the processing of personal data
- request portability of personal data
If you submit any of the requests listed above to us, without undue delay — and in any event within one month of receiving the request — we will provide you with information on the actions taken in connection with the request you submitted.
If necessary, we may extend the one-month period by a further two months due to the complexity of the request or the number of requests.
In each case, we will inform you within one month of receiving the request of any extension of the deadline and provide you with the reasons for the delay.
Right of access to personal data (Article 15 GDPR)
You have the right to obtain information as to whether we process your personal data.
If we process your personal data, you have the right to:
- access your personal data,
- obtaining information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of such data, the planned period for which your data will be stored or the criteria used to determine that period, the rights available to you under the GDPR and the right to lodge a complaint with the President of the Personal Data Protection Office, the source of such data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of such data outside the European Union;
- obtaining a copy of your personal data.
If you wish to request access to your personal data, submit your request to: recepcja@volahostel.pl.
Right to rectification of personal data (Article 16 GDPR)
If your personal data is inaccurate, you have the right to request that we rectify your personal data without delay. You also have the right to request that we complete your personal data.
If you wish to request the rectification or completion of your personal data, submit your request to: recepcja@volahostel.pl
Right to erasure of personal data, the so-called “right to be forgotten” (Article 17 GDPR)
You have the right to request the erasure of your personal data where:
- your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- you have withdrawn specific consent, to the extent that the personal data was processed on the basis of your consent;
- your personal data has been processed unlawfully;
- you have objected to the processing of your personal data for direct marketing purposes, including profiling, to the extent that the processing of personal data is related to direct marketing;
- you have objected to the processing of your personal data in connection with processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of the legitimate interests pursued by us or by a third party.
Despite receiving a request for the erasure of personal data, we may continue to process your data for the purpose of establishing, pursuing or defending claims, of which you will be informed.
If you wish to request the erasure of your personal data, submit your request to: recepcja@volahostel.pl.
Right to request restriction of the processing of personal data (Article 18 GDPR)
You have the right to request restriction of the processing of your personal data where:
- you contest the accuracy of your personal data – in this case, we will restrict the processing of your personal data for the period necessary to verify the accuracy of that data;
- the processing of your data is unlawful and, instead of erasure of the personal data, you request restriction of the processing of your personal data;
- your personal data is no longer needed for the purposes of processing, but it is required for the establishment, pursuit or defence of your claims;
- you have objected to the processing of your personal data – pending verification of whether our legitimate interests override the grounds indicated in your objection.
If you wish to request restriction of the processing of your personal data, submit your request to: recepcja@volahostel.pl.
Right to object to the processing of personal data (Article 21 GDPR)
You have the right to object at any time to the processing of your personal data, including profiling, in connection with:
- processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of the legitimate interests pursued by the Joint Controllers of personal data or by a third party;
- processing for direct marketing purposes.
If you wish to object to the processing of your personal data, submit your request to: recepcja@volahostel.pl.
Right to request portability of personal data (Article 20 GDPR)
You have the right to receive your personal data from us in a structured, commonly used and machine-readable format and to transmit it to another personal data controller.
As standard, we will provide you with your personal data in CSV format. If you would prefer the data to be provided to you in another format, please indicate your preferred format in your request. Where possible, we will endeavour to provide the data in the format you prefer.
You may also request that we transmit your personal data directly to another controller (where technically feasible).
If you wish to request the portability of your personal data, submit your request to: recepcja@volahostel.pl.
Complaint to the supervisory authority
If you believe that the processing of your personal data infringes data protection regulations, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.
In Poland, the supervisory authority within the meaning of the GDPR is the President of the Personal Data Protection Office, which replaced GIODO on 25 May 2018.
You can find more information here.
COOKIES
General information
When you browse the pages of the website, Cookies are used, i.e. small text files that are stored on your end device in connection with your use of the website. They are used to ensure the proper functioning of the website pages.
These files make it possible to identify the software you use and to tailor the website individually to your needs.
Cookies usually contain the name of the domain from which they originate, the period for which they are stored on the device and an assigned value.
Security
The Cookies we use are safe for your devices. In particular, viruses or other unwanted or malicious software cannot enter your devices through Cookies.
Types of Cookies
We use two types of Cookies:
Session Cookies: these are stored on your device and remain there until the session of the relevant browser ends. The stored information is then permanently deleted from your device’s memory. The session Cookie mechanism does not allow any personal data or confidential information to be collected from your device.
Persistent Cookies: these are stored on your device and remain there until they are deleted. Ending the session of the relevant browser or switching off the device does not delete them from your device. The persistent Cookie mechanism does not allow any personal data or confidential information to be collected from your device.
Purposes
We also use third-party Cookies for the following purposes:
- configuration of the website;
- creating statistics that help us understand how users of the website use the website pages, enabling us to improve their structure and content by means of Google Analytics analytical tools, administered by Google Ireland Ltd. with its registered office in Ireland. Google’s Privacy Policy is available at the following link: https://policies.google.com/privacy?fg=1,
- use of Google Ads marketing tools provided by Google Ireland Ltd. with its registered office in Ireland. Google’s Privacy Policy is available at the following link: https://policies.google.com/privacy?fg=1,
- use of Facebook Pixel marketing tools, administered by Facebook Ireland Ltd. Facebook’s Privacy Policy is available at the following link: https://pl-pl.facebook.com/privacy/explanation.
Using your web browser settings or the service configuration, you may independently and at any time change your Cookie settings, specifying the conditions under which Cookies are stored on and access your device. You may change these settings so as to block the automatic handling of Cookies in your web browser settings or to be informed each time Cookies are placed on your device. Detailed information on the possibility and methods of handling Cookies is available in the settings of your software (web browser).
List of service providers we use in operating the Website
ENTITY | PURPOSE |
PayPro S.A. with its registered office in Poznań | Payment processing |
Paypal Polska sp. z o.o. with its registered office in Warsaw | Payment processing |
PayU S.A. with its registered office in Poznań | Payment processing |
PayPo Sp. z o.o. with its registered office in Warsaw | Processing instalment payments |
Google Ireland Ltd. (Google Cloud, Google Analytics, Google Analytics 360, Fabric Software) with its registered office in Ireland | Measuring website traffic, reporting application errors, compiling statistics |
Google Ireland Ltd. with its registered office in Ireland | Profiling Customers – Google AdSense and Google Adwords |
Google Ireland Ltd. with its registered office in Ireland | Analysing Customer activity |
Google Ireland Ltd. (Google Adwords, Double Click Manager, Double Click Search, Remarketing Service, Firebase) with its registered office in Ireland | Measuring the effectiveness of advertising campaigns, managing advertising campaigns |
Facebook Ireland Ltd. with its registered office in Ireland | Promoting the Online Store via the Facebook.com social networking service |
Facebook Ireland Ltd. with its registered office in Ireland | Promoting the Online Store via the Instagram.com social networking service |
LinkedIn Ireland Ltd. with its registered office in Ireland | Promoting the Online Store via the LinkedIn.com social networking service |
Users with a company account | Booking training courses |