Privacy

Dear Sir/Madam,

We are committed to protecting the personal data we collect in accordance with national regulations and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119 of 04.05.2016, p. 1, with the amendment announced in the Official Journal of the EU L 127 of 23.05.2018, p. 2) (hereinafter referred to as "GDPR").We present to you our Privacy Policy to ensure that every person with whom we establish a relationship is aware of:

Who is the controller or joint controller of their personal data,
The scope, purposes, and legal bases on which we process the data, as well as to whom we disclose it,
The rights they are entitled to in connection with the processing of their data, in accordance with Articles 13 and 14 of the GDPR.

The Privacy Policy may be supplemented by information provided at the time of data collection (e.g., in reservation, contact forms, or newsletter sign-up) or within a reasonable period – no later than within a month – in the case of data collected from indirect sources, i.e., not directly from the individuals to whom the data pertains.

I. PERSONAL DATA CONTROLLER

The controller of personal data is Orkan Real Estate sp. z o.o., with its registered office in Warsaw at ul. Mińska 25, 03-808 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIV Commercial Division of the National Court Register under KRS number 0000737396, holding Regon 380574867, NIP 1132977442, represented by the general partner Oak Real Estate sp. z o.o., with its registered office in Warsaw at ul. Mińska 25, 03-808 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIV Commercial Division of the National Court Register under KRS number 0000740375, with a share capital of PLN 5,000.00, holding Regon 380749255, NIP 1132978967.
In certain cases, we may also process data as a recipient, joint controller, or processor.

II. JOINT CONTROLLERS OF PERSONAL DATA FORMING THE CONDO.PL HOTEL GROUP

If the data subject consents by ticking the appropriate box (e.g., in the consent clause) or by providing their email address in the appropriate form (e.g., for the newsletter, or to contact us) and activating it (e.g., by clicking "send message"), their personal data will be processed for the purpose of receiving, via email, commercial information about updates, events, and promotions from the joint controllers forming the Condo.pl Hotel Group (Article 6(1)(a) of the GDPR).
The Condo.pl Hotel Group is a commercial initiative created by the following joint controllers:

Orkan Real Estate sp. z o.o. with its registered office in Warsaw at ul. Mińska 25, 03-808 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIV Commercial Division of the National Court Register under KRS number 0000737396, holding Regon 380574867, NIP 1132977442, represented by the general partner Oak Real Estate sp. z o.o. with its registered office in Warsaw at ul. Mińska 25, 03-808 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIV Commercial Division of the National Court Register under KRS number 0000740375, with a share capital of PLN 5,000.00, holding Regon 380749255, NIP 1132978967.
Oak Real Estate sp. z o.o. with its registered office in Warsaw at ul. Mińska 25, 03-808 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIV Commercial Division of the National Court Register under KRS number 0000740375, with a share capital of PLN 5,000.00, holding Regon 380749255, NIP 1132978967.
Apartamenty Na Wydmach sp. z o.o. with its registered office in Warsaw at ul. Wioślarska 8, 00-411 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register under KRS number 0000816696, with a share capital of PLN 5,000.00, holding Regon 384989453, NIP 7010957938.
House Cloud sp. z o.o. with its registered office in Warsaw at ul. Wioślarska 8, 00-411 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register under KRS number 0000544057, with a share capital of PLN 5,000.00, holding Regon 360823620, NIP 7010468493.
HP Szklarska sp. z o.o. with its registered office in Warsaw at ul. Wioślarska 8, 00-411 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register under KRS number 0000887951, with a share capital of PLN 5,000.00, holding Regon 388388199, NIP 7011024048.
Piemonte sp. z o.o. with its registered office in Warsaw at ul. Wioślarska 8, 00-411 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register under KRS number 0000877696, with a share capital of PLN 5,000.00, holding Regon 387925689, NIP 7011013205.
Tremonti sp. z o.o. with its registered office in Warsaw at ul. Wioślarska 8, 00-411 Warsaw, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register under KRS number 0000751396, with a share capital of PLN 5,000.00, holding Regon 381466387, NIP 7010871131.

3. The purpose of the Condo.pl Hotel Group is to provide up-to-date commercial information about updates, events, and promotions from the joint controllers under the Condo.pl brand.

III. DATA PROTECTION OFFICER (DPO)

To oversee matters related to personal data protection and provide detailed information, we, as the controller or joint controller, have appointed a Data Protection Officer (DPO), who is Maciej Strycharz.
You can contact the DPO via email at iod@condo.pl or by writing to our registered office address.

IV. DATA SUBJECTS
1. Booking or Purchasing Customers

As the data controller, we process personal data for the purpose of concluding and/or fulfilling a contract (Article 6(1)(b) of the GDPR) related to the provision of hospitality services, including accommodation, room rentals, and event organization (such as business meetings, conferences, training sessions, banquets, team-building events, parties, and special occasions). This also encompasses related or additional services such as catering, entertainment, childcare, sports, cosmetic, grooming, relaxation, parking, and gift services. Additionally, data is processed to fulfill purposes arising from legitimate interests (Article 6(1)(f) of the GDPR), such as communication, responding to inquiries, conducting sales analyses (including analytical profiling related to sales or marketing of reserved or ordered services), and establishing, defending, and pursuing claims.
The categories of data processed may include identification data such as name; contact and address data such as email address, phone number, and address.
Data will be retained for at least 5 years from the end of the calendar year in which the tax payment deadline has passed. After our relationship ends, the data will be archived for a standard period of 6 years, ending on the last day of the calendar year, unless legal provisions dictate otherwise. In the event of an ongoing dispute or proceeding, the archiving period starts from the date of the final conclusion of the last of them. If the law prescribes a longer data retention or claim limitation period, we will adhere to the longer period.
The customer has the right to access their data, rectify it, delete it, restrict its processing, and object to its processing. They also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). Detailed information about these rights can be found in the subsequent sections of the Privacy Policy.
Personal data may be processed in the form of analytical, sales, and marketing profiling.

2. Guests

As the data controller, we process personal data for the purpose of concluding and/or fulfilling a contract (Article 6(1)(b) of the GDPR) related to the provision of services such as hospitality, accommodation, room rentals, and event organization (including business meetings, conferences, training sessions, banquets, team-building events, parties, and special occasions). This also includes related or additional services such as catering, entertainment, childcare, sports, cosmetic, grooming, relaxation, parking, and gift services. Additionally, data is processed to fulfill purposes arising from legitimate interests (Article 6(1)(f) of the GDPR), such as conducting sales analyses (including analytical, sales, and marketing profiling), establishing, defending, and pursuing claims, and conducting video surveillance to ensure the safety of persons and property at our premises. Furthermore, based on separate consent (Article 6(1)(a) of the GDPR), we may send commercial information to the provided email address. Consent can be withdrawn at any time without affecting the lawfulness of processing that occurred before its withdrawal.
The categories of data processed may include identification data such as name, PESEL, or ID document number; contact and address data such as email address, phone number, and residential address; as well as additional information for individuals conducting business activities.
Data will be retained for at least 5 years from the end of the calendar year in which the tax payment deadline has passed. After our relationship ends, the data will be archived for a standard period of 6 years, ending on the last day of the calendar year, unless legal provisions dictate otherwise. In the event of an ongoing dispute or proceeding, the archiving period starts from the date of the final conclusion of the last of them. If the law prescribes a longer data retention or claim limitation period, we will adhere to the longer period.
Guests have the right to access their data, rectify it, delete it, restrict its processing, and object to its processing, as well as the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). Detailed information about these rights can be found in the subsequent sections of the Privacy Policy.
Personal data may be processed in the form of analytical, sales, and marketing profiling.

3. Recipients of Commercial Information, Including Newsletter Subscribers of the Administrator

As the data controller, we process personal data based on voluntarily given consent (Article 6(1)(a) of the GDPR). Consent may be provided by ticking the appropriate checkbox or by an implied action, such as providing an email address in a form. We process this data to send commercial information, particularly updates, events, and promotions. Consent can be withdrawn at any time by clicking the appropriate link in the received message or by sending a request to the email address iod@condo.pl. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.
The categories of data processed may include identification data, such as name and surname, and contact data, such as email address.
Data will be stored until consent is withdrawn.
Recipients of commercial information, including newsletter subscribers, have the right to withdraw consent, access their data, rectify it, restrict processing, object to processing, and lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). Detailed information about these rights can be found in the subsequent sections of the Privacy Policy.

4. Recipients of Commercial Information, Including Newsletter Subscribers of the Co-Administrators Forming the Condo.pl Hotel Group

As a co-controller, we process personal data based on voluntarily given consent (Article 6(1)(a) of the GDPR). Consent may be provided by ticking the appropriate checkbox or by an implied action, such as providing an email address in a form. We process this data to send commercial information, particularly updates, events, and promotions. Consent can be withdrawn at any time by clicking the appropriate link in the received message or by sending a request to the email address iod@condo.pl. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.
The categories of data processed may include identification data, such as name and surname, and contact data, such as email address.
Data will be stored until consent is withdrawn.
Recipients of commercial information, including newsletter subscribers of the co-administrators forming the Condo.pl Hotel Group, have the right to withdraw consent, access their data, rectify it, restrict processing, object to processing, and lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). Detailed information about these rights can be found in the subsequent sections of the Privacy Policy.

5. Suppliers, Service Providers, Contractors, and Partners

As the data controller, we process personal data for the purpose of executing a contract or taking steps prior to its conclusion (Article 6(1)(b) of the GDPR) and to fulfill legitimate interests (Article 6(1)(f) of the GDPR).
The categories of data processed may include identification data, such as name and surname, PESEL, NIP, REGON, KRS; contact and business-related telecommunication data, such as email address, phone number, business address or registered office address, and position or function.
Data will be stored for a minimum of 5 years from the end of the calendar year in which the tax payment deadline has passed. After our relationship ends, the data will be archived for a standard period of 6 years, ending on the last day of the calendar year, unless legal provisions dictate otherwise. In the event of an ongoing dispute or proceeding, the archiving period starts from the date of the final conclusion of the last of them. If the law prescribes a longer data retention or claim limitation period, we will adhere to the longer period.
Suppliers, contractors, or partners have the right to access their data, rectify it, delete it, restrict processing, object to processing, and lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). Detailed information about these rights can be found in the subsequent sections of the Privacy Policy.
Providing personal data is a contractual requirement. Failure to provide the data may prevent the conclusion or execution of the contract.

6. Users of Online Form Services

As the data controller, we process personal data to fulfill legitimate interests (Article 6(1)(f) of the GDPR), such as communication and responding to inquiries. In certain situations, such as when personal data is provided via our forms, we may process the data based on implied consent given by the user’s action (filling out the form and using the "submit" function) in accordance with Article 6(1)(a) of the GDPR.
The categories of data processed may include identification data, such as name and surname, and contact or address data, such as email address or phone number.
Data will be stored for the period necessary to respond to inquiries.
Users of our forms have the right to access their data, rectify it, delete it, restrict processing, object to processing, and lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). Detailed information about these rights can be found in the subsequent sections of the Privacy Policy.

V. Recipients of Personal Data

Recipients of personal data may include independent controllers, joint controllers, or processors in accordance with Article 28 of the GDPR, such as providers of reservation, communication, marketing, and hosting services.
Any partner to whom we entrust the processing of personal data (processor) or to whom we provide data (separate controller) will process it in compliance with applicable legal regulations, agreements, and for the purpose of executing the contract, agreement, or cooperation. Such processing will be conducted in accordance with the law as well as our internal policies, procedures, and standards.
Public authorities may also have access to personal data in accordance with applicable legal provisions.

VI. Transfer of Data Outside the European Economic Area (EEA)

As a general rule, we process personal data locally within the territory of Poland or the European Economic Area (EEA). This also applies to partners whose services we use or will use in the future.
In the event that it becomes necessary to transfer data outside the EEA, we will ensure appropriate safeguards in accordance with Articles 44-49 of the GDPR.

VII. Rights Related to the Processing of Personal Data

Right to Withdraw Consent at Any Time (Article 7(3) GDPR):
If your data is being processed based on your voluntary consent, you have the right to withdraw that consent at any time. Upon withdrawal, we will immediately stop processing your data for the purpose for which the consent was given. However, please note that the withdrawal of consent does not affect the legality of data processing that occurred before the withdrawal.
Right of Access to Personal Data and to Obtain a Copy (Article 15 GDPR):
You can request information regarding the processing of your personal data and obtain a copy of your data. The copy will be provided in a commonly used file format. The first copy is provided free of charge, but we may charge a fee for subsequent copies as outlined in the GDPR.
Right to Rectification (Article 16 GDPR):
We are obligated to ensure the accuracy of the data we process. You may request the correction or deletion of data if it is inaccurate, incomplete, or unlawfully collected. The burden of proving these inaccuracies lies with the person to whom the data relates.
Right to Erasure, Including the "Right to Be Forgotten" (Article 17 GDPR):
You have the right to request the deletion of your personal data in the following cases:
- The purposes for which the data was collected have been fulfilled.
- The only legal basis for processing was consent, which has now been withdrawn, and there are no other legal grounds for processing.
- The only legal basis for processing was the consent of a person under 13 years of age.
- You have lodged an objection to the processing under Article 21 GDPR, and we have no overriding legal grounds for continued processing.
- The personal data was processed unlawfully.

5. Right to Be Forgotten:
If the data has been published, for example on this website, and you have the right to have it deleted, we are obligated to remove all copies and references to that data. We must also take steps to ensure that other entities processing the data also delete it. However, this right is not absolute and must consider available technology and costs, which may affect its application.

6. Right to Restriction of Processing (Article 18 GDPR):
Upon request, we are obligated to restrict the processing of your personal data. In such cases, we must refrain from any operations on the data, except for its storage. If there is a question about the accuracy of the data, we will restrict processing for the time necessary to verify the issue. We will also restrict processing if you lodge an objection to the processing.

7. Right to Data Portability (Article 20 GDPR):
You have the right to receive your personal data and transfer it to another chosen data controller. The right to data portability applies when we process data based on consent (Article 6(1)(a) GDPR) or when it is necessary for the performance of a contract (Article 6(1)(b) GDPR), and the data processing is carried out by automated means.

8. Right to Object (Article 21 GDPR):
You may request that we stop processing your personal data, particularly due to reasons related to your specific situation. However, an objection does not apply if the processing is based on consent. In such cases, you should withdraw consent—the effect will be the same, but from a legal standpoint, an objection and withdrawal of consent are different institutions, applied in different situations. A valid objection cannot be made if:

The processing of personal data is necessary for the performance of a contract (Article 6(1)(b) GDPR).
The processing is necessary to fulfill a legal obligation (Article 6(1)(c) GDPR).
The processing is necessary to protect the vital interests of the person concerned or another natural person (Article 6(1)(d) GDPR).

9. Right Not to Be Subject to Automated Individual Decision-Making, Including Profiling (Article 22 GDPR):
You have the right not to be subject to decisions based solely on automated processing, including profiling, if such decisions have legal effects on you or similarly significantly affect your situation. Automated data processing, including profiling, is permissible if:

It is necessary for the conclusion or performance of a contract.
It is authorized by European Union law or the law of the Member State to which we are subject, and which provides appropriate measures to protect rights, freedoms, and legitimate interests.
It is based on explicit (not implied) consent.

10. Right to Lodge a Complaint with a Supervisory Authority (Article 77 GDPR):
If you believe that our actions related to the processing of your personal data violate your rights, you may lodge a complaint with the supervisory authority, which is an independent public body responsible for monitoring GDPR compliance. In Poland, this function is performed by the President of the Office for Personal Data Protection. You can contact the supervisory authority:

By mail: ul. Stawki 2, 00-193 Warsaw;
Electronically via the ePUAP electronic mailbox of the Office for Personal Data Protection: /UODO/SkrytkaESP;
By phone via the hotline: 606 950 000.

11. These rights may be limited in certain situations, such as when we can demonstrate that we are legally obligated to process the data. To exercise your rights, please send a request using our contact details provided in the Privacy Policy.

VIII. Acquisition of Personal Data

Personal data is generally obtained directly from the individuals to whom it relates, as outlined in Section IV of the Privacy Policy. However, in some cases, personal data may be acquired from other sources, such as:

Booking Agents: Personal data of guests other than the person making the reservation may be obtained directly from the individual who makes the booking.
Third Parties: Personal data may be obtained from third parties, for example, when a supplier, contractor, or partner is recommended to us by someone who knows them and recommends them for cooperation.
Other Business Partners: Personal data may be provided by business partners with whom we collaborate in the execution of contracts, projects, or other business ventures or sales activities (e.g., operators of platforms like Booksy.com, Booking.com).

2. In every instance where data is acquired from other sources, we take steps to ensure that the data has been provided in accordance with applicable legal regulations and that the individual whose data is being processed has been appropriately informed about the processing of their personal data.

IX. Types and Purposes of Cookies Used

The Administrator uses the following types of cookies for:

Necessary Cookies: These cookies are essential for the proper functioning of the website and its security. They enable users to browse offers, make reservations, authenticate, and detect abuse. We will use these cookies without asking for the user's consent.
Analytical Cookies: These cookies collect information about how users interact with the website, optimize its content and functionality, and tailor the site to user expectations. We will use these cookies when you give your consent.
Marketing Cookies: These cookies display content and marketing notifications tailored to user preferences, including information about user activity, products, and services from the Administrator and third parties. They include personalizing ads and analyzing the effectiveness of marketing campaigns. We will use these cookies when you give your consent.

2. Users can limit or disable cookies on their devices.

X. Cookie Settings

Initial Consent:
Users can choose which cookies they consent to during their first visit to the website, except for the cookies mentioned in Section IX.1.a of the Privacy Policy.
Changing Settings:
Users can change cookie settings at any time using their web browser settings, except for the cookies mentioned in Section IX.1.a of the Privacy Policy.
Deleting Cookies:
Users can delete cookies at any time using available features in their web browser, except for the cookies mentioned in Section IX.1.a of the Privacy Policy.

XI. Changes to the Privacy Policy

We reserve the right to update the Privacy Policy in the following cases:

Legal Compliance: To comply with applicable legal regulations.
Legal Interpretations: Due to changes in the interpretation of legal provisions.
Judicial and Regulatory Changes: To adapt to court rulings, decisions, recommendations, or guidelines from relevant authorities or bodies.
Correction of Errors: To correct typographical errors or inaccuracies.
Changes in Contact Information: Due to changes in identification or contact details.
Service Changes: Due to changes in the services provided or data collection channels.

2. All changes will be published on our websites and will take effect immediately upon publication.

Last update: September 2, 2024.