Privacy

Privacy Policy

www.archehotelkrakowska.pl
Contents

PREAMBLE.
§1 Definitions.
§2 Data Controller and Data Protection Officer.
§3 Data Protection Officer.
§4 Purposes of processing your personal data.
§4A Processing personal data to respond to your requests/inquiries submitted via contact channels available on the Website, including our social media fan pages.
§4B Processing data to conclude and properly perform a hotel services agreement or take steps at your request before its conclusion.
§5 Joint controllership of personal data when sending commercial information about promotions, offers and events organized by the Joint Controllers, including newsletters (direct marketing).
§6 Your rights
§7 Automated decision-making
§8 Personal data security
§9 Cookies

PREAMBLE

The Privacy Policy of www.archehotelkrakowska.pl sets out the rules for processing your data and identifies the entity responsible for processing it, in accordance with applicable law. It also defines the purposes and scope of processing your personal data and your rights in relation to such processing.

§1 Definitions

The terms used in this document mean:

• Policy – the privacy policy of www.archehotelkrakowska.pl.
• Website – www.archehotelkrakowska.pl.
• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on protecting natural persons regarding the processing of personal data and the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, 2016, p. 1, as amended).
• Personal data – any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified directly or indirectly, in particular by an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity;
• Processing – any operation performed on personal data or sets of personal data, whether automated or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or other provision, alignment or combination, restriction, erasure or destruction;
• Controller – a natural or legal person, public authority, agency or other body which alone or jointly determines the purposes and means of processing personal data;
• Joint Controller – two or more Controllers jointly determining the purposes and means of processing your personal data.
• Processor – a natural or legal person, public authority, agency or other body processing personal data on behalf of the Controller;
• Recipient – a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not. However, public authorities receiving personal data in a particular inquiry under EU or Member State law are not considered recipients.

§2 Data Controller and Data Protection Officer

1. The Controller of your personal data is Arche S.A., based in Warsaw (postal code: 02-801), at 361 Puławska St., entered in the Register of Entrepreneurs of the National Court Register by the District Court for Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under no. 0000831001, NIP: 8211639335, REGON: 71002127700000, with share capital of PLN 2,982,300.00, paid in full.
2. You may contact the Controller by post at the registered-office address above or by email: rodo@arche.pl.

§3 Data Protection Officer

1. The Controller has appointed a Data Protection Officer, whom you may contact regarding all matters related to our processing of your personal data via:

• post at the Controller’s registered-office address indicated in §2(1) of this Policy, marked “Data Protection Officer”.
• by email: rodo@arche.pl.

§4 Purposes of processing your personal data

1. We process your personal data for the following purposes:

• Responding to your requests/inquiries submitted via contact channels available on the Website, including our social media fan pages.
• Concluding and properly performing a hotel services agreement or taking steps at your request before its conclusion.
• Sending you commercial information about promotions, offers and events organized by the Joint Controllers, including newsletters sent to your email address (direct marketing), if you consent. This takes place under joint controllership, as described in §5 of the Policy.

§4A Processing personal data to respond to your requests/inquiries submitted via contact channels available on the Website, including our social media fan pages

1. We process your personal data to respond to your message/inquiry if you contact us via communication channels available on the Website, including the contact form, email or our fan pages on Facebook and Instagram.
2. The legal basis for processing your personal data is Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in handling and responding to your requests or inquiries.
3. If you submit an inquiry or request via our social media profile:

1. Instagram – your data recipient will be Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: Meta Facebook Platforms).

More information on Instagram’s processing of your personal data is available at:

• https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect.

4. If your data is transferred via the above social media fan pages to a location in a third country (outside the EEA), this will occur only with appropriate data security safeguards (standard contractual clauses).
5. Your data may also be received by entities providing the Controller with IT and legal services.
6. We will retain your personal data for as long as necessary to correspond with you, including to respond to your messages/inquiries.
7. Providing your personal data is mandatory if you wish to contact us and receive a response to your inquiry or request.

§4B Processing data to conclude and properly perform a hotel services agreement or take steps at your request before its conclusion

1. Your personal data will be processed for:

• concluding and properly performing a services agreement (the “Agreement”) or taking steps at your request before concluding the Agreement.
• fulfilling the Controller’s legal obligations under applicable law.
• pursuing or defending against potential claims arising during or after performance of the Agreement.
• ensuring the safety of hotel guests and others on the premises of Arche Hotel Krakowska through video surveillance.

2. The legal bases for processing your personal data are:

• for concluding and properly performing the Agreement or taking steps at your request before its conclusion – Article 6(1)(b) GDPR.
• for fulfilling the Controller’s legal obligations under applicable law – Article 6(1)(c) GDPR in conjunction with Article 70 of the Tax Ordinance Act of 29 August 1997 and Article 74 of the Accounting Act of 29 September 1994.
• for pursuing or defending against potential claims arising during or after performance of the Agreement, and ensuring the safety of hotel guests and others on the premises of Arche Hotel Krakowska through video surveillance – our legitimate interest in achieving the above purposes (Article 6(1)(f) GDPR).

3. Recipients of your personal data will be entities providing the Controller with legal, financial and IT services.
4. Your personal data will be stored:

• to conclude and properly perform the Agreement or take action at your request before its conclusion – for the period necessary to conclude or properly perform it.
• to fulfil legal obligations imposed on the Controller by generally applicable law – no longer than 5 years, calculated from the end of the calendar year in which the basis for calculating the public-law receivable arose.
• to pursue or defend against potential claims arising during or after performance of the Agreement – for the period prescribed by generally applicable law, depending on the legal relationship underlying the claim.
• to ensure the safety of hotel guests and others on the premises of Arche Hotel Krakowska through video surveillance – for no longer than 90 days. However, if surveillance footage serves as evidence in civil, criminal or misdemeanour proceedings, it will be stored until those proceedings are finally concluded.

5. Providing the personal data referred to in §4B(1)(a) of the Policy is necessary to conclude the agreement; without it, we cannot conclude it with you. Providing your remaining personal data is mandatory, as without it we cannot fulfil our legal obligations or pursue our legitimate interests.

§5 Joint controllership of personal data for sending commercial information about promotions, offers and events organised by the Joint Controllers, including newsletters (direct marketing).

1. The Joint Controllers of your personal data will be the following entities, which will process your data under the Joint Controllership Agreement (the “Joint Controllers”):

• ‘’ARCHE” S.A., based in Warsaw (postal code: 02 – 801), at ul. Puławska 361.
• Lena Grochowska Foundation, based in Siedlce (postal code: 08 – 110), at ul. Brzeska 134.

Please note that the current list of Joint Controllers may change in the future – the current list is always available at www.arche.pl.

2. The Joint Controllers are jointly responsible for protecting your personal data.
3. Your contact point for personal data protection matters is Auraco Sp. z o.o., based in Warsaw (postal code: 00 – 382), at ul. Solec 81B/73A. You may contact it at the address above or by email: arche.marketing@auraco.pl.
4. The Joint Controllers will process your personal data for marketing purposes by sending personalised commercial information about promotions, current offers of their products and services, and events and activities concerning them to your email address and/or telephone number.
5. The legal basis for processing your personal data is your consent to processing for the above purposes (i.e. Article 6(1)(a) GDPR), which you may withdraw at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
6. Recipients of your personal data may include intermediaries offering our services or products or supporting our activities, and entities supporting our marketing, such as marketing database management system providers and IT and telecommunications service providers. The Joint Controllers will never transfer your personal data outside the European Economic Area.
7. We will store your personal data until you withdraw your consent to its processing or the Joint Controllers’ purposes for which it was collected cease to apply (e.g. when marketing campaigns end).
8. Providing your personal data is entirely voluntary; without it, the Joint Controllers cannot send commercial information about promotions and current offers of their products and services to your email address and/or telephone number.
9. We will analyse your relationship history with us (e.g. services used) and information obtained by analysing interactions with our websites to determine your preferences and interests, enabling us to send personalised commercial information about products, offers and events organised by the Joint Controllers.
10. We will not process your personal data for automated decision-making.

§6 Your rights

1. In connection with our processing of your personal data, you have the right to:

• Withdraw your consent to processing your personal data at any time (where we process it based on your consent).
• Object to the processing of personal data (in the cases specified in Articles 21 and 22 GDPR).
• Data portability – where the legal basis for processing your personal data is your consent or the conclusion and proper performance of the Agreement.
• Access your personal data and receive a copy (Article 15 GDPR).
• Rectify inaccurate personal data and complete incomplete data (Article 16 GDPR).
• Delete your personal data (the right to be forgotten, in the cases specified in Article 17 GDPR).
• Restrict processing of your personal data (in the cases specified in Article 18 GDPR).

2. If you find that we process your personal data contrary to generally applicable law, you may lodge a complaint with the supervisory authority, in Poland: the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

§7 Automated decision-making

We will not process your personal data for automated decision-making.

§8 Personal data security

1. The website has a valid certificate issued by a trusted certification authority. This means that information such as passwords or credit card details is sent securely and cannot be intercepted.
2. An IT employee grants system users authorisation to process personal data in the Controller’s IT systems immediately after receiving their declaration of confidentiality and data security measures.
3. Access to the Controller’s IT systems used to process personal data is possible only after entering a unique ID and password.
4. Data encryption is used, particularly for data transmitted over public networks.
5. Every person employed or cooperating in personal data processing has been authorised to process data.
6. Data processing agreements under Article 28 GDPR have been concluded with third parties processing data for the Controller.
7. Authorised persons have been trained in secure personal data processing.
8. Responsibility for activities related to personal data security has been defined.
9. Persons processing personal data have provided declarations of confidentiality and data security measures.
10. Database integrity is periodically verified by restoring data from backups.
11. Emergency power is provided for servers and workstations using UPS systems or a dedicated power network.

§9 Cookies

1. A cookie is a small text file used by a website to store information on a user’s computer or mobile device while the user accesses it.
2. Cookies may be installed by the Website and read only by it (administrator cookies). The Website may also use cookies from external services, in which case the cookie owner (e.g. Google) may read the data.
3. Cookies may be persistent (stored on the user’s computer and not automatically deleted when the browser closes, for a set period) or session cookies (deleted when the browser closes).
4. Cookies store individual information about the user’s device configuration and preferences (e.g. username, language). They may also be used to compile anonymous statistics on website use. They eliminate the need to re-enter the same data on subsequent visits or repeatedly read cookie notices.
5. The website uses the Controller’s cookies and cookies from external services. The number, type and function of external-service cookies may vary between users due to individual circumstances, e.g. whether they have an account on a social network.
6. The website uses four types of cookies:

• necessary;
• other (Unclassified cookies are cookies we are currently classifying with the providers of individual services, e.g. ProfitroomToken-www.archehotelkrakowska.pl, ubtrs and ubtru.

7. The website uses the following necessary cookie:

• laravel_session – a cookie used by website owners when uploading or renewing website content. It is stored for one day.

8. Cookies can be managed and deleted freely. For more information, see your browser's instructions (links below):

• Google Chrome;
• Mozilla Firefox;
• Microsoft Edge;
• Opera;
• Safari.

9. All cookies on the device can be deleted entirely or selectively by choosing a specific cookie. However, this may delete saved information (e.g. login details, site preferences).
10. Browser settings can block all or selected cookies from a specific site. More information on managing site-specific cookies is available in your browser's privacy and cookie settings.
11. Most modern browsers can prevent cookies from being placed on your device, but you may then need to reset preferences on each visit. Some services and features may not work properly (e.g. profile login).
12. Data processing by necessary cookies (essential for proper website operation) is based on the administrator's legitimate interest in providing the highest-quality content on the website.
13. Data processing by other cookies is based on the website user's consent.
14. The Administrator will transfer personal data to recipients entrusted with processing it on the Administrator's behalf, e.g. entities responsible for the website's technical operation. The Administrator will also disclose personal data where required by law.
15. Data in each cookie will be stored for its validity period saved on the user's device. Cookies on the device can be deleted entirely or selectively by choosing a specific cookie.

List of data processors

• We use the following analytics tools: Google, Facebook
• We use the following marketing tools: Google, GetResponse