§I Introduction to the Privacy Policy

This document sets out our Privacy Policy, i.e. the principles we follow when processing your personal data. It also contains the information that, pursuant to generally applicable laws and regulations, must be provided to data subjects, i.e. to you.

This Privacy Policy sets out the principles governing the processing and protection of personal data provided by users of services provided by EndHotel Sp. z o.o. (hereinafter referred to as “EndHotel” or the “Controller”). It applies to:

• the use of our products and services;
• visits to our websites and social media profiles.

In order to ensure the security of the personal data entrusted to us, EndHotel operates on the basis of internal procedures and guidelines that comply with the relevant data protection laws and regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”). EndHotel uses only the data necessary to achieve each of the purposes for which personal data is processed.

EndHotel takes particular care to protect the interests of data subjects and, in particular, ensures that personal data is:

• processed lawfully;
• collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
• accurate and adequate in relation to the purposes for which it is processed;
• stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed.

§II Data Controller

The Controller of personal data, i.e. the entity deciding how your personal data will be used, is EndHotel Sp. z o.o., Bielany Wrocławskie 55-040, ul. Sosnowa 34, entered in the Register of Entrepreneurs of the National Court Register, whose registration files are maintained by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register, under KRS No. 00000406465, NIP: 8971780358, REGON: 021792849.

§III Contact Details

For all matters relating to the processing of personal data, you can contact us by email at daneosobowe@endhotel.pl or in writing at:

EndHotel Bielany Sp. z o.o.
ul. Sosnowa 34
55-040 Bielany Wrocławskie
Poland

§IV Source of Personal Data

We receive personal data from you or from other persons or entities authorised by you in connection with our business activities, as well as automatically, for example through the collection of “cookies”.

§V Purposes and Legal Bases for Processing Personal Data

Your personal data will be processed by EndHotel for the following purposes:

Marketing of our own services, sending newsletters electronically, storing data in “cookies”, organising competitions and promotional campaigns in which you may participate, and recording telephone conversations during calls — on the basis of the explicit consent of the data subject given before the recording begins (Article 6(1)(a) GDPR).

Taking steps prior to entering into a contract, at the request of the data subject, or performing a contract for the provision of services by EndHotel to which the data subject is a party (Article 6(1)(b) GDPR).

Compliance with a legal obligation applicable to EndHotel (including tax and archiving obligations, handling complaints, and reporting conduct that may constitute an offence or misdemeanour or is generally considered reprehensible) — pursuant to Article 6(1)(c) GDPR.

Protection of vital interests (life and health) and the interests of the data subject (including the processing of data of accompanying persons, including children using hotel services) — pursuant to Article 6(1)(d) GDPR.

Pursuing the legitimate interests of EndHotel (including pursuing or securing claims, ensuring the safety and protection of persons and property, and conducting direct marketing other than on the basis of consent, e.g. discount cards, loyalty programmes, sending occasional gifts or Christmas cards) — pursuant to Article 6(1)(f) GDPR.

Providing personal data is voluntary and consent given may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. When entering into civil-law contracts, providing personal data is necessary. If, for any reason, you fail to provide the required personal data, we may refuse to enter into the contract.

Publicly available personal data — for example, data provided on social media or review websites when posting comments, opinions, etc. — is available to all visitors to the websites containing such data. EndHotel has no possibility of preventing private individuals or companies from using this data to send users unsolicited information. Therefore, such data is not covered by this Privacy Policy.

§VI Categories of Data Processed

We process the following personal data:

In connection with activities preceding the conclusion of a contract, entering into and performing a contract for the provision of services:

• first and last name;
• residential address;
• document number;
• PESEL number;
• date of birth;
• telephone number;
• email address;
• image;
• vehicle registration number;
• dates of ordered events and personal data contained in correspondence;
• information about the stay and the type of services ordered;
• other necessary data, e.g. for the purpose of returning forgotten items.

For marketing purposes:

• first and last name;
• email address;
• telephone number;
• social media username.

In the case of automatic collection of information:

• device information;
• cookies;
• IP addresses;
• browser information;
• other information about users and their behaviour.

§VII Profiling

Your personal data may be processed in an automated manner, including profiling. However, such processing will not produce legal effects concerning you or similarly significantly affect your situation. Automated processing may be carried out in order to assess and determine the personal characteristics or needs of users.

For the purpose of providing content tailored to your needs across different services, we use the Facebook Pixel code, which is used to manage our advertising on Facebook and conduct remarketing activities.

For newsletter statistics, we track the history of whether you open our emails in order to subsequently send you the information that is most useful to you.

Data processed for the purpose of entering into contracts is not subject to profiling.

Entities that receive your personal data in connection with your visit to the Controller’s websites may use it to display similar content tailored to your previous online activity (profiling). They base this on the websites you have previously visited. This applies in particular to Google and Facebook services.

§VIII Transfers of Data to Third Countries

We inform you that we do not transfer your personal data to third countries or international organisations, subject to point IX.1i.

§IX Recipients of Personal Data

Your personal data may be disclosed to entities providing us with:

• hosting and IT services;
• legal and insurance services;
• courier and postal services;
• newsletter contact database management and newsletter distribution services;
• services related to the operation of the booking module on our website;
• marketing services;
• state authorities and services, pursuant to applicable laws and regulations authorising them to obtain personal data, provided that they have an appropriate legal basis for requesting such data;
• services performed in connection with our cooperation with Art Hotel;
• owners of websites/search engines such as Google, YouTube and Facebook, as well as other services whose plugins may be present on EndHotel websites and social media profiles.

Personal data is not sold or rented to other entities.

§X Retention Period

In the case of contracts for the provision of services, personal data will be stored for the duration of the contract and thereafter for the period necessary to:

• secure or pursue potential claims, for no longer than the applicable limitation period under Polish law, or until criminal proceedings are finally concluded by a final judgment;
• comply with legal obligations, including tax and accounting obligations. Under applicable law, this period is 5 years calculated from the end of the calendar year in which the tax obligation arose;
• fulfil statistical and archival purposes;
• for a maximum period of 6 years from the date on which performance of the contract ends.

In other cases, personal data will be processed:

• until consent is withdrawn, an objection to processing is submitted, or the data is no longer necessary to achieve the purpose for which it was collected. Thereafter, until the expiry of the limitation period for any potential claims;
• recordings of calls with the telephone switchboard — for a period not exceeding 3 months, unless, due to special circumstances, it is necessary to retain the recording for a longer period, e.g. until the final conclusion of proceedings;
• video surveillance recordings — for a period not exceeding 3 months, unless, due to special circumstances, it is necessary to retain the recording for a longer period, e.g. until the final conclusion of proceedings.

§XI Rights Related to the Processing of Personal Data

Rights of data subjects

You have the right to:

• access your personal data and receive a copy of it, as well as obtain information about the processing of your data;
• rectify (correct and supplement) your data;
• restrict the processing of your data;
• have your data erased;
• object to the processing of your data;
• data portability;
• lodge a complaint with a supervisory authority;
• withdraw your consent to the processing of personal data at any time, whereby withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

Submitting requests concerning the exercise of rights

A request concerning the exercise of the above rights may be submitted in writing to the addresses indicated in the Contact Details section. The request should clearly specify:

• the right which the person submitting the request wishes to exercise;
• the processing purposes to which the request relates;
• the processing operations and scope of data concerned.

The Controller may ask the person submitting the request for additional information if they are unable to identify that person. A response to the request should be provided within 30 days in the same form in which the request was submitted. If it is necessary to extend this period, the Controller will inform the applicant accordingly.

Data processed by EndHotel through video surveillance where the individual cannot be identified

We inform you that, based solely on a surveillance image, EndHotel Sp. z o.o. is unable to identify a natural person. This means that, pursuant to Article 11 GDPR, the processing does not require identification. Furthermore, in accordance with Article 11 GDPR, Articles 15, 16, 17, 18, 19 and 20 GDPR do not apply — an unidentified person does not have the right to:

• access the content of their personal data contained in surveillance footage or obtain information, including information about data categories and the purposes of processing, or obtain a copy of the data;
• rectify inaccurate data or complete incomplete data;
• be forgotten, i.e. have data processed without a legal basis or unlawfully erased;
• restrict the processing of their data, i.e. suspend data processing operations or prevent the deletion of data in accordance with the submitted request;
• be notified of the rectification or erasure of personal data or restriction of processing;
• request that their personal data be transferred directly by us to another controller, where technically possible.

At the same time, we inform you that you may request from the Controller access to your personal data, its rectification, erasure or restriction of processing, and data portability, provided that you provide the Controller with additional information enabling identification of the previously unidentified natural person.

An individual who cannot be identified on the basis of the Controller’s surveillance footage has the right to object to the processing of their data (provided that they supply the Controller with additional information enabling identification of the previously unidentified natural person) and the right to lodge a complaint with the supervisory authority, namely the President of the Personal Data Protection Office (UODO).

§XII Cookies Policy

When visiting endhotel.pl for the first time, the user is informed about the use of “cookies”. By remaining on the website, the user accepts the use of standard “cookies” on the website. Failure to change the browser settings on the user’s side is equivalent to consent to the use of “cookies”.

The installation of “cookies” is necessary for the proper provision of services on our website. Cookies contain information necessary for the proper functioning of the website, in particular for features requiring authentication. The user may change their browser settings at any time so that cookies are either accepted or rejected, or so that the user is notified when such files are not placed on their computer.

The following types of cookies are used on the website:

Session cookies — remain in the browser until it is closed or the user logs out of the website on which they were placed.

Persistent cookies — remain in the browser of the device until they are deleted by the user or until the predetermined period specified in the cookie parameters expires.

Third-party cookies

Google Analytics — allows us to analyse how our websites are used. More information is available in Google’s Privacy Policy.

Google AdWords — we may commission advertisements targeted at selected groups of recipients, but we do not have access to cookie data stored on your device. More information is available in Google’s Privacy Policy.

YouTube — our websites may contain videos provided by YouTube. A cookie is stored when the browser accesses the YouTube service. More information is available in Google’s Privacy Policy.

Facebook — our websites use the so-called Facebook conversion pixel to manage our advertising on Facebook and conduct marketing activities. More information is available in Facebook’s Privacy Policy.

You can independently change your cookie settings at any time, specifying the conditions for their storage and the scope of their use. Settings can be changed through your web browser or mobile device settings. Detailed information about the options and methods for managing cookies is available in your web browser settings.

§XIII Collection of Personal Data of Persons Under 18 (Children)

We do not knowingly collect or solicit any personal data from persons under 18 years of age, nor do we knowingly allow such persons to make reservations at our hotel. If we learn that we have obtained personal data concerning a person under 18 without the consent of a parent or legal guardian, we will immediately take steps to delete such data.

If you believe that we have or may have information about or originating from a person under 18 years of age, please contact us at daneosobowe@endhotel.pl.

§XIV Changes to the Privacy Policy

Art Hotel reserves the right to make changes to this Privacy Policy, which may result from the development of internet technology, possible changes in data protection laws and the development of the website. Each customer is bound by the current Privacy Policy available on the website on the date on which the EndHotel service is used.

§XV Links to Other Websites

The website may contain links to other websites that operate independently of the website and are not in any way supervised by EndHotel. These websites may have their own privacy policies and terms and conditions, which we recommend that you read carefully.

§XVI Contact Us

In summary, we make every effort to ensure that the processing of your personal data interferes with your privacy to the least possible extent. However, if at any stage of the processing of your personal data you have any doubts as to whether such processing complies with applicable laws and regulations, please contact us.

Regardless of the above, we encourage you to send any questions, comments, observations, requests or complaints concerning this Privacy Policy to daneosobowe@endhotel.pl.

You can also write to us at:

EndHotel Bielany Sp. z o.o.

ul. Sosnowa 34
55-040 Bielany Wrocławskie
Poland