Gołębiewski Hotels

§1 Identification of the Data Controller

Gołębiewski Holding sp. z o.o. with its registered office in Ciemne; 05-250 Ciemne, Radzymin; ul. Wołomińska 125, NIP: 125-173,93-35, REGON: 523380176, entered into the register of entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw in Warsaw, 14th Commercial Division of the National Court Register under the KRS number: 00009996308; with the following branches:

•       Gołębiewski Hotel in Mikołajki, ul. Mrągowska 34, 11-730 Mikołajki, mikolajki@golebiewski.pl, tel. 87 42 90 700
•       Gołębiewski Hotel in Białystok, ul. Pałacowa 7, 15-064 Białystok, bialystok@golebiewski.pl, tel. 85 67 82 500
•       Gołębiewski Hotel in Wisła, al. Ks. Bp. Bursche 3, 43-460 Wisła, wisla@golebiewski.pl, tel. 33 85 54 700
•       Gołębiewski Hotel in Karpacz, ul. Karkonoska 14, 58-540 Karpacz, karpacz@golebiewski.pl, tel. 75 76 70 740
•       Gołębiewski in Pobierowo, ul. Frontowa 1, 72-346 Pobierowo; rez.pob@golebiewski.pl tel. 91 32 00 700

§2 Data Protection Officer

The Hotel has appointed a Data Protection Officer who will be happy to assist you in all the matters relating to personal data protection, and who you may contact to ask any questions regarding the processing of your personal data at the following email address: iod@golebiewski.pl;

§3 Core principles relating to processing of personal data

In order to provide services in line with the business profile, your personal data shall be processed lawfully by the Hotel for various purposes in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), commonly known as the GDPR. We collect your personal data during the process of concluding the agreement or from our partners on booking portals, provided that they gained such consent from you. Below, you will find detailed information on data processing purposes and the legal basis hereon.

a.    We may process the below listed types of personal data of yours in order to prepare a quote for the service provided, book the service and perform the service, and in concluding other agreements related to the Hotel’s business profile:

•        Name and Surname;
•        Address (street, house/apartment number, zip code and city);
•        Phone number;
•        Email address;
•        Company ID , incl. the NIP number (in the case of issuing VAT invoice for a company);
•        Registration number of the vehicle belonging to our Client or Customer (hereinafter “Guest”) (in the case of using the hotel car park);
•        Basic bank account details to confirm the transfer;
•        ID/PESEL number;
•        Nationality;
•        Your debit card number and other card details, credentials and other data relating to billing and accounts associated with mobile billing;
•        Gold Card or Travel Loyalty Programs, incl. membership number;
•        Booking reference.

The legal basis for such data processing is Article 6(1)(b) of the GDPR, which allows for the processing of your personal data if it is necessary for entering an agreement or taking steps to enter into an agreement. Children's data, such as name, surname, nationality and date of birth, are collected exclusively from their parents or legal guardians and only to determine their age and discounts they are entitled to, and for statistical purposes (GUS mandatory reporting obligation or local taxes).

b.    We process the below listed types of personal data of yours in considering complaints:

•        Name and Surname;
•        Address (street, house/apartment number, zip code and city);
•        Phone number;
•        Email address;
•        Booking reference;
•        Alternatively, a bank account number if any refund is granted.

The legal basis for such data processing is Article 6(1)(b) of the GDPR, which allows the processing of your personal data if they are necessary for entering an agreement or to take steps to conclude an agreement;

c.     We process the below listed types of personal data of yours in managing the "GOLDEN CARD" loyalty program:

•        Name and Surname;
•        Address (street, house/apartment number, zip code and city);
•        Phone number;
•        Email address;
•        Information about previous bookings.

 The legal basis for such data processing is Article 6(1)(a) of the GDPR, which allows the processing of your personal data on the basis of voluntarily given consent.

d.    We process the below listed types of personal data of yours in the process of issuing invoices and meeting other obligations arising from the provisions of law, such as - for example - storing accounting documentation for 5 years, the statistical reporting mandatory obligation of the Central Statistical Office (GUS) or paying local taxes:

•        Name and Surname;
•        Company;
•        Residential address or registered office address;
•        Tax identification number (NIP);
•        Booking reference.

The legal basis for such data processing is Article 6(1)(c) of the GDPR, which allows the processing of your personal data if such processing is necessary for the Personal Data Controller to demonstrate compliance with the obligations under the law;

e.    We process the below listed types of personal data of yours for surveying satisfaction with the services offered, auditing, improving and modifying our services:

•        Email address;
•        Booking reference;
•        Name and Surname;
•        Guests’ comments or suggestions.

The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows for the processing of your personal data if the Personal Data Controller pursues its legitimate interest in this way (here, the interest of the Hotel is to learn about the opinions of Guests about the services provided in order to adapt them to the needs and expectations of the interested parties);

f.      We process the below listed types of personal data of yours in order to ensure the safety of the Hotel's employees and guests and to prevent fraud:

•        Key card system data;
•        Facial image obtained from video surveillance systems;
•        Name and Surname;
•        Email address;
•        Phone number;
•        IP address.

The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows for the processing of your personal data if the Personal Data Controller pursues its legitimate interest in this way (here, the interest of the Hotel is to ensure the safety of all persons staying on the premises of the Hotel). Any CCTV data is deleted after a maximum of 30 days from the date of recording.

g.    We process the below listed types of personal data of yours for creating registers and records related to the GDPR, including, for example, a register of Guests who have raised objections in accordance with the GDPR:

•        Name and Surname;
•        Email address.

The GDPR imposes certain documentation obligations on us to demonstrate compliance and accountability. For example, if you have raised objections to the processing of your personal data for marketing purposes, we must learn towards whom not to use direct marketing.

The legal basis for this data processing is Article 6(1)(c) of the GDPR, which allows the processing of your personal data if such processing is necessary for the Personal Data Controller to demonstrate compliance with its legal obligations (provisions contained in the GDPR); along with Article 6(1)(f) of the GDPR, which allows the processing of personal data if the Personal Data Controller pursues its legitimate interest in this way (here, the Hotel's interest is to learn ID on a person who exercises his/her rights under GDPR).

h.    We process the below listed types of personal data of yours for establishing, pursuing or defending against claims:

•        Name and Surname (if the surname has been provided) or the company’s name;
•        Residential address (if provided);
•        PESEL number or NIP number (if provided);
•        Email address;
•        IP address;
•        Booking reference.

The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows for the processing of your personal data if the Personal Data Controller pursues its legitimate interest in this way here, the interest of the Hotel is to obtain identification data for a person that allows to establish, pursue or defend against claims, including Guests and third parties);

i.      We process the below listed types of personal data of yours for analytical purposes, i.e. to study and analyse the activity on the website belonging to the Hotel:

•        Date and time of the website visit;
•        Type of operating system;
•        Approximate location;
•        The type of web browser used to browse the site;
•        Time spent on the site;
•        Visited subpages;
•        The subpage where the contact form was filled in.

The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows for the processing of your personal data if the Personal Data Controller pursues its legitimate interest in this way (here, the interest of the Hotel is to learn about the activity of customers on the Hotel’s website).

j.      In order to process text information on our website , we use cookies (cookies will be described in a separate section). The legal basis for such processing is Article 6(1)(a) of the GDPR, which allows the processing of your personal data on the basis of voluntarily given consent (when you first enter our website, you are asked to give your consent to the use of cookies);

k.     In order to provide administration services on our website , we process such personal data as:

•        IP address;
•        Server date and time;
•        Web browser information;
•        Operating System Information.

This data is automatically saved in the so-called server logs, each time you use the website belonging to the Hotel. Administering a website without the use of a server and without this automatic saving would not be possible. The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows for the processing of personal data if the Personal Data Controller pursues its legitimate interest in this way (here, the interest of the Hotel is the administration of the website);

l.      We process your personal data for marketing our own products and services, and sending marketing information (newsletter) electronically, also through other communication channels with your consent, for the purpose of analysing statistical data, i.e. researching and analysing the effectiveness of marketing campaigns,:

•        Name and Surname;
•        Email address;
•        Residential address;
•        Information regarding previous bookings;
•        Phone number.

The legal basis for the processing of such data is Article 6(1)(a) of the GDPR, which allows the processing of personal data on the basis of voluntarily given consent. This data will be stored as long as you do not withdraw your consent.

§4 Cookies

1.    The Hotel website, other entities alike, uses the so-called cookies, i.e. short text information saved on the user's computer, phone, tablet or other devices. They may be read by our system and systems belonging to other entities whose services we use (e.g. Meta Platforms, Google, PayPal).

2.    Cookies perform many useful functions on the website (for any questions, please contact us), for instance :

•        ensuring security - cookies are used to authenticate users and prevent unauthorized use of the Guest panel. They are therefore used to protect your personal data from access by unauthorized persons;
•        impact on the processes and efficiency of using the website and mobile application - cookies are used to make the website work efficiently and to be able to use the functions available on it, which is possible, among other things, by remembering the settings between subsequent visits to the website. Thanks to them, you can efficiently navigate the website and individual subpages;
•        session status - cookies often store information about how visitors use the website, e.g. which subpages they display most often. They also allow you to identify errors that appear on certain subpages. Cookies used to save the so-called "session state" therefore help to improve services and increase the comfort of browsing websites;
•        maintaining the status of the session - if the client logs in to their panel, cookies allow you to maintain the session. This means that after switching to a different subpage, you do not have to re-enter your login and password each time, which is conducive to the comfort of using the website;
•        creating statistics - Cookies are used to analyse how users use the website (how many open the website, how long they stay on it, which content arouses the most interest, etc.). This allows you to continuously improve the website and adapt its operation to the preferences of users. We use Google tools such as Google Analytics to track activity and create statistics; in addition to reporting website usage statistics, Google Analytics pixel may also be used, together with some of the cookies described above, to help display more relevant content to the user on Google services (e.g. Google Search) and across the web;
•        marketing techniques and personalization of advertisements - allow you to adjust advertising messages to the user's behaviour on the website. Stored cookies are used to track users on the Controller's websites as well as in the mobile application made available by the Controller. The goal is to display ads that are relevant and interesting to individual users. In order to perform these functions, the Controller uses tracking technologies, including Web Push, referred to in paragraph 5
•        use of social functions - on the website we have the so-called Facebook pixel and Instagram, which allows you to like our fan page on this website while using the website. However, in order to do this, we need to use cookies provided by Meta, for example.

3.    By default, your web browser allows the use of cookies on your device, so we ask you to consent to the use of cookies during your first visit. However, if you do not want cookies in browsing the website, you can change the settings in your web browser and completely block the automatic handling of cookies, or request a notification about each time cookies are placed on your device. You can change the settings at any time.

4.    Respecting the autonomy of all persons using the website, however, we feel obliged to warn you that disabling or limiting the use of cookies may cause quite serious difficulties in using the website, e.g. you have to log in to each subpage, a longer loading time of the website, limitations in the use of functionalities, etc.

5.    We use Web Push technology to provide you with short notifications on an ongoing basis, in particular the latest news, information and offers relating to our services.

§5 Right to withdraw consent

1.    If the processing of personal data is based on consent, you can withdraw your consent at any time.

2.    You may withdraw your consent to the processing of personal data for the purpose described in §3(l) at any time in the user panel on the website, in the mobile application made available by the Controller, using the link provided in the e-mail entitled "unsubscribe from the newsletter" or by means of a statement that should be sent to the e-mail address: zgody@golebiewski.pl. This data will be stored until you withdraw your consent.

3.    You may withdraw your consent to the processing of personal data for the purpose described in § 3(c) at any time after logging in to your account using the "delete account" option.

4.    If the processing of your personal data was carried out on the basis of consent, its withdrawal does not make the processing of your personal data illegal until that moment. In other words, until you withdraw your consent, we have the right to process your personal data and its withdrawal does not affect the lawfulness of the processing so far.

§6 Requirement to provide personal data

1.    Providing any personal data is voluntary and depends on your decision. However, in some cases, the provision of certain personal data is necessary to meet your expectations regarding the use of the services.

2.    In order to book services at the Hotel, you must provide the data indicated in § 3(a)a of the Privacy Policy.

3.    In order for you to be able to receive an invoice for services, it is necessary to provide all the data required by tax law because without this, we are not able to issue an invoice correctly.

4.    In order to be able to contact you by phone in matters related to the provision of the service, it is necessary to provide a phone number and e-mail address because without this we are not able to establish telephone contact or send a booking confirmation to you.

§7 Automated decision-making and profiling

The Controller may use profiling (i.e. automated data processing) to create user profiles, analyse preferences, behaviours and interests, and target personalised marketing messages, promotions and commercial offers. The Controller does not make a decision that is based solely on automated processing, including profiling, and has a significant impact on the data subject.

§8 Recipients of personal data

1.    Like most businesses, we rely on the assistance of other entities in our operations, which often requires the transfer of personal data. Therefore, if necessary, we share your personal data with lawyers who provide services to us, payment processing companies, an accounting firm, a hosting company, a company responsible for sending text messages, providers of system solutions such as reservation systems or satisfaction surveys, a provider of newsletter and direct marketing services, and an insurance company (should redress of damages be necessary).

2.    In addition, it may happen that we will be required to share your personal data with other authorities or entities, for example, due to applicable law or a decision of a competent authority.

§9 Transfer of personal data to third countries

1.    Like most businesses, we use various popular services and technologies offered by Meta, Microsoft, Google, and Zendesk. These companies are based outside the European Union and are therefore treated as third countries under the GDPR.

2.    The GDPR introduces certain restrictions on the transfer of personal data to third countries. Since European regulations do not generally apply there, the protection of the personal data of European Union citizens may unfortunately be insufficient. Therefore, each data controller is required to establish a legal basis for such transfer.

3.    We assure you that in using services and technologies we transfer personal data only to entities in the United States and only to those that have joined the Privacy Shield program, based on the European Commission's implementing decision of July 12, 2016. More information can be found on the European Commission's website at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_pl. Entities that have joined the Privacy Shield program guarantee that they will adhere to the high standards of personal data protection that apply in the European Union, therefore the use of their services and technologies in the processing of personal data is lawful.

4.    We can provide you with additional explanations regarding the transfer of personal data at any time if this issue raises your concerns.

§10 Period of personal data processing

1.    In accordance with applicable law, we do not process your personal data "indefinitely", but only for the time that is necessary to achieve the set purpose. After this period, your personal data are irreversibly deleted or destroyed.

2.    In a situation where we do not need to perform any other operations on your personal data than storing them (e.g. when we store the content of the order for the purposes of defending against claims) until it is permanently deleted or destroyed, we additionally secure it - by pseudonymization. Pseudonymization consists in encrypting personal data or a set of personal data in such a way that it cannot be read without an additional key, and therefore such information becomes completely useless to an unauthorized person.

3.    With regard to individual periods of personal data processing, we kindly inform you that we process personal data for the period of:

•        duration of the agreement in relation to personal data processed for the purpose of concluding and performing it;
•        3 years or 10 years + 1 year in relation to personal data processed for the clarification, investigation or defence of claims (the length of the period depends on whether both parties are entrepreneurs or not);
•        6 months in relation to personal data that were collected during the valuation of the service, but the agreement was not concluded immediately;
•        5 years in relation to personal data related to the fulfilment of obligations under tax law;
•        until the consent is withdrawn or the purpose of the processing is achieved in relation to the personal data processed on the basis of such a consent;
•        until an effective objection is lodged or the purpose of processing is achieved, but not longer than for 5 years, in relation to personal data processed on the basis of the legitimate interest of the Personal Data Controller;
•        until it becomes obsolete or no longer useful in relation to personal data processed mainly for analytical purposes, the use of cookies and the administration of the website.

4.    We count periods in years from the end of the year in which we started processing personal data in order to streamline the process of deleting or destroying personal data. A separate calculation of the deadline for each concluded contract would be associated with significant organizational and technical difficulties, as well as a significant financial outlay, so establishing a single date for the deletion or destruction of personal data allows us to manage this process more efficiently. Of course, if you exercise your right to be forgotten, such situations are considered individually.

5.    The additional year related to the processing of personal data collected for the purpose of performing the agreement is dictated by the fact that, hypothetically, you may submit a claim shortly before the expiry of the limitation period, the request may be delivered with a significant delay, or you may incorrectly determine the limitation period for your claim.

§11 Rights of data subjects

1.    We kindly inform you that you have the right to:

•        access your personal data;
•        rectification of your personal data;
•        delete your personal data;
•        restrict the processing of personal data;
•        object to the processing of personal data;
•        be forgotten when other legal provisions allow it;
•        receive a copy of the data;
•        transfer of personal data.

2.    We respect your rights under the data protection regulations and strive to facilitate their execution as much as possible.

3.    We would like to point out that these rights are not absolute, and therefore in some situations we may lawfully refuse to exercise them. However, if we refuse to accept the request, it is only after a thorough analysis and only in a situation where the refusal to accept the request is necessary.

4.    Regarding the right to object, we would like to clarify that you have the right to object to the processing of your personal data at any time on the basis of the legitimate interest of the Personal Data Controller (they are listed in point III) in connection with your particular situation. However, you must remember that according to the regulations, we may refuse to accept such an objection if we prove that:

∙       there are legitimate grounds for the processing which override your interests, rights and freedoms; or

∙       there are grounds for establishing, pursuing or defending claims.

5.    In addition, you may withdraw your consent to the processing of your personal data in accordance with §5 at any time. In such a case, we cease processing for this purpose after receiving the withdrawal of consent.

6.    You can exercise your rights to object in the following ways:

•        send an e-mail to the Data Protection Officer at iod@golebiewski.pl; or
•        send such a request to the address of the Data Protection Officer – 125 Wołomińska Street, Ciemne, 05-250 Radzymin; or
•        contact the receptionist during a visit to one of our hotels.

§12 Right to lodge a complaint

If you believe that your personal data is being processed in violation of applicable law, you may lodge a complaint with the President of the Office for Personal Data Protection.

§13 Final provisions

1.    To the extent not regulated by this Privacy Policy, personal data protection regulations apply.

2.    The Hotel reserves the right to make changes to this Privacy Policy.

3.    Changes to the Privacy Policy must not violate the rights acquired by the Guests.

4.    Information about the change in the Privacy Policy will be published on the Hotel's website: www.golebiewski.pl 14 calendar days before the changes come into force.

5.    This Privacy Policy is effective as of February 12, 2026