Privacy

I. Data Controller

The personal data controller is DK HOME sp. z o.o. with its registered office in Warsaw (ul. Domaniewska 37 lok. 2.43, 02-672 Warsaw; NIP 525-269-97-17; REGON 366596182; KRS 0000664447), operating the facility „Bursztynowe Resort & SPA” in Stegna, ul. Brzozowa 6, 82-109 Stegna.
Contact regarding data protection issues:
• e-mail: recepcja@bursztynowe-resort.pl
• by mail: company registered address

II. Scope of Processed Data

During the use of the facility's services we may process, among others:
• identification data: first name, last name, identity document number, PESEL (if required)
• contact data: e-mail address, phone number, residential address
• data relating to reservations and stay: arrival/departure dates, stay preferences, payment details
• vehicle data (e.g. registration number when using the parking lot)
• data obtained through video monitoring (for security purposes)

III. Purposes and Legal Grounds for Data Processing

We process personal data for the purpose of:
1) Contract performance – reservation, check-in, provision of accommodation and additional services (Art. 6(1)(b) GDPR).
2) Compliance with legal obligations – maintaining registration documents, tax settlements (Art. 6(1)(c) GDPR).
3) Protection of vital interests and ensuring security – monitoring, access control (Art. 6(1)(d) and (f) GDPR).
4) Realization of legitimate interests of the controller – securing claims, direct marketing of own services (Art. 6(1)(f) GDPR).
5) Based on consent – sending newsletters, sending special offers electronically (Art. 6(1)(a) GDPR).

IV. Data Recipients

Personal data may be transferred to:
• IT service providers, reservation and payment systems
• companies providing legal, accounting, or marketing services
• operators of booking portals (in case of bookings made through such services)
• authorized public authorities – only in cases specified by law

V. Data Retention Period

Data will be retained:
• for the duration of the contract and until the prescription period of claims expires (maximum 6 years from the end of the stay)
• monitoring data – maximum 30 days
• data processed on the basis of consent – until its withdrawal

VI. Rights of the Data Subject

Each person has the right to:
• access their data
• rectify data
• delete data (“right to be forgotten”)
• restrict processing
• data portability
• object to processing
• withdraw consent at any time (without affecting the lawfulness of processing before its withdrawal)
• lodge a complaint to the President of the Personal Data Protection Office

VII. Voluntariness of Providing Data

Providing data is voluntary but necessary to conclude and perform the stay agreement. Failure to provide it may prevent service delivery.

VIII. Automated Processing and Profiling

Data are not processed in an automated manner for decisions causing legal effects, including profiling.

IX. Cookies and Website

The facility's website may use cookies for proper functioning, traffic analysis, and marketing. Details can be found in a separate Cookie Policy available on the website www.bursztynowe-resort.pl.

X. Privacy Policy Changes

The privacy policy may be updated to adapt to changes in legal regulations or data processing procedures. The current version is always available at reception and on the facility's website.