Last updated: 17 October 2026

We respect your privacy. Below we explain what personal data we collect when you book a stay, contact us, stay at our property or visit our website, why we do it and what rights you have.

1. Data controller

The controller of your personal data is Willa Gencjana, Tax ID (NIP) 1132317668, ul. Okrzei 26, 58-580 Szklarska Poręba, Poland, which operates the guesthouses Willa Górska Szrenicówka (ul. Okrzei 26a, 58-580 Szklarska Poręba) and Willa Gencjana (“we”, “us”).

You can contact us about personal data:

  • by e-mail: willaszrenicowka@gmail.com,
  • by phone: +48 601 993 003,
  • by post: Willa Gencjana, ul. Okrzei 26, 58-580 Szklarska Poręba, Poland.

We have not appointed a data protection officer.

2. Purposes and legal bases of processing

2.1. Booking and stay

What data: first and last name, e-mail address, phone number, dates of stay, number of guests (including children), selected room and additional services (e.g. breakfast, parking, a space in the bike shed), booking notes and payment details (amount, date, transfer reference and details of the account the payment came from). We do not collect any additional data at check-in.

Legal basis: entering into and performing the accommodation contract (Art. 6(1)(b) GDPR) and complying with legal obligations, in particular tax and accounting obligations (Art. 6(1)(c) GDPR).

How long: for the duration of the booking and stay, and then for the period required by tax and accounting law (generally 5 years from the end of the year in which the accounting document was issued) and until any claims become time-barred.

Providing your data is voluntary but necessary to make a booking. Without it we cannot accept your booking.

2.2. Bookings via booking platforms

If you book through a platform (e.g. Booking.com), the platform is a separate controller of your data and passes it on to us to the extent needed to fulfil the booking. The platform’s own privacy policy describes how it processes your data. We process the data received from the platform for the purposes and periods described in section 2.1.

2.3. Contacting us

When you e-mail us, call us, send a text message or write to us on Messenger, we process the data you give us (e.g. name, e-mail address, phone number, message content) to answer your enquiry. The legal basis is our legitimate interest in responding (Art. 6(1)(f) GDPR) and, if the enquiry concerns a booking, taking steps prior to entering into a contract (Art. 6(1)(b) GDPR). We keep this data until the matter is closed, but no longer than 2 years from the last contact, unless a booking is made – in that case the periods in section 2.1 apply.

2.4. Video surveillance (CCTV)

The property is monitored by CCTV in the following areas: the bike shed, the lower car park, the upper car park, the building entrance and the common areas – the guest lounge on the ground floor and the staircases. There are no cameras in guest rooms or bathrooms. The purpose is to protect people and property, including guests’ bikes and equipment, which is our legitimate interest (Art. 6(1)(f) GDPR). Recordings are kept for 30 days and then automatically overwritten. If a recording is evidence in proceedings, we keep it until those proceedings end.

2.5. Website, cookies and statistics

We use cookies that are necessary for the website to work (including remembering your choices in the consent banner), based on our legitimate interest (Art. 6(1)(f) GDPR).

Only if you give your consent in the banner (Art. 6(1)(a) GDPR):

  • Google Analytics – we collect visit statistics (e.g. which pages are viewed, how you found our website, approximate location, device type) to improve the website. This data is kept for 14 months.
  • Google Maps – we display a map showing the location of the property.

You can withdraw or change your consent at any time in the banner settings (the “Manage consent” link on the website). Withdrawing consent does not affect the lawfulness of processing before the withdrawal. More details are in our Cookie Policy.

With every visit, the server hosting the website also records basic technical data (IP address, date and time, browser type) to keep the website secure and working properly (Art. 6(1)(f) GDPR). The website also uses fonts provided by Google (Google Fonts), which involves sending your IP address to Google.

2.6. Our Facebook page

We run the Willa Górska Szrenicówka page on Facebook. When you visit it, comment or message us, we process your data to run the page and communicate with you (Art. 6(1)(f) GDPR). For page statistics we are joint controllers together with Meta Platforms Ireland Ltd. More information is available in Meta’s privacy policy.

2.7. Offers and newsletter

If you agree, we will send our offers, promotions and newsletter to the e-mail address or phone number you provided. The legal basis is your consent (Art. 6(1)(a) GDPR) together with the consent to receive commercial communications by electronic means required by the Polish Electronic Communications Law. Giving consent is voluntary and does not affect your ability to book. You can withdraw your consent at any time by clicking the unsubscribe link in a message or by writing to willaszrenicowka@gmail.com. We keep the data for this purpose until you withdraw your consent.

2.8. Legal claims

We may process data to establish, pursue or defend legal claims (Art. 6(1)(f) GDPR) until those claims become time-barred.

3. Who receives your data

Your data may only be shared with parties that help us run the property, and only to the extent necessary:

  • our booking and property management system provider – PREVIO s.r.o. (Czech Republic),
  • e-mail, statistics and map service providers – Google Ireland Ltd.,
  • website hosting and technical service providers (GoDaddy, WordPress.com / Automattic),
  • our bank and card payment operator,
  • our accounting office – for accounting and tax purposes,
  • the provider of our offers and newsletter tool – if you have given your consent,
  • booking platforms – if you book through them,
  • public authorities (e.g. the tax office) where required by law.

We do not sell your data.

4. Transfers outside the European Economic Area

Some of our providers (Google, Meta, GoDaddy, Automattic) may also process data in the USA. In that case the transfer is based on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by contacting us.

5. Your rights

You have the right to:

  • access your data and receive a copy,
  • rectify your data,
  • have your data erased,
  • restrict processing,
  • data portability,
  • object to processing based on our legitimate interest,
  • withdraw your consent at any time – without affecting the lawfulness of processing before the withdrawal.

To exercise these rights, write to willaszrenicowka@gmail.com. We will reply without undue delay and no later than within one month.

You also have the right to lodge a complaint with the Polish supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) – or with the data protection authority in your country of residence, if you believe we process your data unlawfully.

6. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.

7. Changes to this privacy policy

We may update this policy, e.g. when the law or the way we run our property changes. The current version is always available on this page, and the date of the last change is shown at the top.