Privacy Policy

The controller responsible for processing your personal data is:

• Name: Christian Hassert
• Address: ul. Wyzwolenia 82a, 43-460 Wisła, Poland
• E-mail: villawisla@gmail.com
• Phone: +48 512 566 519
• NIP (tax identification number): 1182057838
• REGON (statistical number): 387882299

We collect the following categories of personal data:

• Identification data: first name, surname, e-mail address
• Contact data: phone number, home address
• Booking data: dates of stay, number of guests, room details
• Financial data: payment information (card details are not stored)
• Tax data: tax identification number (NIP) and company name (only for business customers requesting an invoice)
• Communication data: e-mails and messages sent via contact forms

Personal data is processed for the following purposes:

• Handling and confirming accommodation bookings
• Communicating with guests about their booking and stay
• Sending invoices and receipts
• Handling complaints
• Fulfilling legal and tax obligations
• Preventing fraud
• Sending information about new offers (if you have given your consent)
• Analysing and improving our services (based on anonymous data)

The processing of personal data is based on:

• Performance of a contract (Art. 6(1)(b) GDPR): processing is necessary to handle bookings and provide accommodation services
• Legal obligation (Art. 6(1)(c) GDPR): issuing invoices and keeping accounting records
• Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, security, analysing and improving our services
• Voluntary consent (Art. 6(1)(a) GDPR): sending marketing materials and press information (only on request) and the use of analytics cookies (after you click “Accept” in the cookie banner)

Personal data is kept for the following periods:

• Booking and communication data: for the duration of the business relationship and 3 years after it ends (required by tax law)
• Invoices and financial documents: 5 years from the end of the year in which the invoice was issued (tax regulations)
• Complaint data: 3 years after the complaint has been handled
• Marketing messages: until you withdraw your consent
• Access logs: up to 30 days (for security purposes)

After these periods, data is deleted or anonymised, unless the law requires us to keep it longer.

Under the GDPR you have the following rights:

• Right of access: you can request access to your personal data
• Right to rectification: you can ask us to correct or complete your data
• Right to erasure (“right to be forgotten”): you can request that your data be deleted, unless we are legally required to keep it
• Right to restriction of processing: you can restrict how your data is processed
• Right to data portability: you can receive your data in a structured format
• Right to object: you can object to the processing of your data for marketing purposes
• Right related to automated decision-making: the right not to be subject to decisions based solely on automated processing

What are cookies?
Cookies are small text files stored on your device while you browse a website. They help us provide a better user experience.

Types of cookies we use:

• Necessary cookies: make sure the website works properly and securely. They are not used for statistics or advertising and do not require consent. We store your choice from the cookie banner in your browser’s local storage.
• Analytics cookies (Google Analytics): help us understand how you use the website. They are set only after you click “Accept”.

Until you click “Accept”, Google tools do not store cookies on your device and send Google only basic information without cookie identifiers (Google Consent Mode).

Managing cookies:
You can change or withdraw your consent at any time: change cookie settings. You can also delete or block cookies in your browser settings.

We implement appropriate technical and organisational measures to protect personal data:

• Encryption of data transmitted via HTTPS (SSL/TLS)
• Secure storage of data in a protected database
• Access to data limited to authorised staff only
• Regular backups
• Security monitoring
• Compliance with data security standards

Despite our efforts, no system is 100% secure. If you suspect a security breach, please notify us immediately.

Your data may only be shared with:

• Public authorities: where required by law (tax authorities, law enforcement)
• Service providers: payment platforms and other service providers (acting under our control)
• Villa Wisła staff: only where necessary to provide the service

Important: We do not sell, rent or exchange personal data for marketing purposes without your explicit consent.

If you have any questions or concerns about this privacy policy, please contact us:

• E-mail: villawisla@gmail.com
• Phone: +48 512 566 519
• Address: ul. Wyzwolenia 82a, 43-460 Wisła, Poland

We will reply to your enquiry within 30 days of receiving it.

We reserve the right to change this privacy policy. We will inform you of significant changes by e-mail or by a notice on the website.

• Last updated: 10 October 2026

By continuing to use our services after changes have been published, you accept the updated privacy policy.

You have the right to lodge a complaint with the data protection supervisory authority:

• Personal Data Protection Office (Urząd Ochrony Danych Osobowych, UODO)
• Address: ul. Stawki 2, 00-193 Warszawa, Poland
• Phone: +48 22 531 03 00
• Website: www.uodo.gov.pl

You can submit a complaint directly to us or to UODO if you believe that your data protection rights have been violated.