Privacy Policy of the Mobile Application
Number of children
1 Child
2 Child
3 Child
4 Child
Privacy Policy
of the Mobile Application
1. General Provisions
1.1. This Privacy Policy applies to the Hotel Warszawianka mobile application, which enables users to make reservations, use services and manage their user account at Hotel Warszawianka, Jachranka 77, 05-140 Serock. This document sets out the rules for the processing of personal data, including the scope of data, purposes and legal bases for processing, information about the data controller and the rights of the user.
2. Information about the Data Controller, Data Recipients and Processing Model
2.1. Personal Data Controller
2.1.1. Creating a User Account, Reservations and Stay
The controller of the user's personal data when the user uses the functionalities related to Hotel Warszawianka and creates a user account for this property is:
Sinfam Sp. z o.o.
Jachranka 77
05-140 Serock
Poland
Hereinafter, the personal data controller shall be referred to as the “Controller”.
| Property | Property Address | Contact | Personal Data Controller |
|---|---|---|---|
| Hotel Warszawianka | Jachranka 77, 05-140 Serock, Poland | Data Protection Officer: iod@warszawianka.pl | Sinfam Sp. z o.o., Jachranka 77, 05-140 Serock, Poland |
2.1.2. Shared Functions
If, in the future, two or more companies jointly determine the purposes and means of processing personal data, in particular as part of a joint loyalty programme or other shared functionalities, joint controllership of personal data may arise pursuant to Article 26 of the GDPR. In such a case, the user will be informed about the principles of joint controllership and the contact points available for exercising their rights.
2.1.3. Switching to Other Properties
The application may in the future enable users to use functionalities of other properties or services available within the same system. If a user creates an account at another property, personal data may be processed by the controller responsible for that property, in accordance with the principles set out in a separate privacy notice.
If such functionality is made available, the user will be informed about the processing of personal data before using it.
2.2. Data Recipients
2.2.1. the software provider – Betasi sp. z o.o., acting on behalf of the Controller to the extent necessary to ensure the proper functioning of the application;
2.2.2. entities providing accounting, IT or legal services to the Controller;
2.2.3. payment service providers;
2.2.4. providers of analytical services concerning the use of the application.
3. Categories and Sources of Data
3.1. Identification and contact data: first name, surname, e-mail address, login credentials and telephone number.
3.2. Reservation data: stay dates, reservation details, preferences and reservation history.
3.3. Billing data: data required to issue an invoice, payment-related data and, where necessary, bank account number.
3.4. Marketing data and preferences: information concerning consents granted or withdrawn for receiving newsletters or other commercial information, as well as information concerning push notification preferences.
3.5. Technical data: system logs, device or application identifiers, information concerning the use of the application, location data and information concerning permissions granted to the application.
3.6. Sources of data: data provided directly by the user, registration data, data related to reservations and data generated automatically while using the application.
4. Purposes, Legal Bases for Processing and Data Retention Periods
| Purpose | Scope of Data | Legal Basis | Retention Period | Categories of Recipients |
|---|---|---|---|---|
| Creating and managing an account in the application | first name, surname, e-mail address, other login identifier | performance of a contract (Article 6(1)(b) GDPR) | For the duration of the account plus the applicable limitation period for claims | Application provider |
| Reservation and stay management | first name, surname, e-mail address, telephone number, reservation data, preferences | performance of a contract (Article 6(1)(b) GDPR), compliance with a legal obligation concerning accounting (Article 6(1)(c) GDPR) | Until the expiry of the applicable limitation period for claims and for the period required by law to fulfil accounting obligations | Application provider, payment provider, accounting service providers |
| Handling complaints and claims | first name, surname, e-mail address, reservation data, stay history | legitimate interest of the Controller (Article 6(1)(f) GDPR) | Until the legitimate interest ceases to exist and until the applicable limitation period for claims expires | Legal advisers, accounting service providers |
| Marketing of services | e-mail address, telephone number, information concerning consents and preferences | user consent (Article 6(1)(a) GDPR) and regulations concerning electronic communications | Until consent is withdrawn | Marketing service providers and analytics service providers |
| Analytics and application development | technical data, logs, IP address, session identifiers | legitimate interest of the Controller regarding data necessary for the operation of the application (Article 6(1)(f) GDPR) / consent with regard to other data (Article 6(1)(a) GDPR) | For the log retention period – 30 days | Application provider, analytics service providers |
| Maintaining system security | logs, IP address, session identifiers, user activity | legitimate interest of the Controller (Article 6(1)(f) GDPR) | For the log retention period – 30 days | IT service providers |
| Personalisation of offers in the application | logs, IP address, session identifiers, activity, purchase or reservation history | legitimate interest – marketing of the Controller's own services (Article 6(1)(f) GDPR) or user consent, where required | Until an objection is raised or consent is withdrawn, but no longer than until the user ceases to use the application; for individual logs used for profiling – no longer than 30 days | Application provider, analytics service providers |
5. Technical Data, Logs and Security
5.1. When using the application, system logs, device or application identifiers and other technical data related to the use of the application may be recorded. Such data is retained for the period necessary to achieve the purposes for which it was collected, with the retention period for logs being 30 days.
5.2. Technical data and logs may be used in particular to ensure system security, detect abuse, diagnose errors, and develop and analyse the application.
5.3. The Controller implements appropriate technical and organisational measures to protect personal data, including access controls, encryption, accountability, confidentiality and data integrity measures.
6. Cookies, Advertising Identifiers and Analytics
6.1. The application may use cookies, advertising identifiers and analytical tools, depending on the functionalities available in the application. These technologies may be used on the basis of the Controller's legitimate interest or the user's consent where such consent is required.
6.2. The consent and preference management mechanism, where available in the application, can be accessed through the application settings or the device settings.
7. Application Permissions
| Permission | Purpose | Mandatory | How to Disable |
|---|---|---|---|
| Location | precise determination of the user's location and enabling features or services related to location | No | In the device settings |
| Camera | enabling QR code scanning and other features requiring access to the camera | No | In the device settings |
| Push Notifications | providing messages concerning the stay, application operation and, where appropriate consent has been given, marketing communications | No | In the application or device settings |
| Finding Nearby Bluetooth Devices | the application may request access to Bluetooth or permission to find nearby devices in order to support the mobile key functionality, i.e. to detect and connect to a compatible hotel lock or reader | No | In the device settings |
8. Rights of Data Subjects
8.1. Every data subject has the right to:
8.1.1. access their personal data, rectify it, erase it or restrict its processing;
8.1.2. data portability to another controller;
8.1.3. object to processing, including objecting to direct marketing;
8.1.4. withdraw consent to processing where the user has given such consent;
8.1.5. lodge a complaint with a supervisory authority.
8.2. Requests may be submitted to the Controller:
Sinfam Sp. z o.o.
Jachranka 77
05-140 Serock
Poland
e-mail: iod@warszawianka.pl
8.3. If personal data is processed by joint controllers, as separately communicated by the joint controllers, a request may be submitted to the contact point designated by the joint controllers. The joint controllers shall establish procedures for cooperation, forwarding requests and responding within the applicable time limits.
9. Voluntary/Mandatory Provision of Data and Consequences
9.1. It is not necessary to provide personal data in order to use the application. However, if the user wishes to make full use of the application's functionalities, such as creating an account, making a reservation or using specific services of Hotel Warszawianka, the provision of certain personal data may be required by the Controller.
9.1.1. Account creation/reservation: providing the data is necessary to use selected application functions and perform the contract.
9.1.2. Marketing, loyalty programme, location and notifications: providing data or granting the relevant permissions is voluntary, subject to situations where the data is necessary to perform a specific function selected by the user.
9.1.3. Consequences of failure to provide data: the user may be unable to use a selected service or application functionality if providing the data is necessary for its provision.
10. Profiling and Automated Decision-Making
10.1. As part of the use of the application, the Controller may carry out profiling of users, i.e. use selected information about the user to tailor content displayed in the application or communications with the user.
Profiling is primarily carried out on the basis of data provided by the user and data relating to the user's activity in the Controller's services, including, in particular, stay history, reservation history, purchasing habits, preferences regarding hotel services, activity in the application, demographic data or other information available in the hotel's systems.
10.2. The purpose of profiling is to better tailor displayed content, offers, recommendations, messages or information about hotel services to the user's presumed needs and interests. For example, the user may be shown content relating to services, packages, amenities or offers which, based on the available data, may be more relevant to them than other content.
10.3. Profiling may be carried out on the basis of the Controller's legitimate interest consisting of marketing its own services, personalising communications and improving the quality of user service, or – where required by applicable law or the communication channel used – on the basis of the user's consent.
Where consent constitutes the legal basis, the user may withdraw it at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal.
10.4. The user has the right to object at any time to the processing of their personal data for marketing purposes, including profiling carried out for direct marketing purposes. If such an objection is made, the user's data will no longer be processed for these purposes. An objection may be submitted, in particular, by contacting the Controller at iod@warszawianka.pl or by changing the relevant settings in the application, if such functionality is available.
10.5. The profiling described above is used to personalise content and communications. The Controller does not make decisions concerning users based solely on automated processing of personal data, including profiling, which would produce legal effects concerning them or similarly significantly affect them within the meaning of Article 22 of the GDPR.
10.6. This means, in particular, that profiling does not automatically result in a refusal to allow a reservation, refusal to provide hotel services or any other decision producing significant effects for the user. Profiling may, however, result in the user being shown more personalised content, communications, recommendations or offers.
10.7. The Controller does not disclose profiling data to other controllers, except where such disclosure is required or permitted by law or where the user has been separately informed of such disclosure.
11. Transfers of Data Outside the EEA
11.1. Personal data is generally not transferred outside the European Economic Area.
11.2. If it becomes necessary to transfer analytical data or other data outside the European Economic Area in connection with the use of services provided by entities having related entities outside the EEA, the Controller shall apply appropriate mechanisms for legitimising such transfers in accordance with the GDPR, in particular Standard Contractual Clauses or other legally permissible safeguards.
12. Amendments to the Privacy Policy
12.1. The user shall be informed of any material amendment to this Privacy Policy by means of an appropriate notification in the application or by updating the document. The current version of the Privacy Policy is available in the application and on the Controller's website, where it has been made available.