Privacy policy

Controllers

The joint data controllers are Marzena Makles and Dariusz Makles; correspondence address: ul. Centralna 43A, 05-825 Radonie; contact: kontakt@klonowapark.com. They jointly determine the purposes and means of processing for bookings and stays. Marzena Makles handles day-to-day matters; rights may be exercised against either controller.

Purposes and legal bases

Data is processed to handle enquiries, bookings, payments and accounts - to enter into or perform a contract (Article 6(1)(b) GDPR); to meet legal obligations, including tax obligations (point (c)); and for security and the establishment, exercise or defence of claims as the controllers' legitimate interests (point (f)).

Recipients and transfers

Data may be received, as necessary, by hosting, technical support, email, payment and booking-tool providers, and competent authorities. Stripe handles payments, Beds24 availability, and Cloudflare Email Routing routes incoming email. Stripe and Cloudflare describe possible processing outside the EEA and safeguards, including standard contractual clauses and adequacy decisions. Transfer and safeguard information is available in Stripe documentation and Cloudflare documentation, and through the contact given above.

Retention

Enquiries are retained until the matter is closed; booking and payment data until the stay is settled, and thereafter only to the extent and for the period required by law or necessary to protect legal claims. Account data is retained until the account is closed, while legally required records are preserved. Data no longer needed for its purpose is deleted.

Rights

Rights include access and rectification and, where provided by law, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. Requests may be addressed to either controller. Complaints may be lodged with the President of the Polish Personal Data Protection Office.

Required data

A booking requires a first name, surname and an email address or telephone number; an account requires an email address. Without this information, the relevant function cannot be provided.

Cookies and browser storage

The kp_gosc cookie maintains a session for up to 180 days after renewal. The language setting is stored locally until changed or browser data is cleared. A temporary token in the current tab enables confirmation downloads; it has limited validity and is removed after download or when the tab is closed. During payment, Stripe may use its own technologies described in its cookie policy. Restricting essential storage may affect sign-in or payment.