Privacy policy

1.1. The Data Controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “Regulation”), with regard to your personal data, is BookingHost Sp. z o.o., with its registered office in Warsaw, at ul. Nakielska 3, 01-106 Warsaw, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000606096, Tax Identification Number (NIP): 7010556748, REGON: 363905731 (hereinafter the “Data Controller” or “BookingHost”).

1.2. Sales agreements with natural persons conducting business activities, including partners in a civil-law partnership (business customer)

The Data Controller processes the personal data provided by you to the extent necessary for the proper functioning of the Website, in particular as necessary to register an account, place orders, perform the sales agreement, comply with accounting and financial reporting obligations, and pursue claims.

For these purposes, the Data Controller collects personal data such as: first name and surname, company name, address, Tax Identification Number (NIP), telephone number and email address. Data concerning orders placed are also collected.

Providing this personal data is necessary for the performance of the agreement, and the processing thereof is carried out on the basis of Article 6(1)(b) of the Regulation.

1.3. Sales agreements with natural persons who do not conduct business activities (retail customer)

The Data Controller processes the personal data provided by you for the purposes indicated below, on the basis of the legitimate interest of the Data Controller as the owner and operator of the Website (Article 6(1)(f) of the Regulation), which consists in ensuring the proper functioning of the Website, including the handling of electronic payments, handling your requests submitted in accordance with Section 8 of this Privacy Policy, ensuring the security of electronically provided services, and preventing fraud and abuse.

1.4. The Data Controller also collects and processes your personal data for marketing purposes. The processing of personal data for marketing purposes by the Data Controller is carried out only with your consent, on the basis of Article 6(1)(a) of the Regulation.

Providing personal data for marketing purposes is voluntary and depends entirely on the discretion of the data subject, and the processing of such data by the Data Controller is subject to obtaining the data subject’s consent.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. More information on the conditions for granting and withdrawing consent is provided in Section 3 of this Privacy Policy.

The Data Controller may sometimes use automated processes, including profiling, to analyse personal data in order to send you personalised offers and marketing information or to display such offers and information on the Website. Such processing is carried out on the basis of your consent. However, you may opt out of such marketing at any time, including profiling related to such activities.

1.5. The Data Controller also analyses the results of its marketing activities based on user activity on the Website in order to measure the effectiveness and relevance of advertising activities and its pricing policy.

Data concerning your activity on the Website are recorded and stored through cookies. Details concerning the use of cookies can be found in the Cookie Policy.

1.6. Operational website traffic recording

BookingHost uses essential first-party visit and session identifiers to recognize returning visits, diagnose website operation, detect unusual traffic, and connect submitted contact forms with earlier website visits.

For this purpose, we may process IP addresses, basic browser request metadata, visited URLs, page transitions, BookingHost cookie identifiers, Microsoft Clarity cookie identifiers when available, and the email address submitted in a form after successful validation.

Raw operational traffic records are generally retained for up to 12 months, while aggregated website operation records are retained for 24 months.

1.7. The Data Controller stores your personal data only for the period necessary to take steps prior to entering into an agreement, perform the agreement, pursue claims, and comply with the requirements arising from applicable laws, including tax regulations.

In the case of personal data processed for marketing purposes, the Data Controller stores the personal data provided for the period necessary for the purpose of processing or until consent is withdrawn.

After these periods have expired, your personal data will be deleted.

1.8. SMS Data Privacy

To send SMS messages to guests, BookingHost processes your mobile phone number and name, together with reservation details necessary to provide check-in and check-out instructions.

This contact information is obtained through the booking platform used to make your reservation (Booking.com or Airbnb), in accordance with that platform's Terms of Service and Privacy Policy, which permit sharing this data with the property manager/host (BookingHost) for the purpose of fulfilling your reservation.

BookingHost does not sell or share your mobile number or SMS opt-in data with third parties for marketing or promotional purposes. Data is retained only for as long as necessary to provide services related to your stay and to comply with applicable legal and accounting requirements.

For any requests regarding your personal data, please see Section 8 of this Privacy Policy.

2.1. You have the right to obtain confirmation from the Data Controller as to whether your personal data are being processed, the right to request access to such data, and the right to obtain information from the Data Controller concerning the purposes of processing and the categories of personal data processed, information about the recipients or categories of recipients to whom the personal data are disclosed, the planned period of storage of the personal data, the source of the data where they were not collected from the data subject, and information as to whether the Data Controller makes automated decisions concerning the data subject, including decisions based on profiling.

You also have the right to obtain a copy of your personal data.

2.2. You also have the right to request the rectification of personal data, the erasure of personal data, the restriction of processing, the portability of data, and the right to object to processing. These rights may be exercised in the cases specified in the Regulation.

2.2.1.

With regard to a request for rectification of data: where your data are inaccurate or incomplete.

2.2.2.

With regard to a request for erasure of data: where your data are no longer necessary for the purposes for which they were collected by the Data Controller; where you withdraw your consent to the processing of your data; where you object to the processing of your data; where your data are processed unlawfully; where the data must be erased in order to comply with a legal obligation; or where the data were collected in connection with the offering of information society services.

2.2.3.

With regard to a request for restriction of data processing: where your data are inaccurate; where the processing of your data is unlawful but you do not want the data to be erased; where the Data Controller no longer needs your data but you need them to establish, pursue or defend legal claims; or where you have objected to the processing of your data.

2.2.4.

With regard to the right to data portability: where the processing of your data is based on your consent or on an agreement and where such processing is carried out by automated means.

2.2.5.

With regard to the right to object: where the processing of your personal data is carried out on the basis of the Data Controller’s legitimate interest and the objection is justified by reasons relating to your particular situation, as well as where your personal data are processed for the purposes of direct marketing, including profiling.

2.3. You also have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data concerning you infringes the provisions of the Regulation.

2.4. The security procedures implemented by the Data Controller mean that, before exercising your rights, we may request confirmation of your identity.

3.1. Where the Data Controller processes personal data that are not necessary for the provision of a service, providing such data is always voluntary and takes place after you have given your consent to the processing of the data provided.

3.2. Consent is given after becoming familiar with this Privacy Policy by ticking the appropriate checkbox. By doing so, you consent to the collection and processing by the Data Controller of the personal data you provide for the purpose expressly indicated when consent is given.

3.3. You may withdraw your consent at any time in the same manner in which it was given, i.e. by unticking the appropriate checkbox.

You may also withdraw your consent by sending the Data Controller a statement of withdrawal in the manner specified in Section 8 of this Privacy Policy.

3.4. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

4.1. The Data Controller also uses, in part, external service providers who process personal data on behalf of the Data Controller, such as hosting service providers, mail service providers, marketing and email communication system providers, providers of website traffic analysis services, providers analysing the effectiveness of marketing campaigns, providers supporting the functionality of the Account, payment service providers, courier companies, audit firms, insurance companies, and entities involved in the pursuit of claims.

The transfer of data may only serve the purpose of providing their respective services.

The Data Controller uses only the services of entities that provide sufficient guarantees for the protection of the rights of data subjects. The processing of personal data by such entities is carried out on the basis of written agreements concluded with the Data Controller.

Such entities comply with the Data Controller’s instructions and are subject to audits conducted by the Data Controller.

5.1. The Data Controller processes your personal data in accordance with the provisions of the Regulation, including by applying appropriate technical and organisational measures to ensure the security and appropriate confidentiality of personal data, including protection against unauthorised access, unauthorised modification, disclosure or destruction of such data.

5.2. When your personal data are collected as part of account registration and purchases, their transmission takes place via an encrypted SSL connection.

5.3. Protecting your password and computer against unauthorised access is of great importance. After using a shared computer, you should always log out of the Website.

6.1. The processing of personal data of the Owner and the Referred Person as part of the Referral Programme is carried out in accordance with the provisions of the Regulation.

6.2. When providing an individual affiliate link to the Registration Form to a Referred Person, the Owner is obliged to comply with generally applicable laws, including regulations on combating unfair competition, personal data protection regulations (including the Regulation), and regulations concerning the transmission of commercial information.

6.3. The Owner declares that, when sending an individual affiliate link to the Registration Form to the Referred Person, they obtained the personal data of the Referred Person in a manner compliant with generally applicable laws, including the provisions of the Regulation.

6.4. When providing the Owner with an individual affiliate link to the Registration Form, the Data Controller specifies the personal data of the Referred Person that are necessary for the Owner to participate in the Referral Programme.

Providing personal data is voluntary. However, refusal to provide personal data will result in the Owner being unable to participate in the Referral Programme.

6.5. For purposes related to participation in the Referral Programme, the Data Controller will process the following personal data of the Referred Person: the personal data of the Referred Person contained in the Registration Form, in particular: first name and surname, email address and telephone number.

6.6. By using the individual affiliate link provided by the Owner and completing the Registration Form by entering the required data, the Referred Person consents to the processing of the personal data provided for purposes related to the implementation of the Referral Programme and for the purposes specified in Sections 1.2–1.6 of this Privacy Policy.

The wording of the consent is specified in the Registration Form in the appropriate checkbox.

6.7. Consent to the processing of the personal data provided in the Registration Form by the Referred Person is given after becoming familiar with this Privacy Policy by ticking the appropriate checkbox contained in the Registration Form.

6.8. Use of the individual affiliate link provided by the Owner by the Referred Person constitutes acceptance of the invitation from the Owner to complete the Registration Form.

6.9. Complete and error-free completion of the Registration Form accessed through the individual affiliate link provided by the Owner, including providing all personal data contained in the Registration Form and giving consent to the processing of personal data in the wording specified in the Registration Form, is a necessary condition for the Owner’s participation in the Referral Programme and for presenting the BookingHost offer to the Referred Person.

6.10. Failure to provide all personal data required in the Registration Form, incorrect completion of the Registration Form, or failure to give consent to the processing of personal data in the wording specified in the Registration Form will result in the loss of the Owner’s right to participate in the Referral Programme and the inability to present the BookingHost offer to the Referred Person.

6.11. If the Referred Person does not consent to the processing of personal data in the wording specified in the Registration Form and does not submit the BookingHost Registration Form, the personal data of the Referred Person will not be transferred to the Data Controller in any way and will not be processed by the Data Controller.

6.12. The Data Controller stores the personal data provided by the Referred Person through the Registration Form only for the period specified in Section 1.7.

6.13. In matters not regulated in this subsection, the provisions of this Privacy Policy shall apply accordingly to the processing of personal data provided by the Referred Person through the Registration Form.

BookingHost sends SMS text messages to guests who have booked a stay at one of our managed properties through Booking.com, Airbnb, or directly with BookingHost.

These messages provide check-in and check-out instructions, including access codes for electronic locks, and other operational information related to the guest's stay.

Message frequency varies depending on your reservation (typically 1–3 messages per stay). Message and data rates may apply.

These messages are transactional and operational in nature. BookingHost does not send promotional or marketing SMS messages.

You may opt out of future SMS communications at any time by replying STOP to any message.

Reply HELP for assistance, or contact us at reservations@bookinghost.com or +48 22 113 14 14.

All requests, demands, notifications and enquiries concerning the processing of personal data may be submitted by email to: rodo@bookinghost.com

or in writing to:

BookingHost Sp. z o.o. ul. Nakielska 3 01-106 Warsaw Poland