Website privacy policy

On 25 May 2018 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (known as the “GDPR” or the “General Data Protection Regulation”), came into force. We would therefore like to inform you about the processing of your data and the rules under which it takes place.

This privacy policy applies to the website sunrise-sarbinowo.pl.

We are talking about personal data entered by you in forms and collected while you use our website, including data stored in cookies.

The controller of your data is P.P.H.U. BIX Beata Misztal, Rybitwy 10/4, 88-170 Pakość, Poland, tax ID (NIP) 556-207-50-69, tel. +48 510 050 908, e-mail: kontakt@sunrise-sarbinowo.pl.

We process your personal data in order to: a) enable you to contact us through forms; b) provide you with greater security of services, detect bots, fraud and abuse, and take measurements that allow us to create better services, more tailored to you.

Data is disclosed to external entities only within the limits permitted by law.

User data may be transferred outside the European Union — to third countries. Because the Controller uses external providers of various services, e.g. Facebook and its subsidiaries, Google, Microsoft, Apple etc., user data may be transferred to the United States of America (USA) in connection with its storage on US servers (in whole or in part). Google and Facebook apply the compliance mechanisms provided for by the GDPR (e.g. certifications) or standard contractual clauses in relation to their services.

Data will be transferred only to recipients who guarantee the highest protection and security of data, including by: a) cooperating with processors in countries for which an appropriate European Commission adequacy decision has been issued; b) applying standard contractual clauses issued by the European Commission (as is the case, for example, with Google); c) applying binding corporate rules approved by the competent supervisory authority; d) or to those to whom the user has consented to the transfer of personal data.

Detailed information is available in the privacy policies of each of these service providers on their websites, e.g. Apple: apple.com/legal/privacy, Google LLC: policies.google.com/privacy, Meta Platforms Ireland Ltd.: facebook.com/privacy/policy. Currently the services offered by Google and Facebook are mainly provided by entities located in the European Union. However, you should always read the privacy policy of these providers for up-to-date information on data protection.

Personal data is processed in accordance with applicable law: for purpose a) on the basis of Art. 6(1)(a) of the General Data Protection Regulation of 27 April 2016 (the data subject has given consent to the processing of their personal data for one or more specific purposes); for purpose b) on the basis of Art. 6(1)(f) of the General Data Protection Regulation of 27 April 2016 (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child).

In the event of a personal data breach, the competent authorities are notified in accordance with applicable law.

We process your personal data for as long as necessary to achieve the intended purpose or until you withdraw your consent.

To protect your personal data we have implemented a Personal Data Protection Policy compliant with the GDPR, applied in our company according to the following rules and standards.

Rule of adequacy — we process only the data necessary to achieve the given purpose of processing.

Rule of transparency — you should know exactly what happens to your data. This document, in which we try to give you full information about the rules under which we process your personal data, is an expression of that.

Rule of accuracy — we try to keep your personal data in our systems up to date and correct. If you find that in some area your personal data has not been updated by us or is incorrect, please contact us: tel. +48 510 050 908, e-mail kontakt@sunrise-sarbinowo.pl.

Rule of integrity and confidentiality — we apply the necessary measures to protect the confidentiality and integrity of your personal data. We improve them all the time, along with the changing environment and technological progress. The safeguards include physical and technological measures restricting access to your data, as well as appropriate measures protecting against the loss of your data.

Rule of accountability — we want to be able to account for every action we take on personal data, so that at your request we can give you full and reliable information about what we did with your data.

Data protection law gives you a number of rights that you may exercise at any time. As long as you do not abuse these rights (e.g. by unjustified daily requests for information), exercising them is free of charge for you and should be easy.

Right of access to your personal data — you may ask us to export the information we hold about you from our databases and send it to you in one of the commonly used formats.

Right to rectification — if you learn that the data we process is incorrect, you have the right to ask us to correct it and we will be obliged to do so. In that case we may ask you to present a document or other evidence of the change.

Right to restriction of processing — if, despite our compliance with the rule of adequacy, you consider that for a given process we are processing too broad a range of your personal data, you have the right to demand that we limit the scope of processing. As long as your request does not conflict with the requirements imposed on us by applicable law or make it impossible to perform the contract, we will comply.

Right to erasure — also known as the right to be forgotten, this is your right to demand that we delete from our database systems and our documentation all information containing your personal data. Please remember that we will not be able to do so if we are legally obliged to process your data.

Right to data portability — under the General Data Protection Regulation you may ask us to export the data you provided in the course of all our contacts and cooperation to a separate file, for transfer to another data controller.

You may exercise the rights described above by contacting us: tel. +48 510 050 908, e-mail kontakt@sunrise-sarbinowo.pl. You may also contact us at these details whenever any of our actions raises your concern that it may infringe your rights or freedoms.

If you consider that we have in any way breached the rules of processing your personal data, you have the right to lodge a complaint directly with the supervisory authority — the President of the Personal Data Protection Office (UODO). When exercising this right you should give a full description of the situation and indicate which action you consider to infringe your rights or freedoms. The complaint should be lodged directly with the supervisory authority at: ul. Stawki 2, 00-193 Warsaw, Poland.

Right to object — you also have the right to object to the processing of your personal data. You lodge an objection when you do not want us to process your personal data for a specific purpose. In that case we will continue to process your data for other processes (other purposes), but no longer for the purpose you objected to, unless your request conflicts with obligations imposed on us by law. You may lodge an objection at: tel. +48 510 050 908, e-mail kontakt@sunrise-sarbinowo.pl.

The website collects information about users and their behaviour in the following ways.

1. Information in forms. The website collects information provided voluntarily by the user. The website may also record connection parameters (timestamp, IP address). Data in forms is not shared with third parties other than with the user's consent. Data provided in a form is processed for the purpose resulting from the function of that form, e.g. to contact us. Data provided in forms may be passed to entities technically performing some of our services.

2. Cookies and browser storage. The website stores in your browser only the information it needs to work (list in the section “Cookies — list and changing your consent”). We use no statistics or advertising tools on the website itself. Google Analytics and Google Ads run only in the Hotres booking calendar on the Booking page and load only after you consent.

3. Server logs. Information about some user behaviour is logged at the server level. This data is used solely to administer the website and to ensure the most efficient hosting service. Browsed resources are identified by URL. The following may also be recorded: the time the request arrived, the time the response was sent, the name of the client station — identified via the HTTP protocol, information about errors that occurred during the HTTP transaction, the URL of the page previously visited by the user (referer link) — where the website was reached via a link, information about the user's browser, information about the IP address. This data is not linked to specific persons browsing the pages and is used only for server administration purposes.

Cookies are small files saved by your browser. We treat data saved in browser storage (localStorage, sessionStorage) the same way. Below is every such entry: its name, who saves it, why and for how long. This section takes precedence over earlier mentions of measurement and cookies in this policy.

Essential (no consent needed, Article 399(3) of the Polish Electronic Communications Law): a) sunrise_zgoda (cookie, our website) — your cookie choice: settings version, decision and date; 6 months, then we ask again; b) lucy-session-sunrise (sessionStorage) — identifier of your conversation with the LUCY chat; created when you send the first message and removed when you close the tab; c) lucy-nudge-shown (sessionStorage) — notes that the LUCY prompt bubble has already been shown, so that it does not appear on every page; holds only the value “1”, never leaves your device and is removed when you close the tab; d) PHPSESSID (cookie, booking.hotres.pl) — session of the Hotres booking system (dates, basket); only in the loaded calendar, until you close the browser.

Statistics and advertising in the Hotres calendar (only with consent — Article 399(1) of the Polish Electronic Communications Law and Article 6(1)(a) GDPR): the Hotres booking calendar loads the resort's Google tag (Google Analytics linked with Google Ads). It stores, among others, _ga (distinguishing visitors, 2 years), _ga_RVHR3Z2RD1 (Google Analytics session state, 2 years), _gcl_au (linking visits with Google Ads, 90 days), _gcl_ls (the same in browser localStorage; its data is valid for approx. 90 days) and test_cookie on doubleclick.net (checking whether the browser accepts cookies, 15 minutes). Depending on the browser, some of them may not be stored. It also sends Google a page-view signal for remarketing lists. Recipients: Google Ireland Limited and Google LLC (USA, EU-US Data Privacy Framework).

How to change your consent: the “Cookie settings” link in the footer of every page. Withdrawal immediately switches off the Hotres calendar on our website, including in other open tabs; close any calendar opened directly in a new window. Files saved earlier by Google can be removed in your browser settings by clearing the data of this website and of booking.hotres.pl and doubleclick.net. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Without storing anything in your browser: we fetch the weather forecast from Open-Meteo, the map from OpenStreetMap and the chat widget from the Lange Software Solutions server; the Hotres calendar loads fonts from Google Fonts and scripts from jsDelivr. These services see your IP address and standard technical request information.

Online bookings on the website are handled by the Hotres system (Hotres sp. z o.o.), acting as a processor on behalf of the Controller — the data entered in the booking form (name, e-mail, phone number, number of guests, dates) is used to conclude and perform the accommodation contract (Art. 6(1)(b) GDPR).

The chat on the website (the LUCY virtual receptionist) runs on the Lange Software Solutions platform (Edinburgh, United Kingdom — a country covered by a European Commission adequacy decision), which uses language models as a tool to generate replies; the content of conversations is used solely to handle your enquiry (Art. 6(1)(f) GDPR) and is not used to train models. The website also fetches the weather forecast from Open-Meteo and the map from OpenStreetMap — these services see the IP address and standard technical request information (e.g. browser type).

This part supplements the earlier chapters of the policy and describes how the current website works. Where anything in the earlier chapters conflicts with it, this part prevails.

Recipients of data. Personal data related to the use of the website may be received by: a) Lange Software Solutions (Edinburgh, United Kingdom) — the provider of the website and the LUCY chat, processing data on behalf of the Controller under a data processing agreement; b) Vercel Inc. — hosting of the website and the chat; server logs (including IP address, the page visited, time, browser type) are kept for up to 30 days; servers in the EU and the USA; c) Supabase Inc. — the chat database, servers in the EU; d) Anthropic PBC — the language model that prepares LUCY's replies and conversation summaries; USA; Anthropic does not train models on the content of conversations; e) Hotres sp. z o.o. — the booking engine embedded on the booking page, processing data on behalf of the Controller: the booking form and the newsletter sign-up, if you use it; f) Google Ireland Limited and Google LLC — Google Analytics and Google Ads in the Hotres booking calendar; they run only after you consent and store cookies in your browser (list in the section “Cookies — list and changing your consent”); g) Open-Meteo (weather forecast) and OpenStreetMap (directions map) — they receive only the IP address and standard technical request information needed to display the weather and the map; h) Resend, Inc. — sending the e-mails through which the property receives contact details and questions left in the chat; USA.

Transfers outside the European Economic Area. Data may be transferred to the United Kingdom, for which the European Commission has issued an adequacy decision, and to the USA (Vercel, Anthropic, Google, Resend). Transfers to the USA are based on standard contractual clauses approved by the European Commission (SCC) or on the adequacy decision for organisations certified under the EU-US Data Privacy Framework (DPF).

Conversations with LUCY. We store the content of a chat conversation together with the time of the messages, the IP address and information about your browser (user-agent). Conversations are kept for 365 days, then marked for deletion and permanently deleted after a further 30 days (this period allows a conversation to be restored if it is needed for a matter). Conversation data is used to handle your enquiry and to keep the service secure (Art. 6(1)(f) GDPR) and, when you ask about a booking, also to take steps prior to entering into a contract (Art. 6(1)(b) GDPR). Please do not share in the chat data that is not needed for a reply, e.g. an identity document number or payment card details. The chat stores in your browser the identifier of the current conversation (sessionStorage; created after the first message and removed when you close the tab) and a note that the prompt bubble has already been shown (sessionStorage). If you leave contact details (name, phone, e-mail) or a question for the property in the chat, we pass them to the property by e-mail so that it can reply. We keep this data for as long as needed to handle the enquiry and, if a booking follows, in the same way as the booking data described above. You can ask for it to be deleted at any time.

Dictating messages. The microphone button uses the speech recognition built into your browser. It works only when you click it and allow the browser to use the microphone. The recording is processed by the browser provider under its own terms (e.g. Google in Chrome, Apple in Safari) — neither the Controller nor Lange Software Solutions receives the recording. The recognised text is placed in the message field and sent to LUCY like a normal message.