PL EN Book
Effective from: 2026-10-03

Privacy policy

This policy explains how we process the personal data of guests and site visitors, in line with Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679).

1. Controller

The controller is UR4N.COM spółka z ograniczoną odpowiedzialnością, registered office in Kraków, ul. Stoigniewa 10, 30-572 Kraków, Poland, entered in the National Court Register (KRS) under no. 0001147562, NIP 6793318934, REGON 540578838. Data protection contact: t.j.lichon@gmail.com. We have not appointed a data protection officer.

2. Purposes, legal bases and retention

  • Booking and stay (name, email, phone, dates, number of guests, messages): performance of a contract, Art. 6(1)(b) GDPR. Kept for the stay and then until claims become time-barred (generally 3 years under the Polish Civil Code).
  • Payment and invoicing (payment details, invoice details, tax number): legal obligation, Art. 6(1)(c) GDPR, under tax and accounting law. Kept for 5 years from the end of the year in which the tax obligation arose.
  • Guest registration and safety, where the law requires us to collect guest details: legal obligation, Art. 6(1)(c) GDPR, for the period the law sets.
  • Email enquiries outside a booking: our legitimate interest in replying, Art. 6(1)(f) GDPR, until the matter is closed and at most 1 year.
  • Establishing and defending claims: legitimate interest, Art. 6(1)(f) GDPR, until claims become time-barred.
  • Running and securing the site (IP address and browser type in server logs): legitimate interest, Art. 6(1)(f) GDPR, for the hosting provider's short log retention period.

Giving your data when booking is voluntary, but we can't take the booking or issue an invoice without it.

3. Recipients

We share data only with the companies that help us run the rentals, acting on our behalf or as separate controllers:

  • Hostex: booking and guest messaging system (including the booking calendar on this site),
  • Stripe: card payments; card details go straight to Stripe and we never see them,
  • Airbnb and Booking.com, if you book through them (as separate controllers, under their own policies),
  • iFirma: the accounting and invoicing system we use to issue invoices and keep our books, and our accounting office,
  • Cloudflare: hosting of this site,
  • Google: email, and maps if you choose to load them,
  • public authorities, where the law requires it.

4. Transfers outside the EEA

Some providers (e.g. Stripe, Google, Cloudflare, Hostex) may process data outside the European Economic Area. Such transfers rely on a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission. On request, we'll tell you which safeguards a given provider uses and send you a copy (for example the standard contractual clauses).

5. Cookies and third-party services on this site

This site uses no analytics or marketing cookies and doesn't track visitors. Fonts are served from our own server. Google Maps loads only after you click "Show map"; from then on Google may set its own cookies under its privacy policy. The booking calendar and search load from Hostex's servers, which may use files strictly necessary for booking to work.

6. Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on our legitimate interest. To exercise these rights, email t.j.lichon@gmail.com. You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

We don't make automated decisions about guests or profile them.

7. Changes

If we change how we process data, we'll update this page and the date at the top.