This Privacy Policy contains information about the processing of your personal data in connection with your use of the website available at: https://balticseason.pl (hereinafter: the website).
- Information about the Controller of your personal data
The controller of personal data is Baltic Season limited liability company with its registered office in Szczecin (70-481), at Al. Wojska Polskiego 81, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court Szczecin-Centrum in Szczecin, 13th Commercial Division of the National Court Register, under KRS number: 0000932526, holding NIP: 8522677668 and REGON: 520645680, hereinafter referred to as the “Personal Data Controller” or the “Company”.
- Contacting the Personal Data Controller
For all matters relating to personal data protection and this Privacy Policy, you may contact the Personal Data Controller as follows:
- by email at: [email protected]
- in writing: Baltic Season sp. z o.o., Al. Wojska Polskiego 81, 70-481 Szczecin
- Data Protection Officer
The Personal Data Controller has appointed a Data Protection Officer, who may be contacted at: [email protected]
- Purposes and legal bases of data processing
Your personal data will be processed for the following purposes
| Purpose of processing | Personal data | Legal basis |
| Making apartment reservations | • full name; • email address; • telephone number; • NIP; • company name; • business address; • check-in date; • number of guests; • other data provided in the form | Article 6(1)(b) GDPR – processing is necessary to enter into and perform a contract and to take steps before entering into it; prevention of abuse |
| Entering into and performing a short-term rental agreement | • full name; • email address; • telephone number; • PESELNIP; • company name; • business address; • check-in date; • number of guests; • other data provided in the registration form | Article 6(1)(b) GDPR – performance of a contract |
| Processing payments, deposits and settlements related to a reservation | • full name; • email address; • NIP; • payment details; • bank account number; • payment information | Article 6(1)(b) GDPR – performance of a contract and compliance with an obligation arising from applicable law under Article 6(1)(c) GDPR |
| Verifying a Guest’s identity during check-in and ensuring the security of the Property | • full name • identity document details; • date of birth; • identity document number | Article 6(1)(f) GDPR – the Controller’s legitimate interest in confirming the identity of the person using the reservation, ensuring the safety of Guests, the Property and the Controller’s assets, and enabling the establishment, pursuit or defence of potential claims related to the stay |
| Issuing invoices, maintaining accounting records and fulfilling tax obligations | • full name; • residential address; • NIP • company name; • registered office; • other data shown on the invoice | Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation imposed on the Controller under income tax legislation |
| Handling complaints and enquiries and communicating in connection with Guest service | • Full name; • Email address; • Data provided in the complaint | Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation imposed on the Company, namely responding to a complaint submitted by a Consumer under consumer rights legislation. Article 6(1)(f) GDPR– processing is necessary for the purposes of the Company’s legitimate interest in responding to a complaint submitted by an entity that is not a Consumer within the meaning of consumer rights legislation. |
| Contact with the Guest and ongoing communication regarding the reservation; | • Full name; • Email address; • Telephone number; • Reservation date • Communication history | Article 6(1)(b) GDPR – performance of a contract and Article 6(1)(f) GDPR – the Controller’s legitimate interest in providing efficient Guest service and communication. |
| Conducting marketing and promotional activities, including sending commercial information and the Newsletter | • Full name, email address; • Telephone number | Article 6(1)(a) GDPR – the data subject’s consent in conjunction with Article 6(1)(f) GDPR – the Controller’s legitimate interest in marketing the Company |
| Publishing reviews, managing stay ratings and contacting Guests after their stay | • Full name; • Email address; • Information about the stay; • reviews | Article 6(1)(f) GDPR – the Controller’s legitimate interest in collecting reviews concerning the quality of the services provided |
| Fulfilling obligations arising from the GDPR | • full name • email address • telephone number • other necessary data | Article 6(1)(c) GDPR – processing constitutes a legal obligation imposed on the Company. Article 6(1)(f) GDPR – processing is necessary for the purposes of the Company’s legitimate interest, which in this case includes, for example, maintaining registers and records and retaining information about persons who exercised rights provided for under the GDPR. |
| Archiving and evidentiary purposes | • full name • email address • telephone number • other necessary data | Article 6(1)(f) GDPR – processing is necessary for the purposes of the Company’s legitimate interest, which in this case is safeguarding information that may be used to demonstrate facts of legal significance. |
| Establishing, pursuing or defending claims | • full name • email address • telephone number • other necessary data | Article 6(1)(f) GDPR – processing is necessary for the purposes of the Company’s legitimate interest, which in this case is protecting the Company’s financial interests. |
| Analysing your activity on the website | • date and time of the website visit • type of web browser used to browse the website • approximate location • IP address • time spent on the website • time spent on individual pages • data collected in cookies • other data collected by Google Analytics | Article 6(1)(f) GDPR processing is necessary for the purposes of the Company’s legitimate interest, which in this case is understanding your activity on the website. |
| Use of cookies other than essential cookies. | • cookies of the website user | Article 6(1)(a) GDPR – personal data is processed on the basis of consent (when you first access the website, you are asked to consent to the use of cookies). |
- Requirement to provide personal data
Providing personal data is voluntary; however, to the extent necessary to make a reservation, enter into and perform an accommodation services agreement and complete the stay, it is a condition for entering into and performing the agreement with the Controller. Failure to provide personal data may prevent, in particular, making and confirming a reservation, completing the stay, making payments or settlements, checking in the Guest and verifying their identity, issuing accounting documents and invoices, communicating in connection with reservation or stay services, and handling complaints or enquiries.
When contacting the Controller, providing identification and contact details is necessary to receive a response and for the proper handling of the enquiry.
Providing data required by law (data necessary for tax settlements) is mandatory to the extent required by those laws.
- Right to withdraw consent
Where personal data is processed on the basis of consent, you may withdraw that consent at any time, at your discretion, by changing your settings. If your personal data was processed on the basis of consent, withdrawing it does not mean that the processing carried out up to that point was unlawful. In other words, we are entitled to process your personal data until consent is withdrawn, and its withdrawal does not affect the lawfulness of processing carried out previously.
- Profiling and automated decision-making
Please be informed that we will not use your data for automated decision-making, including profiling.
- Recipients of personal data
We may disclose your personal data to entities cooperating with the Controller only to the extent necessary to achieve the processing purposes specified in this Privacy Policy. In particular, data may be disclosed to the following categories of recipients:
- Entities providing IT hosting services – to the extent necessary to maintain servers, IT systems and the website;
- Entities providing technical support and maintenance services – where access to data is necessary to remedy a failure or ensure the proper operation of the system;
- Entities providing accounting and tax services – to the extent necessary to fulfil accounting and tax obligations, including preparing tax documentation;
- Entities providing legal services – to the extent necessary to handle complaints, pursue claims, defend against claims or ensure compliance with applicable law;
- Entities providing analytics or marketing services – to the extent resulting from the consent granted (for cookies other than essential cookies).
In addition, there may be situations where, for example, under an applicable legal provision or a decision of a competent authority, we are required to disclose your personal data to other public or private entities. We assure you that every request for disclosure of personal data is reviewed very carefully and thoroughly so that information is not inadvertently disclosed to an unauthorised person.
- Transfers of data to third countries
Please be informed that your data will not be transferred to third countries or international organisations.
- Personal data retention period
In accordance with applicable law, we do not process your personal data “indefinitely”, but only for the period necessary to achieve the specified purpose. After that period, your personal data will be irreversibly deleted or destroyed. The processing periods are described below:
- Making apartment reservations – data will be processed for the period necessary to make and service the reservation and subsequently for the limitation period applicable to claims related to the reservation;
- Entering into and performing a short-term rental agreement and completing the stay – data will be processed for the duration of the agreement and for the limitation period applicable to claims arising from the agreement;
- Processing payments, deposits and settlements related to a reservation – data will be processed for the period necessary to process the payment and for the period required by tax and accounting legislation, generally for five years from the end of the tax year in which the tax obligation arose;
- Verifying a Guest’s identity during check-in and ensuring the security of the Property – data will be processed for the period necessary to achieve the processing purpose and subsequently for the limitation period applicable to claims related to the stay;
- Issuing invoices, maintaining accounting records and fulfilling tax obligations – data will be retained for the period required by tax and accounting law, generally for five years from the end of the tax year in which the tax obligation arose
- Handling complaints and enquiries and communicating in connection with Guest service – data will be processed for the period necessary to handle the enquiry or complaint and subsequently for the limitation period applicable to claims and for the period required by law;
- Contact with the Guest and ongoing communication regarding the reservation – data will be processed for the period necessary to achieve the purpose of the communication or until an effective objection is made;
- Conducting marketing and promotional activities, including sending commercial information and the Newsletter – data will be processed until consent is withdrawn or an effective objection to processing is made;
- Publishing reviews, managing stay ratings and contacting Guests after their stay – data will be processed for the period necessary to achieve the processing purpose or until an effective objection is made;
- Fulfilling obligations arising from the GDPR – data related to personal data protection will be processed until it is no longer useful, until you make an effective objection or until the limitation period for our liability as the Personal Data Controller expires;
- Archiving and evidentiary purposes – data related to archiving and evidentiary purposes will be processed until you make an effective objection or the processing purposes are achieved
- Establishing, pursuing or defending claims – data related to claims will be processed until the claims become time-barred; the limitation period may vary under applicable law;
- Analysing your activity on the website – data related to the analysis of website activity will be processed until you make an effective objection or the processing purposes are achieved
- Use of cookies other than essential cookies – data related to cookies will be processed until consent is withdrawn or the processing purpose is achieved
- Your rights in connection with the processing of personal data
Under the GDPR, you have the right to:
- access your personal data;
- rectify your personal data;
- erase your personal data;
- restrict the processing of your personal data;
- object to the processing of your personal data;
- data portability,
- lodge a complaint with a supervisory authority (if you believe that we are processing data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office or another competent supervisory authority).
As the Personal Data Controller, we respect your rights under personal data protection laws and strive to facilitate their exercise to the greatest extent possible. Please note that the rights listed above are not absolute, and in certain situations we may lawfully refuse to fulfil them. However, we will refuse a request only after careful analysis and only where refusal is necessary.
- Cookies
Like other entities, the Personal Data Controller uses cookies on its website. Cookies are short text files stored on the computer, telephone, tablet or other device of a website user. They may be read by our system and by systems belonging to other entities whose services we use.
We use cookies on the basis of your consent, except where cookies are essential for the proper operation of the website.
Cookies that are not essential for the proper operation of the website remain blocked until you consent to their use. During your first visit to the website, we display a notice asking for your consent and enabling you to manage cookies, including deciding which cookies you accept and which you wish to block.
Cookies perform many functions on the website, including:
- functional cookies – the use of such cookies is necessary for the proper operation of the website; we may place these cookies without your consent,
- creating statistics — cookies are used to analyse how users use the website (how many people open the website, how long they remain on it, which content attracts the greatest interest, etc.). This enables the website to be continually improved and its operation adapted to user preferences. We use Google tools such as Google Analytics to track activity and create statistics;
By default, your web browser permits the use of cookies on your device, which is why we ask for your consent to their use during your first visit. However, if you do not wish cookies to be used while browsing the website, you can change your browser settings to block the automatic handling of cookies entirely or request notification whenever a cookie is placed on your device. You may change these settings at any time.
You can manage cookie settings in your web browser. You can block all or selected cookies, as well as cookies from specific websites. You may also delete previously stored cookies and other website and plug-in data at any time.
Web browsers also offer an incognito mode. You may use it if you do not want information about visited pages and downloaded files to be stored in your browsing and download history. Cookies created in incognito mode are deleted when all incognito windows are closed. Please be aware that disabling or restricting cookies may prevent the use of some features available on our website and may cause difficulties when using this and many other websites that use cookies.
- Types of cookies used
| Name | Description | Retention period | Type |
| _ga | A file used to distinguish unique users by assigning a randomly generated number as a client identifier. It is used to compile visitor, session and campaign data for analytics reports. | Approximately 24 months | Analytics |
| _ga_HKW8TR26KB | A cookie used to track user activity on the website and analyse how visitors use the site, enabling the website to be improved | Approximately 24 months | Analytics |
| _gcl_au | A cookie used to track the effectiveness of advertising campaigns and user conversions on the website | 90 days | Marketing |
| _fbp | An advertising file used to track users visiting websites. Its purpose is to personalise advertisements on Facebook and Instagram and measure the effectiveness of marketing campaigns. | Approximately 3 months | Marketing |
| CookieConsent | A cookie used to store information about the user’s consent to cookies | Approximately one year | Functional |
| pll_language | A cookie used to remember the language version of the website | Approximately 12 months | Functional |
| _Secure-1PAPISID | Customising content for Google Ads and targeting | Approximately 6 months | Google Marketing |
| _Secure-1PSID | Delivering personalised advertisements and retargeting | Approximately 6 months | Google Marketing |
| _Secure-1PSIDCC | Google advertising and retargeting services | Approximately 6 months | Google Marketing |
| _Secure-PSIDTS | Google advertising and retargeting services | Approximately 6 months | Google Marketing |
| _Secure-3PAPISID | Google advertising and retargeting services | Approximately 6 months | Google Marketing |
| _Secure-3PSID | Google advertising and retargeting services | Approximately 6 months | Google Marketing |
| _Secure-3PSIDCC | Google advertising and retargeting services | Approximately 6 months | Google Marketing |
| _Secure-3PSIDTS | Google advertising and retargeting services | Approximately 6 months | Google Marketing |
| _Secure-BUCKET | Google advertising and retargeting services | Approximately 6 months | Google Marketing |
| _Secure-ENID | This file is set by Google and is used to store user preferences and information such as language preferences and personalised search results | Approximately 6 months | Google Marketing |
| _Secure-ROLLOUT | A Google file that assigns the browser to a specific test group | Approximately 6 months | Google Marketing |
| _Secure-YENID | A file used to identify the user’s session | Approximately 13 months | Google Marketing |
| _Secure-YNID | Used to track the user’s interactions with embedded YouTube videos, store video player preferences and provide analytics. | Approximately 6 months | Google Marketing |
| AEC | A Google Analytics cookie that controls data consistency | Approximately 6 months | Google Marketing |
| APISID | A Google marketing cookie | Approximately 6 months | Google Marketing |
| DSID | A tracking cookie used by Google, primarily for advertising purposes. It is one of the key elements used to personalise advertisements and analyse users’ online behaviour | Approximately 2 weeks | Google Marketing |
| HSID | A cookie required by Google to verify the user and ensure account security | Approximately 6 months | Google Security |
| IDE | A cookie used for advertising purposes, including displaying and personalising advertisements and tracking conversions. | Approximately 12 months | Google Marketing |
| LOGIN_INFO | This file is used to maintain the login session by remembering that the user is logged in, avoiding the need to enter a password during every visit. | Approximately 24 months | |
| NID | A cookie used mainly to personalise advertisements and remember user preferences | Approximately 6 months | Google Marketing |
| SAPISID | A cookie that collects information about users within the YouTube service. | Approximately 24 months | Google Marketing |
| SEARCH_SAMESITE | This cookie is used to prevent the browser from sending this cookie with cross-site requests. | Approximately 6 months | Functional |
| SID | Optimising session management by Google Ads by assigning a unique session identifier | Approximately 24 months | |
| SIDCC | Ensuring the identification of trusted network traffic | Approximately one year | Google Security |
| SSID | A Google cookie supporting certain tools and saving preferences such as the number of search results displayed per page | Approximately 24 months | Google Marketing |
| VISITOR_INFO1_LIVE | A file used for analytics and marketing purposes (traffic analysis, remembering preferences and displaying personalised advertisements) | Approximately 6 months | Google Marketing |
| VISITOR_PRIVACY | This file stores information about whether the user has accepted the Privacy Policy or consented to tracking, preventing the cookie banner from being displayed again during every visit. | Approximately 6 months | Google Marketing |
| YSC | The YSC cookie set by YouTube is used to track views of embedded videos on YouTube service pages. It supports security and helps prevent spam, fraud and abuse. This file prevents malicious websites from acting on the user’s behalf without their knowledge | Approximately 6 months | Google marketing |
- Policy updates
We may amend the Privacy Policy, in particular due to technological developments and changes in applicable law. This Privacy Policy is effective from: 27 May 2026.