Privacy Policy

1. Scope and nature of the website

This Privacy Policy applies exclusively to https://grandsal.polturizm.eu/, an independent informational presentation operating within the international POLTURIZM network.

The official Grand Sal Hotel website is https://grandsal.com/. The Privacy Policy of the official hotel website is not the Privacy Policy of this presentation.

2. Data controller

The controller of personal data processed in connection with the technical operation of grandsal.polturizm.eu is:

AKTRU Sp. z o.o. acts as controller in relation to the technical operation of this presentation, the consent mechanism and the optional analytics described in section 6. It is not the controller of data processed by Grand Sal Hotel, its reservation systems or any third-party services accessed after leaving this domain.

For matters concerning privacy or the exercise of rights related to data processing, contact AKTRU Sp. z o.o. using the details above.

3. Data that may be processed

The website does not provide user registration, user accounts, payment systems or a contact form collecting data directly within this domain.

When the website is used, basic technical data may be recorded automatically in server logs, including:

• the IP address of the device,
• the date and time of the connection,
• the address of the requested resource,
• the server response code,
• browser type, operating system and device information,
• the referring page address, if provided by the browser.

This data is technical in nature and is required to ensure security, proper website operation and diagnosis of possible errors.

4. Purposes and legal grounds for processing

Technical data may be processed for the following purposes:

• ensuring proper display and availability of the website,
• maintaining infrastructure security and preventing abuse,
• diagnosing technical errors and security incidents,
• establishing, pursuing or defending legal claims.

The legal basis for processing is the controller’s legitimate interest in maintaining, protecting and properly operating the website, pursuant to Article 6(1)(f) of the GDPR.

5. Cookies and browser storage

The website may use cookies or browser storage mechanisms required for basic technical functions, security and recording the visitor’s optional analytics decision.

Google Analytics 4 cookies are enabled only after analytics is explicitly accepted. Rejecting analytics does not affect the website. The decision can be changed at any time through “Cookie settings” in the footer; after consent is withdrawn, GA4 cookies accessible to the website are removed.

The website does not use advertising or remarketing cookies. Users may also manage cookies through their browser settings.

6. Optional analytics

After consent, the website enables Google Analytics 4 (measurement ID G-YCVTW3CRLC), managed by AKTRU, solely for aggregated traffic and user-acquisition statistics. The legal basis for this processing is the user’s consent under Article 6(1)(a) of the GDPR.

We do not use Google Tag Manager, Google Ads, remarketing, Google Signals, User ID or cross-domain tracking, and we do not send form data to analytics. Before consent, the GA4 script is not fetched, analytics requests are not sent and analytics cookies are not set.

7. Recipients of data

Technical data may be accessed by entities supporting the controller in maintaining the website, in particular hosting, server infrastructure, technical-support and security providers, and only to the extent necessary to perform the tasks entrusted to them. After consent, Google is also a recipient of analytics data as the Google Analytics 4 service provider, under the terms applicable to that service.

After consent, analytics data may be transferred outside the European Economic Area, including to the United States, in connection with the operation of Google Analytics 4. Google states that, depending on the circumstances, it applies appropriate transfer mechanisms, including the EU–US Data Privacy Framework and the standard contractual clauses approved by the European Commission.

Data may also be disclosed to authorised public authorities where such disclosure is required by law.

8. Links to external websites

The presentation contains links to external websites, including the official Grand Sal Hotel website, social-media services, Tripadvisor and Google Maps.

After visiting an external website, the privacy rules determined by its operator apply. The controller of grandsal.polturizm.eu is not responsible for the privacy policies or tracking mechanisms used by third parties after the user leaves this domain.

9. Data retention period

Technical logs are retained for the period necessary to ensure website security, stability and diagnostics, and are then deleted, anonymised or overwritten in accordance with the rules applied by the controller and the infrastructure provider.

Analytics data collected in Google Analytics 4 is retained for a period of 2 months from collection, in accordance with the data-retention settings applied to the property, after which it is deleted by the service. Aggregated statistical reports are not affected by this setting.

Data relating to security incidents or legal claims may be retained for the period necessary to investigate the incident or until the relevant limitation periods expire.

10. User rights

To the extent provided for by the GDPR, users may have the right to:

• access their data and obtain a copy,
• rectify their data,
• erase their data,
• restrict processing,
• object to processing based on legitimate interests,
• data portability, where the statutory conditions for this right apply,
• withdraw consent at any time where data is processed on the basis of consent.

Users also have the right to lodge a complaint with the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO) in Poland if they believe that the processing of their data infringes applicable law.

11. Security

The controller applies appropriate technical and organisational measures to protect the website and technical data, including encrypted HTTPS connections, software updates, access controls and server-infrastructure safeguards.

12. Changes to this Privacy Policy

This Privacy Policy may be updated in response to legal, technological, functional or organisational changes, in particular before new analytical or marketing tools are activated.

The current version of this document is always published at: https://grandsal.polturizm.eu/privacy-policy.html.

In the event of any discrepancy between language versions of this document, the Polish version prevails.