1. Data Controller
The controller of your personal data is JUPICO SP. Z O. O., ul. Grunwaldzka 89, 81-771 Sopot, Poland (VAT no. PL5223025459, KRS: 0000549172), landlord of the rooms in the Green Loft Gdynia building.
Data protection contact: recepcja@greenloft.pl
2. Purposes and legal bases for processing
- Contract performance (Art. 6(1)(b) GDPR) — handling reservations, check-in, providing accommodation and ancillary services
- Legal obligations (Art. 6(1)(c) GDPR) — issuing VAT invoices, maintaining guest registers, tax obligations
- Legitimate interests (Art. 6(1)(f) GDPR) — property security (CCTV), pursuing and defending legal claims, internal statistics
- Consent (Art. 6(1)(a) GDPR) — sending marketing communications, analytical cookies (Google Analytics 4), marketing cookies (Google Ads, including remarketing and conversion measurement) and functional cookies
3. Categories of personal data processed
- Identity data: name, date of birth, ID document number
- Contact data: email address, phone number
- Payment data: card details (pre-authorisation), invoice data
- Stay data: arrival and departure dates, number of guests, room number
- Technical data: IP address, cookies (website)
- Image data: CCTV footage (retained for max. 30 days)
4. Data recipients
Data may be shared with: tenancy management software (contract records and settlements), payment processors (Polcard), IT and marketing service providers (SeoHost; Google Ireland Limited for Google Tag Manager, Google Analytics 4, Google Ads and Google Workspace; Usercentrics for the Cookiebot consent banner; Web3Forms for the rental enquiry form), and public authorities as required by law.
Using Google services may involve a transfer of data to Google LLC in the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses. Apart from those cases, data is not transferred outside the European Economic Area without appropriate safeguards.
5. Retention periods
- Rental contract data — 5 years from the end of the tenancy
- Invoices and accounting documents — 5 years (tax law requirements)
- CCTV footage — 30 days
- Marketing data (newsletter) — until consent is withdrawn
- Claims data — until the limitation period expires (max. 3 years)
6. Your rights
Under GDPR you have the right to:
- access your data and receive a copy
- rectification (correction) of inaccurate data
- erasure of your data ("right to be forgotten")
- restriction of processing
- data portability
- object to processing
- withdraw consent at any time (without affecting prior processing)
- lodge a complaint with the Polish supervisory authority (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl
To exercise any of these rights, write to: recepcja@greenloft.pl. We will respond within 30 days.
7. Voluntary nature of data provision
Providing personal data necessary to conclude a rental contract is voluntary but required to conclude and perform the contract. Failure to provide data prevents the provision of services. Providing data for marketing purposes is voluntary and has no effect on service provision.
8. Automated decision-making
Guest personal data is not subject to automated decision-making, including profiling, that produces legal effects or similarly significantly affects guests.
If you consent to marketing cookies, your activity on the website may be used to show remarketing ads within Google services. This is profiling for marketing purposes only: it does not affect the terms of your rental contract, the amount of rent or any decision taken about you. You can withdraw your consent at any time through the "Cookie settings" link in the website footer.