Privacy Policy and Use of Cookies (Alternative, more formal website/legal wording: **Privacy and Cookies Policy**)

• Information Clause

  Dear Customer,

  In accordance with Article 13(1) and Article 13(2) of the General Data Protection Regulation of 27 April 2016 (GDPR), we hereby inform you that we process your personal data. Detailed information is provided below:

  The controller of your personal data is Fontia Sp. z o.o., address: 1 Maja 1, 28-100 Busko-Zdrój, Poland, tel. +48 41 330 30 33, email: recepcja@bristolbusko.pl

  Recipients of your personal data will only be entities authorized by the controller to obtain personal data, including: the accounting office, hosting provider, IT company, and the company operating the online booking system.

  Your personal data will be stored for the duration of the contract and, after its completion, for a period of 6 years. In the case of data obtained based on consent, the data will be stored until such consent is withdrawn.

  You have the right to access your personal data, rectify it, restrict its processing, transfer your personal data, object to processing, and withdraw your consent (if processing is based on consent).

  You also have the right to lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office.

  Providing personal data is voluntary, but necessary for the provision of services. In the case of personal data processed for direct marketing purposes, providing data is voluntary.

  Your personal data will be processed for the following purposes:

  a. provision of services pursuant to Article 6(1)(b) of the GDPR;

  b. compliance with a legal obligation imposed on the controller, pursuant to Article 6(1)(c) of the GDPR (in connection with the Accounting Act of 29 September 1994, Journal of Laws 1994 No. 121 item 591, and the Tax Ordinance Act of 29 August 1997, Journal of Laws 2018 item 800);

  c. pursuing the legitimate interests of the controller consisting in asserting claims and protecting against claims, pursuant to Article 6(1)(f) of the GDPR;

  d. direct marketing – offering the controller’s own products and services. The legal basis for data processing will be Article 6(1)(a), i.e. the consent of the data subject. If you consent to receiving marketing communications via email, telephone, or SMS, the legal basis will also be Article 10 of the Act of 19 July 2002 on Providing Services by Electronic Means and Article 172 of the Telecommunications Law of 16 July 2004. Your consent may be withdrawn at any time.

  e. verification of the limit of persons staying on the premises pursuant to Article 9(2)(a) of the GDPR in connection with the prevention, counteraction, and combating of COVID-19.

  The controller has appointed a Data Protection Officer, who can be contacted via email at: iod@bristolbusko.pl or by phone at: +48 41 370 58 77.