Privacy Policy

Data controller

The controller of your personal data is Łukasz Ryłko, sole proprietor trading as „Łukasz Ryłko - Przewodnik Tatrzański", registered office: Os. Kasprusie 13/5, 34-500 Zakopane, Poland, Polish tax ID (NIP): 7361750140, business registry (REGON): 529530576 (the „Controller"). Contact for all data protection matters: kontakt@tatractive.pl, phone +48 508 710 246. The Controller has not appointed a Data Protection Officer - data protection inquiries are handled directly by the Controller.

Scope of collected data

• Booking (online, as well as made individually, e.g. by phone or e-mail): full name, e-mail, phone, number of participants, optional notes, price and payment status, and organizational information about the date
• Contact form: name, e-mail, phone (optional), message content
• Payments: data processed by the payment operator (currently Stripe) - we do not store payment card data; we receive only the transaction ID and payment status
• Cookies: technical cookies necessary for the website and - only with your consent - analytics and marketing cookies (currently Google tools)
• Ad-performance measurement identifiers: when you make a booking or buy a voucher, we store the analytics client identifier (currently Google Analytics), and for a booking also the ad click identifier (gclid), if present in your browser - to attribute the booking or voucher purchase to a traffic source and account for advertising campaigns
• Tour photos: we may process participants' photos in a private keepsake album based on legitimate interest (section „Private keepsake album"); publication of your image on the website or social media takes place only with your separate consent, given at booking or at the meeting point
• Minor participants: data from the parent's or guardian's written consent - the child's data, the parent's/guardian's contact details, the tour name and date, and health information relevant to safety (§ 15 of the Terms)
• Gift voucher purchase: full name, e-mail, phone (optional), the optional „For whom" and dedication fields, and voucher and payment data (section „Gift vouchers")

Purpose of data processing

• Performance of the guiding service contract (booking, payment, tour-related communication)
• Payment handling and issuance of accounting documents (invoice/receipt)
• Responding to contact form inquiries
• Website traffic analysis (currently Google Analytics 4 - only with consent)
• Personalized advertising and remarketing in advertising tools (currently Google Ads) - only with consent given in the cookie banner
• Pursuing or defending against claims (after the contract ends)
• Ensuring the Participant's safety during the tour - health information provided voluntarily and on your own initiative (the booking „Notes" field, e-mail, or verbally to the Guide), processed as a special category of personal data (Art. 9 GDPR)
• Measuring advertising campaign performance on the Controller's side - attributing bookings and voucher purchases to traffic sources (identifiers described in the „Scope of collected data" section); this is a process separate from personalized advertising and operates independently of cookie consent
• Selling and redeeming gift vouchers and checking the conditions for extending them (sections „Gift vouchers" and „Certificate for extending a voucher")

Legal basis for processing

• Performance of the guiding service contract (booking, payment, tour-related communication) - Art. 6(1)(b) GDPR
• Payment handling and accounting documentation - Art. 6(1)(c) GDPR (legal obligation - tax and accounting regulations)
• Responding to inquiries from the contact form - Art. 6(1)(f) GDPR (legitimate interest - communication with a person interested in the offer)
• Traffic analytics and personalized advertising and remarketing (currently Google Analytics 4 and Google Ads) - Art. 6(1)(a) GDPR (consent given in the cookie banner) and the provisions of the Polish Electronic Communications Law on storing information on end-user devices
• Private keepsake album - Art. 6(1)(f) GDPR (legitimate interest: delivering a record of the performed service); publication of your image on the website and social media - Art. 6(1)(a) GDPR (consent) and Article 81 of the Polish Copyright Act
• Health data - Art. 9(2)(a) GDPR (explicit consent). Providing this information is entirely voluntary and takes place solely on your own initiative, to ensure safety during the tour; you may withdraw the consent at any time by requesting deletion of the health information (kontakt@tatractive.pl). Health information about a minor contained in the parent's or guardian's written consent is processed on the basis of the parent's/guardian's explicit consent (Art. 9(2)(a) GDPR), given in that document
• Pursuing / defending claims - Art. 6(1)(f) GDPR (legitimate interest)
• Measuring advertising campaign performance (identifiers stored when you make a booking or buy a voucher, and purchase information sent to Google Analytics) - Art. 6(1)(f) GDPR (legitimate interest: accounting for and optimizing campaigns); a process separate from personalized advertising, independent of cookie consent
• Gift vouchers - the legal bases for the individual purposes are given in the section „Gift vouchers" (Art. 6(1)(b), (c) and (f) GDPR); certificate for extending a voucher - Art. 9(2)(a) GDPR (explicit consent), section „Certificate for extending a voucher"

Legitimate interests

• responding to inquiries sent via the contact form or e-mail (communication with persons interested in the offer)
• ensuring website security and protection against abuse (bot protection, anomaly monitoring)
• pursuing or defending against claims (after the contract ends, until limitation periods expire)
• measuring advertising campaign performance and attributing bookings and voucher purchases to traffic sources
• preparing a private keepsake album for tour participants (section „Private keepsake album")

Private keepsake album after the tour

• Scope of data: photos of participants from the given trip and the e-mail address provided at booking.
• The album is private - available only via an individual, unguessable link and not indexed by search engines. We do not publish it anywhere publicly.
• We keep the album and photos for up to 365 days from sending, after which they are permanently deleted.
• You may object to the processing or request deletion of the photos at any time - just message kontakt@tatractive.pl and we will remove them promptly.

Gift vouchers

• Buyer - what data. When you buy a voucher we process: the Buyer's full name and e-mail, optionally a phone number, the voucher code, its type, route, number of people or amount, the purchase and expiry dates, the payment status and identifier, and the analytics client identifier (currently Google Analytics, section „Google Analytics 4 and Google Ads"). Payments are handled by the payment operator (currently Stripe) - we do not store card data (section „Scope of collected data"). The phone number is optional - you give it only if you want to, and we use it solely to contact you about this purchase (e.g. when the payment or the voucher needs clarifying); we do not pass it to the payment operator. Giving your name and e-mail is voluntary, but without them we cannot sell the voucher or send you its PDF file; leaving out the phone blocks nothing.
• Buyer - purpose and legal basis. (a) Concluding and performing the voucher sale contract (purchase confirmation, the PDF file and re-sending it, withdrawal from the contract, refunds, contact about the voucher, including by phone if you give a number) - Art. 6(1)(b) GDPR. (b) Settling the sale and keeping accounting records - Art. 6(1)(c) GDPR (tax and accounting law). (c) Establishing or defending claims - Art. 6(1)(f) GDPR (legitimate interest, as in the section „Legitimate interests"). (d) Measuring advertising campaign performance - Art. 6(1)(f) GDPR (section „Google Analytics 4 and Google Ads").
• Buyer - recipients. The data goes to the recipients described in the section „Data recipients": the payment operator (currently Stripe), the website and database hosting providers (currently Vercel and Supabase - database in the EU region), and the communication automation tool and e-mail providers through which we send the purchase confirmation with the PDF file, while purchase information (without your name, e-mail or phone) goes to the analytics and advertising tool provider (currently Google). Messages about a voucher that you send to kontakt@tatractive.pl are read by the Controller and Karolina Gac. Transfers outside the EEA are described in the section „Transfer of data outside the European Economic Area (EEA)".
• Buyer - how long. We keep the purchase data needed for tax settlements until the tax liability becomes time-barred - as a rule 5 years from the end of the year in which the tax payment deadline passed (Art. 70 § 1 and Art. 86 § 1 of the Polish Tax Ordinance), and the data needed to establish or defend claims - for up to 6 years from the end of the contract (section „Data retention period"). The phone number, if given, is kept together with the voucher data on the same terms. After these periods we delete or anonymise the data.
• The „For whom" and dedication fields. These fields are optional. If you enter the recipient's first name (up to 60 characters) and a dedication (up to 250 characters), we print them on the voucher exactly as entered. This means we also process data of the recipient, which we do not receive from them directly - we do not ask for their surname, address, e-mail or phone. Please do not enter sensitive data or unnecessary data of other people in these fields - the name you want to address them by is enough. Purpose: preparing the personalised voucher you ordered. Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller and the Buyer - producing the personalised voucher). We keep the content of these fields together with the voucher data, for as long as the voucher data (point „Buyer - how long"). If you are the recipient: we received your name and the dedication from the Buyer. You may at any time object or request their deletion from our records (kontakt@tatractive.pl) - we will delete them promptly; a PDF file the Buyer has already received stays with the Buyer.
• Voucher holder booking a tour. The voucher is a bearer voucher - we do not check whether the person with the code is the Buyer. When the Holder books a tour with a voucher, we process their data and the participants' data on the same terms as for any booking (sections „Scope of collected data", „Purpose of data processing", „Legal basis for processing" and „Data retention period"). In addition, we record with the booking which voucher paid for it, to settle the voucher's use (Art. 6(1)(b) GDPR).

Certificate for extending a voucher

• What data and why. We ask for a document that confirms only the obstacle and its period - without the diagnosis or other medical data. If the document contains them, cover them before sending. We use it only to check the conditions for the extension.
• Legal basis. Explicit consent of the person the document concerns - Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. You give consent by sending us the document with the extension request; to make it unambiguous, add to your message: „I agree to the use of the health data in this document solely to check the conditions for extending the voucher". Consent is voluntary: without it we cannot check the conditions for the extension under § 4(3) of the Voucher Terms and the voucher expires on its date. This does not affect other grounds for an extension or refund under the Voucher Terms or any of your other matters with us.
• If the document concerns another person. That person sends it, or you attach their consent to using the document for this purpose (§ 13(3) of the Voucher Terms). Before that person gives consent, show them this privacy policy (especially this section) - it tells them who processes their data and why, and what rights they have, including the right to lodge a complaint with the President of the UODO. The consent belongs to that person and only they can withdraw it.
• Who has access and for how long. The document arrives in our mailbox kontakt@tatractive.pl. Access to it is limited to the Controller (Łukasz Ryłko) and Karolina Gac - a guide cooperating with the Controller who answers messages together with him - and, technically, our e-mail provider, which hosts the mailbox. We do not pass the document to anyone else and do not enter it into forms or the booking system. We delete it promptly after checking the conditions for the extension - from the mailbox, including the trash. We keep only the information that the voucher was extended and until when (Art. 6(1)(b) and (f) GDPR - performance of the contract and defence against claims; period as in the point „Buyer - how long" of the section „Gift vouchers").
• Withdrawing consent. You can withdraw it at any time (kontakt@tatractive.pl). Withdrawal does not affect the lawfulness of processing before it. If you withdraw consent before we check the document, we will delete it unchecked - in that case we cannot grant the extension for illness or an accident.

Data retention period

• Booking and payment data - 5 years from the end of the year in which the accounting document was issued (Art. 86 § 1 of the Polish Tax Ordinance, Art. 74(2) of the Accounting Act)
• Data for pursuing / defending claims - up to 6 years after the contract ends (the general limitation period under Art. 118 of the Polish Civil Code; a trader's claims connected with business activity become time-barred after 3 years, while a consumer's claims against a trader - as a rule after 6 years)
• Contact form data - up to 30 days after the correspondence ends (unless a contract was concluded - then contractual periods apply)
• Google Analytics 4 data - up to 14 months (GA4 default setting)
• Cookies - according to the lifetime of the specific cookie listed in the „Cookies" section
• Image - publication on the website or social media - until consent is withdrawn (photos are removed from publication within 14 days of the request)
• Photos in the private keepsake album - up to 365 days from sending the album, after which they are permanently deleted (section „Private keepsake album")
• Health data from the booking „Notes" field - no longer than the booking itself (point 1), but it is not used further after the tour ends, and upon withdrawal of consent or on request we remove it from the booking promptly; information given verbally to the Guide is not recorded
• Voucher purchase data - until the tax liability becomes time-barred and for up to 6 years for claims (section „Gift vouchers"); certificate for extending a voucher - deleted promptly after checking (section „Certificate for extending a voucher")

Your rights

• Access your personal data (Art. 15 GDPR)
• Rectify (correct) your data (Art. 16 GDPR)
• Delete your data - „right to be forgotten" (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent at any time - without affecting the lawfulness of processing based on consent before its withdrawal. Cookie consent can be withdrawn via the „Manage cookies" link in the footer. Image or other category consent can be withdrawn by e-mail to the Controller.
• Lodge a complaint with the supervisory authority - President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl

Requirement to provide data

Providing personal data in the booking form is voluntary, but necessary to conclude and perform the guiding service contract. Failure to provide required data (full name, e-mail, phone, number of participants) prevents booking. The „Notes" field is optional - you may voluntarily disclose there health circumstances relevant to safety (§ 14 of the Terms); their absence may, however, make it harder to assess the safety of your participation. Providing data in the contact form is voluntary - without it the Controller cannot respond to your inquiry.

Automated decision-making and profiling

The Controller does not make decisions about users based solely on automated processing, including profiling, that produce legal effects on them or similarly significantly affect them (Art. 22 GDPR). Google Analytics and Google Ads use profiling techniques for analytics and advertising, but the Controller does not use their output to make individual decisions about specific users.

Data recipients

• Payment operator (currently: Stripe Payments Europe Ltd., Ireland, and Stripe Inc., USA) - online payment processing, PCI DSS certified
• Database hosting provider (currently: Supabase Inc.; data storage region: EU, Frankfurt) - storage of booking data and website content
• Website hosting provider (currently: Vercel Inc., USA) - operation of www.tatractive.pl
• Analytics and advertising tool providers (currently: Google LLC, USA - Google Analytics 4, Google Ads) - only with your consent; the exception is information about a paid booking or voucher, sent independently of consent (section „Google Analytics 4 and Google Ads")
• Communication automation tools and e-mail/SMS service providers (currently: a self-hosted n8n automation tool and external e-mail and SMS gateway providers) - sending booking confirmations, reminders, organizational notifications, album links and gift voucher purchase confirmations with the PDF file; only the data necessary to handle a given message is transferred (full name, e-mail, phone, booking details, including the content of the „Notes" field; for a voucher: the Buyer's full name and e-mail, the voucher code and details, and in the PDF file also the content of the „For whom" and dedication fields)
• E-mail delivery provider (currently: Plus Five Five, Inc., USA - the Resend service) - sends the e-mails related to your booking or voucher: confirmations, pre-tour reminders and payment notifications. It processes your e-mail address, full name, and the content and attachments of the e-mail (e.g. a confirmation or voucher as a PDF file). The e-mails are sent from servers in Ireland, and data about sent messages and sending logs is stored in the USA.
• The guide leading the tour (currently: Karolina Gac, a licensed Class III Tatra mountain guide cooperating with the Controller) - the data necessary to conduct the tour; in addition, Karolina Gac has access to our mailbox kontakt@tatractive.pl and answers messages together with the Controller (including about vouchers)
• The provider of the tour group messenger and social media services (currently: Meta Platforms Inc., USA - WhatsApp, Instagram, Facebook) - only if you join the tour communication group (§ 29 of the Terms) or consent to publication of your image on social media
• Rescue services (TOPR, Horská záchranná služba) - solely in life- or health-threatening emergencies (transmission of information necessary for the rescue operation)
• Public authorities - only at the request of authorized authorities (tax office, court, prosecutor, police) under applicable law

Transfer of data outside the European Economic Area (EEA)

• payment operator (currently Stripe Inc., USA)
• website hosting provider (currently Vercel Inc., USA)
• analytics and advertising tool provider (currently Google LLC, USA)
• messenger and social media provider (currently Meta Platforms Inc., USA)
• e-mail delivery provider (currently Plus Five Five, Inc., USA - the Resend service) - transfer basis: certification under the EU-US Data Privacy Framework and the Standard Contractual Clauses (SCC) in the data processing agreement with Resend

Google Analytics 4 and Google Ads

Google Analytics 4 collects data on how you use the website (pages viewed, time spent, device type, approximate location based on IP address - the IP is not stored). Although Google declares that the IP is not recorded, GA4 data may contain identifiers allowing indirect identification of the user, so it is processed as personal data based on consent (Art. 6(1)(a) GDPR). We use the Google Consent Mode v2 mechanism - by default all consents (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to „denied" and Google collects no data until you give explicit consent in the cookie banner. Separate from this mechanism is conversion measurement on the Controller's side: when you make a booking or buy a voucher, we may store the GA client identifier, and for a booking also the ad click identifier (gclid), if present in the browser. After a booking or voucher is paid, we send Google Analytics information about the purchase: the transaction number, the amount, the type and number of services bought, the GA client identifier (or a random identifier if there is none) and - if present - the GA session identifier. We do not send your name, e-mail or phone number. Both rely on legitimate interest (Art. 6(1)(f) GDPR), independently of cookie consent, solely to attribute the purchase to a traffic source and measure campaign performance (see the „Scope of collected data" section). This data is not used for ad personalization.

Cookies - categories and consent management

We use three categories of cookies: (1) necessary - required for the site to function (language preference, booking session, CSRF protection), no consent required; (2) analytics - help us understand how you use the site, require your consent; (3) marketing - remarketing and ad performance measurement, require your consent. Analytics and marketing cookies are enabled only after your consent expressed in the banner (Art. 6(1)(a) GDPR and the provisions of the Polish Electronic Communications Law on storing and accessing information on end-user devices). You can withdraw or change your consent at any time via the „Manage cookies" link in the footer, or manage cookies in your browser settings.

Detailed list of cookies

The list is updated as changes occur. You can check the cookies actually active at any given time in your browser settings.

Newsletter and marketing communication

Apart from the voluntary tour communication group described in § 29 of the Terms, the Controller does not currently run a newsletter, mailing list, or other regular marketing communication. Contact details provided to conclude the contract (e-mail, phone) are not used to send commercial offers without separate consent. If you join the communication group and give separate consent to receiving commercial information, we may send there information about future tours, discount codes, and news - you can withdraw the consent at any time by leaving the group or writing to kontakt@tatractive.pl. If a newsletter is launched in the future, using it will require separate, voluntary, and express consent (a separate checkbox), in accordance with Art. 6(1)(a) GDPR and Art. 10 of the Polish Act on Providing Services by Electronic Means.