Privacy Policy

Data controller

The controller of your personal data is Łukasz Ryłko, sole proprietor trading as „Łukasz Ryłko - Przewodnik Tatrzański", registered office: Os. Kasprusie 13/5, 34-500 Zakopane, Poland, Polish tax ID (NIP): 7361750140, business registry (REGON): 529530576 (the „Controller"). Contact for all data protection matters: kontakt@tatractive.pl, phone +48 508 710 246. The Controller has not appointed a Data Protection Officer - data protection inquiries are handled directly by the Controller.

Scope of collected data

• Booking (online, as well as made individually, e.g. by phone or e-mail): full name, e-mail, phone, number of participants, optional notes, price and payment status, and organizational information about the date
• Contact form: name, e-mail, phone (optional), message content
• Payments: data processed by the payment operator (currently Stripe) - we do not store payment card data; we receive only the transaction ID and payment status
• Cookies: technical cookies necessary for the website and - only with your consent - analytics and marketing cookies (currently Google tools)
• Ad-performance measurement identifiers: when a booking is placed, we store with it the ad click identifier (gclid) and the analytics client identifier (currently Google Analytics), if present in your browser - to attribute the booking to a traffic source and account for advertising campaigns
• Tour photos: we may process participants' photos in a private keepsake album based on legitimate interest (section „Private keepsake album"); publication of your image on the website or social media takes place only with your separate consent, given at booking or at the meeting point
• Minor participants: data from the parent's or guardian's written consent - the child's data, the parent's/guardian's contact details, the tour name and date, and health information relevant to safety (§ 15 of the Terms)

Purpose of data processing

• Performance of the guiding service contract (booking, payment, tour-related communication)
• Payment handling and issuance of accounting documents (invoice/receipt)
• Responding to contact form inquiries
• Website traffic analysis (currently Google Analytics 4 - only with consent)
• Personalized advertising and remarketing in advertising tools (currently Google Ads) - only with consent given in the cookie banner
• Pursuing or defending against claims (after the contract ends)
• Ensuring the Participant's safety during the tour - health information provided voluntarily and on your own initiative (the booking „Notes" field, e-mail, or verbally to the Guide), processed as a special category of personal data (Art. 9 GDPR)
• Measuring advertising campaign performance on the Controller's side - attributing bookings to traffic sources (identifiers described in the „Scope of collected data" section); this is a process separate from personalized advertising and operates independently of cookie consent

Legal basis for processing

• Performance of the guiding service contract (booking, payment, tour-related communication) - Art. 6(1)(b) GDPR
• Payment handling and accounting documentation - Art. 6(1)(c) GDPR (legal obligation - tax and accounting regulations)
• Responding to inquiries from the contact form - Art. 6(1)(f) GDPR (legitimate interest - communication with a person interested in the offer)
• Traffic analytics and personalized advertising and remarketing (currently Google Analytics 4 and Google Ads) - Art. 6(1)(a) GDPR (consent given in the cookie banner) and the provisions of the Polish Electronic Communications Law on storing information on end-user devices
• Private keepsake album - Art. 6(1)(f) GDPR (legitimate interest: delivering a record of the performed service); publication of your image on the website and social media - Art. 6(1)(a) GDPR (consent) and Article 81 of the Polish Copyright Act
• Health data - Art. 9(2)(a) GDPR (explicit consent). Providing this information is entirely voluntary and takes place solely on your own initiative, to ensure safety during the tour; you may withdraw the consent at any time by requesting deletion of the health information (kontakt@tatractive.pl). Health information about a minor contained in the parent's or guardian's written consent is processed on the basis of the parent's/guardian's explicit consent (Art. 9(2)(a) GDPR), given in that document
• Pursuing / defending claims - Art. 6(1)(f) GDPR (legitimate interest)
• Measuring advertising campaign performance (identifiers stored with the booking) - Art. 6(1)(f) GDPR (legitimate interest: accounting for and optimizing campaigns); a process separate from personalized advertising, independent of cookie consent

Legitimate interests

• responding to inquiries sent via the contact form or e-mail (communication with persons interested in the offer)
• ensuring website security and protection against abuse (bot protection, anomaly monitoring)
• pursuing or defending against claims (after the contract ends, until limitation periods expire)
• measuring advertising campaign performance and attributing bookings to traffic sources
• preparing a private keepsake album for tour participants (section „Private keepsake album")

Private keepsake album after the tour

• Scope of data: photos of participants from the given trip and the e-mail address provided at booking.
• The album is private - available only via an individual, unguessable link and not indexed by search engines. We do not publish it anywhere publicly.
• We keep the album and photos for up to 365 days from sending, after which they are permanently deleted.
• You may object to the processing or request deletion of the photos at any time - just message kontakt@tatractive.pl and we will remove them promptly.

Data retention period

• Booking and payment data - 5 years from the end of the year in which the accounting document was issued (Art. 86 § 1 of the Polish Tax Ordinance, Art. 74(2) of the Accounting Act)
• Data for pursuing / defending claims - up to 6 years after the contract ends (the general limitation period under Art. 118 of the Polish Civil Code; a trader's claims connected with business activity become time-barred after 3 years, while a consumer's claims against a trader - as a rule after 6 years)
• Contact form data - up to 30 days after the correspondence ends (unless a contract was concluded - then contractual periods apply)
• Google Analytics 4 data - up to 14 months (GA4 default setting)
• Cookies - according to the lifetime of the specific cookie listed in the „Cookies" section
• Image - publication on the website or social media - until consent is withdrawn (photos are removed from publication within 14 days of the request)
• Photos in the private keepsake album - up to 365 days from sending the album, after which they are permanently deleted (section „Private keepsake album")
• Health data from the booking „Notes" field - no longer than the booking itself (point 1), but it is not used further after the tour ends, and upon withdrawal of consent or on request we remove it from the booking promptly; information given verbally to the Guide is not recorded

Your rights

• Access your personal data (Art. 15 GDPR)
• Rectify (correct) your data (Art. 16 GDPR)
• Delete your data - „right to be forgotten" (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent at any time - without affecting the lawfulness of processing based on consent before its withdrawal. Cookie consent can be withdrawn via the „Manage cookies" link in the footer. Image or other category consent can be withdrawn by e-mail to the Controller.
• Lodge a complaint with the supervisory authority - President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl

Requirement to provide data

Providing personal data in the booking form is voluntary, but necessary to conclude and perform the guiding service contract. Failure to provide required data (full name, e-mail, phone, number of participants) prevents booking. The „Notes" field is optional - you may voluntarily disclose there health circumstances relevant to safety (§ 14 of the Terms); their absence may, however, make it harder to assess the safety of your participation. Providing data in the contact form is voluntary - without it the Controller cannot respond to your inquiry.

Automated decision-making and profiling

The Controller does not make decisions about users based solely on automated processing, including profiling, that produce legal effects on them or similarly significantly affect them (Art. 22 GDPR). Google Analytics and Google Ads use profiling techniques for analytics and advertising, but the Controller does not use their output to make individual decisions about specific users.

Data recipients

• Payment operator (currently: Stripe Payments Europe Ltd., Ireland, and Stripe Inc., USA) - online payment processing, PCI DSS certified
• Database hosting provider (currently: Supabase Inc.; data storage region: EU, Frankfurt) - storage of booking data and website content
• Website hosting provider (currently: Vercel Inc., USA) - operation of www.tatractive.pl
• Analytics and advertising tool providers (currently: Google LLC, USA - Google Analytics 4, Google Ads) - only with your consent
• Communication automation tools and e-mail/SMS service providers (currently: a self-hosted n8n automation tool and external e-mail and SMS gateway providers) - sending booking confirmations, reminders, organizational notifications, and album links; only the data necessary to handle a given message is transferred (full name, e-mail, phone, booking details, including the content of the „Notes" field)
• The guide leading the tour (currently: Karolina Gac, a licensed Class III Tatra mountain guide cooperating with the Controller) - only the data necessary to conduct the tour
• The provider of the tour group messenger and social media services (currently: Meta Platforms Inc., USA - WhatsApp, Instagram, Facebook) - only if you join the tour communication group (§ 29 of the Terms) or consent to publication of your image on social media
• Rescue services (TOPR, Horská záchranná služba) - solely in life- or health-threatening emergencies (transmission of information necessary for the rescue operation)
• Public authorities - only at the request of authorized authorities (tax office, court, prosecutor, police) under applicable law

Transfer of data outside the European Economic Area (EEA)

• payment operator (currently Stripe Inc., USA)
• website hosting provider (currently Vercel Inc., USA)
• analytics and advertising tool provider (currently Google LLC, USA)
• messenger and social media provider (currently Meta Platforms Inc., USA)

Google Analytics 4 and Google Ads

Google Analytics 4 collects data on how you use the website (pages viewed, time spent, device type, approximate location based on IP address - the IP is not stored). Although Google declares that the IP is not recorded, GA4 data may contain identifiers allowing indirect identification of the user, so it is processed as personal data based on consent (Art. 6(1)(a) GDPR). We use the Google Consent Mode v2 mechanism - by default all consents (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to „denied" and Google collects no data until you give explicit consent in the cookie banner. Separate from this mechanism is conversion measurement on the Controller's side: when a booking is placed, we may store with it the ad click identifier (gclid) and the GA client identifier, if present in the browser - on the basis of legitimate interest (Art. 6(1)(f) GDPR), independently of cookie consent, solely to attribute the booking to a traffic source and account for campaigns (see the „Scope of collected data" section). This data is not used for ad personalization.

Cookies - categories and consent management

We use three categories of cookies: (1) necessary - required for the site to function (language preference, booking session, CSRF protection), no consent required; (2) analytics - help us understand how you use the site, require your consent; (3) marketing - remarketing and ad performance measurement, require your consent. Analytics and marketing cookies are enabled only after your consent expressed in the banner (Art. 6(1)(a) GDPR and the provisions of the Polish Electronic Communications Law on storing and accessing information on end-user devices). You can withdraw or change your consent at any time via the „Manage cookies" link in the footer, or manage cookies in your browser settings.

Detailed list of cookies

The list is updated as changes occur. You can check the cookies actually active at any given time in your browser settings.

Newsletter and marketing communication

Apart from the voluntary tour communication group described in § 29 of the Terms, the Controller does not currently run a newsletter, mailing list, or other regular marketing communication. Contact details provided to conclude the contract (e-mail, phone) are not used to send commercial offers without separate consent. If you join the communication group and give separate consent to receiving commercial information, we may send there information about future tours, discount codes, and news - you can withdraw the consent at any time by leaving the group or writing to kontakt@tatractive.pl. If a newsletter is launched in the future, using it will require separate, voluntary, and express consent (a separate checkbox), in accordance with Art. 6(1)(a) GDPR and Art. 10 of the Polish Act on Providing Services by Electronic Means.