Privacy policy

Version: 23 October 2026

1. Data controller and contact details

The controller of your personal data is Dawid Legierski, a sole trader operating under the business name Mitologie Branding Dawid Legierski, ul. Chabrów 7, 43-450 Ustroń, Poland, Polish tax identification number (NIP): 5482329556, EU VAT number: PL5482329556, operating VISLA Apartments, hereinafter referred to as the “Controller” or “we”.

For matters concerning personal data, you can contact us:

by email: hello@visla.apartments;
in writing: at the Controller’s address given above.

This policy explains how we process data in connection with your use of the VISLA Apartments website, contact with us, booking and provision of accommodation, and the handling of payments, cancellations and refunds.

2. What data we process and where we obtain it

The scope of the data we process depends on how you use our services. It may include:

contact details: first name and surname, email address and telephone number;
booking details: booking number, selected apartment, dates of stay, number of guests and, where needed to determine the price, the number and ages of children, selected rate, discount code used, and practical information you provide;
billing details: invoice details, address and tax identification number, where applicable to the transaction;
payment details: amount, transaction identifier, status and dates, link to the booking and, for refunds, the bank account number and recipient details where necessary to make the refund;
the content of correspondence, complaints and enquiries;
technical data: IP address, connection time, information about your browser and device, website addresses visited, errors and security events;
information about cookie choices and consents, where such consents are collected.

We obtain data primarily from you. If you book through Booking.com or Airbnb, we may receive booking, contact and billing details from that platform to the extent made available through its services. Data may also come from a person booking on your behalf and from a payment provider or bank, for example as confirmation of payment.

If you provide us with other guests’ data, please limit it to what is needed to arrange the stay and make this policy available to those guests. Please do not include health information or other specially protected data in forms unless it is needed to handle your matter.

3. Purposes and legal bases of processing

We process data in accordance with Regulation (EU) 2016/679, hereinafter the “GDPR”.

Purpose	Legal basis
Preparing an offer, checking availability, accepting and managing bookings, providing accommodation, sending confirmations and practical information, payments, cancellations and refunds arising from the contract	Article 6(1)(b) GDPR — taking steps before entering into a contract and performing the contract
Processing data of guests who are not parties to the contract	Article 6(1)(f) GDPR — our legitimate interest in arranging and providing the booked accommodation
Keeping tax records, issuing billing documents and fulfilling other statutory obligations, including those relating to the local tourist tax, where applicable	Article 6(1)(c) GDPR — a legal obligation, in particular under tax legislation and legislation on local charges
Responding to general questions and handling correspondence not directly related to entering into a contract	Article 6(1)(f) GDPR — our legitimate interest in handling correspondence
Handling complaints and disputes, and establishing, pursuing and defending claims	Article 6(1)(b) or (c) GDPR for handling the contract and legal obligations, and Article 6(1)(f) GDPR for protecting our rights
Ensuring website operation and security, and preventing spam, abuse and fraudulent bookings	Article 6(1)(f) GDPR — our legitimate interest in protecting the website, services and users
Keeping records of consent given or withdrawn	Article 6(1)(c) GDPR — the obligation to demonstrate compliance to the extent required by law, and Article 6(1)(f) GDPR — defending against claims

Google Analytics is used to analyse how the website is used, for example the number of visits, traffic sources and the popularity of individual content. Personal data for these analytics is processed under Article 6(1)(a) GDPR — the user’s consent. Refusing or withdrawing consent does not affect your ability to make a booking.

We use Google Analytics 4. Analytics is activated after consent has been obtained, in accordance with the user’s choice in the cookie settings panel.

Messages concerning bookings, payments and stays are sent to perform the contract. They do not require marketing consent.

4. Whether providing data is mandatory

Providing data is voluntary, but information marked as required in a form is needed to manage a booking or respond to an enquiry. Without it, we may be unable to enter into and perform the contract or contact you. Providing data required by law, for example to issue an invoice correctly, is an obligation under that law. Other information is optional.

5. Tpay payments and refunds

Online payments are handled by Krajowy Integrator Płatności S.A., with its registered office in Poznań, Poland, the operator of Tpay. To process a transaction, we provide the operator with the data needed to execute it and link it to the booking, in particular the payer’s details, the amount and the payment identifier or description. We receive transaction status information needed to manage bookings and settlements.

You enter payment instrument details in the environment of the payment operator or the institution handling the relevant payment method. Our booking form does not collect full card details or online banking login credentials.

Tpay processes data relating to its payment services as a separate controller, in accordance with its own legal obligations and the Tpay privacy policy.

Refunds due under the booking conditions are made manually by bank transfer. If we need bank account details or confirmation of those details to make a refund, we will request them in connection with the relevant booking. We do not request your banking password, a BLIK code or card details for this purpose.

6. Who may receive your data

Data may be disclosed only to the extent necessary for the relevant purpose:

cyber_Folks S.A. — our hosting and email provider, for storage of the website, databases, correspondence and backups;
providers of website and booking system maintenance and IT services, where we use their assistance;
Google Ireland Limited and, in connection with Google’s infrastructure and services, Google LLC — for Google Analytics after consent has been obtained;
the provider of Cloudflare Turnstile protection;
the Tpay operator and banks involved in processing payments or refunds;
accounting and legal service providers and persons authorised to manage bookings and stays;
the platform through which the booking was made, to the extent necessary to manage it;
public authorities and other authorised entities where required by law.

Entities acting on our behalf process data under appropriate agreements and our instructions. Entities pursuing their own purposes and legal obligations, in particular banks, the payment operator and booking platforms, may act as separate controllers.

Provider information: cyber_Folks and Google.

7. Form protection — Cloudflare Turnstile

We use Cloudflare Turnstile, provided by Cloudflare, Inc., to protect forms against spam and automated submissions. The tool analyses technical signals, such as IP addresses and information about the browser and connection, to distinguish users from automated traffic.

The legal basis for processing data to protect our website is Article 6(1)(f) GDPR. According to its documentation, Cloudflare acts as a processor when providing the service to us and as a separate controller when improving bot detection.

Further information: Cloudflare Turnstile Privacy Addendum and the Cloudflare privacy policy.

8. Transfers outside the European Economic Area

Using international providers, including Cloudflare and Google, may involve transferring data outside the European Economic Area, including to the United States.

Such transfers require a basis under Chapter V GDPR. This may be a European Commission adequacy decision, where it covers the recipient and scope of the transfer, or standard contractual clauses together with additional safeguards where needed. You can obtain information about the safeguards used and the possibility of obtaining a copy by contacting the Controller.

According to the providers’ documentation, Google LLC and Cloudflare rely on the EU–US Data Privacy Framework for covered transfers to the United States. Cloudflare identifies standard contractual clauses as a fallback mechanism if its certification ceases to be valid and for other applicable transfers. Details: Google — data transfer frameworks and Cloudflare — GDPR.

9. How long we retain data

We retain data only for as long as needed for the relevant purpose:

Bookings and stays: during preparation and performance of the contract, and afterwards only to the extent necessary to fulfil legal obligations or protect claims.
Tax records: generally for 5 years from the end of the calendar year in which the payment deadline for the relevant tax expired; longer where required by law, for example because the limitation period has been suspended or interrupted.
Claims and disputes: until the applicable limitation period expires; generally 3 years for business-related claims or 6 years for other claims, subject to specific time limits and rules for calculating them. If proceedings are brought, until they have been finally concluded and settled, where further retention is necessary.
Incomplete bookings: no longer than 12 months from the last activity, unless further retention of specific data is necessary to investigate abuse or protect claims.
General correspondence: until the matter is closed and then for no longer than 12 months, unless it forms part of contractual, billing or dispute records.
Technical and security logs: for 30 days. Data relating to an incident may be retained until the investigation is complete or for the protection of claims.
Hosting backups: cyber_Folks backups are available for up to 28 days back. This is the period during which backups are available for restoration; it does not mean that the source data is deleted after 28 days.
Google Analytics 4: we retain event data for 2 months and user data for 14 months. These periods apply to data covered by GA4 retention settings; they do not determine the retention period for standard aggregated reports or cookie lifetimes. The option to reset the user data retention period on new activity is enabled; new activity renews that period in accordance with how GA4 operates.
Data processed on the basis of consent: until consent is withdrawn or the relevant purpose ends earlier. After withdrawal, we may retain only information necessary to demonstrate that consent was given and withdrawn, for the period needed for accountability or the protection of claims.
Cookies and similar technologies: for the period specified for each technology in the list available on the website.

10. Your rights

Subject to the conditions and limits set out in the GDPR, you have the right to:

access your data and receive a copy;
rectify and complete your data;
have your data erased;
restrict processing;
data portability where processing is automated and based on consent or a contract;
object to processing based on our legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time;
withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Information on lodging a complaint is available at uodo.gov.pl.

To exercise your rights, please contact us using the details in section 1. If we have reasonable doubts about the identity of the person making a request, we may ask for additional information necessary to confirm their identity.

We respond without undue delay, generally within one month of receiving a request. If the complexity or number of requests justifies extending this period by a further two months, we will notify you and explain the reason within the first month.

11. Cookies and similar technologies

The visla.apartments website uses cookies and similar technologies, including browser storage. They ensure website operation, support booking functions, remember consent choices and, after consent has been obtained, provide visitor statistics.

Technologies strictly necessary to transmit a communication or provide a service you explicitly request may operate without consent within the limits permitted by law. We activate analytics technologies after obtaining your consent. Refusing consent does not prevent you from viewing our offer or making a booking.

We use Complianz to manage cookie choices. You can accept optional technologies, refuse their use or change the available settings. You can change or withdraw consent at any time using the “Cookie settings” function on the website. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Detailed information about the names, providers, purposes and lifetimes of cookies and similar technologies is provided in the separate Cookie Policy available on the VISLA Apartments website. A cookie’s lifetime is distinct from the Google Analytics data retention period described in section 9.

You can also delete cookies and manage their storage in your browser settings. Blocking essential technologies may restrict some functions. Simply deleting cookies from your browser does not amount to withdrawing all consents recorded in other systems.

12. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Automatic calculation of a price based on the selected dates, rate and discount code serves to present the booking terms. Anti-spam measures may automatically reject suspicious submissions; if you have difficulty using the form, you can contact us directly.

13. Security and changes to this policy

We apply technical and organisational measures appropriate to the risks of processing, including measures to secure system access and data transmission. Only authorised persons and entities receive access to data, to the extent necessary to perform their tasks.

This policy may be updated following changes to services, tools or legislation. We publish the current version on the website together with its update date. Where a change requires additional information or consent, we will act in accordance with applicable law.