Privacy policy

Privacy policy

The following documents outlines key information concerning the processing of your personal data by

Kopalnia Soli „Wieliczka” Turystyka Sp. z o.o. with its registered office at Park Kingi 10, 32–020 Wieliczka, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, under KRS no. 0000030908, NIP (VAT ID): 6831480313, REGON (National Business Registry Number): 351197769, share capital:810,000.00 PLN, which operates the Grand Sal Hotel (hereinafter referred to as the Company) in connection with the use of the services provided on the https://grandsal.pl/ website (hereinafter referred to as the Website), as well as in connection with establishing or maintaining contact with the Company via other communication channels, including e-mail, telephone calls and conventional postal correspondence.

Please be advised that a Data Protection Officer has been appointed by the Company. You may contact the Data Protection Officer via the following e-mail address: iod.ksw@kopalnia.pl

1. Terms and Conditions for the processing of personal data

Pursuant to Articles 13(1) and 14 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as GDPR or the General Data Protection Regulation), the Company informs you that:

1. The Data Controller is Kopalnia Soli “Wieliczka” Turystyka Sp. z o.o. with its registered office at Park Kingi 10, 32–020 Wieliczka (hereinafter also referred to as the Data Controller).
   1. Compliance with data protection regulations is supervised by a Data Protection Officer appointed by the Data Controller, who may be contacted via e-mail: iod.ksw@kopalnia.pl
   1. Personal data will be processed for the following purposes and on the basis of the following legal grounds:

Purposes of data processing	Legal basis for data processing
Receiving enquiries concerning the Company’s offer and replying to them, as well as making a booking via the contact form.	Article 6(1)(b) of the General Data Protection Regulation (taking action at the request of the data subject prior to entering into an agreement);
	Article 6(1)(f) of the General Data Protection Regulation (purposes of legitimate interests – contact with the person placing the order on behalf of the ordering party);
Complaint processing	Article 6(1)(b) of the General Data Protection Regulation (taking action at the request of the data subject prior to entering into an agreement);
	Article 6(1)(f) of the General Data Protection Regulation (purposes of legitimate interests – contact with the person making a claim on behalf of the ordering party);
Compliance with the obligations arising from the law concerning the issue and retention of accounting documents (invoices, receipts) – in case an invoice is requested	Article 6(1)(c) of the General Data Protection Regulation (legal obligation) – the Accounting Act and tax law regulations
Carrying out promotional and marketing activities, including distribution of newsletters and other marketing communications, provided the user has given the required consent for the relevant communication channel.	Article 6(1)(f) of the General Data Protection Regulation (legitimate interest – marketing in connection with consent given in accordance with Article 398 of the Electronic Communications Act)
Claim assertion and undertaking action related to the debt collection process, as well as defence against claims	Article 6(1)(f) of the General Data Protection Regulation (legitimate interest – claim assertion and undertaking debt collection actions, defence against claims)
Fulfilment of obligations stemming from child protection standards, including receiving, documenting and investigating reports or incidents concerning the safety of minors – to the extent required by law and in accordance with established child protection standards.	Article 6(1)(c) of the General Data Protection Regulation (legal obligation incumbent on the Data Controller) in conjunction with the Act on Combating the Threats of Sex Offences and the Protection of Minors.
Compiling analytics and statistics concerning user activity on the Website with cookies and similar technologies. Installing cookies.  Installing cookies for this purpose may require obtaining additional consent in accordance with separate legal provisions.	Article 6(1)(f) of the General Data Protection Regulation (legitimate interest – carrying out analytical and statistical activities relating to the User for the purpose of developing and improving services).
Advertising, measuring campaign effectiveness, personalising advertisements and using extended conversions, including the use of tools provided by Google, Meta, Benhauer/Salesmanago, Hotjar and others. Installing cookies for this purpose may require obtaining additional consent in accordance with separate legal provisions.	Article 6(1)(f) of the General Data Protection Regulation (legitimate interest – the Company’s own marketing and optimisation of marketing activities).
Handling enquiries and providing user support, including analysing conversations to improve responses and the presentation of information about the Data Controller’s services using a chatbot.	Article 6(1)(f) of the General Data Protection Regulation – the Controller’s legitimate interest concerning analysing the quality of services provided  and improving communication with the user). Article 6(1)(b) of the General Data Protection Regulation – taking actions prior to entering into a contract, including requesting a quote or making a booking.

1. The recipients of personal data include entities providing services to the Data Controller, in particular IT support, entities handling the booking process, accountancy firms, banks and payment service providers, transport companies (if an additional hotel transfer service is selected), marketing agencies (in connection with the implementation of marketing activities), providers of marketing and analytics tools (including Google, Hotjar, ChatLab), social media providers (such as Meta – Facebook, Instagram) as well as other companies within the KSW Group, namely: Kopalnia Soli Wieliczka S.A and Kopalnia Soli Wieliczka Wsparcie.

The recipients of your data will also include entities authorised to receive data under the law.

1. If you are a representative of our client (the contracting party) or a supplier, the Data Controller will process your contact details (including your first name, surname, e-mail address, telephone number, job title) in connection with our ongoing partnership or with a view to establishing such a partnership. In the cases where we have not obtained this data directly from you, we have received it from our client or supplier, of whom you are a representative.
   1. Personal data will be stored:
      1. for the duration of the contract or the provision of services;
      1. for the duration of the correspondence or contact;
      1. until you have objected to the processing of your data – in the case when the processing of personal data is based on a so-called legitimate interest (such cases are described in item 3 above);
      1. until you object or withdraw your consent to cookies, as described in section 7 of the Cookie Policy;

After the period specified above, personal data will be archived for as long as the relevant legal provisions require the data to be retained or for the duration of the limitation period for any potential claims, after which it will be deleted or anonymised.

1. You have the following rights in relation to the processing of your personal data:
   1. the right of access to data content, the right of rectification, the right to erasure, the right to limit data processing, the right to data portability,
   1. the right to withdraw your consent by sending a request to the e-mail address provided, and, in the case of consent to cookies, also by changing the settings in the cookie banner or in the consent management panel;
   1. the right to object to the processing of your personal data – if the processing of your personal data is based on the so-called legitimate interest and under the conditions specified in the provisions of the General Data Protection Regulation,
   1. the right to lodge a complaint to the supervisory authority (President of the Office for the Protection of Personal Data) if it is considered that the processing of personal data violates the provisions of the General Data Protection Regulation.
   1. All the above-mentioned rights apply to the extent provided for in the General Data Protection Regulation. You may exercise the above rights by sending a request to the Data Controller’s registered office or, if contacting us via e-mail, by sending a message to: iod.ksw@kopalnia.pl
   1. In connection with the use of analytical, marketing and communication tools as well as artificial intelligence-based solutions, your data may be transferred outside the European Economic Area.

In such cases, the transfer of data takes place in accordance with the requirements of the GDPR, in particular on the basis of standard contractual clauses approved by the European Commission.

1. Providing your personal data is obligatory if such an obligation results from the provisions of the Accounting Act and tax law regulations (with respect to issuingand storing accounting documents). Providing data for other purposes (as described in section 3) is voluntary, but may prove necessary for the purposes of responding to an enquiry, ordering a service, concluding and performing a contract, or using the Website.
   1. Conversations with the chatbot are carried out using artificial intelligence systems (the ChatLab platform, whch is used for developing and deploying chatbots), which analyse the content of queries and generate automated responses based on an analysis of queries submitted by Website users.

2.     Cookie Policy

• When the user visits the Website, the Data Controller may collect information concerning the user, such as cookie identifiers and information gathered via cookies and other similar technologies.
  • Cookie files constitute data, in particular text files, which are stored in the User’s end device and are intended for use on the pages of the Website. Cookies usually contain the name of the website from which they originate, the timestamp signifying their installation on the end device and a unique number.
  • Cookie identifiers, as well as information collected via cookies and other similar technologies, may in certain circumstances constitute personal data.
  • Cookies are used for the following purposes:
    • to enable users to use the Website and to ensure that its features work correctly (strictly necessary cookies);
    • to compile statistics that help us understand how Website users use its pages, thereby enabling us to improve their structure and content (analytical cookies);
    • to carry out marketing and remarketing activities, personalise advertising content, measure the effectiveness of advertising campaigns, and use marketing automation and extended conversion tools, including tools provided by Salesmanago, Meta Platforms, Google and other marketing technology providers (optional and statistical cookies).
  • The Website uses two main types of cookies: ‘session’ cookies and ‘persistent’ cookies. ‘Session’ cookies are temporary files that are stored on the user’s device until they leave the Website or close the software (web browser). ‘Persistent’ cookies are stored on the user’s device for the period specified in the cookie settings or until the user deletes them.
  • You can find detailed information about cookies by expanding the cookies banner and clicking on the ‘Details’ tab.
  • When the user visits the website for the first time, a banner will appear informing them about the use of cookies and allowing them to set cookie management preferences. Users can manage the cookies that are stored on their device – they may consent to all categories of cookies or only to some of them. They may also withdraw their consent at any time by clicking the ‘Decline’ button. To accept the installation of all cookies, they user clicks the ‘Allow all’ button. To manage cookie settings for a particular category, the user needs to click the ‘Details’ button, adjust the relevant slider on the cookie banner, and then click the ‘Allow selected’ button. The option to manage cookies does not apply to essential cookies, which cannot be disabled or rejected.
  • Users may also change their cookie settings at any time in the settings of their web browser. By default, the web browser allows cookies to be stored on the user’s device. These settings can be changed in such a way as to prevent automatic cookie handling or to inform the Website user about every instance of placing a cookie file on their device. Detailed information about the possibilities and methods of handling cookies is available in the settings of web browser.
  • The Website Operator informs that restrictions on the use of cookies may affect some of the features available on the Website.
  • The Website Operator reserves the right to make changes to the Cookie Policy. Any changes will be published on the Website.
• Information on cookies used, enhanced conversions and the chatbot.
  • The Website uses technical cookies, which are essential for the continued operation of the Website. These files may be shared with third parties responsible for ensuring the proper functioning of the Website.
  • Users may provide personal data (such as an e-mail address or telephone number) on the Website, for example when filling in the contact form. This data can be converted into an encrypted identifier, which can be sent to Google for use in enhanced conversions. If the user uses Google services (such as a Google account or if they are signed in to the Google Chrome browser), Google may link their activity on the Website with their account. The data may then be used in accordance with Google’s privacy policy.
  • Subject to the user’s consent given via the cookie banner on the Website, the Webste uses and enables the use of cookies and extended conversion tracking (Google) for statistical and advertising purposes, and also transfers the stored data to third parties including Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland as well as Google LLC, with its registered office at 1600 Amphitheatre Parkway, Mountain View, California, 94043, Meta Platforms Ireland Limited, with its registered office at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and Benhauer Sp. z o.o., with its registered office at Grzegórzecka 21, 31 – 532 Kraków, Poland, Hotjar Limited with registered office at Dragonara Business Centre, 5TH Floor, Dragonara Road, Paceville, St. Julians STJ 3141, Malta).
  • It is up to the user to decide whether they wish cookies to be stored on their computer or whether they wish enhanced conversions to be used, by giving or refusing their consent to cookies and enhanced conversions, when opening the Website. They may deactivate or completely disable cookies in the settings of their web browser or by selecting the appropriate option in firewall programs. They can also delete cookies that have been saved to date.
  • Any user who consents to the use of cookies can customise advertisements on the Google ad network in the Ads Preference Manager in their Google account. The rules governing the collection and processing of data as part of the services provided by Google are provided at www.google.com/policies/privacy/partners/.
  • A Chatbot service has been implemented on the Website, which enables Users to obtain information about services and products through an automated conversation. The Chatbot conversation mechanism is based on artificial intelligence (AI) solutions and cookies (marketing cookies). The Chatbot may process ordinary personal data, such as the IP address, geolocation data and mobile device identifiers, in connection with the User’s activity. The rules governing the collection and processing of data in connection with the services provided by CHATLAB Sp. z o.o. are set out at https://www.chatlab.com/privacy/. 
  • Detailed information about the cookies used is available by clicking on the Cookiebot icon, located in the bottom left-hand corner of the home page and on every page of the Website.