Privacy policy

The controller of your personal data is P&S Apartamenty Gdańsk Svitlana Okunievich, ul. Długie Ogrody 18B/60, 80-765 Gdańsk, Polska, NIP 5833504112, REGON 528077608.

For all data-protection matters please contact us:

• email: piotr@okuniewicz.eu

• phone: +48 692 279 376

We process your data to:

• conclude and perform the short-term rental contract (GDPR art. 6(1)(b)),
• issue a VAT invoice on request (art. 6(1)(c) — legal obligation),
• handle complaints and pursue claims (art. 6(1)(f) — legitimate interest),
• send our own marketing (e.g. post-stay review request) based on legitimate interest or your consent.

We process: name, email, phone number, stay dates, card / payment data (via Stripe or Krajowy Integrator Płatności S.A. — Tpay; we do not store card numbers or banking credentials), optionally invoice details (NIP, company, address), and technical logs (hashed IP, browser, visit time).

We use vetted vendors who process data on our behalf under data processing agreements:

• Stripe Payments Europe Ltd. — card and digital-wallet payments (Ireland / EEA),
• Krajowy Integrator Płatności S.A. (Tpay), ul. Plac Andersa 3, 61-894 Poznań, Poland, KRS 0000412357 — BLIK, Przelewy24 and card payments (Poland),
• Resend Inc. — transactional email (USA, under SCCs),
• Supabase Inc. — database hosting (EU-West),
• Vercel Inc. — application hosting (USA, under SCCs),
• Cloudflare Inc. — bot protection (Turnstile),
• external accounting firm — VAT invoicing and document archive.

Some processors (Resend, Vercel, Cloudflare) are based in the USA. Transfers rely on the European Commission's Standard Contractual Clauses (SCCs) plus technical safeguards (TLS, at-rest encryption).

• Booking data — for the duration of the stay plus 6 years after (statute of limitations + tax obligations),
• VAT invoices — 5 full calendar years from year-end of issue (Polish tax law),
• Marketing emails — until you withdraw consent,
• Technical logs — at most 12 months.

You have the right to: access, rectification, erasure ("right to be forgotten"), restriction, portability, object, withdraw consent at any time. Erasure does not apply to data we must retain by law (e.g. invoices). To exercise a right, write to piotr@okuniewicz.eu.

You may lodge a complaint with the Polish Data Protection Authority (UODO) at uodo.gov.pl, ul. Stawki 2, 00-193 Warsaw.

Details about cookies are in a separate Cookie policy. We use only strictly necessary cookies (e.g. language preference) and — only with your consent — analytics for anonymous traffic counts. We do not use third-party advertising cookies.

Booking and contact forms are protected by Cloudflare Turnstile to limit spam. Turnstile does not use tracking cookies but evaluates browser metadata to distinguish humans from bots.

We use TLS, hashed admin passwords, VPN/SSO-only database access, regular backups, and role-based access control.

We update this policy when laws or our processors change. The current version is always available on this page with the date of the last update.