Cookies

Privacy and Cookie Policy

Principles of Data Processing

Przedsiębiorstwo Turystyczne Mazowsze Sp. z o.o., operating under the brand Zdrowotel Łeba (hereinafter “Zdrowotel Łeba”), attaches great importance to respecting the rights of internet users, with particular regard to the right to privacy. The privacy policy presented below explains the principles we apply when collecting and processing personal data.

When collecting and processing personal data, Zdrowotel Łeba adheres to all of the data processing principles set out below and satisfies at least one of the conditions for the lawful processing of personal data for every person whose data is processed by Zdrowotel Łeba.

1.1. Principles relating to the processing of personal data:

  1. Lawfulness, fairness and transparency
  2. Purpose limitation
  3. Data minimisation
  4. Accuracy
  5. Storage limitation
  6. Integrity and confidentiality

1.2. Conditions for the lawful processing of personal data:

  1. The data subject has given consent to the processing of their personal data for one or more specific purposes
  2. Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract
  3. Processing is necessary for compliance with a legal obligation to which the controller is subject
  4. Processing is necessary in order to protect the vital interests of the data subject or of another natural person
  5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  6. Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child

1.3. Consent mechanism for data processing

Out of respect for the users of our website and to maintain transparency in processing, as well as to meet GDPR requirements, we have implemented a clear consent mechanism. During your first visit to our website, you will see a banner asking for your consent to:

  1. The processing of personal data for marketing and analytical purposes
  2. The use of cookies
  3. The use of tracking pixels and analytics tags (including Google Analytics)
  4. Ad personalisation

Consent is voluntary, but withholding it may limit access to certain features of the website.

What data do we collect about you?

Data collected during registration

In order to use certain features offered by the website, you will need to register. During registration, we will ask you for:

  1. Login and password
  2. First and last name
  3. Email address
  4. Phone number
  5. Stay details (dates, number of people, preferred services)

You will also be asked to consent to the processing of your personal data by Zdrowotel Łeba. We record every consent given, including the date, time and the text of the notice displayed to you.

Data collected automatically

During your visit to our website, data relating to your visit is collected automatically, in particular:

  1. Your IP address
  2. Domain name
  3. Browser type
  4. Operating system type
  5. Information about clicks and on-site behaviour
  6. Time spent on the website
  7. The pages that referred you to our website

More information can be found in the section devoted to cookies.

Google Enhanced Conversions

We use Google's Enhanced Conversions feature, which sends Google hashed data (e.g. your email address) submitted in a form. Hashing means the data is encoded in such a way that Google cannot identify you directly. This feature allows conversions to be accurately attributed to advertising campaigns without revealing your identity. Consent to Enhanced Conversions is optional and can be withdrawn at any time.

Ad personalisation and performance measurement

Our website uses Google advertising technologies (Google Ads, Google Analytics, Google Tag Manager), which may collect data for the following purposes:

  1. Ad personalisation – tailoring ads to your interests based on your previous activity
  2. Ad performance measurement – tracking whether you clicked on our ad and which actions you took on our website
  3. Remarketing – displaying our ads to you on other websites you have previously visited

Ad personalisation and performance measurement require consent to data processing and to the use of cookies.

Who is the controller and how to contact the Data Protection Officer

Personal data controller:
Zdrowotel Łeba
ul. Nadmorska 15/17
84-360 Łeba, Poland

The Data Protection Officer is Mr Marek Pióro, CISA, CISM, CGEIT, CRISC, CDPSE.

You can contact the DPO via:

  1. Email: iod@zdrowotel.pl
  2. Regular mail: Data Protection Officer, Przedsiębiorstwo Turystyczne Mazowsze Sp. z o.o., ul. Nadmorska 15/17, 84-360 Łeba, Poland

For what purpose and on what basis will data be processed

Your personal data obtained in connection with your use of Zdrowotel Łeba's services will be processed for the following purposes:

  1. Handling reservations – legal basis: contract
  2. Conducting marketing activities, including customer acquisition and retention – legal basis: consent
  3. Selling services – legal basis: contract
  4. Analyses and statistics related to our business activity – legal basis: the controller's legitimate interest
  5. Ensuring the security of the website and services – legal basis: the controller's legitimate interest
  6. Archiving – legal basis: legal obligation or legitimate interest
  7. Fulfilling legal obligations incumbent on Zdrowotel Łeba – legal basis: legal obligation
  8. Measuring the effectiveness of advertising campaigns – legal basis: consent (for users from the EEA)

Legal bases for processing

The processing of your data will be carried out on the following legal bases:

  1. Consent given – for marketing purposes, ad personalisation, campaign performance measurement, and processing of Enhanced Conversions data
  2. Necessity for the performance of a contract or to take steps at your request prior to entering into a contract
  3. Necessity for compliance with a legal obligation to which the controller is subject
  4. The controller's legitimate interest – e.g. responding to your letters and requests, system security

Important: due to GDPR requirements, we must obtain your explicit consent before loading any Google tags or tracking pixels. If you do not give consent, these technologies will not run in your browser.

Who will receive your data and where it will be transferred

Your personal data will not be transferred to third countries or international organisations, unless this results from agreements concluded with us.

Your data may be disclosed to the following entities:

  1. Data processors in connection with activities commissioned by Zdrowotel Łeba and carried out on its behalf (e.g. IT service providers, vendors)

Google LLC – for the processing of data for the purposes of:

  1. Website analytics (Google Analytics)
  2. Ad personalisation and remarketing
  3. Measuring the effectiveness of advertising campaigns
  4. Processing Enhanced Conversions

More information on how Google processes data can be found in Google's Privacy Policy: https://business.safety.google/privacy/

  1. Courier companies – which will deliver shipments
  2. Law firms – commissioned by Zdrowotel Łeba to conduct proceedings
  3. Entities or authorities authorised under applicable law

Details regarding Google and transparency:

In accordance with GDPR requirements and Google's EU User Consent Policy guidelines, we hereby confirm that:

  1. Data may be processed by Google in the United States
  2. Google processes data under a data processing agreement
  3. A link to Google's Privacy Policy is available above and in our consent banner

For how long will data be processed

The period for which your personal data is processed depends on the purpose for which it is processed:

  1. User account management — Duration of the account + 3 years from the last activity
  2. Archiving of reservations and invoices — 5 years (required by income tax law)
  3. Debt collection — Claims period + limitation period (6 years)
  4. Data for marketing purposes — 3 years from the granting of consent or until it is withdrawn
  5. Cookie data (session identifiers) — Duration of the session or a maximum of 12 months
  6. Consent logs — 3 years (in accordance with Google's guidelines)
  7. Enhanced Conversions (hashed data) — 90 days

Additional information: in order to protect Zdrowotel Łeba's legal interests, data may be stored for the period necessary to defend against claims. The retention period is calculated on the basis of: applicable law, account management, the controller's legitimate interest, and the period for which consent was given.

What rights do you have?

You have the following rights regarding your personal data:

1. Right of access

You have the right to request access to your personal data, including information about the purposes of processing, the recipients of the data, and the retention period.

2. Right to rectification

You have the right to request the rectification of inaccurate data and the completion of incomplete data.

3. Right to erasure (“right to be forgotten”)

In certain situations, you may request the erasure of your data, e.g. when:

  1. The data is no longer needed for the purposes for which it was collected
  2. You have withdrawn your consent and there is no other legal basis for processing
  3. You object to the processing

However, this right does not apply if processing is necessary for compliance with a legal obligation.

4. Right to restriction of processing

You may request the restriction of the processing of your data, e.g. while its accuracy is being verified.

5. Right to data portability

You have the right to receive your data in a structured, commonly used format and to transmit that data to another controller.

6. Right to object

You may object to the processing of your data for marketing purposes or for purposes arising from the controller's legitimate interests.

7. Right to withdraw consent

You have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

How to exercise your rights

To exercise the rights listed above, please contact us:

  1. Email: iod@zdrowotel.pl
  2. Regular mail to: Przedsiębiorstwo Turystyczne Mazowsze Sp. z o.o., ul. Nadmorska 15/17, 84-360 Łeba, Poland, marked “Personal data”

If your data was collected via cookies, we may ask you for additional information to confirm your identity.

Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with:

The President of the Personal Data Protection Office (UODO)
ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland
Email: kancelaria@uodo.gov.pl
UODO electronic delivery address: AE:PL-67085-31860-RWFHC-35
Website: https://uodo.gov.pl

What are the consequences of not providing your data?

  1. Reservation form data – providing this data is a prerequisite for concluding a contract. Without it, the reservation cannot be processed.
  2. Marketing data – providing this data is voluntary. Not consenting to marketing will not affect your ability to use our core services.
  3. Cookie and personalisation data – without consent to cookies, the website will still function, but some features may be limited.

How do we profile you?

Zdrowotel Łeba does not use automated decision-making systems that could independently determine your rights or obligations. All decisions concerning your data are made by natural persons.

How can you obtain information about the processing of your data?

Please direct all correspondence regarding the processing of your personal data to:

  1. Email: iod@zdrowotel.pl
  2. Regular mail to: Przedsiębiorstwo Turystyczne Mazowsze Sp. z o.o., ul. Nadmorska 15/17, 84-360 Łeba, Poland, marked “Personal data”

Use of cookies

Our website uses cookies, which are used to identify your browser while you use our website. Cookies are small pieces of text that can only be read by the website that sent them. The information collected allows us to learn how often you visit our website, which of its elements interest you the most, and to monitor the security of the website.

We use the data obtained for:

  1. Better tailoring the website to your needs
  2. Making the website easier to use and navigate
  3. Statistical and analytical purposes
  4. Ad personalisation (with your consent)
  5. Protection against fraud and abuse

Important: cookies cannot be used to infect your device with viruses or other malicious software (malware).

Each individual cookie consists of four basic parts:

  1. Website name – the name of the domain or subdomain that set the cookie
  2. Cookie name – each cookie has a unique name for each website
  3. Expiry date – session cookies expire when the browser is closed, while persistent cookies expire once a set date is reached
  4. Value – information the website uses to remember your previous visit

What do we store in cookies?

In cookies, we store:

  1. User session identifiers
  2. Preference settings (e.g. language choice)
  3. Information about the pages viewed and display format
  4. Identifiers for ad personalisation
  5. Security tokens

Use of cookies for the purposes of:

  1. Recognising users logging into protected web pages
  2. Recording user preferences – browsing content and format
  3. Recording pages visited – helps us improve content and navigation
  4. Ad personalisation – displaying ads tailored to your interests
  5. Measuring campaign effectiveness – tracking conversions and interactions

Types of cookies:

  1. Necessary cookies — Required for the website to function, for security and preferences. Consent required: No (required by law)
  2. Analytics cookies — Google Analytics – collecting anonymised data about users. Consent required: Yes
  3. Marketing cookies — Ad personalisation, remarketing. Consent required: Yes
  4. Third-party cookies — Meta, LinkedIn, Bing – for marketing purposes. Consent required: Yes

Right to refuse cookies:

You have the right to:

  1. Refuse to have cookies saved – you can change your browser settings or decline consent in our banner
  2. Delete cookies – they can be removed via your browser settings
  3. Block cookies – for specific websites you choose, or for all websites

Note: blocking cookies may result in the loss of certain features that require cookies to be installed, including personalised ads.

Information on managing cookies can be found at: https://www.allaboutcookies.org/manage-cookies/ and https://wszystkoociasteczkach.pl/

We use the following cookies on our website:

  1. PHPSESSID — expires after: End of session — Session identification and correct display of information
  2. _ga — expires after: 2 years — Google Analytics – user identifier
  3. _gid — expires after: 24 hours — Google Analytics – session identifier
  4. _gat — expires after: 1 minute — Google Analytics – request rate limiting
  5. GTM-* — expires after: Variable — Google Tag Manager – tag management
  6. fbp — expires after: 3 months — Facebook Pixel – conversion tracking
  7. bscookie — expires after: 2 years — LinkedIn – tracking professional users

Additional information: cookies may also be set by our advertising partners. Detailed information about their cookies can be found in their respective privacy policies.

Consent to cookies and personalisation – important information

Consent banner

When you visit our website for the first time (or after clearing your cookies), you will see a banner asking you to consent to:

  1. Necessary cookies (e.g. for security) – set automatically
  2. Analytics cookies (Google Analytics) – requires your consent
  3. Marketing cookies (ad personalisation) – requires your consent
  4. Third-party cookies – requires your consent

How to give consent

  1. Click “Accept all” – all cookies will be applied
  2. Click “Customise” – to choose which cookies to accept
  3. Click “Reject” – only necessary cookies will be applied

How to withdraw consent

Withdrawing consent is just as easy as giving it:

  1. Find the “Manage cookies” / “Change settings” link (usually at the bottom of the page or in the settings)
  2. Change your cookie preferences
  3. Save your changes

You can also change your consents in your browser settings.

How do we protect your personal data?

Data transmission security

  1. Communication between your browser and our server is encrypted using the SSL/TLS protocol (Secure Socket Layer / Transport Layer Security)
  2. The connection is identified by a padlock icon in the URL address bar
  3. We implement the PCI DSS standard for the protection of credit card data (where applicable)

Database security

  1. Our databases are protected against access by third parties
  2. We implement multiple layers of security, including firewalls and monitoring systems
  3. Only authorised personnel have access to personal data
  4. We perform regular data backups

Staff security

  1. Employees undergo training on the protection of personal data
  2. They are bound by a duty of confidentiality
  3. Access to data is restricted on the basis of the “least privilege” principle

Security of Google Analytics and other tools

  1. We apply IP anonymisation when sending data to Google
  2. Data in Enhanced Conversions is hashed (encrypted)
  3. We use Google Tag Manager for secure tag management

Changes to our privacy policy

We reserve the right to amend the above privacy policy by publishing a new version on our website. After a change is made, the Privacy Policy will appear on the website with a new date.

Change history:

  1. 25.05.2018 (version 1.0) — Initial version (GDPR 2018)
  2. 13.08.2026 (version 2.0) — Updated in line with Google's EU User Consent Policy and changes to the guidelines on ad personalisation, Enhanced Conversions, performance measurement, and consent log retention requirements

Contact

Registered office of the controller:
Przedsiębiorstwo Turystyczne Mazowsze Sp. z o.o.
ul. Nadmorska 15/17
84-360 Łeba, Poland

Phone: +48 59 866 18 70, +48 509 667 369

  1. Reservations and general enquiries: info@zdrowotel.pl
  2. Privacy / GDPR: iod@zdrowotel.pl

Social media:

  1. Facebook: http://facebook.com/ZdrowotelLeba
  2. Instagram: https://www.instagram.com/zdrowotel.leba/
  3. YouTube: https://www.youtube.com/@zdrowotel_leba

Appendices

Appendix A – Link to Google's Privacy Policy

In accordance with Google's EU User Consent Policy guidelines, we provide access to information on how Google processes personal data: https://business.safety.google/privacy/

Appendix B – Information on analytics and marketing service providers

  1. Google LLC — Analytics, Ads, Tag Manager — https://policies.google.com/privacy
  2. Meta Platforms — Facebook Pixel — https://www.facebook.com/privacy/explanation
  3. LinkedIn — Insight Tag — https://www.linkedin.com/legal/privacy-policy
  4. Microsoft — Bing Ads — https://privacy.microsoft.com/en-us/privacystatement

Łeba, 13 August 2026

This Privacy and Cookie Policy has been approved by the Data Protection Officer, Marek Pióro, CISA, CISM, CGEIT, CRISC, CDPSE.

This privacy policy applies to all language versions of the Zdrowotel Łeba website (PL, EN, DE, CS) and is binding on all users of the website.