Privacy Policy
Last updated: 15 January 2026
1. Introduction
This Privacy Policy sets out the rules for the processing of personal data of users of the website www.goraspokoju.pl (hereinafter: “the Website”) and guests of the training and leisure centre “Tranquility Hill. Osada Klimatyczna-Leśna” located at ul. J. Tuwima 41 in Inowłódz (97-215) (hereinafter: “the Centre”).
This document has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and the Act of 10 May 2018 on the protection of personal data.
2. Joint data controllers
The controllers of your personal data are jointly (so-called joint controllers within the meaning of Article 26 of the GDPR):
a) Yellow Bahama Sp. z o.o.
- Registered office: ul. J. Tuwima 41, 97-215 Inowłódz
- KRS: 0000332263 (District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register)
- Share capital: PLN 250,000.00
- Tax Identification Number (NIP): 525-245-73-22
- Responsible for: running and maintaining the Website, handling enquiries from contact forms, marketing, cookies, analytics.
b) Tranquility Hill Foundation
- Registered office: 41 J. Tuwima Street, 97-215 Inowłódz
- KRS: 0000658142 (District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register)
- Tax ID: 7732480606
- Responsible for: processing bookings and stays at the Centre, guest services, accounting records, and complaints regarding the Centre’s services.
The main content of the arrangements between the joint controllers (Article 26(2) of the GDPR) is available on request at the email address kontakt@goraspokoju.pl. Regardless of the internal division of responsibilities, you may exercise your rights under the GDPR with respect to any of the joint controllers.
Single point of contact:
- Email: kontakt@goraspokoju.pl
- Telephone: +48 884 622 625
- Postal address: ul. J. Tuwima 41, 97-215 Inowłódz
3. Scope of data collected
Depending on how you use the Website and the Centre’s services, we may process the following categories of personal data:
Users of the Website (contact form, enquiries):
- first name and surname,
- email address,
- telephone number (if provided),
- message content,
- IP address, device and browser data,
- data obtained from cookies (details in the Cookie Policy).
Visitors to the Centre:
- first name and surname,
- home address,
- PESEL number (for registration purposes, in accordance with separate regulations),
- series and number of identity document (presented upon check-in),
- telephone number,
- email address,
- details of the duration and purpose of stay,
- invoicing details (if applicable): company name, VAT number, address,
- payment details (bank transfer or invoice details).
We do not process special categories of personal data (sensitive data), unless this arises from information you have voluntarily provided (e.g. when reporting special dietary requirements).
4. Purposes and legal bases for processing
| Purpose | Legal basis | Retention period |
|---|---|---|
| Response to an enquiry via the contact form / email / telephone | Article 6(1)(b) of the GDPR (pre-contractual measures) and (f) (legitimate interest – handling correspondence) | up to 12 months from the end of the correspondence, if no contract was concluded |
| Processing of bookings and stays at the Centre | Article 6(1)(b) of the GDPR (performance of a contract) | for the duration of the contract and until the expiry of the limitation periods for claims arising therefrom (up to 6 years – Article 118 of the Civil Code) |
| Issuing invoices, accounting settlements, tax obligations | Article 6(1)(c) of the GDPR (legal obligation) – the Accounting Act, the Tax Ordinance | 5 years from the end of the tax year in which the tax payment deadline expired |
| Registration obligations | Article 6(1)(c) of the GDPR – Population Registration Act | in accordance with applicable regulations |
| Handling of complaints | Article 6(1)(f) of the GDPR (legitimate interest – defence against claims) and (c) (legal obligation) | 3 years from the conclusion of the complaints procedure |
| Direct marketing (newsletter, offers) | Article 6(1)(a) of the GDPR (consent) and (f) (legitimate interest) | until consent is withdrawn or an objection is raised |
| Website traffic analytics (Google Analytics) | Article 6(1)(a) of the GDPR (consent to analytical cookies) | up to 14 months (GA4) or until consent is withdrawn |
| Social media marketing activities (Meta Pixel) | Article 6(1)(a) of the GDPR (consent to marketing cookies) | in accordance with Meta’s policy, until consent is withdrawn |
| Investigation and defence against claims | Article 6(1)(f) of the GDPR (legitimate interest) | until the expiry of the limitation period for claims |
5. Recipients of data
We may transfer your data to the following categories of recipients:
- entities providing IT and hosting services – website hosting provider (seohost), email service providers, booking system providers,
- an accounting firm handling settlements,
- providers of analytical and marketing tools: Google Ireland Limited (Google Analytics 4), Meta Platforms Ireland Limited (Meta Pixel),
- postal operators and couriers (where necessary for correspondence),
- law firms and debt collection agencies – should it become necessary to pursue claims,
- state authorities authorised to request data under the law (police, Social Insurance Institution (ZUS), tax offices, etc.).
All entities to whom we entrust data processing operate on the basis of data processing agreements (Article 28 of the GDPR) ensuring an adequate level of protection.
6. Transfer of data outside the European Economic Area (EEA)
The use of Google (Google Analytics) and Meta (Meta Pixel) tools may involve the transfer of data outside the EEA, in particular to the United States. The transfer takes place on the basis of:
- the European Commission’s Implementing Decision of 10 July 2023 confirming the adequate level of protection of personal data provided by the EU–US Data Privacy Framework – for certified entities,
- Standard Contractual Clauses (SCCs) approved by the European Commission – as an additional safeguard.
7. Your rights
In connection with the processing of personal data, you have the following rights:
- the right to access your data and receive a copy of it,
- the right to rectify (correct) inaccurate or incomplete data,
- the right to erasure (the right to be forgotten), subject to exceptions provided for by law,
- the right to restrict the processing of your data,
- the right to data portability (to the extent that data is processed on the basis of consent or a contract and by automated means),
- the right to object to data processing based on the controller’s legitimate interests, including profiling and direct marketing,
- the right to withdraw consent at any time (withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal),
- the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl).
You may exercise these rights by contacting us using the contact details provided in point 2.
8. Automated decision-making and profiling
We do not make decisions regarding you based solely on automated data processing, including profiling, which produce legal effects or similarly significantly affect you.
As part of our analytical and marketing tools (Google Analytics 4, Meta Pixel), user behaviour may be profiled in order to tailor marketing content – solely on the basis of your consent given via the cookie banner.
9. Voluntary provision of data
The provision of personal data is voluntary; however:
- failure to provide data in the contact form will prevent us from responding,
- failure to provide data when making a booking will prevent the conclusion of a contract,
- failure to provide registration details will prevent us from fulfilling our obligations under the regulations on population registration.
10. Data security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or destruction, in particular:
- encryption of the connection to the Website (SSL/TLS),
- access control to systems and documentation,
- regular backups,
- a confidentiality obligation for employees and associates.
11. Cookies
The Website uses cookies and similar technologies. You can find detailed information in the Cookie Policy.
12. Changes to the Privacy Policy
We reserve the right to make changes to the Privacy Policy. The current version is always available on the Website. Significant changes will be communicated in advance.
13. Contact
For matters relating to the protection of personal data, please contact us:
Email: kontakt@goraspokoju.pl Telephone: +48 604 884 622 625 Address: 41 J. Tuwima Street, 97-215 Inowłódz