Privacy Policy
1. General information
This Privacy Policy sets out the rules for processing the personal data of users of the Weranda House website available at werandahouse.pl (hereinafter the “Website”), run by Rival Group sp. z o.o., and of guests booking a stay at Weranda House.
2. Data controller
The controller of personal data is Rival Group sp. z o.o., ul. Wąchocka 1N, 03‑934 Warsaw, Poland, KRS 0000698317, NIP 521‑379‑78‑41, REGON 368480584, email: l.babicz@rival.pl, phone: +48 501 189 735 (hereinafter the “Controller”).
3. Data Protection Officer
The Controller has not appointed a Data Protection Officer. For all matters relating to data protection, please contact us at the email address given in section 2.
4. Purposes and legal bases of processing
The Controller processes data for the following purposes:
Booking and providing the stay – handling bookings made via the Hotres booking system embedded in the Website, by phone or by email, contact regarding the booking, receiving the prepayment and settlements (Art. 6(1)(b) GDPR).
Bookings via booking portals (e.g. Slowhop) – if a booking is made through a portal, we receive the guest’s data from that portal in order to provide the stay (Art. 6(1)(b) GDPR). With regard to the booking made on the portal, its operator is a separate data controller and the rules of processing are set out in its privacy policy.
Accounting and tax obligations (Art. 6(1)(c) GDPR).
Replying to enquiries sent by email or phone (Art. 6(1)(f) GDPR).
Security and proper functioning of the Website, including server logs (Art. 6(1)(f) GDPR).
Anonymous visit statistics using Umami Analytics (e.g. number of visits, pages viewed, device type, country). Umami does not use cookies, does not store full IP addresses and does not allow users to be identified. The legal basis is the Controller’s legitimate interest in improving the Website (Art. 6(1)(f) GDPR).
Measuring the effectiveness of Facebook and Instagram ads – only if you give consent in the cookie banner, the Website activates the Meta Pixel provided by Meta Platforms Ireland Ltd. The Pixel stores cookies and sends Meta information about the pages you visit and the booking steps (choosing dates, entering details, creating a booking). This lets us measure how well our ads work and show them to people interested in a stay. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
5. Data retention period
Data category
Retention period
Booking and settlement data
6 years from the end of the calendar year in which the stay ended (tax obligations and pursuit of claims)
Correspondence (email, phone)
until the matter is closed, then until any claims become time-barred
Server logs (IP address, timestamp, user agent)
up to 30 days
Umami statistics
aggregated, anonymous data
Meta Pixel cookies
up to 90 days or until consent is withdrawn; data received by Meta – according to Meta's privacy policy
6. Data recipients
Data may be disclosed to:
Hotres Sp. z o.o. – the booking system provider, processing data on behalf of the Controller,
Framer B.V. (Netherlands) – the Website hosting provider,
Umami Software, Inc. – the provider of anonymous visit statistics,
Meta Platforms Ireland Ltd. (Ireland) – only with your consent, for the Meta Pixel; for the collection and transfer of this data, the Controller and Meta are joint controllers (Art. 26 GDPR), and data may be transferred to Meta Platforms, Inc. in the USA under the EU-US Data Privacy Framework,
the Controller’s bank – for bank transfer payments,
booking portals (e.g. Slowhop) – for bookings made through them,
entities authorised to obtain data under the law (e.g. courts, public authorities).
7. Users' rights
Users have the right to:
access their data and receive a copy,
rectify their data,
erase their data (“right to be forgotten”),
restrict processing,
object to processing (including marketing),
data portability,
lodge a complaint with the President of the Personal Data Protection Office (UODO).
Rights can be exercised by contacting us at the email address given in section 2.
8. Voluntary provision of data
Providing data is voluntary but necessary to use the Website's booking functions or to conclude a contract.
9. Automated decision-making and profiling
The Website does not make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR). If you consent to the Meta Pixel, Meta may use this data to tailor the ads you see.
10. Cookies
The Website uses essential cookies (for the site and the embedded Hotres booking system) and – only with your consent – Meta Pixel cookies (e.g. _fbp), stored for up to 90 days. On your first visit, a banner lets you accept or decline them. Declining does not affect browsing or booking. You can change your choice at any time: Change cookie settings or by clearing site data in your browser. Umami statistics work without cookies.
11. Data security
The Controller applies appropriate technical and organisational measures, in particular:
TLS (SSL) encryption,
hosting with a reputable provider with advanced protection,
strong passwords and multi-factor authentication for administration panels,
access to data only for authorised persons.
12. Changes to the Privacy Policy
The Controller reserves the right to amend this Policy. The new version will be published on the Website with the current date.
13. Contact
For matters relating to personal data, please contact us at l.babicz@rival.pl or by phone at +48 501 189 735.
Version of 14 October 2026.