Controller and contact
The controller is Carlina Łukasz Liniewicz, 9 Kwiatowa Street, 34-460 Szczawnica, Poland, tax ID 8942933983. Send privacy questions and requests to info@villa-carlina.pl or this postal address. This notice applies from 22 October 2026.
Enquiries, bookings and payment records
We process your name, email, supplied phone number, stay dates, guest and pet counts, correspondence, and information needed for invoices and bank-transfer reconciliation. The form does not require other guests’ names. Providing information needed to contact you and perform the contract is voluntary, but we cannot handle a booking without it; invoice details may be legally required. Please do not put sensitive personal information or payment-card details in the notes.
Purposes and legal grounds
We answer enquiries, prepare offers and provide accommodation under Article 6(1)(b) GDPR. Tax and accounting records fulfil legal obligations under point (c). Website protection, prevention of abuse and establishing or defending legal claims serve our legitimate interests under point (f). Acknowledging the terms or privacy notice is not marketing consent.
Recipients and service providers
Necessary access is limited to authorised accommodation staff, hosting and email providers, accounting support, the bank and legally authorised bodies. Booking email uses our own mail server and the SMTP2GO relay (Sand Dune Mail Ltd, New Zealand). This provider may use subprocessors outside the EEA, with the required transfer grounds, including adequate protection or standard contractual clauses. Ask us at the contact address above for information about the applicable safeguards. We do not sell personal data. This website does not accept card payments or use automated invoicing.
Availability calendar
We exchange occupied dates with Airbnb through ICS calendars. Our export contains generic unavailable periods without names, email addresses, phone numbers, prices or house-access instructions. Bookings made through Airbnb are also subject to that service’s policies.
Cookies and security
Essential cookies and similar mechanisms secure bookings, remember their progress, protect against forged requests and support administrator sign-in. Local ALTCHA anti-bot verification is not advertising tracking. We use no advertising analytics or advertising cookies. Technical logs may contain an IP address, timestamp, requested path and browser information for security and fault diagnosis.
Retention
We retain enquiry data while handling the enquiry and necessary follow-up. Booking details, accepted conditions and payment records remain for contract performance and the applicable limitation period for related claims. Accounting records remain for the period required by tax law. A dispute, inspection or legal obligation may extend retention. Technical logs and temporary delivery data are periodically removed; backups are rotated and access is restricted. You may ask us to explain the period applicable to a particular record.
Your rights
Subject to the GDPR, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests and complain to the Polish data-protection authority (uodo.gov.pl) or your competent supervisory authority. Legal duties, such as accounting requirements, may prevent immediate deletion of some records. We do not make decisions with legal effects solely through profiling.