Privacy policy – Lividus 307, Świnoujście

1. Data controller

The controller of personal data is Katarzyna Wabia, ul. Kminkowa 26A, 72-003 Bezrzecze, Poland, tax ID (NIP) 839-167-71-41.
Contact on personal data: biuro@lividus307.pl, phone +48 502 556 812.

When you book: first and last name, e-mail, phone, country, expected arrival time, notes, number of guests and – if you want a company invoice – company name, tax ID and address.
When you pay: the amount, method and status of the payment. We never see or store card details – you enter them directly with the payment provider Stripe. For a bank transfer – the transfer confirmation, if you send it.
In the chat, form, e-mail and phone: the content of your question and the contact details you give.

To conclude and perform the rental contract – booking, payment, information about your stay, the door code (Art. 6(1)(b) GDPR).
To meet legal obligations – tax, accounting and collecting the local spa tax (Art. 6(1)(c) GDPR).
To answer questions from the chat, form, e-mail and phone (Art. 6(1)(b) and (f) GDPR). Providing the data is necessary to conclude the contract.

Avirlo sp. z o.o., Szczecin, which runs the booking system on our behalf, with its providers: home.pl (server in the EU), Acronis (encrypted backups), Beds24 (booking calendar, Germany) and Anthropic (chat on the website).
The payment provider Stripe, our e-mail providers, our accounting office, Fakturownia (invoicing), authorities and other parties entitled by law, and providers of extra services we book for you.
Data is shared only electronically, over encrypted connections (HTTPS/TLS), and only to the extent each recipient needs. We do not sell data or share it for advertising.
Stripe and Anthropic may also process data in the USA – under the standard contractual clauses approved by the European Commission.
If you book through a portal (e.g. Booking.com, Airbnb), the portal also processes the data you give there as a separate controller.

The website and the booking system run only over encrypted HTTPS connections.
Only authorised people can access the booking system, each with their own account, password and a second sign-in factor (a code from the phone or Face ID); every change is logged.
Backups are encrypted. Card payments are handled by Stripe, certified to the payment card industry security standard PCI DSS.

Booking data – one year after the end of the stay; accounting documents – five years, as tax law requires.
Chat conversations are deleted after 30 days, form and e-mail enquiries once settled, at the latest after one year.

The apartment website uses no cookies. The booking part uses only necessary cookies (signing in, keeping your dates on hold) – no advertising and no tracking.

You have the right of access to your data, to rectification, erasure, restriction of processing and data portability, the right to object and the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).
On personal data, write to biuro@lividus307.pl.