Skip to content
PL | EN 18 35 14 169 Book a room

Privacy Policy

This policy explains what personal data we collect through the ostoja.com.pl website, for what purpose, who we entrust it to and what rights you have. It applies from 16 October 2026.

1. Data controller

The controller of your personal data is Ostoja HoReCa Sp. z o.o., with its registered office in Bobowa, ul. Grunwaldzka 78, 38-350 Bobowa, entered in the National Court Register (KRS) under number 0000935733, tax ID (NIP) 7382165487 (hereinafter: “we”, “Ostoja”).

For any matters relating to personal data, you can contact us by e-mail: kontakt@zajazdostoja.pl, by phone: 18 35 14 169 or by post at our registered office address.

2. What data we collect, why and on what legal basis

  • Contact form and e-mail – your name, e-mail address, phone number and the content of your message. We use them to answer your question, prepare an offer (e.g. for a party, wedding or stay) and, where applicable, to conclude a contract. Legal basis: Art. 6(1)(b) GDPR (steps taken prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest – replying to correspondence).
  • Website chat (“Quick chat”) – the content of the conversation and any data you choose to provide (e.g. name, phone number, e-mail). Messages are passed to our staff via the Telegram messaging app. Suggested replies may be prepared by an artificial intelligence tool (Claude by Anthropic) – they are always checked and sent by a person. Legal basis: Art. 6(1)(b) and (f) GDPR.
  • Telephone contact – your phone number and the content of the call, to the extent needed to deal with your enquiry. Legal basis: Art. 6(1)(b) and (f) GDPR.
  • Accommodation bookings – we accept bookings through the hotres.pl system. Data provided in the booking form is processed in order to conclude and perform the contract for hotel services (Art. 6(1)(b) GDPR) and to fulfil legal obligations, e.g. tax obligations (Art. 6(1)(c) GDPR).
  • Online food orders – these are handled by the zajazd-ostoja.skubacz.pl service, which has its own terms and conditions and privacy policy.
  • Spam protection – the contact form uses Google reCAPTCHA, which assesses whether a message is being sent by a human. Legal basis: Art. 6(1)(f) GDPR (protecting the website against misuse).
  • Visitor statistics – we only activate Google Analytics once you have given consent in the cookie banner. Legal basis: Art. 6(1)(a) GDPR (consent), which you may withdraw at any time.
  • Establishing and defending claims – in the event of a dispute, we may process data to the extent necessary. Legal basis: Art. 6(1)(f) GDPR.

Providing your data is voluntary, but without it we will not be able to reply to your message or accept your booking.

3. Who we entrust data to

We use trusted service providers who process data on our behalf and on our instructions:

  • the hosting company that maintains the website (servers in Poland) and our e-mail provider,
  • Hotres (accommodation booking system),
  • Telegram (forwarding chat messages to our staff),
  • Anthropic (AI tool preparing suggested replies in the chat),
  • Google (reCAPTCHA, Google Analytics – subject to consent, maps and fonts on the website),
  • our accounting firm and IT service providers – to the extent necessary for their work.

Data may also be disclosed to public authorities where required by law. We do not sell data and we do not use it for automated decision-making or profiling.

4. Transfers of data outside the European Economic Area

Some providers (Google, Anthropic, Telegram) may process data outside the EEA, including in the USA. This takes place on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to us.

5. How long we keep data

  • correspondence (form, e-mail, chat) – until the matter has been dealt with, and then for no longer than 12 months, unless we enter into a contract,
  • data relating to contracts and payments – for the duration of the contract and then for the period required by tax and accounting regulations (usually 5 years from the end of the tax year) and until any claims become time-barred,
  • data processed on the basis of consent – until consent is withdrawn,
  • cookies – for the period described in the Cookie Policy.

6. Your rights

You have the right to: access your data and receive a copy of it, rectification, erasure, restriction of processing, data portability, object to processing based on our legitimate interest, and withdraw your consent at any time (without affecting the lawfulness of processing carried out before its withdrawal). To exercise these rights, please write to kontakt@zajazdostoja.pl.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

7. Cookies

The website uses cookies that are essential for it to work and – with your consent – statistical cookies as well. You can give or change your consent in the “Manage consent” window. Details and a list of cookies can be found in the Cookie Policy.

8. Security and changes to this policy

We apply technical and organisational measures to protect data, including an encrypted connection (HTTPS) and restricted staff access. The website contains links to other services (e.g. hotres.pl, skubacz.pl, Facebook) – their own privacy rules apply there. We may update this policy; the current version is always available on this page.

Zadzwoń do nas