Privacy policy

1. Data controller

The controller for the processing by Boutique No.7 described here is:

Please send privacy enquiries to this email or postal address. The apartment is at Spokojna 8; the operator’s address above is the contact address for data protection matters.

2. Website access and hosting

The website is provided through OpenAI Sites using Cloudflare infrastructure. The domain is managed with IONOS. Domain management and website hosting are separate services.

Access involves processing connection data needed to deliver the site, notably the IP address and requested page. Depending on the hosting configuration, logs may include request times, browser details and technical errors. This supports delivery, troubleshooting and protection against attacks.

The legal basis for our provision of the website is Article 6(1)(f) GDPR. Our legitimate interest is a functioning, secure website. Recipients are the hosting and infrastructure providers involved. The website cannot technically be delivered without the necessary connection data.

Further provider information: OpenAI and Cloudflare.

3. Language preference and local storage

The website stores the displayed language (DE, PL or EN) in the browser’s local storage under “boutique-language”. It reads this value on a later visit. The entry has no fixed expiry and remains until you clear the website’s browser data or replace the language setting.

It is used to display the language; the site code does not use it for advertising or user profiles. Any personal data processing involved is based on Article 6(1)(f) GDPR, reflecting the interest in a user-friendly website. Separate requirements governing storage on and access to information on a user’s device must also be considered.

The supplied website code contains no analytics or advertising services or tracking cookies. Photos, logos and the location map load as files of this website. The hosting provider’s technical functions must be considered separately.

4. Contact and booking enquiries

When you call or write to us, we process the contact details you provide, your message and the information needed to arrange your stay. This may include your name, telephone number, email address, travel dates and number of guests. You supply these data; when you book through Booking.com, we may receive booking and contact details from that platform.

We use these details to reply, prepare an offer and handle your booking. The legal basis is Article 6(1)(b) GDPR for pre-contractual steps and performance of the contract. For general enquiries, Article 6(1)(f) GDPR applies, based on our interest in dealing with your message.

Contacting us is voluntary. Without sufficient reply or booking details, we may be unable to deal with your request. The website has no on-site payment or booking-data form.

The mailbox kontakt@boutique7home.com is provided by IONOS. Privacy enquiries sent to piotr.asobon@gmail.com are processed through Gmail. Only Piotr Jurkiewicz has access to incoming emails and booking enquiries. Further information is available in the privacy policies of IONOS and Google.

5. Contact through WhatsApp

The WhatsApp button is an external link. Opening it takes you to WhatsApp. A message is sent only when you send it yourself. If you contact us there, we see in particular your telephone number, message and any profile information you make available. We use these for the purposes and on the legal bases described under “Contact and booking enquiries”.

WhatsApp Ireland Limited provides WhatsApp to users in the European Region. The service’s own processing is described in WhatsApp’s privacy policy. You may also contact us by telephone or email.

The operator uses a regular WhatsApp account without a WhatsApp Business integration. Only Piotr Jurkiewicz has access to messages addressed to Boutique No.7. Any additional storage of messages in a device backup depends on the settings of the smartphone and backup service used.

6. Booking through Booking.com

Our booking buttons open the external Booking.com platform. Booking.com B.V. is responsible for processing on its platform under its own privacy policy. As the landlord, we process the data received from Booking.com to carry out your booking for the purposes described under “Contact and booking enquiries”.

7. Video on YouTube

The video link opens YouTube. No YouTube player is embedded in this website. Simply displaying the link does not cause the site code to load YouTube content.

After opening the service, Google’s privacy policy applies; Google Ireland Limited is generally the controller for users in the EEA. The service may process device, usage and account data.

8. Recipients and processing outside the EEA

Depending on your use, hosting, communication and booking service providers are involved. Competent authorities or advisers subject to professional confidentiality may also receive data where required by law or necessary for legal claims.

International providers may process data outside the European Economic Area, particularly in the United States. Their information describes their respective data protection arrangements. It does not replace checking the specific arrangements for this website and its contact channels.

9. Retention and deletion

Enquiries that do not lead to a booking are deleted once the matter is concluded and retention is no longer needed for legal claims or a statutory duty. Booking retention periods depend on performance of the contract, applicable tax or other record-keeping duties and any need to preserve evidence for claims. Data are deleted when these purposes and duties no longer apply.

Technical hosting logs are processed by the providers only for as long as necessary for operation, security and compliance with legal duties. The language setting remains in the browser until deleted or overwritten. External platforms set their own retention periods for the processing they control.

10. Your rights

Subject to the statutory conditions, your rights include:

• Access to your personal data and a copy (Article 15 GDPR).
• Correction of inaccurate data and completion of incomplete data (Article 16 GDPR).
• Erasure or restriction of processing (Articles 17 and 18 GDPR).
• Data portability for automated processing based on consent or a contract (Article 20 GDPR).
• Withdrawal of consent for the future, without affecting the lawfulness of earlier processing (Article 7(3) GDPR).

Right to object: Where processing relies on legitimate interests, you may object on grounds relating to your particular situation (Article 21(1) GDPR). We must then stop processing unless there are overriding compelling legitimate grounds or grounds relating to legal claims. You may object to processing for direct marketing at any time without giving particular reasons.

Please use the controller’s contact details for your request. Through this website we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

11. Complaints to a supervisory authority

If you believe that processing infringes data protection law, you may complain to a supervisory authority under Article 77 GDPR, particularly where you habitually reside or work, or where the alleged infringement occurred. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).