1. Data controller
The controller of your personal data is LUVARO GROUP Sp. z o.o., Rynek Główny 29, 31-010 Kraków, NIP 676 271 29 72, REGON 543967339, KRS 0001223359 (Luvaro, we), owner of the Luvaro Stay brand and the luvarogroup.com website.
For any data matters write to reservations@luvaro.pl or call +48 505 20 20 30. You can also send a letter to our registered address. We have not appointed a data protection officer.
2. What data we collect
- Booking: name, e-mail, phone, dates and number of guests, chosen apartment, rate plan and extras, notes, payment data (status and amount, never the card number).
- VAT invoice: company name, tax ID, address.
- Contact form: name, e-mail, phone (optional), subject and message.
- Newsletter: e-mail address and date of consent.
- Technical data: IP address, browser and device type, server logs, saved settings (e.g. cookie consent).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Taking and fulfilling your booking, stay communication, sending door codes | Art. 6(1)(b) (contract) |
| Payments, invoices, tax and accounting duties | Art. 6(1)(c) (legal obligation) |
| Replying to form or e-mail enquiries | Art. 6(1)(b) or (f) (legitimate interest) |
| Website security, abuse prevention, establishing and defending claims | Art. 6(1)(f) |
| Newsletter, special offers and discount code | Art. 6(1)(a) (consent) |
| Analytics and marketing cookies (if enabled) | Art. 6(1)(a) (consent) |
Providing booking data is voluntary, but without it we cannot accept the booking. We do not make solely automated decisions and do not profile you.
4. Who receives the data
We share data only with parties that help us run the apartments and the website, under data processing agreements or as separate controllers:
- Previo s.r.o. - the property management system holding our bookings;
- LH.pl Sp. z o.o. - website and e-mail hosting;
- PayPro S.A. (Przelewy24) - online payments, if you choose that method;
- ING Bank Śląski S.A. - bank transfers;
- our accountants and legal advisers;
- booking portals (e.g. Booking.com, Airbnb, Expedia) - only when you book through them, as separate controllers;
- public authorities - where required by law.
5. Third-party services on the site
To display and work properly, your browser loads some resources from external servers, which see your IP address:
- Google Fonts (Google Ireland Ltd. / Google LLC) - typefaces;
- OpenStreetMap (OpenStreetMap Foundation) - map tiles;
- cdnjs / Cloudflare, Inc. - the Leaflet map library.
The distances on our maps were measured in advance; your location is never requested.
6. Transfers outside the EEA
Google LLC and Cloudflare, Inc. are based in the USA and participate in the EU-U.S. Data Privacy Framework, covered by a European Commission adequacy decision. The United Kingdom (OpenStreetMap Foundation) also benefits from an adequacy decision. No other data is transferred outside the European Economic Area.
7. How long we keep data
- booking data - for the duration of the contract and then until claims become time-barred;
- accounting records - 5 years from the end of the tax year concerned;
- contact form correspondence - until the matter is closed, no longer than 12 months unless it leads to a booking;
- newsletter - until you withdraw consent;
- server logs - up to 30 days.
8. Your rights
You have the right to access your data and obtain a copy, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
You may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
10. Changes
We update this policy when our services or the law change. The current version is always available on this page.