Privacy policy

Last updated: 19 sierpnia 2026.

1. Data controller

The controller of your personal data is LUVARO GROUP Sp. z o.o., Rynek Główny 29, 31-010 Kraków, NIP 676 271 29 72. Data contact: reservations@luvaro.pl.

2. Purposes and legal bases

• Booking and stay - Art. 6(1)(b) GDPR (contract).
• Legal obligations, incl. tax and accounting - Art. 6(1)(c) GDPR.
• Contact form enquiries - Art. 6(1)(f) GDPR (legitimate interest).
• Newsletter and marketing - Art. 6(1)(a) GDPR (your consent, withdrawable anytime).
• Claims, statistics and security - Art. 6(1)(f) GDPR.

3. Recipients

We may share data with trusted processors, in particular: the Previo booking system (PMS), the online payment provider Przelewy24 (PayPro S.A.), booking channels (OTAs such as Booking.com), our hosting/e-mail provider, accounting office and analytics tools (e.g. Google Analytics).

4. Retention

Booking data for the term of the contract and the limitation period; accounting records for the legally required period (generally 5 years); consent-based data until consent is withdrawn.

5. Your rights

You have the right to access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and to lodge a complaint with the Polish DPA (PUODO, Stawki 2, 00-193 Warsaw).

6. Transfers outside the EEA

Any transfer outside the EEA (e.g. via analytics tools) relies on appropriate safeguards, including the European Commission’s standard contractual clauses.

7. Cookies

The site uses necessary cookies and, with your consent, analytics cookies. Manage consent via the banner shown on your first visit and in your browser settings.