Privacy policy

This policy explains how we process the data of people using dk.olsztyn.pl and dkapartamenty.pl, contacting us and booking stays with DK Apartamenty.

Last updated: 11 October 2026.

1. Controller and contact details

The data controller is Jarosław Krawczyk, trading as STERTA.PL JAROSŁAW KRAWCZYK, tax identification number 5821172035, at al. Sybiraków 2, 10-257 Olsztyn.

For privacy matters, email olsztyn [at] gmail.com, call +48 511 554 405 or write to the address above. An active email link is provided in the contact section at the bottom of the page.

2. Data we process and why

• Contact and stay enquiries: contact details, name and information supplied in correspondence or conversation. If you enquire about entering into a contract, the legal basis is taking steps at your request before entering into it — Article 6(1)(b) GDPR. Other correspondence is handled on the basis of our legitimate interest in responding — Article 6(1)(f) GDPR.
• Checking offers and arranging a stay: dates, number of guests, selected apartment and details required for booking, such as name, contact and billing information. The basis is entering into and performing a contract — Article 6(1)(b) GDPR.
• Records and legal obligations: data required for accounting documents, tax settlements and other obligations connected with providing services, including safeguarding minors where applicable. The basis is Article 6(1)(c) GDPR.
• Complaints and claims: information about bookings, stays, payments and correspondence. The basis is our legitimate interest in establishing, pursuing or defending claims — Article 6(1)(f) GDPR, and Article 6(1)(c) GDPR where legal obligations apply.
• Website operation and security: technical information such as IP address, request time, page visited, browser information and server response. This is used to deliver pages, diagnose errors and prevent abuse — Article 6(1)(f) GDPR.

Providing data is voluntary, but without the information needed for contact or booking we may be unable to reply or arrange your stay. Data required by law is necessary to fulfil the relevant obligations. Please do not send sensitive data or document copies unless they are needed for a specific matter.

3. Bookings and external services

The search tool sends dates, guest numbers and offer identifiers to IdoBooking to obtain prices and availability. Clicking “Book now” opens IdoBooking, where you choose the conditions and enter booking details. Information about processing by that system and payment operators is available during booking. Viewing a price on our websites does not require payment-card details.

If you book through Booking.com, Airbnb or another platform, we receive the information needed to manage the booking, such as contact details, dates and guest numbers. The platform also processes data under its own privacy policy.

On the map page, your browser downloads maps from OpenStreetMap. Its provider receives technical connection data, including your IP address. See the OpenStreetMap Foundation privacy policy. The Facebook link leads to an external service; it is not an embedded tracking plugin.

4. Recipients and transfers outside the EEA

Where needed for the purposes above, data may be received by providers of hosting and technical support, IdoBooking, Gmail email, payment, accounting and legal services, and people authorised to manage your stay. Public authorities may receive data where there is a legal basis. We limit disclosure to what each service needs.

External services, especially email and booking platforms, may involve processing outside the European Economic Area. Such transfers require a basis under Chapter V GDPR, such as an adequacy decision or standard contractual clauses with the required safeguards. You may ask us about recipients, the transfer basis and how to obtain a copy of the safeguards. See also Google’s privacy policy for Gmail.

5. How long we keep data

• Enquiry data is kept as long as needed to resolve the matter, and afterwards only when needed to document arrangements or protect claims.
• Booking and stay data is kept for the performance of the contract, then for periods required by law or justified by claim limitation periods.
• Accounting and tax records are kept for periods required by the relevant accounting and tax rules.
• Technical logs are kept as long as needed for security and error investigation. Information about a specific incident may be retained until its investigation and related proceedings are completed.

These periods may be extended when further retention is required by law or data needs to be preserved for a specific dispute.

6. Cookies and browser settings

The public part of this version of our websites does not use advertising cookies, marketing pixels or analytics tools that track visitors. Stay parameters are carried in page addresses. Guest accounts are not required; technical session cookies relate to signing in to the administration panel.

After you enter an external booking system or platform, its cookie rules apply. You can manage cookie storage in your browser settings. Blocking essential cookies may restrict services requiring a session. Visiting our pages does not constitute consent to marketing. Introducing tools requiring consent will require appropriate information and consent before they run.

7. Your rights

Under the conditions set out in the GDPR, you have the right to access and receive a copy of your data, have it corrected or erased, and restrict processing. Data portability applies to data processed automatically on the basis of a contract or consent.

You may object to processing based on legitimate interests for reasons relating to your particular situation. An objection to direct marketing does not require reasons. Where consent is the basis, you may withdraw it at any time without affecting the lawfulness of earlier processing.

To exercise your rights, contact the controller. If there are reasonable doubts, we may request information needed to confirm your identity. We normally reply within one month; any legally permitted extension and its reasons will be communicated within that period. Some requests, such as erasing documents subject to mandatory retention, may be restricted.

You also have the right to complain to the President of the Polish Personal Data Protection Office. Information on making a complaint is on the UODO website.

8. Automated decisions and policy changes

Within the services described, we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated price calculation and displaying available offers serve to present accommodation options.

We update this policy when website operation, data processing or applicable rules change. The current version remains available at this page’s address. The rights described are based on the General Data Protection Regulation (GDPR).