Privacy Policy Polish Travel Quo Vadis Sp. z o.o.

I. Controller and contact details

The controller of your personal data is Polish Travel Quo Vadis Sp. z o.o., ul. Ptasia 2, 00-138 Warsaw, Poland, National Court Register (KRS) number 0000148731, tax identification number (NIP) 5260211386 ("PTQV", the "Controller", "we", "us" or "our").

For matters relating to personal data protection, withdrawal of consent or the exercise of your rights, you may contact the Controller directly using the contact form or by post at the address above. Including "Personal data protection" in your message will help us handle your request, but is not required.

II. Purposes and legal bases for processing

We process personal data only to the extent necessary for a specified purpose and on the appropriate legal basis.

1. Enquiries, proposals and performance of contracts

We process data to prepare a proposal at your request, enter into and perform a contract, handle bookings and make arrangements for services such as tickets, accommodation, transport, car hire, travel insurance, individual and business travel, destination management (DMC) services, conferences, meetings, incentive travel and events. The legal basis is Article 6(1)(b) GDPR where you are a party to the contract or request steps to be taken before entering into a contract.

2. Business contacts and travel booked by other people

We process data to communicate with representatives of companies and business partners and to arrange services for people nominated by an employer, event organiser or person making a booking. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to coordinate arrangements, fulfil the order and efficiently assist the people covered by the service. We do not automatically apply the contractual legal basis to every traveller who is not a party to a contract with us.

3. Legal obligations

We process data to settle accounts, maintain accounting and tax records, issue invoices and fulfil obligations arising from the legislation applicable to the relevant service. The legal basis is Article 6(1)(c) GDPR, in particular in conjunction with accounting, tax and travel services legislation, to the extent that it applies.

4. Correspondence, service quality and legal claims

We process data to answer questions not directly related to entering into a contract, address feedback, maintain necessary records of arrangements, assess service quality, and establish, exercise or defend legal claims. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are communication, service improvement and the protection of rights. Where handling a matter fulfils a specific legal obligation, Article 6(1)(c) GDPR applies to the relevant processing.

5. Marketing our own services

Marketing our own services may be based on Article 6(1)(f) GDPR where permitted by the circumstances, the outcome of the balancing of interests and the rules applicable to the relevant communication channel. This legitimate interest does not replace any consent required for marketing communications or tracking technologies.

We send newsletters you have requested and other marketing communications by email, or contact you by telephone for marketing purposes, on the basis of the appropriate freely given consent. The legal bases are Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law Act of 12 July 2024 ("PKE"). The consent specifies the purpose and communication channel. Responding to a specific enquiry does not enrol you in subsequent marketing campaigns.

6. Website operation and security

We process data to make the website available, provide technical support, detect errors and misuse, and protect our systems. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to maintain the availability and security of our services. The rules on storing information on a user's device are described separately in Section X.

7. Handling rights requests and documenting consent

We process data to comply with our obligations under the GDPR, including handling requests and demonstrating compliance. The legal basis is Article 6(1)(c) GDPR. We may need to retain a limited record of an objection or a decision to opt out to ensure that unwanted marketing does not resume. The legal basis is compliance with legal obligations and, to the extent necessary for protection in relation to legal claims, Article 6(1)(f) GDPR.

8. Special categories of personal data

Where arranging the service you have requested requires information about health, disability, allergies or other specific needs that reveals personal data covered by Article 9 GDPR, we process only the necessary information on the basis of explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR. A dietary preference does not necessarily constitute health data or another special category of personal data.

Where vital interests are at risk, Articles 6(1)(d) and 9(2)(c) GDPR may apply. For special categories of personal data, this applies only where the individual is physically or legally incapable of giving consent. Such data may also be processed to the extent necessary for the establishment, exercise or defence of legal claims under Articles 6(1)(f) and 9(2)(f) GDPR. Please do not send unnecessary medical records or copies of identity documents with general enquiries.

9. Website analytics and usability improvements

We measure website traffic, traffic sources, the effectiveness of content and campaigns, and actions leading to service enquiries. We also assess website usability using the tools described in Section X. This processing is based on consent under Article 6(1)(a) GDPR, taking account of Article 399 PKE. This also applies to linking events to a pseudonymous identifier, where one is used. We do not consider analytics necessary merely to display information about our services.

10. Information materials and follow-up to enquiries

We process data to provide a guide, itinerary, presentation or other material you have requested and to respond to a need you have expressly communicated. The legal basis is Article 6(1)(b) GDPR where we provide the requested service or take steps before entering into a contract. In other cases, the legal basis is Article 6(1)(f) GDPR, namely our legitimate interest in responding to a request for information. Adding your details to a newsletter mailing list or to subsequent campaigns unrelated to your enquiry requires a separate legal basis and the appropriate consent for the communication channel.

III. Whether you are required to provide personal data

You do not need to provide your first name or surname simply to browse publicly available content. When you contact us, we need details that enable us to respond. When you make a booking, we need the data necessary to provide the particular service. Failure to provide the required data may prevent us from responding, entering into a contract or fulfilling a booking. Invoicing details may be required by law.

Providing additional information and giving consent to marketing are voluntary. Declining marketing does not prevent you from having your enquiry handled, purchasing a service or receiving material you have requested. Our forms distinguish required fields from optional fields. Withdrawing consent to the processing of data needed for specific assistance may prevent us from providing that assistance, but does not justify collecting a wider range of data.

IV. Categories and sources of personal data

Depending on the nature of the contact and the service, we process:

• Identification and contact details: first name, surname, address, email address and telephone number, and, for business contacts, the organisation's name and the individual's position or role.
• Booking details: dates, routes, participants, required services, preferences, booking references and necessary travel document details. We process date of birth, age or nationality only where required for the particular service or by law.
• Billing information and records of arrangements: invoicing details, payment information, correspondence, complaints and records of service delivery.
• Information about specific needs: in accordance with Section II.8.
• Technical connection data: IP address, time of the request, address of the page visited, browser and device information, and error information, to the extent recorded by the website's infrastructure.
• Consent and objection records: the wording and date of consents, their withdrawal and objections, where relevant to the particular processing activity.

We receive data directly from you or from a person ordering a service on your behalf, your employer, a group or event organiser, or a partner handling a booking. For business contact data, we may also obtain information from professional details you have made available. We receive from these sources only the categories of data necessary for communication or the requested service.

Where we do not obtain data directly from you, we provide the information required by Article 14 GDPR. As a rule, we do so no later than one month after obtaining the data. If we contact you or disclose your data to another recipient earlier, we provide the information at the first communication or first disclosure, as applicable, unless a statutory exception applies. Publishing this Policy on the website does not replace the obligation to provide that information where required.

Analytics may involve the processing of pseudonymous browser and session identifiers, traffic sources, pages visited, clicks, scrolling, activity duration, device type, language and approximate location. Such data is not inherently anonymous. Recording the event is sufficient to measure a form submission. The contents of an enquiry, names, email addresses, telephone numbers and travel details should not be sent to analytics tools or included in URLs used for measurement.

We obtain data about children travelling with their family or a group from an authorised guardian or organiser, only to the extent necessary, for example to arrange a ticket or accommodation. Describing family travel does not encourage children to provide data independently or constitute consent to profiling them for advertising purposes.

V. Recipients of personal data

To the extent necessary for the relevant purpose, personal data may be shared with:

• Hotels and other accommodation providers, air, rail, ferry and coach carriers, transport and car hire companies, and insurers.
• Providers of reservation systems and global distribution systems (GDS), and organisations handling ticket issuance and settlement.
• Guides, tour leaders, local partners, conference venues and other providers delivering elements of a travel or event programme.
• The employer or organiser funding the service, within the scope of the agreed booking and settlement, without automatic access to all additional information about the traveller.
• Hosting, IT support and communication tool providers, accounting and legal service providers, banks and payment service providers.
• Competent public authorities and, where visa services have been requested, the relevant consular offices, only on an appropriate legal basis and to the extent necessary.

Not every recipient receives data in connection with every service. We disclose only the information necessary for the particular task. Providers acting on our instructions are processors. Carriers, hotels, insurers and other service providers may act as independent controllers in relation to their own services and obligations. We provide the information relevant to a particular service provider as part of the booking process.

We use Microsoft 365 for communications and work involving documents. Bookings and settlements are also handled using travel industry systems and service management and accounting systems. The name of a software product does not mean that its developer receives all the data processed using it. Recipients are the entities actually providing hosting, maintenance, support or data processing services.

The website tools Google Analytics 4, Cookiebot and Microsoft Clarity are described in Section X and in the list of tools.

For Clarity, Microsoft acts as an independent controller to the extent described by the provider, rather than solely as a processor acting on our instructions. We distinguish the rules applicable to Clarity from the terms governing Microsoft 365 services. Further details are provided in Section X.4.

We do not sell customer databases. For promotional activities co-funded by the Polish Tourism Organisation, we provide aggregate, anonymised results in our reporting. Submitting an enquiry does not in itself result in the enquirer's contact details being disclosed to the Polish Tourism Organisation.

VI. Processing and retention periods

The retention period depends on the purpose and category of personal data. We apply the following rules. Longer retention requires a separate reason of the kind described below, rather than merely the possibility that the data may be useful in the future.

• Enquiries and proposals that do not lead to a contract: for the duration of active discussions and for up to 12 months after the last substantive contact, to allow arrangements concerning the trip or event to be resumed.
• Contracts and bookings: for the time needed to prepare, deliver and settle the service. We subsequently retain the records necessary to fulfil legal obligations and protect our position in relation to legal claims.
• Contact persons at business partners: for the duration of the business relationship and while the person acts as a contact, until we are informed of a change or an objection takes effect.
• Legal claims: for the applicable limitation period and, in the event of a dispute, until the proceedings are finally concluded and the decision is implemented.
• Accounting and tax records: for the period required by the applicable legislation.
• Marketing based on consent: until consent is withdrawn or the relevant purpose ends, whichever occurs first.
• Consent records and the handling of rights requests: while we rely on the consent or handle the matter, and subsequently for the period during which we need to demonstrate compliance or defend a specific legal claim.
• Data concerning health and specific needs: until the relevant service has been provided and matters raised in connection with it have been resolved, or until consent is withdrawn earlier.
• Public website logs: standard access and error logs for up to 30 days after the event, and separately retained security logs for up to 90 days.
• Analytics and usability research data: in accordance with the rules for GA4 and Microsoft Clarity set out in Section X.
• Cookies and browser storage: for the periods specified for the individual mechanisms in the declaration applicable to the website.

At the end of the applicable retention period, we delete the data or irreversibly anonymise it. Data scheduled for deletion may remain in isolated operational backups of public websites until the backup overwrite cycle is complete, for no longer than 90 days. We do not use that data for routine service delivery or marketing.

VII. Profiling and automated decision-making

Our website measurements are used to assess visibility, traffic sources, content usability and the effectiveness of generating enquiries. We do not carry out remarketing that targets users again on the basis of their previous visits to the website. We do not use automated assessments of website activity to set individual prices, refuse services or assess a user's economic situation or health.

The fact that PTQV does not carry out remarketing does not mean that the provider of Clarity acts solely on our instructions or does not pursue purposes of its own. Information about Microsoft's independent role, its purposes and privacy choices is provided in Section X.4.

Analytics tools may distinguish between sessions and link interactions to a pseudonymous identifier. To the extent that automated analysis involves evaluating an individual's behaviour, it may constitute profiling within the meaning of Article 4(4) GDPR. Its purpose is to analyse how the website is used and resolve usability issues, rather than to make decisions about a user's rights.

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

VIII. Your rights

Subject to the conditions set out in the GDPR, you have the right to access your personal data and obtain a copy of it, and to request its rectification, erasure or restriction of processing. The right to erasure does not override the obligation to retain data required by law or data necessary in relation to legal claims.

Data portability: where processing is based on consent or a contract and is carried out by automated means, you may receive the data you have provided to us in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that it be transmitted to another controller.

Right to object: you may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to direct marketing, including profiling related to such marketing, at any time and without giving reasons.

Withdrawal of consent: you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. You can use the available opt-out mechanism or contact us using the contact details in Section I.

We respond to requests without undue delay and, as a rule, within one month. In the circumstances permitted by the GDPR, this period may be extended by a further two months. We will inform you of the reasons for the extension within the first month.

You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), whose website is uodo.gov.pl, or with another competent supervisory authority.

IX. Transfers of personal data outside the European Economic Area

Data associated with cloud services, analytics or international bookings may be transferred outside the European Economic Area ("EEA"), including through remote access by a provider's personnel. Locating the primary server in the EU does not rule out such access.

The use of Microsoft 365 and Google Analytics 4 may involve transfers to entities within the Microsoft and Google groups, particularly in the United States, to the extent arising from the provision and security of those services. The providers' terms include transfer mechanisms, including the European Commission's standard contractual clauses where applicable.

For Microsoft Clarity, the provider identifies Microsoft Ireland Operations Limited as the contracting party for customers in the EU and indicates that data may be transferred to Microsoft Corporation in the United States on the basis of standard contractual clauses between those entities.

When arranging a particular trip, data is sent to recipients in countries connected with the itinerary, such as a carrier or hotel. Where there is no applicable adequacy decision and no appropriate safeguards, the derogations in Article 49 GDPR may be relied on only where their conditions are met.

Information about a specific recipient, country, legal basis for a transfer and how to obtain a copy of the applicable safeguards is available through the contact form.

X. Cookies, similar technologies and consent management

1. Purposes and rules for the use of these technologies

Cookies, browser local storage, pixels and similar technologies may be used to operate the website, save privacy choices, measure traffic and assess usability. We distinguish technical data necessary to handle a connection to the server from additional tracking of user activity.

Under Article 399 PKE, storing information on or accessing information from a user's device requires prior consent unless it is strictly necessary for transmission or for providing a service expressly requested by the user. Article 6(1)(a) GDPR is the legal basis for analysing personal data in this context.

2. Giving and changing consent: Cookiebot

Cookiebot by Usercentrics is the solution designated to manage privacy choices on the website. You may accept selected purposes, decline optional technologies and reopen the settings using the privacy button or the "Cookie settings" link.

Cookiebot processes the data necessary to remember and document your choice, including the consent identifier, the content and date of the consent, and technical information associated with giving it. The provider is Usercentrics A/S, Denmark.

3. Google Analytics 4

We use Google Analytics 4 (GA4), a service provided by Google Ireland Limited, Ireland, to measure traffic, traffic sources, the popularity of content and the effectiveness of activities leading to enquiries. We activate GA4 within the scope of the consent given for analytics.

We do not intentionally send the contents of correspondence, names, email addresses, telephone numbers, identity document details or booking data to GA4. We do not use GA4 data for remarketing campaigns.

For user and event data covered by the GA4 retention setting, we apply a retention period of 14 months, without resetting the retention period associated with an identifier when new activity occurs.

4. Usability research: Microsoft Clarity

Purpose and activation. Microsoft Clarity is a tool used to assess website usability. We use it only after obtaining prior consent covering the analysis and the disclosure of data to Microsoft. We assess which content is clear and where users encounter difficulties when using the website.

Categories of data. The analysis may include clicks, scrolling, pointer movements, navigation between pages, device and browser information, activity duration, traffic sources, approximate location and pseudonymous identifiers.

Limitations. Clarity does not cover areas accessible after logging in, payment areas, booking details or pages intended for children. Form contents and other personal data displayed on a page are excluded from recording or masked before transmission.

Provider and its role. For customers in the EU, the provider identifies Microsoft Ireland Operations Limited, with Microsoft Corporation and other group entities involved in providing the service. Microsoft processes Clarity data as a controller in accordance with its own privacy statement.

Retention. According to the Clarity documentation, ordinary session replay data is retained for 30 days from the date of recording. Click data, heatmaps and sessions that have been tagged or marked as favourites may be retained for 9 months.

Consent and opting out. Declining or withdrawing consent to Clarity does not restrict your access to information about our services or your ability to contact us. Without such consent, we do not activate data collection through Clarity.

5. Scope of consent and the current cookie declaration

Giving consent for a particular website does not automatically constitute consent to other purposes. The detailed cookie declaration available alongside the consent panel identifies the mechanisms actually used on the website, their providers, purposes and duration.

XI. Security, other websites and changes to this Policy

We implement technical and organisational measures appropriate to the risks, including access restrictions, protection of communications, system safeguards and arrangements for the secure handling of data. Access is granted to individuals and service providers who need it to perform their tasks.

Links to external websites lead to environments governed by separate privacy notices. The use of embedded maps, videos or other external components requires a separate assessment of data flows and an appropriate legal basis.

We update this Policy when there is an actual change to our services, purposes, legal bases or processing arrangements. We provide information about material changes before carrying out the processing affected by them. A new version of this document does not constitute the user's consent.

Tools and implementation scope

Scope covered by this version: 13 September 2026

The list below identifies the tools covered by this Policy. The relevant consent panel and cookie declaration indicate whether they are present and their current scope of operation. Optional tools remain inactive until they have been correctly implemented and the required consent has been obtained.

Google Analytics 4: measurement of website traffic and enquiries. Provider: Google Ireland Limited, Ireland, with the possible involvement of Google LLC and other group entities, including entities in the United States. Analytics operates following consent, without remarketing carried out by PTQV. The retention period for data covered by the relevant setting is 14 months.

Microsoft Clarity: usability research. Provider: Microsoft Ireland Operations Limited, with the possible involvement of Microsoft Corporation in the United States. Ordinary session replays are retained for 30 days. Click data, heatmaps and certain saved sessions may be retained for up to 9 months.

Cookiebot: consent management. Provider: Usercentrics A/S, Denmark. The panel manages privacy choices and cookie declarations.

Remarketing and automated lead scoring based on website visits: outside PTQV's current scope. Introducing them requires the separate definition of the processing activity, appropriate privacy information and a valid legal basis.

For questions about these tools, please use the contact form.