← Back to the hotel
RODO / GDPR
Privacy notice
How personal data is used when you visit the website, contact the hotel, use the AI concierge or make a booking.
Effective: 22 July 2026
1. Controller and contact details
The controller for hotel enquiries, direct reservations and the operation of this website is AD-POL Michał Burowski, Sole trader (jednoosobowa działalność gospodarcza) registered in CEIDG, ul. Gołębia 2 lok. 5, 31-007 Kraków, Poland, Central Registration and Information on Business (CEIDG), maintained by the minister responsible for the economy, KRS: Not applicable — a sole trader is entered in CEIDG, not in the KRS court register, NIP: 6760124691, REGON: 122489966, share capital: Not applicable — the operator is a sole trader, not a company.Privacy questions and requests may be sent to reservations@ahsm-krakow.com. Data Protection Officer: [COMPLETE: Data Protection Officer contact details, or state that no DPO has been appointed].
2. What we process and why
| Activity | Data and purpose | Legal basis | Retention |
|---|---|---|---|
| Website delivery and security | IP address, request time, browser/device data and server events used to deliver and secure the website and prevent abuse. | GDPR Art. 6(1)(f): legitimate interests in secure, reliable operation. | [COMPLETE: actual hosting/server-log retention period] |
| Enquiries and complaints | Contact details and message content used to answer, document and resolve the request. | GDPR Art. 6(1)(b), 6(1)(c) or 6(1)(f), depending on the request. | [COMPLETE: actual enquiry and complaint retention schedule] |
| Booking and stay | Identity, contact, stay, guest, payment-status and preference data needed to conclude and perform the accommodation contract, meet tax/accounting duties and handle claims. | GDPR Art. 6(1)(b), 6(1)(c) and 6(1)(f). | [COMPLETE: actual reservation, accounting and tax-record retention schedule] |
| AI concierge | The prompt, chat context, locale and transient network data used to answer the user and protect the service from abuse. | GDPR Art. 6(1)(b) for the requested answer and 6(1)(f) for security. | Processed for the response; optional question analytics are retained for 90 days only when analytics consent is granted and the feature is enabled. |
| Optional analytics and Google Maps | Consent choices, page/feature measurement and data required to load the third-party map. | GDPR Art. 6(1)(a) and Article 399 of the Polish Electronic Communications Law. | Until consent is withdrawn or the periods in the Cookie Policy expire. |
3. AI concierge
Messages sent to the concierge are transmitted to Anthropic solely to generate a response. Do not enter payment-card data, passwords, health information, identity-document numbers or other sensitive data.If measurement consent has been granted and the optional analytics database is configured, the hotel may also store the guest’s questions, a random session identifier, locale, model name and a salted hash of the IP address for up to 90 days. Assistant replies and raw IP addresses are not stored in that analytics table.International-transfer and processor details: [COMPLETE: confirm the Anthropic contracting entity, DPA and any Chapter V GDPR transfer safeguard]. Analytics provider details: Not used. Questions asked to the AI concierge are not recorded, stored or analysed by the operator; they are only sent to the AI provider to generate the answer shown in the chat..
4. OnePageBooking
The booking engine is operated for the hotel by [CONFIRM: HotelNetSolutions legal entity operating OnePageBooking under the hotel contract]. When the user opens it, the provider processes search and booking data on behalf of, or together with, the hotel as defined by the applicable contract and notice.Booking-engine privacy notice: [COMPLETE: the privacy-policy URL shown inside the hotel’s OnePageBooking checkout]. Processing location and safeguards: [COMPLETE: OnePageBooking processing location and transfer safeguards from the DPA].
5. Recipients
- Website hosting and infrastructure: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers are located in Falkenstein, Germany (EU/EEA)..
- Booking technology: [CONFIRM: HotelNetSolutions legal entity operating OnePageBooking under the hotel contract].
- Anthropic for AI response generation; the optional analytics database provider if enabled; authorised hotel staff and professional advisers; payment, accounting and public authorities where required by law.
- Google receives data only when the user consents to the embedded map or independently opens Google Maps.
6. Your rights
Depending on the legal basis and circumstances, you may request access, rectification, erasure, restriction, portability, or object to processing. Consent may be withdrawn at any time without affecting prior lawful processing. Contact reservations@ahsm-krakow.com.You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl.
7. Source, requirement and automated decisions
Data normally comes from the guest, the person making the booking, the booking engine or the systems used to deliver the website. Data needed for a reservation is contractual; without it the booking or stay may not be provided. Optional analytics and map consent is voluntary.The website itself does not make decisions producing legal or similarly significant effects. Booking-engine pricing or personalisation status: [COMPLETE: confirm whether OnePageBooking uses personalised or automated pricing].
8. Changes
The current version and effective date appear above. Material changes will be published here and, where required, communicated directly.
Need help?
Contact us about a booking, privacy, cookies or accessibility.