Privacy policy

This page describes what data the hoteltoscania.pl website collects, why we process it and who we pass it to.

1. Data controller

The controller of your personal data is MARIUSZ PYTLIK-FIRMA 1.TOSCANIA (Mariusz Pytlik, a sole proprietorship entered in the Polish business register CEIDG), ul. Karola Kurpińskiego 24, 64-140 Włoszakowice, Poland, tax ID (NIP) 6972172772, REGON 301069970. The business runs Hotel Toscania (ul. Spokojna 4a, 64-140 Włoszakowice), Toscania Restaurant (ul. K. Kurpińskiego 24, 64-140 Włoszakowice) and the hoteltoscania.pl website.

For personal data matters, write to our data protection officer: iod@hoteltoscania.pl. You can also send a letter to the business address marked “Data Protection Officer”.

2. Purposes and legal bases of processing

Forms and enquiries. You provide your first and last name (on the wedding form, the couple's names), an email address or phone number and your message, and on some forms also a subject, dates and the number of guests. We also record which page the form was sent from. We use this data to reply and to prepare an offer. The legal basis is the consent you tick on the form (Art. 6(1)(a) GDPR) and, when you ask about our services, steps taken before entering into a contract (Art. 6(1)(b) GDPR). After the matter is closed we keep the correspondence so that we can show how it went and defend ourselves against claims (Art. 6(1)(f) GDPR).

Newsletter. You provide your email address and, if you wish, a phone number. We send information about events at Toscania and about the 10% discount on advance tickets. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to recepcja@hoteltoscania.pl.

Online room booking. The booking module is supplied by PREVIO s.r.o. of Prague. You enter the data needed for the booking there. We process it to conclude and perform the contract (Art. 6(1)(b) GDPR) and to meet accounting and tax obligations (Art. 6(1)(c) GDPR). The module has its own information on data and cookies, available at the bottom of the module.

Hotel stays and CCTV. We process guests' data to perform the contract for hotel or catering services (Art. 6(1)(b) GDPR), to meet tax obligations (Art. 6(1)(c) GDPR) and to pursue claims (Art. 6(1)(f) GDPR). CCTV serves the safety of people at Toscania (Art. 6(1)(f) GDPR).

Statistics. With your consent (Art. 6(1)(a) GDPR) we use Google Analytics to measure visits and how the site is used, including clicks on the phone number and email address and the sending of a form, without its content.

Website security. Server logs (IP address, time, page address, browser data) and a limit of 5 form submissions in 10 minutes protect the site against abuse (Art. 6(1)(f) GDPR). For the limit we store a hash of the IP address, not the address itself.

3. Data recipients

Form submissions and newsletter sign-ups go by email to the staff handling the relevant department (weddings, conferences, parties, hotel, restaurant) and to reception. A copy of every submission goes to a designated person at Toscania and to the company that maintains the website (Digital Voice). Submissions are also stored in the website's admin panel.

We use these providers: home.pl S.A. (website hosting and email), PREVIO s.r.o. of Prague (booking system), Google Ireland Limited (Analytics, Maps, YouTube, reCAPTCHA), Lapentor (virtual tour) and PayU S.A., ul. Grunwaldzka 186, 60-166 Poznań, which is also the controller of the payer's data. Where necessary, data may also be received by our accounting office, legal advisers and authorities entitled under the law.

Google may transfer data to the USA on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework). Lapentor stores data on servers in the USA and is itself responsible for data connected with its service; see the Lapentor privacy policy.

4. Retention period

Form enquiries: 2 years from the last contact. If we conclude a contract, we keep the data as contract data.

Newsletter: until you withdraw your consent.

Bookings, stays and orders: for the duration of the contract, then until claims expire and for as long as tax and accounting rules require.

CCTV: 14 days from recording, unless the recording is needed in proceedings conducted by the competent authorities.

Google Analytics: 2 months.

Server logs: about 14 days, at the hosting provider.

IP address hash for the submission limit: up to one day.

5. Rights of the data subject

You have the right to access your data, to have it rectified or erased, to restrict its processing and to data portability, and the right to object to processing based on legitimate interest. You can withdraw consent at any time; this does not affect the lawfulness of earlier processing. Send your request to iod@hoteltoscania.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO; ul. Stawki 2, 00-193 Warsaw, Poland).

Providing data is voluntary, but without the required fields we cannot send the form, sign you up for the newsletter or accept a booking or order. We do not make decisions producing legal effects about you by solely automated means. The reCAPTCHA service may automatically stop a form it considers spam; if that happens, call us or send us an email.

6. Cookies and external tools

You can change or withdraw your consent to statistics and the map at any time under “Cookie settings” in the page footer.

Your choice. We remember it in your browser's storage (toscania_consent_v1) until you delete it. We also keep interface texts there and, in the Christmas shop, your basket until you close the tab. They contain no personal data.

Google Analytics 4. The script loads only after consent. It stores the _ga and _ga_MK2JT9RFCG cookies, valid for up to 2 years. If you withdraw consent, we delete them.

Google Maps. The directions map loads after consent or after you click “Show map”. Google then receives, among other things, your IP address and may store its own cookies.

YouTube video. It loads only after you click, from the youtube-nocookie.com domain. Google then receives, among other things, your IP address, and YouTube may store its own cookies.

Google reCAPTCHA v3. It protects forms against spam (Art. 6(1)(f) GDPR). The script loads when you start filling in a form or send it. Google then receives, among other things, your IP address and data about your browser and your use of the site, and may store the _GRECAPTCHA cookie.

Previo booking module. It loads only after you click the button on a booking page or on the home page. It then connects to Google (fonts, Tag Manager, Analytics, DoubleClick) and stores cookies on the previo.app domain. These are not our statistics: the information in the module describes them.

Lapentor virtual tour. It loads only after you click the button on the tour page. It then connects to Google (reCAPTCHA, Tag Manager, fonts) and stores the cf_clearance cookie on the lapentor.com domain.

Fonts come from our own server, with no connection to Google. Facebook and Instagram are plain links, with no plug-ins from those services. On the weddings page, the weselezklasa.pl button loads an image from that service's server, which then sees your IP address. The toscania_cms cookie is stored only for staff logging in to the admin panel.

Google's rules: privacy policy, how Google uses data from partner sites. You can also delete or block cookies in your browser settings.

7. Orders in the Christmas shop

When you place an order on the /sklep-swiateczny/ page (in Polish), you provide your first and last name, phone number, email address and any comments. We process the data to conclude and perform the contract, send a confirmation and contact you about collection (Art. 6(1)(b) GDPR), to meet accounting and tax obligations (Art. 6(1)(c) GDPR) and to pursue or defend ourselves against claims (Art. 6(1)(f) GDPR). Providing the data is voluntary, but without it we cannot accept the order. The data can be accessed by staff handling orders, the hosting and email providers and the company that maintains the website. Point 4 describes the retention period. To protect the form against abuse, we store a hash of the IP address for one day.

8. Vouchers

When you place an order on the /voucher/ page (in Polish), you provide your first and last name and email address and, if you want an invoice, also your tax ID (NIP), company name and address. We also record the date of your consent to the terms, the transaction number, the voucher number and balance, and its usage history. We process the data to conclude and perform the contract, send the voucher and settle the balance (Art. 6(1)(b) GDPR), to meet accounting and tax obligations (Art. 6(1)(c) GDPR) and to pursue or defend ourselves against claims (Art. 6(1)(f) GDPR). Providing the data is voluntary, but without it we cannot accept the order.

Payment is handled by PayU S.A., ul. Grunwaldzka 186, 60-166 Poznań, which is also the controller of the payer's data. We pass it your email address, IP address, the amount and the transaction identifier. Its privacy statement describes the rules. We do not receive card details or bank login details. There are no PayU scripts or additional cookies on our website.

The data can be accessed by staff handling vouchers, the hosting and email providers and the company that maintains the website. We delete unpaid orders after 30 days and keep paid orders in accordance with point 4. To protect the form against abuse, we store a hash of the IP address for one day.

9. Changes to this policy

When we change our rules or tools, we will update this page. This policy applies from 5 November 2026.

This is a translation. If the language versions differ, the Polish version prevails.