LEGAL
Privacy Policy
Last updated: 13 October 2026
1. Who is the controller?
The controller of personal data processed through the Hotel Finance Lab website is Studio Finansów Sp. z o.o., ul. Bp. Piotra Tomickiego 24/91, 31-982 Kraków, Poland, KRS 0000952629, NIP 6751761234, REGON 521184761.
Hotel Finance Lab is a brand operated by Studio Finansów Sp. z o.o.
For privacy-related matters, contact:
2. What data do we process?
When you use the contact form, we may process:
- your name,
- company or hotel name, if provided,
- email address,
- the content of your message,
- the language of the enquiry.
When you visit the website, our hosting provider may process technical information necessary to deliver and secure the website, such as IP address, request information, user agent and technical server logs.
We do not use the website for advertising profiling or marketing tracking.
3. Why do we process your data?
We process contact-form and correspondence data in order to:
- respond to your enquiry,
- discuss potential cooperation,
- take steps requested by you before entering into a contract,
- manage related correspondence.
Where your enquiry concerns potential cooperation or a contract, the legal basis is Article 6(1)(b) GDPR.
For general enquiries and necessary correspondence, the legal basis may be our legitimate interest in communicating with people who contact us and managing business enquiries, under Article 6(1)(f) GDPR.
Technical data connected with hosting and website security may be processed on the basis of our legitimate interest in operating, securing and maintaining the website.
4. Who may receive your data?
We use service providers that support the operation of the website and email communication, including:
- Vercel — website hosting and technical infrastructure,
- Resend — delivery of contact-form messages,
- home.pl — email mailbox and email hosting.
These providers process data only to the extent necessary to provide their services and in accordance with applicable contractual and data-protection requirements.
We do not sell personal data.
5. International data transfers
Some service providers may process data outside the European Economic Area.
Where such transfers occur, they are carried out using safeguards required by applicable data-protection law, such as adequacy decisions or Standard Contractual Clauses, where applicable.
6. How long do we keep data?
Enquiries and correspondence that do not lead to an ongoing contractual relationship are generally retained for up to 12 months from the last substantive contact.
If the correspondence leads to a contract or ongoing cooperation, relevant data may be retained for the duration of that relationship and afterwards for periods required by law or necessary to establish, exercise or defend legal claims.
Technical logs are retained according to the operational and security settings of the relevant infrastructure providers and only for as long as necessary for those purposes.
7. Your rights
Subject to the conditions set out in the GDPR, you may have the right to:
- access your personal data,
- rectify inaccurate data,
- request erasure,
- request restriction of processing,
- object to processing based on legitimate interests,
- receive data in a portable format where the right to portability applies.
Where processing is based on consent, you may withdraw consent at any time. The current contact form does not rely on consent as its primary legal basis.
To exercise your rights, contact:
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO).
8. Automated decision-making
We do not use personal data collected through this website for automated decision-making or profiling.
9. Security
We use technical and organisational measures appropriate to the nature of the website and the data processed to reduce the risk of unauthorised access, loss or misuse.
No method of electronic transmission or storage can be guaranteed to be completely secure.
10. Cookies and analytics
The website currently does not use analytics, advertising or marketing tracking tools.
The website does not intentionally set non-essential cookies or use browser storage for tracking.
See our Cookies Policy for more information.
11. Changes to this Privacy Policy
We may update this Privacy Policy when the website, our services or applicable legal requirements change.
The current version and its update date will always be available on this page.