Data Processing Agreement
This is a courtesy translation. In case of any discrepancy, the Polish version of this document prevails. Terms for processing the personal data of guests that the user enters into the service. The agreement is concluded together with acceptance of the Terms of Service.
En vigueur depuis le 25.08.2026
1. Parties and subject matter
The controller is the service user (the accommodation property). The processor is Event Space sp. z o.o., ul. Kanarkowa 47, 11-041 Olsztyn, Polska.
Processing covers the data of people staying at the property and of contact persons on the group's side: name, contact details, type and number of identity document, address, stay dates, settlements and dietary preferences.
The sole purpose of processing is to provide the service described in the Terms of Service.
2. Obligations of the processor
We process data solely on the controller's documented instructions, which take the form of using the service's features.
We ensure that persons authorised to process the data have undertaken to maintain confidentiality.
We apply technical and organisational measures appropriate to the risk, described in the data security statement.
We assist the controller in responding to data subject requests and in meeting obligations related to personal data breaches.
3. Subprocessing
The controller gives general authorisation for the use of subprocessors for server infrastructure, email and payment handling.
We give 30 days' notice of any intended change of subprocessor, allowing an objection to be raised.
All subprocessors process data within the European Economic Area under agreements providing the same level of protection.
4. Personal data breaches
We notify the controller of any confirmed breach of the entrusted data without undue delay, and no later than 24 hours after detecting it.
The notification covers the nature of the breach, the categories and approximate number of people affected, the likely consequences and the remedial measures taken.
5. End of processing
After the contract ends we delete the entrusted data within 7 days, unless a legal obligation requires it to be retained.
Before deletion, the controller can download the complete data in JSON or CSV format from the account settings.
6. Audit
The controller has the right to audit the processing of the entrusted data, subject to arranging a date at least 14 days in advance.
On request we provide the information necessary to demonstrate compliance with the obligations under Article 28 GDPR.