← Back to the hotel
RODO / GDPR
Privacy notice
How personal data is used when you visit the website, contact the hotel, use the AI concierge or make a booking.
Effective: 22 July 2026
1. Controller and contact details
The controller for hotel enquiries, direct reservations and the operation of this website is AD-POL Michał Burowski, Sole trader (jednoosobowa działalność gospodarcza) registered in CEIDG, ul. Gołębia 2 lok. 5, 31-007 Kraków, Poland, Central Registration and Information on Business (CEIDG), maintained by the minister responsible for the economy, KRS: Not applicable — a sole trader is entered in CEIDG, not in the KRS court register, NIP: 6760124691, REGON: 122489966, share capital: Not applicable — the operator is a sole trader, not a company.Privacy questions and requests may be sent to reservations@ahsm-krakow.com. Data Protection Officer: No Data Protection Officer has been appointed; the operator is not required to appoint one. Privacy questions and requests under the GDPR go directly to the operator at the address and email above..
2. What we process and why
| Activity | Data and purpose | Legal basis | Retention |
|---|---|---|---|
| Website delivery and security | IP address, request time, browser/device data and server events used to deliver and secure the website and prevent abuse. | GDPR Art. 6(1)(f): legitimate interests in secure, reliable operation. | Server and security logs are kept for up to 90 days and then deleted automatically. They are used only to keep the website available and to investigate abuse or technical faults. |
| Enquiries and complaints | Contact details and message content used to answer, document and resolve the request. | GDPR Art. 6(1)(b), 6(1)(c) or 6(1)(f), depending on the request. | Enquiries and complaints are kept until the matter is resolved, and then for as long as a related claim could still be brought or defended under the Polish Civil Code limitation periods. Correspondence that leads to a booking is kept with that booking's records instead. |
| Booking and stay | Identity, contact, stay, guest, payment-status and preference data needed to conclude and perform the accommodation contract, meet tax/accounting duties and handle claims. | GDPR Art. 6(1)(b), 6(1)(c) and 6(1)(f). | Reservation, invoice and accounting records are kept for as long as Polish tax and accounting law requires. Under Art. 70 §1 and Art. 86 §1 of the Tax Ordinance that is five years counted from the end of the calendar year in which the tax became payable — so records of a stay are normally held into a sixth year, and longer if the limitation period is suspended or interrupted. After that they are deleted. |
| AI concierge | The prompt, chat context, locale and transient network data used to answer the user and protect the service from abuse. | GDPR Art. 6(1)(b) for the requested answer and 6(1)(f) for security. | Processed for the response; optional question analytics are retained for 90 days only when analytics consent is granted and the feature is enabled. |
| Optional analytics and Google Maps | Consent choices; anonymous page, room, section, scroll and booking-handoff events; and data required to load the third-party map. | GDPR Art. 6(1)(a) and Article 399 of the Polish Electronic Communications Law. | Until consent is withdrawn or the periods in the Cookie Policy expire. |
3. AI concierge
Messages sent to the concierge are transmitted to Anthropic solely to generate a response. Do not enter payment-card data, passwords, health information, identity-document numbers or other sensitive data.If measurement consent has been granted and the optional analytics database is configured, the hotel may also store the guest’s questions, a random session identifier, locale, model name and a salted hash of the IP address for up to 90 days. Assistant replies and raw IP addresses are not stored in that analytics table.International-transfer and processor details: The AI concierge is provided by Anthropic Ireland, Limited, which is the contracting entity for customers in the European Economic Area. Anthropic's data processing agreement, incorporating the European Commission's Standard Contractual Clauses, applies automatically under its commercial terms and covers any transfer outside the EEA (GDPR Chapter V). Messages are sent only to generate the reply shown in the chat; they are not used to build a profile of you and the hotel does not record them.. Analytics provider details: Not used. Questions asked to the AI concierge are not recorded, stored or analysed by the operator; they are only sent to the AI provider to generate the answer shown in the chat..
4. OnePageBooking
The booking engine is operated for the hotel by HotelNetSolutions GmbH, Genthiner Str. 8, 10785 Berlin, Germany. Registered at Amtsgericht Charlottenburg under HRB 101600 B, VAT ID DE 814674232.. When the user opens it, the provider processes search and booking data on behalf of, or together with, the hotel as defined by the applicable contract and notice.Booking-engine privacy notice: shown as "Privacy Policy" in the footer of the booking engine itself (it opens in the page rather than at its own web address). Processing location and safeguards: Processed within the European Economic Area. The booking engine's own privacy policy states that personal data are not transferred outside the EEA, so no Chapter V GDPR transfer mechanism is relied on for the reservation itself..
5. Customer-journey analytics
Only after measurement consent, the site may record anonymous page and room journeys, section views, scroll depth, engagement time, web-performance measurements, interactions and the point at which a guest opens the booking engine. Session recording is switched off: no replay of your screen is ever captured. Free-text messages to the AI concierge are never collected by the analytics.Campaign parameters are recorded by name, while replay URLs and captured referrers have their query strings removed. The hotel site does not send booking form contents, payment details or completed-reservation data to this analytics integration.Provider and retention details: PostHog (EU Cloud). Used only after you accept the measurement category. It records which pages and sections you view, which booking links you click and basic performance timings, so we can see where the booking journey fails. Data is processed in the European Union under PostHog's data processing agreement. Events are retained for 30 days and then deleted. Session recording is switched off, so no recording of your visit is ever made. No personal profile is built: the analytics are not linked to a named person. Declining leaves the analytics software undownloaded — no identifier or event is created at all..
6. Guest reviews
The reviews shown on this site were written by guests and published by them on public review platforms. We copy only the first name, the country the platform shows, the date, the source platform and the review text.Source, legal basis and removal: Guest reviews shown on this site are collected by ReviewPro (Shiji Group) from the public review platforms where guests posted them — Booking.com, Expedia, Google and others. Only the first name, the country if the platform shows one, the date, the source platform and the review text are copied; no surname, email address, booking reference or room number is stored. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in showing prospective guests what previous guests publicly said: the text was already published by its author under their own name, and it is used here for the same purpose it was written for. Reviews are not edited, shortened or reordered. Responses to our private post-stay survey are never published. To have a review removed from this site, delete or amend it on the platform where you posted it and it will disappear at the next refresh, or write to us and we will remove it directly.
7. Recipients
- Website hosting and infrastructure: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers are located in Falkenstein, Germany (EU/EEA)..
- Booking technology: HotelNetSolutions GmbH, Genthiner Str. 8, 10785 Berlin, Germany. Registered at Amtsgericht Charlottenburg under HRB 101600 B, VAT ID DE 814674232..
- Anthropic for AI response generation; the optional concierge analytics database provider and customer-journey analytics provider if enabled; authorised hotel staff and professional advisers; payment, accounting and public authorities where required by law.
- Google receives data only when the user consents to the embedded map or independently opens Google Maps.
8. Your rights
Depending on the legal basis and circumstances, you may request access, rectification, erasure, restriction, portability, or object to processing. Consent may be withdrawn at any time without affecting prior lawful processing. Contact reservations@ahsm-krakow.com.You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl.
9. Source, requirement and automated decisions
Data normally comes from the guest, the person making the booking, the booking engine or the systems used to deliver the website. Data needed for a reservation is contractual; without it the booking or stay may not be provided. Optional analytics and map consent is voluntary.The website itself does not make decisions producing legal or similarly significant effects. Booking-engine pricing or personalisation status: room rates are set automatically by a revenue-management system using date, length of stay, occupancy and demand. The same rate is shown to every guest searching the same room and dates: no profiling, personal data or browsing history is used to determine a price, and no personalised pricing is applied. This price-setting is not an automated decision producing legal or similarly significant effects within the meaning of Article 22 GDPR.
10. Changes
The current version and effective date appear above. Material changes will be published here and, where required, communicated directly.
Need help?
Contact us about a booking, privacy, cookies or accessibility.