I. General Provisions
This Privacy Policy defines how Users’ personal data is collected, processed, and stored in order to provide services electronically via the website https://balticwavesresort.pl/ (hereinafter: the Website).
The Website collects only the personal data necessary for the provision and development of services offered therein.
Personal data collected through the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter GDPR), and the Personal Data Protection Act of 10 May 2018.

II. Data Controller
The controller of personal data collected via the Website is PI Apartments sp. z o.o, address: Piastowska 44D, 30-070 Kraków, Poland, KRS: 0000763166, NIP: 6793178120, REGON: 382064372 (hereinafter: the Controller).

III. Purpose of Data Collection
Personal data is used for the following purposes:

• account registration and User identity verification,

• enabling Website login,

• performance of contracts and e-services,

• communication with the User (live chat, contact form, etc.),

• sending newsletters (upon User consent),

• operating a comment system,

• providing community services,

• promoting the Controller’s offer,

• marketing, remarketing, and affiliate programs,

• personalizing the Website for Users,

• analytical and statistical purposes,

• debt recovery,

• establishing, exercising, or defending legal claims.

Providing data is voluntary but necessary to conclude a contract or use other Website functionalities.

IV. Type of Processed Personal Data
The Controller may process the following User personal data: full name, date of birth, residential address, email address, phone number, and tax identification number (NIP).

V. Data Retention Period
Users’ personal data will be processed:

• where the basis is the performance of a contract — until the statute of limitations for claims following its execution,

• where the basis is consent — until it is withdrawn, and after withdrawal, until the statute of limitations for claims.

The general limitation period is 6 years, and 3 years for periodic benefits and business-related claims (unless otherwise specified by law).

VI. Sharing Personal Data
Users’ personal data may be shared with: entities affiliated with the Controller, subcontractors, partners cooperating with the Controller, e.g., online payment operators, courier/postal companies, legal firms.
Personal data will not be transferred outside the European Economic Area (EEA).

VII. Users’ Rights
Users have the right to access their personal data, rectify it, erase it, restrict its processing, transfer it, object to its processing, and withdraw consent at any time (without affecting the legality of processing based on consent before its withdrawal).
Requests to exercise these rights should be sent to: pi@pimanagement.pl.
The Controller will comply or refuse to comply with the request promptly — within one month at the latest.
Users may file a complaint with the President of the Personal Data Protection Office if they believe their data is being processed in violation of the GDPR.

VIII. Cookies
The Website collects information via cookies — session, persistent, and third-party cookies.
Cookie collection supports proper service delivery and statistical purposes.
Users can define cookie access scope via their browser settings.

IX. Automated Decision-Making and Profiling
Users’ data is not subject to automated decision-making that could affect them legally or otherwise.
Users’ data may be profiled to customize content and personalize offers, only with their consent.

X. Final Provisions
The Controller reserves the right to amend this Privacy Policy without limiting Users’ rights.
Information about changes will be published as a notice on the Website.
Matters not regulated herein are governed by the GDPR and applicable Polish law.