Privacy policy

Stara Piekarnia — Ogrodowa 6A, 59-600 Lwówek Śląski, Poland

Effective: 26 Oct 2026. Version 1.1 (adds section 3a on the phone receptionist).

This policy describes how personal data is collected, processed, and protected for people using stara-piekarnia.com and making reservations at the “Stara Piekarnia” property. It has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

1. Data controller

The controller of your personal data is:
Expanding Web Marcin Dancewicz
ul. Malinowskiego 1, 59-600 Lwówek Śląski, Poland
Tax ID (NIP): PL6161455447, REGON: 369984358
tel.: +48 517 681 441
email: rezerwacje@stara-piekarnia.com

For any data-processing matters, please contact us at the email above.

2. Data collected

When making a Reservation we collect:

• full name,
• email address,
• phone number,
• stay dates and number of guests,
• optional message / request.

In addition:

• payment data (card number, transaction token) is collected exclusively by the payment provider Stripe — we only receive payment confirmation and transaction id; we do not have access to the card number;
• IP address and connection timestamps (server logs) — to the extent necessary to ensure site security.

3. Purposes and legal bases for processing

3a. Phone receptionist (Nina)

When you call Stara Piekarnia, the call may be answered by Nina — an AI receptionist (artificial intelligence, not a person). She says so at the start of every call and tells you the call is recorded. At your request she can transfer the call to the host.

From each call we store your phone number, the date, time and duration of the call, and a text transcript with a summary of your request — it goes to our company email inbox (Google Workspace) and to our own server in the EU. We record the whole call: the audio recording is kept on our own server in the EU for up to 31 days, and a copy in Google Cloud Storage in the EU for 90 days from upload (after that it may stay in the bin for up to 7 more days before it is gone for good). We use recordings to check the quality of the answers and to clarify the matter if there is a dispute.

Call details (number, date, duration) are kept on our server for no longer than 12 months. If the call concerned a reservation, its content stays with the reservation records (periods in the table above).

Call audio is processed in real time on our behalf by OpenAI (provider of the voice interface, USA); transfers outside the EEA rely on the EU–US Data Privacy Framework and standard contractual clauses. The call is connected by our telephone operator FCN (Poland). Legal basis: handling your request and reservation before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in handling calls properly (Art. 6(1)(f) GDPR). The controller of this data is Expanding Web Marcin Dancewicz (section 1). Nina makes no decisions with legal effect about you.

4. Data recipients

Your data may be shared with the following processors:

• Stripe Payments Europe, Ltd. (Ireland) — payment processing. Stripe processes full card data; we only receive the payment status.
• Google Ireland Ltd. — email provider (Google Workspace) receiving reservation messages, and web-font provider (Google Fonts) used to render the page.
• OpenAI (USA) — real-time voice processing during calls with the phone receptionist Nina (section 3a).
• FCN (Poland) — telephone operator that connects calls with Nina (section 3a).
• Hosting provider — the site runs on a server owned by the Controller, hosted on Google Cloud Platform infrastructure (Netherlands region).
• Public authorities — only to the extent required by law.

5. Transfers outside the EEA

We use services that may transfer data outside the European Economic Area (notably Google and OpenAI — USA). Such transfers take place on the basis of Standard Contractual Clauses approved by the European Commission, or adequacy decisions (EU-U.S. Data Privacy Framework). Stripe processes data within the EEA (Ireland).

6. Your rights

In connection with the processing of your data you have the following rights:

• right of access — to learn what data we hold,
• right to rectification — of inaccurate or incomplete data,
• right to erasure (“right to be forgotten”) — to the extent it does not conflict with the Controller’s legal obligations,
• right to restriction of processing,
• right to data portability,
• right to object — in case of processing based on legitimate interest,
• right to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise these rights, please email: rezerwacje@stara-piekarnia.com.

7. Profiling and automated decision-making

We do not use profiling or automated decision-making within the meaning of art. 22 GDPR.

8. Cookies

The site uses cookies to a minimal extent:

• Our (functional) cookies: sp_sess — a session cookie set only after logging into the admin panel. Necessary for login to work, expires when the browser is closed. Consent is not required (art. 173(3) of the Polish Telecommunications Act).
• Third-party cookies: Google Fonts may set cookies on its own domains when loading typefaces. Stripe sets its own cookies only on its own site (stripe.com) when you proceed to payment.

We do not use analytics tools (Google Analytics, Facebook Pixel, etc.) or marketing cookies.

You can manage cookies in your browser settings — blocking the session cookie will prevent logging into the admin panel.

9. Security

We use technical and organisational data-protection measures, including HTTPS encryption, limited database access, passwords hashed with bcrypt, and regular software updates. Despite these measures, we encourage you to be cautious when sharing data online.

10. Changes to the policy

This policy may be updated from time to time (for example, in case of legal or technical changes). The current version is always available at: stara-piekarnia.com/polityka-prywatnosci.php (Polish, binding) or stara-piekarnia.com/en/privacy (English translation).