Privacy policy

§ 1. General information

1. The website whataboat.pl (hereinafter: “Website”) is operated by Wiktoria Majcher, a sole trader operating under the business name What a boat – Wiktoria Majcher, Liliowa 5, 32-061 Rybna, Poland, NIP: 8943264797, REGON: 542251159, email: ahoy@whataboat.pl (hereinafter: “Controller”).
2. In connection with the operation of the Website, data of Website users (hereinafter: “Users”), including personal data, may be collected, processed and used.
3. Users’ data may be collected as a result of Users voluntarily providing it (e.g. when making an online booking, where in the booking form Users provide, among other things: first name and surname, email address, telephone number, and the data necessary to process the payment) or through the use of cookies.
4. The following may also be collected: information about the User’s IP address, the time the request arrived and the response was sent, the address of the website from which the User was redirected to the Website, and the type of software the User uses. This information is used for the purposes of administering the Website and creating statistics and analyses.
5. This Privacy Policy concerns the processing of personal data in connection with the use of the Website and the making of online bookings. If the hire agreement is concluded in person (on site at the Boat Hire), the rules for the processing of personal data are set out directly in the hire agreement and in the Terms and Conditions appended to it.

§ 2. Personal data

1. The controller of Users’ personal data is Wiktoria Majcher, a sole trader operating under the business name What a boat – Wiktoria Majcher, Liliowa 5, 32-061 Rybna, Poland, NIP: 8943264797, REGON: 542251159, email: ahoy@whataboat.pl.
2. Through the Website, the Controller may collect and then process personal data for purposes such as:
   • the proper performance of the booking and the conclusion and performance of the boat hire agreement, including an agreement concluded at a distance through the online booking system;
   • handling and settling payments for bookings made online;
   • responding to the User’s enquiries or correspondence, including handling complaints;
   • meeting the legal obligations incumbent on the Controller, in particular tax and accounting obligations (including issuing a receipt or invoice);
   • establishing, pursuing or defending claims;
   • statistics and analysis of Users’ behaviour on the Website.
3. The Controller processes personal data on the following bases:
   • for data processed in order to perform the booking and to conclude and perform the hire agreement, including payment handling – processing necessary to perform the agreement (Article 6(1)(b) GDPR);
   • for data processed in order to meet legal obligations, in particular tax and accounting ones – on the basis of Article 6(1)(c) GDPR;
   • for data processed in order to respond to enquiries or correspondence and to handle complaints – on the basis of the Controller’s legitimate interest, namely communicating with the User and handling complaints (Article 6(1)(f) GDPR);
   • for data processed in order to establish, pursue or defend claims – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR);
   • for data processed in order to keep statistics and analyses – on the basis of the Controller’s legitimate interest, namely verifying how Users use the Website (Article 6(1)(f) GDPR).
4. The Controller may disclose Users’ data to its subcontractors (entities whose services it uses in processing), such as: an accounting office, the online payment provider (Mollie B.V., based in Amsterdam), the boat’s insurer, the hosting provider and the online booking-system provider, as well as other providers of IT services and solutions.
5. The Controller may use IT service providers based outside the European Economic Area. As a result, the User’s data may be transferred outside the EEA. The Controller uses only services supplied by entities based in countries which the European Commission has found to provide an adequate level of protection, by entities processing personal data on the basis of Standard Contractual Clauses adopted by the European Commission, as referred to in Article 46 GDPR and concluded between the Controller and that entity, or by entities processing data under the Data Privacy Framework.
6. The retention periods for personal data are as follows, for data processed in order to:
   • perform the booking and conclude and perform the hire agreement, including payment handling – the data is kept for the period of performance of the agreement and for the period necessary to pursue the Controller’s own claims or to defend against claims, and for the period required by tax law (as a rule, 5 years counted from the end of the calendar year in which the tax payment deadline fell);
   • respond to the User’s enquiries or correspondence – the data is processed for a period of 3 years from the date the enquiry or correspondence was sent;
   • keep statistics and analyses of Users’ behaviour on the Website – the data is processed for a maximum of two years from the date it was collected.
7. The User to whom the data relates has the following rights:
   • the right to access personal data and to receive a copy of it – the User may ask the Controller whether their data is being processed and, if confirmed, request access to it and a copy of the processed personal data;
   • the right to request rectification of personal data – the User may request the rectification of incorrect personal data or the completion of incomplete personal data, taking into account the purposes of processing;
   • the right to request erasure of personal data;
   • the right to request restriction of processing of personal data;
   • the right to data portability;
   • the right to object to the processing of personal data;
   • the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office.
     To exercise the above rights, the User should contact the Controller.
8. Providing personal data is voluntary; however, without it, it will not be possible to perform the booking, to conclude and perform the hire agreement, or to contact the Controller.
9. The Controller does not take decisions in relation to Users based solely on automated processing, including profiling.

§ 3. Cookies

1. In connection with the operation of the Website, cookies stored on Users’ end devices are used. The use of cookies means their storage and the obtaining of access to them by the Controller.
2. Cookies are IT data, in particular text files, which are stored on the User’s end device and are intended for use of websites. Cookies usually contain the name of the website they come from, the time they are stored on the end device, the content (e.g. action identifiers) and a unique number.
3. Depending on the time for which cookies are installed on the User’s end device, the cookies used on the Website fall into two basic types:
   • session cookies (session storage) – these are temporary files stored on the User’s end device until the session ends (e.g. leaving the Website, the User deleting them, or switching off the software);
   • persistent cookies (local storage) – stored on the User’s end device for the time specified in the cookie parameters or until the User deletes them.
4. Depending on the purpose for which they are used, cookies fall into:
   • necessary – required for the proper functioning of the Website, including ensuring security, handling sessions, handling bookings and payments, and the consent-management mechanism;
   • preferences – enabling a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.
   • statistics – enabling the measurement of traffic on the Website and analysis of the use of the services;
   • marketing – displaying ads that are relevant and engaging for the individual user.
5. On the Website, the Controller uses the following cookies:

Necessary

Name	Provider	Storage period	Cookie description
CookieConsent	Cookiebot	1 year	Stores the user’s cookie consent state for the current domain.

Preferences

Name	Provider	Storage period	Cookie description
pll_language	Polylang	1 year	Stores the visitor’s preferred language so the website is displayed in the correct language on return visits. Set by the Polylang plugin.

Statistics

Name	Provider	Storage period	Cookie description
_ga	Google	2 years	Set by Google Analytics to distinguish unique users by assigning a randomly generated ID. Enables traffic analysis and reporting on website usage.
_ga_YLGTPP9RRW	Google	2 years	Stores a unique session ID used by Google Analytics 4 to track user sessions and interactions across the website. This is the GA4 container-specific variant of the _ga cookie.
_clck	Microsoft	1 year	Persists a unique user ID used by Microsoft Clarity to track visits and behaviour across the website. Helps build session recordings and heatmaps.
_clsk	Microsoft	1 day	Stores a unique session ID used by Microsoft Clarity to combine page views belonging to the same visit into a single session recording.

Marketing

Name	Provider	Storage period	Cookie description
_gcl_au	Google	3 months	Set by Google Tag Manager to store and track conversion events. Used by Google Ads to measure the effectiveness of advertising campaigns and attribute conversions.
_fbp	Meta	3 months	Set by Meta (Facebook) Pixel to identify browsers and track visits across websites in order to measure and deliver personalised advertising.
_tt_enable_cookie	TikTok	13 months	Set by TikTok Pixel to confirm that the visitor has consented to marketing cookies. Required for GDPR-compliant use of TikTok advertising tools.
_ttp	TikTok	13 months	Set by TikTok Pixel to build a profile of the visitor’s interests and show relevant TikTok ads. Tracks user behaviour across websites that use TikTok advertising tools.
ttcsid	TikTok	3 months	Set by TikTok to track user sessions and attribute conversions to TikTok ad campaigns. Stores a unique session identifier linked to the TikTok Pixel.
ttcsid_D8MK9QJC77U9RJN7A0UG	TikTok	3 months	A pixel-specific variant of the ttcsid cookie. Set by TikTok to track user sessions and attribute conversions to the specific TikTok Pixel installed on this website.

6. The default settings of internet browsers usually allow necessary cookies to be stored on the end devices of website users.
7. Personal data will be processed in connection with the use of cookies other than necessary only after the User’s consent to the use of such cookies has been obtained while using the Website. Consent to their use may be withdrawn at any time by selecting the relevant option in the cookie settings available on the Website.
8. Notwithstanding the above, the User may set the conditions for the use of cookies through the settings of the software (internet browser) installed on their end device. The change may consist in partially or fully limiting the ability to store cookies on the User’s end device, which may at the same time cause the content of the Website to be displayed incorrectly.
9. The use of cookies does not cause configuration changes to the User’s end device or the software installed on that device.
10. Detailed information on changing browser settings relating to cookies and on deleting them can be found on the official website of the particular browser. In particular, the above information can be found at the following web addresses:
• Firefox browser;
• Chrome browser;
• Microsoft Edge browser;
• Opera browser;
• Safari browser;