Privacy

Privacy Policy and Cookies Policy

TMS Park Sp. z o.o. – Holiday Inn Resort Warszawa–Józefów TMS Park Sp. z o.o. ("TMS Park", "Hotel", "we", "us", "our", "Controller") attaches great importance to the protection of privacy and the security of personal data. This Privacy Policy explains how, why, and for how long we process personal data. It also sets out your rights in relation to the processing of your personal data. The Hotel processes the personal data of its guests, business partners, and other individuals who are interested in the Hotel's services or cooperate with the Hotel. Please read this Privacy Policy carefully, as it explains your rights regarding the processing of your personal data.

Who is the Data Controller?

The controller of your personal data is:

TMS Park Sp. z o.o.
ul. Telimeny 1
05-420 Józefów
Poland

Company Registration Number (KRS): 0000207487 Where the personal data of Hotel guests is processed for the purposes of the loyalty programme operated by InterContinental Hotels Group (IHG), the controller of such personal data is Six Continents Hotels, Inc., a company within the IHG group. For more information, please refer to the IHG Privacy Statement available on the official IHG website.

Why and on what legal basis do we process personal data?

We process personal data for various purposes.

I. Personal Data of Hotel Guests

We process the personal data of our guests in order to provide hotel accommodation services and related services. We process not only the personal data of individuals who have entered into an accommodation agreement directly with us, but also the personal data of accompanying persons or beneficiaries of our services (for example, participants of events or receptions held at the Hotel). We also process guests' personal data for the purpose of:

• improving the quality of our services,
• forecasting future demand for our services,
• complying with the operational standards of the Holiday Inn Resort brand.

In addition, we process personal data for tax and accounting purposes, including issuing VAT invoices and fulfilling obligations arising under applicable laws. The Hotel also operates CCTV surveillance systems. Personal data collected through video monitoring is processed to ensure the safety and security of Hotel guests, visitors, employees, and to protect the Hotel's property. The legal basis for processing guests' personal data is primarily:

• Article 6(1)(b) GDPR – processing necessary for the performance of a contract;
• Article 6(1)(c) GDPR – processing necessary for compliance with legal obligations;
• Article 6(1)(f) GDPR – processing based on the legitimate interests pursued by the Hotel.

II. Personal Data of Individuals Interested in Hotel Services

We process personal data of individuals who express an interest in our services, including those who contact us by telephone, email, or through contact forms available on our website. The purpose of processing is to enable communication and provide information regarding our services. The legal basis for such processing is Article 6(1)(f) GDPR, namely the legitimate interest of the Hotel in responding to enquiries and establishing business relationships.

III. Personal Data of Persons Entering into Agreements with the Hotel

When entering into a cooperation agreement or any other contract with TMS Park Sp. z o.o., the Hotel processes the personal data of individuals representing its contractors for the purpose of performing the agreement. The legal basis for such processing is Article 6(1)(f) GDPR, reflecting the legitimate interests of both parties in executing the contractual relationship.

IV. Personal Data Relating to Complaints, Claims and Legal Disputes

If a complaint or claim is submitted in connection with our services, we process personal data for the purpose of handling and resolving such complaint. Where a legal dispute exists, personal data may also be processed for the establishment, exercise, or defence of legal claims. The legal basis for this processing is Article 6(1)(f) GDPR, based on the Hotel's legitimate interest in protecting its legal rights.

V. Personal Data Processed During Recruitment

The Hotel processes the personal data of job applicants during recruitment processes. Such data is processed:

• in order to comply with legal obligations,
• based on the legitimate interests of the Hotel,
• and, where necessary for concluding an employment contract, for the performance of pre-contractual measures.

The legal bases are:

• Article 6(1)(b) GDPR,
• Article 6(1)(c) GDPR,
• Article 6(1)(f) GDPR.

What are the consequences of not providing personal data?

Failure to provide the personal data required by the Hotel may result in the inability to:

• provide hotel accommodation or related services,
• conclude or perform a contract,
• establish contact or respond to enquiries,
• process reservations or requests,
• fulfil legal obligations arising from applicable regulations.

Where the provision of personal data is required by law or is necessary for the performance of a contract, failure to provide such data may prevent the Hotel from delivering its services.

Who may receive your personal data?

For the purposes of conducting our business activities, we may entrust personal data to service providers acting on our behalf or disclose personal data to our business partners where necessary. Recipients of personal data may include, in particular, entities providing:

• accounting and auditing services,
• banking and insurance services,
• security services,
• transport and taxi services,
• IT support and software development services,
• legal and advisory services.

Personal data may also be disclosed to public authorities where required by law, including courts, law enforcement authorities, tax authorities, or other competent governmental institutions. Where a guest participates in the IHG One Rewards loyalty programme, personal data may also be shared with InterContinental Hotels Group companies and affiliated entities operating within the IHG hotel network, to the extent necessary for the operation of the programme.

Contact regarding personal data

Should you have any questions concerning the processing of your personal data, you may contact the Hotel at:

TMS Park Sp. z o.o.
ul. Telimeny 1
05-420 Józefów
Poland

or by email at: iod@holiday.tmspark.pl

Your rights regarding personal data processing

Under the General Data Protection Regulation (GDPR), you are entitled to exercise the following rights:

1. Right to Information

You have the right to obtain information regarding the processing of your personal data, including:

• the purposes of processing,
• the categories of personal data processed,
• the recipients of your personal data,
• the legal basis for processing,
• the period for which your data will be retained.

This Privacy Policy is intended to fulfil our obligation to provide such information.

2. Right to Lodge a Complaint

If you believe that your personal data is being processed unlawfully, you have the right to submit a complaint directly to the Hotel. You also have the right to lodge a complaint with the competent supervisory authority responsible for data protection in your country. In Poland, this authority is:

President of the Personal Data Protection Office (UODO)
ul. Stawki 2
00-193 Warsaw
Poland

3. Right of Access

You have the right to obtain confirmation as to whether your personal data is being processed and to receive a copy of the personal data held by the Hotel.

4. Right to Erasure and Right to Object

You have the right to request the deletion of your personal data where there is no legal basis for further processing. You may also object to the processing of your personal data where such processing is based on the legitimate interests of the Hotel.

5. Right to Restriction of Processing

You may request that the processing of your personal data be restricted in situations provided for by applicable law.

6. Right to Rectification

You have the right to request the correction or completion of inaccurate or incomplete personal data concerning you.

7. Right to Data Portability

Where processing is based on consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

How can you exercise your rights?

To exercise any of the rights described above, you may contact the Hotel directly in writing or by email. Requests concerning access to personal data should be submitted in writing or electronically. Where reasonable doubts exist regarding the identity of the person making the request, the Hotel may request additional information necessary to verify the identity of the applicant before processing the request.

Retention periods for personal data

The Hotel retains personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable law.

Hotel accommodation services

Personal data is processed throughout the duration of the accommodation agreement and retained for six (6) years following its termination.

Other agreements

Personal data processed in connection with contracts other than accommodation agreements is retained throughout the duration of the agreement and for six (6) years after its termination.

Recruitment processes

Personal data of job applicants is processed for the duration of the recruitment process and retained for one (1) year following its completion.

Complaints and claims

Personal data relating to complaints or claims is retained for six (6) years from the date of submission or from the conclusion of the complaint-handling process.

Contact enquiries

Personal data collected through enquiries submitted by telephone, email, or contact forms is retained for three (3) years from the date of the last contact.

Cookies Policy
General Information
What are cookies?

Cookies are small text files stored on a user's device when visiting a website. They enable websites to function properly, improve user experience, remember preferences, and collect analytical information regarding website usage. Cookies do not normally contain information that directly identifies an individual user, although the information stored in cookies may be linked with personal data held by the Hotel. What is device recognition? Device recognition refers to technologies that enable a website to identify certain characteristics of the device used to access it. These technologies may detect information such as:

• device type,
• operating system,
• browser type,
• time zone,
• screen and resolution,
• language settings,
• technical configuration.

The purpose of device recognition is to optimise the appearance, functionality, and performance of the website for different devices. This information is used solely for technical purposes and does not allow the Hotel to identify an individual user. What other information does the Hotel use? The Hotel also uses information resulting from standard Internet communications, including data contained in server logs such as:

• IP address,
• date and time of access,
• browser type,
• operating system,
• referring website.

Such information is processed for technical purposes related to website administration, security monitoring, and system maintenance. IP addresses may also be used to generate anonymous statistical reports concerning website traffic and visitor demographics. Use of Cookies The Hotel uses cookies and similar technologies to facilitate the operation of its websites and improve the quality of services provided. For the purposes of this Policy, all similar technologies are collectively referred to as "cookies". Types of cookies used by the Hotel
Session Cookies Session cookies are temporary files that remain stored on the user's device only for the duration of a browsing session. They are automatically deleted when the browser is closed. Persistent Cookies Persistent cookies remain stored on the user's device for a specified period or until they are manually deleted. Unlike session cookies, they are not removed when the browser is closed. First-Party Cookies First-party cookies are placed directly by the Hotel's website and are used to ensure its proper functioning and improve user experience. Third-Party Cookies Third-party cookies are placed by external service providers whose services are integrated into the Hotel's website, including analytical and marketing tools such as Google Analytics. The Hotel uses both first-party and third-party cookies where appropriate. Why does the Hotel use cookies? Cookies are essential for providing core website functionalities and ensuring the proper operation of our online services. In particular, first-party cookies enable:

• the correct display of website content,
• the operation of contact forms,
• maintenance of user sessions,
• website security,
• technical functionality of the website.

Performance and optimisation Cookies are also used to improve website performance and optimise content based on user preferences and browsing behaviour. They allow us to understand how visitors interact with our website and help us enhance its usability and functionality. Analytics and statistics Analytical cookies, including those provided by third parties, enable the Hotel to collect anonymous statistical information such as:

• number of visitors,
• duration of visits,
• pages viewed,
• navigation paths,
• website performance.

This information is aggregated and anonymous and cannot be used by the Hotel to identify individual users. Marketing and remarketing The Hotel may use cookies for advertising and remarketing purposes. Remarketing cookies allow advertisements relating to the Hotel's services to be displayed on other websites visited by users after they leave our website. These technologies may use browsing history and interactions with our website to deliver more relevant advertising content. Marketing cookies may include both first-party and third-party cookies. Does the Hotel sell or share cookies with other companies? No. The Hotel does not sell cookies or disclose them to third parties for commercial purposes. Where third-party cookies are used (for example, analytics or advertising services), they operate in accordance with the privacy policies of their respective providers. How can I manage cookies? Users may control or disable cookies at any time through their web browser settings. Most browsers allow users to:

• delete existing cookies,
• block all or selected cookies,
• receive notifications before cookies are stored,
• manage preferences for individual websites.

Instructions for managing cookies can usually be found within the Settings or Preferences section of the browser being used. Can I use the website with cookies disabled? Yes. Disabling cookies generally does not prevent users from accessing the Hotel's website. However, certain functionalities may become unavailable or operate incorrectly, including:

• contact forms,
• personalised settings,
• certain website features,
• optimal display of website content.

As a result, the user experience may be affected. Links to external websites The Hotel's website may contain links to third-party websites. The Hotel is not responsible for the privacy policies or data processing practices of external websites operated by other entities. Users are encouraged to review the privacy policies of any external websites before providing personal data or using their services. Changes to this Privacy and Cookies Policy The Hotel reserves the right to amend or update this Privacy Policy and Cookies Policy at any time, particularly where required by changes in applicable law, technological developments, or modifications to the Hotel's services. The latest version of the Privacy Policy will always be published on the Hotel's official website and shall become effective upon publication. Contact If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact:

TMS Park Sp. z o.o.
ul. Telimeny 1
05-420 Józefów
Poland

Email: iod@holiday.tmspark.pl