Privacy Policy

1. The controller of your personal data is [full entity name], registered at [address], NIP […], REGON […], hereinafter the "Controller".

2. Contact on personal data matters: [email address], [phone number].

3. This Policy applies to the website spintour.net and to bookings and trips organized by the Controller.

1. Booking and participation in a trip — first name, last name, email address, phone number, age, playing level, chosen package and add-ons, arrival and return dates, and any notes you enter in the form. Purpose: handling your request, concluding and performing the contract, and contacting you about payment and trip logistics. Legal basis: Article 6(1)(b) GDPR (contract or steps prior to entering into one).

2. Contact and group enquiries — first name, last name, email address, phone number, the content of your message, and for group enquiries also the club name, number of people and trip preferences. Purpose: replying to your enquiry and preparing an offer. Legal basis: Article 6(1)(f) GDPR (legitimate interest in handling enquiries), and point (b) where the enquiry concerns entering into a contract.

3. Waiting list and notifications about dates — email address and, where provided, your name. Purpose: letting you know when booking opens, a spot becomes available or new dates are announced. Legal basis: Article 6(1)(a) GDPR (consent).

4. Accounting and legal obligations — data required to issue accounting and tax documents. Legal basis: Article 6(1)(c) GDPR (legal obligation).

5. Establishing, pursuing and defending legal claims, and website security (including server logs). Legal basis: Article 6(1)(f) GDPR (legitimate interest).

6. Health data. If you provide information about your health or injuries in the form or when contacting us (for example in the notes field), we process it solely to organize the sessions safely, on the basis of your explicit consent — Article 9(2)(a) GDPR. Providing such information is voluntary.

7. WhatsApp group for trip participants — your phone number and name (visible to the other group members). Purpose: adding you to a group for day-to-day organizational communication before and during the trip. Legal basis: Article 6(1)(a) GDPR (consent given in the booking form). Consent is voluntary — not giving it does not affect your ability to book, and we will contact you by email or phone instead.

8. We do not carry out profiling or automated decision-making that produces legal effects concerning you.

1. We receive data directly from you, through the forms on the Website, email or phone.

2. Providing data is voluntary, but it is necessary for a booking (first name, last name, email, phone, age, travel dates) or to reply to an enquiry. Without it we cannot provide the relevant service.

Data may be entrusted or disclosed, only to the extent necessary, to the following categories of recipients: - website hosting and infrastructure providers — Vercel Inc. (application hosting), - database and file storage provider — Supabase Inc., - email delivery provider — Resend, - messaging provider — WhatsApp Ireland Ltd / Meta Platforms Ireland Ltd (only if you consent to being added to a WhatsApp group), - the email provider and office tools used by the Controller, - parties delivering the trip: hotels, sports facilities, insurers, carriers and activity providers — solely to the extent necessary for your participation, - accountants, legal advisers and banks — for settlements and legal support, - public authorities, where required by law.

1. Some of the providers listed in section 4 (in particular Vercel and Resend) are based in the United States or may process data outside the EEA. Database storage region: [Supabase region].

2. Transfers are made on the basis of the mechanisms provided for in the GDPR, in particular a European Commission adequacy decision (Data Privacy Framework) or standard contractual clauses. You can obtain a copy of the safeguards by contacting the Controller.

• bookings and participant data — for the duration of the contract and then until the limitation periods for claims expire, and no shorter than tax and accounting law requires (accounting documents — 5 years from the end of the tax year),
• contact form messages and group enquiries — until the matter is closed, then for up to [12] months,
• waiting list and notifications — until you withdraw consent or until the end of the season concerned, whichever is earlier,
• phone number in the WhatsApp group — until the trip has ended or you withdraw consent, whichever is earlier; after the trip we remove participants from the group,
• health information provided voluntarily — until the trip has ended, unless it is needed to defend legal claims,
• server logs — up to 30 days, unless longer retention is necessary to investigate a security incident.

1. You have the right to access your data, rectify it, erase it, restrict processing, data portability, and to object to processing based on legitimate interest.

2. Where processing is based on consent, you may withdraw it at any time (for example via the unsubscribe link in a message or by emailing us), without affecting the lawfulness of processing carried out before withdrawal.

3. To exercise your rights, write to [email address]. We reply within one month.

4. You have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

1. The Website uses only strictly necessary functional cookies: - locale — remembers your chosen language (Polish/English), valid for up to 12 months, - admin panel session cookie — used only by authorized staff after logging in.

2. We do not use analytics, advertising or profiling cookies, or third-party tracking tools.

3. You can delete or block cookies in your browser settings at any time; your language choice will then not be remembered.

We apply technical and organizational measures appropriate to the risk, including an encrypted connection (HTTPS), authentication for the admin panel, and access to data limited to authorized people. We do not store payment card details.

1. We may amend this Policy, in particular when the law or the scope of processing changes. The current version is always available on the Website.

2. The Polish version is the binding version. Translations are provided for information only.