Back to the trips PL

Document

Privacy policy

This is an English translation of the privacy policy published at oxynite.com/pl/polityka-prywatnosci/. It is provided for your convenience; in the event of any discrepancy, the Polish version prevails.

§ 1 General provisions

  1. This privacy policy sets out the rules for processing personal data in connection with the use of the websites in the oxynite.com domain (the "Website").
  2. The controller of the personal data processed on the Website is Fundacja Oxynite with its registered office in Trzebinia at ul. Plażowa 8, 32-540 Trzebinia, Poland, entered in the register of entrepreneurs and the register of associations, other social and professional organisations, foundations and independent public health care institutions of the National Court Register kept by the court in Kraków under number 0001030925, entered in the register of tour operators and entrepreneurs facilitating the procurement of linked travel arrangements kept by the Marshal of the Małopolska Region under number 41671, tax ID (NIP) 6282291045, REGON 525060978, share capital PLN 2,000, e-mail: kontakt@oxynite.com, phone: +48 576 299 567 (the "Controller").
  3. You can contact the Controller in writing at the registered office address given above or by e-mail at kontakt@oxynite.com.
  4. The Controller applies the appropriate technical and organisational measures required by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR"), in particular measures protecting personal data against unlawful access, modification or destruction by unauthorised persons.
  5. Matters not covered by this privacy policy are governed by the relevant provisions of the Website Terms and Conditions available at oxynite.com/pl/regulamin/ (in Polish). Capitalised terms not defined in this privacy policy have the meaning given to them in the Website Terms and Conditions.
  6. The Controller reserves the right to change this privacy policy at any time, in particular because of changes to the Website's functionality or to the applicable law.

§ 2 Categories of data, purposes and legal bases of processing

  1. The Controller processes the following categories of data of Website users ("Users"):
    • data connected with contracts concluded and bookings made, such as first name, surname, contact and address details, travel details, payment and transaction information;
    • data connected with a Website account: first name, surname, contact and address details, login details;
    • information about Users' use of the Website, such as IP address, end devices, website traffic data.
  2. Personal data provided by Users are processed for the following purposes and on the following legal bases:
    • to conclude and perform contracts concluded through the Website and to make bookings, or to take steps at the User's request before concluding a contract (Article 6(1)(b) GDPR);
    • to communicate with Users and reply to messages received from Users, e.g. via the contact forms available on the Website, which is the Controller's legitimate interest (Article 6(1)(f) GDPR);
    • in connection with the User's use of the Website, handling the Website account and providing technical support, i.e. to perform the contract for the use of the Website or to take steps at the User's request before concluding a contract (Article 6(1)(b) GDPR);
    • to fulfil the Controller's legal obligations, in particular for accounting and tax purposes and in connection with possible inspections or enquiries, court proceedings, etc. (Article 6(1)(c) GDPR);
    • where data are received from another User, which may happen when the data are processed to perform a booking made by that User (several people on one booking), which is the Controller's legitimate interest (Article 6(1)(f) GDPR);
    • to establish, pursue or defend against claims, to ensure the security of traffic and services, and to prevent abuse and fraud, which is the Controller's legitimate interest (Article 6(1)(f) GDPR);
    • to offer the Controller's products and services, which is the Controller's legitimate interest in the form of direct marketing (Article 6(1)(f) GDPR);
    • for archiving and evidence purposes, to secure information in case of a legal need to prove facts, including to meet the accountability obligation under the GDPR, which is the Controller's legitimate interest (Article 6(1)(f) GDPR);
    • in other cases where consent to the processing of personal data may be given, data are processed to the extent and for the purpose stated in the consent (Article 6(1)(a) GDPR). If the User has consented to receiving marketing communications by e-mail or phone, the legal basis is additionally Article 10 of the Polish Act of 18 July 2002 on the provision of services by electronic means and Article 172 of the Polish Act of 16 July 2004 – Telecommunications Law.
  3. Providing personal data is voluntary, but refusing to provide them will make it impossible to make a booking, use the Website's functionality or receive a reply to an enquiry.

§ 3 Users' rights

Every User has the right to:

  • access their data and receive a copy of them;
  • rectify (correct) their data;
  • erase their data, where the GDPR allows it;
  • restrict the processing of their data, to the extent the GDPR allows it;
  • object to the processing of data carried out for the legitimate interest of the Controller or a third party, including direct marketing, and where the processing is necessary for the Controller to perform a task carried out in the public interest or in the exercise of official authority vested in the Controller;
  • data portability, on the terms set out in the GDPR;
  • lodge a complaint with the supervisory authority – if the User believes that the Controller processes their data unlawfully, they may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland;
  • withdraw consent to the processing of personal data – the User may at any time withdraw consent to the processing of the personal data that the Controller processes on the basis of that consent; withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

§ 4 Data retention period

Personal data are kept for as long as necessary to achieve the purposes for which they were collected, i.e.:

  • in the case of contracts and bookings – for the period required by law (until the limitation periods for claims expire and until the periods prescribed by law for keeping accounting documents expire);
  • in the case of use of the Website, also after the User stops using the Website – for the period required by law (until the limitation periods for claims expire and until the periods prescribed by law for keeping accounting documents expire);
  • in the case of data processed on the basis of the User's consent – until the consent is withdrawn, provided that if the User withdraws consent or deletes data on the Website, the Controller may continue to process the data necessary to perform contracts concluded earlier;
  • where personal data are processed for the legitimate interests of the Controller or a third party referred to in this privacy policy – until those interests are fulfilled or an objection to such processing is raised, unless the GDPR allows further processing;
  • as regards the Controller's legal obligations – for the period and to the extent required by law, and afterwards for the period resulting from the law or for the legitimate interests of the Controller, including securing and pursuing possible claims.

§ 5 Recipients of data

  1. The following may have access to Users' personal data:
    • insurance companies, airlines, hotels, tour operators and other entities cooperating in the performance of contracts concluded with Users, which may be separate data controllers in this respect;
    • entities handling the payment processes available on the Website – payment operators, which may be separate data controllers in this respect;
    • service providers supplying the Controller with technical and organisational solutions, in particular IT, hosting, marketing and analytics services;
    • accounting offices, tax advisers, providers of legal services;
    • competent public authorities, on the basis of applicable law.
  2. The Controller will not transfer or allow the transfer of personal data outside the European Economic Area, except to entities in respect of which the measures necessary to ensure that the transfer complies with the GDPR have been taken. Such measures may include in particular transferring personal data to a recipient in a country which, according to a decision of the European Commission, ensures an adequate level of protection of personal data, or transferring personal data subject to the appropriate safeguards referred to in Article 46 GDPR.

§ 6 Cookies and analytics and marketing tools

  1. The Website (snf.oxynite.com) uses cookies and similar technologies. Cookies that are necessary for the Website to work and to remember your consent decision are stored without consent, under the exemption for files necessary to provide the service (Article 399 of the Polish Electronic Communications Law of 12 July 2024) and on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR). Statistics and marketing cookies are stored only after you give consent in the cookie banner (Article 399 of the Electronic Communications Law and Article 6(1)(a) GDPR). You can change or withdraw your consent at any time by clicking "Change cookie consent" at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Refusing consent does not limit your use of the Website.
  2. Consent is managed with Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark). Your decision is stored in the CookieConsent cookie (12 months) and in a consent log, so that the Controller can demonstrate that consent was given (Article 7(1) GDPR). Cookiebot stores data on servers in the EU.
  3. Before you make a decision, Google tools receive only aggregated signals without cookies and without a user identifier (Google consent mode), used to estimate statistics. If you refuse, no Google cookies are stored.
  4. The Website uses the following tools:
    • Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): technical loading of the other tools in line with your consent. Category: necessary. It does not store cookies of its own.
    • Google Analytics 4 (Google Ireland Limited): visit statistics such as pages viewed, traffic sources and on-site events (e.g. clicking "Book", sending an enquiry). Google Analytics 4 does not log users' IP addresses. Category: statistics. Cookies: _ga (24 months), _ga_* (24 months). Data may be processed by Google LLC in the USA under the EU-US Data Privacy Framework.
    • Google Ads (Google Ireland Limited): measuring the effectiveness of Google advertising and remarketing. Category: marketing. Cookies: _gcl_au (3 months), _gcl_aw (3 months), IDE (doubleclick.net, 13 months). Data may be processed by Google LLC in the USA under the EU-US Data Privacy Framework.
    • Meta Pixel and Conversions API (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland): measuring the effectiveness of advertising on Facebook and Instagram and remarketing. On-site events (page view, clicking "Book", sending an enquiry) together with your IP address, browser data and the advertising click identifier are sent to Meta directly from your browser and through an intermediary server (Conversions API). The Controller and Meta are joint controllers for the collection of this data. Category: marketing. Cookies: _fbp (3 months), _fbc (3 months). Data may be processed by Meta Platforms, Inc. in the USA under the EU-US Data Privacy Framework.
    • Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): click maps and recordings of how the Website is used (cursor movement, scrolling, clicks); text typed into form fields is masked. Category: statistics. Cookies: _clck (12 months), _clsk (1 day), CLID (12 months), ANONCHK (10 minutes), MR (7 days), MUID (12 months), SM (session). Data may be processed by Microsoft Corporation in the USA under the EU-US Data Privacy Framework.
    • Booking system (Skaleo sp. z o.o., ul. Rybałtów 12/40, 02-886 Warsaw, Poland, KRS 0000841734): booking and payment for a trip at fundacjaoxynite.skaleo.pl. The details you enter in the booking form (name, date of birth, e-mail, phone, address, Polish personal identification number where required for insurance) are processed on the Controller's behalf as a processor under a data processing agreement. Legal basis: necessity for the conclusion and performance of the contract (Article 6(1)(b) GDPR). The booking system uses its own session cookies.
  5. Providers established in the USA (Google LLC, Meta Platforms, Inc., Microsoft Corporation) process part of the data outside the European Economic Area. Transfers take place on the basis of the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which these providers are certified, and additionally on the basis of standard contractual clauses contained in the providers' data processing terms.
  6. Links to external services (YouTube, Facebook, Instagram) lead outside the Website. Once you click them, the privacy policy of the given service applies. The Website does not embed players or plug-ins of these services.
  7. To convert prices into euro, the Website retrieves the current exchange rate from the public interface of the National Bank of Poland (api.nbp.pl). For this purpose the NBP receives only technical connection data (IP address). No cookies are stored in the process.
  8. You can also delete and block cookies in your browser settings. Blocking necessary cookies may prevent some functions of the Website from working. Detailed information on managing cookies is available in the browser settings, for example on the following pages:

§ 7 Final provisions

This privacy policy applies from 1 January 2024. Section 6 (cookies and tools) was last updated on 10 November 2026.

Back to the trips