Privacy Policy
Version dated August 12, 2026
1. Administrator
The data controller is METALIST sp. z o.o., ul. Kolejowa 7, 57-215 Srebrna Góra, NIP: 8871832239, e-mail: villastaraapteka@gmail.com.
2. Scope of data
In connection with the use of the website, we may process: first and last name, email address, phone number, message content, information about planned stay, IP address, cookie identifiers, device and browser data, and information about activity on the website.
3. Purposes and bases of processing
We process data for the purpose of:
handling inquiries, presenting availability and preparing an offer – on the basis of Article 6(1)(b) GDPR;
making and fulfilling reservations – on the basis of Article 6(1)(b) GDPR;
fulfilling tax and accounting obligations – on the basis of Article 6(1)(c) GDPR;
ensuring website security and establishing, investigating or defending claims – on the basis of Article 6(1)(f) GDPR;
analyzing website usage using Google Analytics 4 – after obtaining consent, on the basis of Article 6(1)(a) GDPR;
measuring advertising effectiveness, remarketing and audience matching using Meta Pixel – after obtaining consent, on the basis of Article 6(1)(a) GDPR.
4. Form and services used
The form on the website dostepnosc.villastaraapteka.pl sends the provided data via EmailJS to the Administrator’s email inbox.
Data may be processed by entities supporting the website operation and inquiry handling, in particular:
Framer B.V. – website platform;
EmailJS Pte. Ltd. – sending messages from the form;
Google Ireland Limited and entities from the Google group – Gmail, Google Tag Manager and Google Analytics 4;
Meta Platforms Ireland Limited and entities from the Meta group – Meta Pixel, ad measurement, remarketing and advanced matching;
hosting providers, IT services, reservation systems, accounting and legal services.
If Meta advanced matching is enabled, the email or phone provided in the form may be hashed and sent to Meta for more accurate attribution of website activity to advertising. This happens only after consent to optional cookies is given.
5. Data transfer outside the EEA
Using the services of Framer, EmailJS, Google and Meta may involve data processing outside the European Economic Area, in particular in the United States or Singapore. Transfers are carried out using mechanisms provided in the GDPR, in particular decisions establishing an adequate level of protection or standard contractual clauses.
6. Storage period
We store data for the time necessary to handle the inquiry or complete the reservation, and then until the expiration of the statute of limitations for potential claims. Accounting documents are stored for the period required by law. Analytical and marketing data are processed until consent is withdrawn or the storage period specified in the settings of a given tool expires.
7. User rights
The user has the right to access data, rectify it, delete it, restrict processing, data portability, lodge an objection, and withdraw consent. They also have the right to lodge a complaint with the President of the Personal Data Protection Office.
To exercise rights, please write to villastaraapteka@gmail.com.
8. Voluntary data and profiling
Providing data in the form is voluntary, but lack of required data may make it impossible to provide a response. Refusal of optional cookies does not restrict the use of basic website features.
After granting consent, Meta may use activity data to create audience groups and personalize ads. We do not make decisions against the user that produce legal effects based solely on automated processing.
Accepting cookies does not mean consent to receive offers by email, phone, or SMS.
9. Withdrawal of consent and policy changes
Consent to optional cookies can be withdrawn by reopening the banner using the “Change Consent” link available on the website. Withdrawal of consent does not affect the lawfulness of earlier processing.
The policy may be updated if there are changes to the tools used, how the website operates, or applicable regulations.