Privacy policy and GDPR information

Privacy policy and GDPR information

The controller of data handled by Hornigold is Hornigold w Zielonej Kamienicy sp. z o.o., ul. Mikołaja Kopernika 6, 40-064 Katowice, Poland, NIP 6343076075, KRS 0001265196. For privacy matters and rights requests, contact office@hornigold.pl or the company’s postal address. This is the controller’s contact; it is not presented as a Data Protection Officer address. This notice covers this website and reception enquiries, not the inactive payment system.

Messages are prepared locally in your browser. Only when you send one from your email do you disclose your email address, message and voluntarily supplied details to the recipient. Data necessary for an offer or contract are processed under GDPR Article 6(1)(b); general correspondence, prevention of abuse and establishment or defence of claims under legitimate interests (Article 6(1)(f)); legally required records under Article 6(1)(c). Marketing consent is not required to ask a question or book a stay.

Providing enquiry details is voluntary, but without contact and stay information we cannot reply or prepare an offer. Do not send sensitive information or identity documents through the form. The website does not profile users or make automated decisions with legal effects. It has no newsletter subscription form or active advertising tools.

Hosting providers depend on the address visited. chatgpt.site uses OpenAI Sites and Cloudflare infrastructure; github.io uses GitHub Pages. Delivery and security may involve processing IP addresses, request time and URL, browser information and technical logs. Our legitimate interest under Article 6(1)(f) GDPR is providing a secure website and preventing abuse. Hosting does not mean that an enquiry entered here is sent to an AI model: the form prepares the message locally.

Correspondence retention criteria. Enquiry data are needed while handling the request and agreeing an offer; if a contract follows, also for performance and the period required for the relevant records. Further retention requires a separate basis, such as tax duties or establishing or defending claims; the applicable period depends on the document, claim and events affecting the limitation period. There is no single universal period for all correspondence. Ask the controller for details about your case. Infrastructure-log and provider-backup retention are separate from browser storage and must be determined for the particular service.

You may request access, rectification, erasure and restriction, and portability where GDPR conditions are met. You may object to processing based on legitimate interests. Consent can be withdrawn at any time without affecting prior lawful processing. You may complain to the President of Poland's UODO (uodo.gov.pl) or the competent supervisory authority. Requests are normally answered within one month; any permitted extension and its reasons are communicated within that period. Proportionate identity verification may be requested.

Google maps and panoramas are optional. Embeds load only after consent in privacy settings (Article 6(1)(a) GDPR). Google may then receive IP and browser data and use its own storage under https://policies.google.com/privacy. Withdrawal removes the embed and prevents reloading; it does not reverse the provider’s earlier processing. An ordinary map link opens a separate service when clicked.

Recipients and roles. Authorised Hornigold staff handling the matter have access. Recipients may include email and IT suppliers and, where needed, accounting, legal advisers and legally authorised authorities. A supplier acting on our instructions requires an appropriate processing arrangement; a party determining its own purposes may be a separate controller. Naming a supplier here does not certify a signed processing agreement or the same role for every service. Contact the controller for recipient details relating to your matter.

Transfers outside the EEA. Global hosting and map providers may process data outside the European Economic Area. Their published notices describe safeguards including standard contractual clauses and, where applicable, the EU–US Data Privacy Framework: https://openai.com/policies/eu-privacy-policy/, https://www.cloudflare.com/privacypolicy/, https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. These are provider statements, not confirmation of the mechanism used in a particular Hornigold contract. Ask the controller about the country, recipient, applicable transfer basis and how to obtain a copy of safeguards; the mechanism must be checked for the service and recipient concerned.

Privacy choices are valid for at most 180 days. An invalid entry is removed when the website next reads it; a closed or offline browser does not perform background deletion. Technical periods verified in code. Privacy choices remain on your device for at most 180 days; stay plans and comparisons last until the tab session ends. Language choices remain until you delete them. Dismissing the language suggestion also uses the session key hornigold-language-suggestion-dismissed. Clearing saved choices removes these first-party entries. This does not determine email correspondence or provider-log retention. The Sites aggregate counter stores a total and start date without visitor identifiers; the counter is hidden on GitHub Pages.

Cookies, device storage and choices

We do not load embedded Google panoramas without your consent. Scrolling or closing the notice does not give consent. Maps are the only optional integration; Google Analytics and advertising tools are inactive.

Website storage: hornigold-language (localStorage) retains your chosen language until deleted; hornigold-stay, hornigold-comparison and hornigold-enquiry-plan (sessionStorage) retain planning and comparison choices until the tab session ends. Free-text enquiries and card details are not stored there. hornigold-privacy (localStorage) records your privacy choice, policy version and date for up to 180 days; optional maps are disabled again after expiry. These functions support your requests and record choices rather than track advertising activity.

The language suggestion uses browser language settings, without locating the visitor or redirecting automatically. Choosing to stay in the current language saves this deliberate choice in hornigold-language (localStorage) and the hornigold-language-suggestion-dismissed marker (sessionStorage), which prevents another suggestion during this tab session. The marker contains no personal identifier or enquiry data and ends with the session according to browser behaviour. The persistent language choice remains until you delete it. Clearing saved choices in privacy settings removes both entries. These are not analytics or advertising tools.

Dates and guest count may appear in page URLs: sharing a link discloses those values, and the requested URL may enter hosting logs. Do not place names, email addresses or other personal data in URLs. External links open separate services only when clicked.

Open Privacy settings in the footer to choose necessary functions only or allow Google maps separately, and withdraw just as easily later. Withdrawal removes embedded maps. We cannot erase information already stored by an external provider; also manage it in your browser and with that provider. The clear-choices button removes Hornigold's own storage on this device. Refusal leaves written directions and contact details available.

The Sites version has an aggregate page-view counter. Its database stores only the total and the measurement start date. It stores no IP addresses, visited page URLs or personal identifiers, and uses no cookies or device storage to recognise visitors. Reloads and repeat visits may increase the count: these are page views, not unique visitors. It does not measure sales or advertising performance. Hosting technical logs are separate from this database. On GitHub Pages the counter is hidden.