The Polish version of this Privacy Policy is the binding one. The English text is provided for convenience.
§ 1. Data controller
The controller of personal data processed in connection with the use of the website qctravel.pl (the "Website"), with marketing activities and with the conclusion and performance of package travel contracts is QC Travel Sp. z o.o. with its registered office in Warsaw, ul. Włościańska 23/19, 01-710 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001232333, NIP (tax ID): 5253084662, REGON: 544371703 (the "Controller").
Contact for personal data matters: e-mail: hello@qctravel.pl; post: QC Travel Sp. z o.o., ul. Włościańska 23/19, 01-710 Warszawa, Poland.
§ 2. General principles of data processing
The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Polish Personal Data Protection Act of 10 May 2018 and the Polish Electronic Communications Law of 12 July 2024 (PKE). Data are processed only to the extent necessary for the specified purposes, on an appropriate legal basis and for no longer than required for a given purpose.
Providing personal data is voluntary but necessary to conclude and perform a package travel contract, prepare an offer or reply to an enquiry. Without the data marked as required, the Controller cannot conclude a contract or reply to an enquiry. Consent to the newsletter and to marketing cookies is entirely voluntary and does not condition the use of the services.
The person making a booking provides the Controller with the data of the other trip participants (including children). These data are processed to the extent described in § 3 and § 4. The booking person declares that they are authorised to provide these data and undertakes to pass the information contained in this Policy on to the other adult participants.
§ 3. Purposes and legal bases of processing: overview
| Purpose | Categories of data | Legal basis | Retention period |
|---|---|---|---|
| Conclusion and performance of a package travel contract (booking, delivery of the trip) | First name, surname, address, e-mail, phone number, date of birth, PESEL number (for insurance purposes) | Art. 6(1)(b) GDPR (performance of a contract) | For the duration of the contract and the limitation period for claims: 3 years from its performance or from the date on which it was to be performed |
| Data of minor participants (health data from the Participant Information Card: allergies, illnesses, medication) | First name, surname, date of birth, PESEL number, health data (special category of data) | Art. 6(1)(b) and Art. 9(2)(c) GDPR (protection of the vital interests of the child) | 3 months after the end of the trip; longer only if a complaint or court proceedings require the data to be retained |
| Issuing invoices and tax documentation | First name and surname or company name, address, NIP | Art. 6(1)(c) GDPR (legal obligation under tax law) | 5 years from the end of the calendar year in which the tax obligation arose |
| Handling an enquiry sent via the Website form, e-mail or telephone (preparing an offer, answering questions) | First name, surname, e-mail, phone number, content of the enquiry, selected trip and date, composition and ages of participants. Additionally, if the User has consented to marketing cookies: advertising click identifiers (gclid, fbclid) and campaign parameters (utm), landing page address, referring page address, consent status at the time of submission and a technical event identifier | Art. 6(1)(b) GDPR (steps at the request of the data subject prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest: handling correspondence and measuring advertising effectiveness) | 12 months from the last contact; longer if the correspondence concerns the conclusion of a contract (then as for the contract) |
| Contact forms made available on Meta platforms (Facebook, Instagram), so-called instant forms | First name and surname, e-mail address, selected trip date and other information provided in the form | Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(a) GDPR (consent to electronic contact given in the form) | 12 months from the last contact; longer if the correspondence concerns the conclusion of a contract (then as for the contract) |
| Newsletter: sending information about offers and news | E-mail address | Art. 6(1)(a) GDPR (consent) and Art. 398 PKE (consent to electronic communication for marketing purposes) | Until consent is withdrawn |
| Direct marketing: remarketing, personalised advertising and measuring advertising effectiveness (Google, Meta) | Behavioural data from cookies and similar technologies (browsing history, clicks), device and browser identifiers. Additionally, hashed (transformed with the SHA-256 hash function before sending) contact details provided in the enquiry form: e-mail address, phone number, first name, surname. The Controller does not transfer these data to Google or Meta in plain form | Art. 6(1)(a) GDPR (consent to marketing cookies given in the consent banner) | Until consent to marketing cookies is withdrawn |
| Establishing, pursuing and defending claims | Data from the contract and correspondence | Art. 6(1)(f) GDPR (legitimate interest) | Until the expiry of the limitation period for claims, as a rule 3 years from performance of the contract |
| Website security: access logs, abuse detection | IP address, session identifiers, timestamps, browser data | Art. 6(1)(f) GDPR (legitimate interest) | 12 months, unless the logs constitute evidence in proceedings, then until their conclusion |
§ 4. Special protection of children's data
The Controller processes health data of minor participants (in particular information on allergies, chronic illnesses and medication taken) solely to ensure the child's safety during the trip, including ski school lessons and children's activities. These data are disclosed only to the resident representative and to the instructors and animators cooperating with the Controller, who are bound by confidentiality, to the extent strictly necessary for the care of the child.
Children's health data are stored in paper form (Participant Information Card) under conditions ensuring confidentiality (a locked safe or cabinet). After the retention period, the Information Cards are destroyed in a manner that makes the data unreadable.
The Website is not directed at children within the meaning of Art. 8 GDPR. Minors use the Website only with the consent and under the supervision of their parents or legal guardians. The Controller does not knowingly collect data from children under 16 without verifiable parental consent.
§ 5. Recipients of data
5.1. Processors acting on behalf of the Controller and recipients acting as separate controllers
- Insurer: SIGNAL IDUNA Polska Towarzystwo Ubezpieczeń S.A., ul. Siedmiogrodzka 9, 01-204 Warszawa, Poland (participant lists for the purpose of insurance and the tourist guarantee). The insurer is a separate data controller.
- Accommodation providers: the hotels where the trip takes place, in particular Hotel Das Saal (Saalfelden, Austria), Hotel Engel (Carezza / Nova Levante, Italy), Hotel Madonnina (Soraga di Fassa, Italy), Hotel Villa di Bosco (Tesero, Italy). The hotels receive the data necessary for accommodation (first name, surname, date of birth, number and ages of children) and are separate data controllers.
- Trip staff: the resident representative, ski school instructors and animators cooperating with the Controller under civil law contracts, bound by confidentiality (participant data necessary to run lessons and care for children).
- Accounting office: Soroban Sp. z o.o. (soroban.pl), data required for bookkeeping, under a data processing agreement.
- Website and application hosting provider: Vercel Inc. (USA), on whose infrastructure the Website operates, including the enquiry handling panel, and the provider of the application database service in which enquiry records and newsletter sign-ups are stored, under data processing agreements.
- E-mail and office tools provider: Google Ireland Limited (Google Workspace services: Gmail, Google Drive, Google Sheets), in which the Controller conducts correspondence with clients, keeps records of enquiries and bookings and stores data from Meta instant forms, under a data processing agreement.
- Online payment operator: if the Controller launches online payments, the data necessary to process a payment will be transferred to the selected operator under a data processing agreement; information about the operator will be indicated in this Policy.
- Newsletter tool provider: subscribers' e-mail addresses are currently stored exclusively in the Controller's own system. If the mailing is entrusted to an external provider, information about that provider will be indicated in this Policy.
- Organisers of recommended trips: If you send an enquiry through the form on the page of a partner trip (marked as “Partner trip”) and consent to the transfer of your data, we will pass your first name and surname, e-mail address, phone number, number of people and the content of your message to the organiser of that trip, indicated on the trip page, in order to respond to the enquiry. The organiser processes these data as a separate controller, under its own privacy policy. This currently applies to POLSPORT UK LTD, registered in the United Kingdom. The transfer of data to the United Kingdom is based on the European Commission decision finding an adequate level of data protection. You may withdraw your consent at any time by writing to hello@qctravel.pl; this does not affect the lawfulness of a transfer made before the withdrawal.
- Public authorities: only to the extent required by applicable law (e.g. the Tax Office, the President of the Personal Data Protection Office, the Insurance Guarantee Fund in respect of the Tourist Guarantee Fund and the Tourist Assistance Fund, the Marshal of the Masovian Voivodeship as the supervisory authority for tour operators).
5.2. Providers of analytics and advertising tools
In respect of analytics and advertising tools, data are transferred to the following entities, which, depending on the service, act as processors, joint controllers or independent controllers:
- Google Ireland Limited / Google LLC: Google Analytics 4 (analytics), Google Ads (advertising, including enhanced conversions) and Google Tag Manager (tag management). Scope: cookie data and browser identifiers and, after consent to marketing cookies, also hashed contact details from the enquiry form, used to measure advertising effectiveness (see § 9).
- Meta Platforms Ireland Limited / Meta Platforms, Inc.: Meta Pixel, Meta Conversions API (transfer of events from the Controller's server) and Meta Ads, including instant forms on Facebook and Instagram. Scope: cookie data and browser identifiers and, after consent to marketing cookies, also hashed contact details from the enquiry form, IP address and browser data, used to match the event to the user's account on Meta platforms and to measure advertising effectiveness (see § 9). For instant forms, Meta is a separate data controller in respect of collecting the data on its platforms.
5.3. The Controller's social media profiles
The Controller runs profiles on Facebook and Instagram. Data of persons who follow these profiles, react to published content, comment on it or send private messages (profile name, content of the comment or message, contact details provided in it) are processed by the Controller for the purpose of communication, answering questions and preparing an offer, on the basis of legitimate interest (Art. 6(1)(f) GDPR) and, to the extent leading to the conclusion of a contract, on the basis of Art. 6(1)(b) GDPR. The content of messages is retained for 12 months from the last contact and, if it concerns the conclusion of a contract, as for the contract. Meta Platforms Ireland Limited, as the operator of these platforms, processes users' data under its own rules described in its privacy policy and, in respect of aggregated profile statistics, acts as a joint controller together with the Controller.
§ 6. Transfers of data to third countries (outside the EEA)
Personal data may be transferred to the United States of America in connection with the use of services of the following providers:
- Google LLC: Google Analytics 4, Google Ads, Google Tag Manager and Google Workspace services. Information on data protection: https://policies.google.com/privacy.
- Meta Platforms, Inc.: Meta Pixel, Meta Conversions API and Meta Ads services. Information: https://www.facebook.com/privacy/policy.
- Vercel Inc.: hosting of the Website and application. Information: https://vercel.com/legal/privacy-policy.
The basis for the transfer is the European Commission Implementing Decision of 10 July 2023 on the EU-US Data Privacy Framework in respect of entities certified under that framework and, in other cases, the Standard Contractual Clauses adopted by European Commission Decision 2021/914 of 4 June 2021. Contact details transferred to Google and Meta for advertising purposes are hashed beforehand (see § 9.4).
§ 7. Rights of data subjects
Every person whose personal data are processed by the Controller has the following rights:
| Right | Scope |
|---|---|
| Right of access (Art. 15 GDPR) | The right to obtain confirmation from the Controller as to whether personal data are being processed and to receive a copy of those data together with information on the purposes, legal bases and recipients. |
| Right to rectification (Art. 16 GDPR) | The right to request the prompt rectification of inaccurate data or the completion of incomplete data. |
| Right to erasure (Art. 17 GDPR) | The right to request erasure of data where they are no longer necessary for the purposes for which they were collected, where consent has been withdrawn or where processing is unlawful. This right does not apply to data necessary to establish, pursue or defend claims, nor to data processed on the basis of a legal obligation. |
| Right to restriction of processing (Art. 18 GDPR) | The right to request restriction of processing in the cases set out in Art. 18 GDPR (e.g. where the accuracy of the data is contested). |
| Right to data portability (Art. 20 GDPR) | The right to receive the data in a structured, machine-readable format and to transmit them to another controller; applies to data processed on the basis of consent or a contract. |
| Right to object (Art. 21 GDPR) | The right to object to the processing of data on the basis of the Controller's legitimate interest (including profiling for marketing purposes). After an objection is lodged, the Controller ceases processing unless it demonstrates compelling legitimate grounds. |
| Right to withdraw consent (Art. 7(3) GDPR) | Where processing is based on consent: the right to withdraw it at any time, including consent to marketing and analytics cookies via the consent banner settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. |
How to exercise your rights? Requests should be sent by e-mail to hello@qctravel.pl or by post to the Controller's registered office. The Controller handles a request within one month of receipt (extendable by a further 2 months for complex requests, of which the Controller will inform the applicant).
Right to lodge a complaint: if you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, e-mail: kancelaria@uodo.gov.pl.
§ 8. Automated decisions, profiling and data security
The Controller does not take decisions concerning data subjects based solely on automated processing which would produce legal effects or similarly significantly affect them. Profiling is limited to the targeting and measurement of advertising on Google and Meta platforms on the basis of cookie data and does not take place without the User's consent to marketing cookies. The price calculation in the configurator on an offer page is a calculation based on the participant composition entered and does not constitute a decision to conclude a contract.
The Controller applies technical and organisational measures appropriate to the risk, in particular: an encrypted connection to the Website (HTTPS), access to the enquiry handling panel and e-mail restricted to authorised persons with authentication, regular data backups at the infrastructure providers, data processing agreements with processors, and storage of Participant Information Cards containing children's health data in paper form in a locked place (§ 4).
§ 9. Cookies and similar technologies
9.1. What are cookies?
Cookies are small text files saved by the web browser on the User's device when visiting the Website. The Website also uses browser storage (sessionStorage) to temporarily hold information during a single visit. These technologies allow the Website to remember the User's choices, analyse how the Website is used, and display and measure the effectiveness of advertising.
9.2. Types of cookies and technologies used
| Category | Examples | Purpose / description | Basis / consent |
|---|---|---|---|
| Necessary | qc_consent, session identifier, form security tokens | Necessary for the proper operation of the Website: security, operation of the enquiry form, remembering the User's cookie decisions (qc_consent, 180 days). Without them the Website does not work properly. | Art. 399(3) PKE: no consent required |
| Analytics | _ga, _ga_* (Google Analytics 4) | Collect pseudonymised data on how the Website is used (number of visits, time, pages visited, traffic source), linked to a random browser identifier. Used to improve the Website. Data are sent to Google (USA, see § 6). | Art. 6(1)(a) GDPR and Art. 399(1) PKE: consent required. Implemented with Google Consent Mode v2. |
| Marketing | _fbp, _fbc, fr (Meta Pixel), _gcl_au, _gcl_aw (Google Ads), campaign parameters in sessionStorage | Allow advertising tailored to the User's interests to be displayed on external platforms (Facebook, Instagram, Google) and advertising effectiveness to be measured. After consent, the Website remembers, for the duration of the visit, the advertising click identifiers and campaign parameters with which the User reached the Website and stores them in the enquiry record. As part of advanced matching (Meta) and enhanced conversions (Google Ads), hashed contact details provided in the enquiry form are additionally transferred (see 9.4). Data are sent to Meta and Google (USA, see § 6). | Art. 6(1)(a) GDPR and Art. 399(1) PKE: consent required. Implemented with Google Consent Mode v2; Meta Pixel is loaded only after consent. |
Analytics and advertising tags are managed by Google Tag Manager, which does not itself set cookies and launches individual tools only in accordance with the User's decision in the consent banner.
9.3. Managing cookies
The User can manage cookies via the consent banner displayed on first entry to the Website and available again in the page footer under the "Cookie settings" link. Consent can be withdrawn at any time without consequences for the use of the Website. Withdrawal of consent stops further transfer of data to analytics and advertising tools from the moment of withdrawal.
Cookies can also be managed from the web browser settings. Instructions for popular browsers:
- Chrome: Settings, Privacy and security, Cookies and other site data
- Firefox: Settings, Privacy and Security, Cookies and Site Data
- Safari: Preferences, Privacy
- Edge: Settings, Cookies and site permissions
Disabling all cookies in the browser may prevent the proper use of some Website functions, in particular the enquiry form.
9.4. Measuring advertising effectiveness using hashed contact details
If the User has consented to marketing cookies and has submitted the enquiry form, the Controller transfers to Google (Google Ads enhanced conversions) and to Meta (Meta Pixel advanced matching and Meta Conversions API) the e-mail address, phone number, first name and surname provided in the form, transformed with the one-way SHA-256 hash function. The transformation takes place before the data are sent, and the recipient receives only the hash, which it can compare with the hashes of its own users' data. The purpose is to attribute the submitted enquiry to the advertising campaign from which it originated and to measure advertising effectiveness. In the case of the Meta Conversions API, the event is sent from the Controller's server and additionally includes the IP address, browser data and the identifiers from the _fbp and _fbc cookies. Without consent to marketing cookies, none of the above data are transferred.
9.5. Consent banner statistics
The Controller counts the number of times the consent banner is displayed and the number of decisions in each category (accept all, reject, selection from settings). These statistics contain only the date and the count, without cookies, User identifiers, IP addresses or browser data.
9.6. Embedded content from external services
On offer pages, the Website displays Google Maps and videos from YouTube. When such content is loaded, the User's browser connects directly to Google's servers, which receive the IP address and browser data and may set their own cookies under the rules described in Google's privacy policy (https://policies.google.com/privacy). The Controller has no influence over the scope of data collected by Google in connection with this content.
§ 10. Changes to the Privacy Policy
The Controller may update this Privacy Policy. The current version is always available on the Website at qctravel.pl/en/polityka-prywatnosci.
The binding version is the PDF document (in Polish). The permanent link below always points to the current file.