1. Data controller

The controller of personal data is:
DUNAJ SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ SPÓŁKA KOMANDYTOWO - AKCYJNA
ul. Powstańców Warszawy 25, 84-360 Łeba
NIP: 8411732269

Contact in matters concerning personal data: biuro@leba.pl and via the contact form available on the website.

2. What data do we process?

• Data provided by the user – e.g. name/nickname, e-mail address, message content (in the contact form).
• Technical data – e.g. IP address, cookie identifiers, browser and device type, operating system, approximate location, events on the website (as part of statistics/security).

3. Purposes of data processing

• Contact and handling of inquiries sent via the contact form.
• Statistics and website development (analysis of traffic and user behavior after consenting to analytical cookies).
• Marketing and campaign measurement (Google Ads – only after consenting to marketing cookies when campaigns are active).
• security , abuse detection, system administration and server logs.

4. Legal basis (GDPR)

• Article 6(1)(b) of the GDPR – taking action at the user's request (reply to a message).
• Article 6 paragraph 1 letter f of the GDPR – legitimate interest of the Controller (security, logs, protection against abuse).
• Article 6(1)(a) GDPR – consent (analytical/marketing cookies, if the user accepts them).

5. Data recipients

Data may be transferred to entities supporting the operation of the website, in particular:

• Hostido – hosting service/server infrastructure (processor).
• Google – if the user displays the map or consents to analytical/marketing cookies (Google Maps, statistics, Google Ads – depending on the configuration and consents granted).
• IT entities operating the website – if they are involved in maintenance/administration.

The Administrator does not sell personal data.

6. Transfer of data outside the EEA

The use of Google services may involve the transfer of data outside the European Economic Area (e.g., to the USA). Such transfers are carried out in accordance with the GDPR, based on appropriate legal mechanisms used by service providers (e.g., adequacy decisions or standard contractual clauses – depending on the service and the provider's current terms and conditions).

7. How long do we store data?

• Contact form – for the time necessary to handle correspondence and any possible defense of claims.
• Server logs – for the period necessary to ensure the security and proper operation of the website.
• Analytical/marketing cookies – in accordance with their validity period and tool settings, until consent is withdrawn.

8. User rights

The user has the right to: access data, rectification, deletion, restriction of processing, data transfer, objection and withdrawal of consent.

A complaint may be filed with the President of the Personal Data Protection Office (UODO) .

In order to exercise your rights, you can contact the Administrator at: biuro@leba.pl .

9. Cookies – how they work and how to manage them

The website uses cookies and similar technologies to ensure the operation of the website, to maintain statistics and – optionally – for marketing activities.

9.1 Cookie categories

• Necessary – necessary for the website to function (do not require consent).
• Analytical – statistics and traffic analysis (activated after consent).
• Marketing – measurement and optimization of advertising campaigns (triggered after consent; when campaigns are active).

9.2 Consent and withdrawal of consent

Analytical and marketing cookies are blocked until you express your consent in the cookie banner. You can change or withdraw your consent at any time through the cookie settings available on the website (e.g., the "Cookie Settings" link or by re-displaying the banner).

9.3 Browser settings

Cookies can also be deleted or blocked in your browser settings. Restricting cookies may affect the functionality of the website.

10. External services

10.1 Google Maps

The website may provide a Google map to display locations and facilitate navigation. Displaying the map may result in data (e.g., your IP address) being transferred to Google.

Important: if the map uses technologies that require consent (e.g. cookies/identifiers), the map component is displayed only after the appropriate consent has been expressed in the cookie banner or after a conscious action by the user (e.g. clicking "Show map").

10.2 Statistics (e.g. Google Analytics)

The website may use analytical tools to measure traffic and improve content. Cookie-based tools are activated only after the user's consent.

10.3 Google Ads

The website may periodically run Google Ads campaigns. If the user consents to marketing, advertising performance measurement technologies may be used.

11. Security

The Administrator uses appropriate technical and organizational measures to protect data against unauthorized access, loss or modification.

12. Policy Changes

The policy may be updated in the event of changes to the website's features or regulations. The current version is published on leba.pl.