Privacy and Cookie Policy

This policy explains how Hotel Gdynia Boutique processes the personal data of Guests and visitors to hotelgb.pl, including people who book online, and how we use cookies and similar technologies.

1. Data controller

The controller of personal data is Hotel Gdynia Boutique spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Gdynia, ul. Abrahama 39, 81-366 Gdynia, Poland, entered in the register of entrepreneurs of the National Court Register under KRS number 0000739201, tax ID (NIP) 5862333630 (the “Hotel”, “we”).

You can contact us about any matter concerning personal data:

2. Purposes, legal bases and retention periods

Booking and stay at the Hotel

When you book (online, by phone, by e-mail or at the reception) and during your stay we process in particular: first name and surname, home address, nationality, phone number, e-mail address, dates and details of the stay, payment information and invoice details if you ask for an invoice.

Purposes and legal bases:

  • concluding and performing the contract for hotel services – Art. 6(1)(b) GDPR,
  • complying with legal obligations, in particular tax and accounting obligations – Art. 6(1)(c) GDPR,
  • establishing, pursuing or defending legal claims – Art. 6(1)(f) GDPR (the Hotel’s legitimate interest).

Providing data is voluntary but necessary to make a booking and provide the stay. We keep the data for the duration of the contract, then until the limitation periods for claims expire and for the document retention period required by tax and accounting law.

Enquiries and correspondence

If you contact us by e-mail or phone, we process the data you provide (e.g. name, e-mail address, phone number, content of the message) to answer your enquiry – under Art. 6(1)(b) GDPR where the enquiry concerns a booking or stay, and otherwise under Art. 6(1)(f) GDPR (our legitimate interest in handling correspondence). We keep the data for as long as needed to deal with the matter and then until the limitation periods for any claims expire.

Video surveillance (CCTV)

CCTV operates in the public areas of the Hotel to ensure the safety of Guests and protect property – Art. 6(1)(f) GDPR. Recordings are kept for 14 days and then deleted.

Use of the hotelgb.pl website

  • Displaying the website and security – the web server processes your IP address and browser information to display the website and protect it against abuse – Art. 6(1)(f) GDPR.
  • Statistics (analytics cookies) – only with your consent – Art. 6(1)(a) GDPR.
  • Marketing and ad measurement (marketing cookies) – only with your consent – Art. 6(1)(a) GDPR.

You can withdraw your consent at any time via “Cookie settings” in the website footer. Withdrawal does not affect the lawfulness of processing carried out before it. Data collected on the basis of consent is processed until you withdraw it or until the cookies described in section 4 expire.

3. Online booking – the Profitroom system

Online bookings are handled by the booking system of Profitroom S.A., Poznań, Poland (ul. Franklina Roosevelta 9, 60-829 Poznań), which processes data on behalf of the Hotel. The booking window opens on our website (domains upperbooking.com, booking.profitroom.com and checkout.profitroom.com). We process the data entered in the booking form for the purposes and on the legal bases described in section 2 (“Booking and stay at the Hotel”).

The booking system script loads on every page so that the “Book” button works. It also loads Profitroom components that handle unfinished bookings and collect statistics on how the booking system works; in doing so Profitroom receives your IP address and browser information.

The booking system has its own cookie settings (a link at the bottom of the booking window). The choice you make in the banner on our website is passed on to the booking system; you can change it in either place. Once you consent, the following run in the booking system: our Google Analytics property (analytics cookies), the OpenAI ads conversion pixel and Google Ads conversion measurement (marketing cookies) and Profitroom’s analytics tools. When a booking is confirmed and you have consented to marketing cookies, we send Google Ads your email address, phone number and first and last name in hashed form (SHA-256) to match the booking to a click on a Google ad and measure its effectiveness (Google Ads enhanced conversions). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings.

Online payments are handled by payment operators (e.g. Przelewy24 – PayPro S.A.), which process payment data as separate controllers under their own terms and privacy policies.

4. Cookies and similar technologies

Cookies are small text files stored in your browser. Browser storage (localStorage, sessionStorage) works in a similar way. We use necessary cookies without consent, because the website and bookings cannot work without them. Analytics and marketing cookies are only stored after you consent in the banner. You can change your choice at any time via the “Cookie settings” link in the footer and delete stored cookies in your browser settings.

We use Google Consent Mode v2. Until you give consent, Google tools do not store or read analytics or advertising cookies. Google may, however, receive cookieless signals from your browser (such as a page view, your consent status and browser type), which are used to model statistics.

Necessary (no consent required)

  • hgb_consent – hotelgb.pl – stores your cookie choice – 6 months.
  • pll_language – hotelgb.pl – stores the website language – 1 year.
  • bookingSessionId (sessionStorage) – hotelgb.pl, Profitroom – booking window session identifier – until the browser tab is closed.
  • Profitroom booking system cookies (domains profitroom.com, upperbooking.com), e.g. storing consent in the booking system – booking functionality – according to the booking system settings.

Analytics (with consent)

  • _ga, _ga_4MZSXFSM7G – Google Analytics 4 (Google Ireland Limited) – distinguishing visitors and sessions, statistics on visits and bookings – 2 years.

Marketing (with consent)

  • _fbp, _fbc and lastExternalReferrer, lastExternalReferrerTime (localStorage) – Meta pixel (Meta Platforms Ireland Limited) – measuring the effectiveness of ads on Facebook and Instagram, ad personalisation – up to 3 months (localStorage until deleted).
  • _gcl_au, _gcl_aw (may be set) – Google Ads (Google Ireland Limited) – measuring conversions from Google ads – up to 90 days.
  • OpenAI Ads pixel – in the booking window – measuring bookings from ads in ChatGPT.

Other external services (no cookies on hotelgb.pl)

  • Fonts – the website loads the Open Sans and PT Serif fonts from Google servers (fonts.gstatic.com); Google receives your IP address and browser information. Legal basis: our legitimate interest in a legible and consistent website design – Art. 6(1)(f) GDPR.
  • Google Map – the Contact page shows a Google Maps map (Google Ireland Limited); when it is displayed, Google receives your IP address and browser information. Legal basis: our legitimate interest in showing how to get to the Hotel – Art. 6(1)(f) GDPR.

5. Recipients of data

Recipients of data – to the extent necessary for their tasks – may be:

  • Profitroom S.A. (Poznań) – online booking system, processor acting on our behalf,
  • cyber_Folks S.A. (Poznań) – website and e-mail hosting, processor acting on our behalf,
  • Google Ireland Limited – Google Analytics, Google Tag Manager, Google Ads, Google Maps, Google Fonts,
  • Meta Platforms Ireland Limited – Meta pixel; we are joint controllers with Meta for collecting data with the pixel and transmitting it to Meta, while further processing is carried out by Meta as a separate controller (Meta Privacy Policy),
  • OpenAI – ads conversion pixel for ChatGPT ads in the booking window (only with consent to marketing cookies),
  • payment operators (e.g. Przelewy24 – PayPro S.A.) – as separate controllers,
  • providers of accounting, legal and IT services to us, and public authorities where required by law.

6. Transfers outside the EEA

Google, Meta and OpenAI belong to groups headquartered in the USA, so data collected by their tools may be transferred to the USA. Transfers are based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) for certified entities and otherwise on standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR). Information on the safeguards applied is available at info@hotelgb.pl.

7. Your rights

You have the right to:

  • access your data and receive a copy,
  • rectify your data,
  • erase your data,
  • restrict processing,
  • data portability – for data processed on the basis of a contract or consent,
  • object to processing based on our legitimate interest,
  • withdraw consent at any time – on the website via the “Cookie settings” link in the footer – without affecting the lawfulness of processing before withdrawal,
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with another supervisory authority, in particular in the EU Member State of your habitual residence.

To exercise your rights, write to info@hotelgb.pl or call +48 570 177 888.

8. Changes to this policy

We update this policy when the tools we use or the rules of data processing change. The current version is always available on this page.

Last updated: 23.09.2026