1. Data controller
The controller of personal data collected through this website and in connection with enquiries and bookings is Tomasz Kieres KRK-KrakowTours, Agatowa 33/57, 30-798 Kraków, Poland, NIP 6792867142.
Privacy contact: krk.krakowtours@gmail.com, phone / WhatsApp: +48 511 968 164.
2. What data we process
Depending on how you contact us or which service you request, we may process your name, email address, phone or WhatsApp number, travel date, number of travellers, pickup and drop-off locations, luggage or vehicle requirements, tour preferences, messages you send us and other information that you voluntarily provide in connection with your trip.
For website security and anti-spam protection, the server may also process technical information such as your IP address, request time, browser information and requested URL. The booking and transfer forms use short-lived anti-abuse records based on a one-way hash of the IP address; the active rate-limit window is 10 minutes.
3. Why we use your data and the legal basis
- To answer enquiries, prepare quotes and take steps requested before a booking — Article 6(1)(b) GDPR.
- To arrange and perform booked tours, activities or transfers — Article 6(1)(b) GDPR.
- To meet legal, tax or accounting obligations where applicable — Article 6(1)(c) GDPR.
- To protect the website, prevent abuse, keep necessary business records and establish, exercise or defend legal claims — Article 6(1)(f) GDPR (legitimate interests).
We do not use the website forms to subscribe you to marketing communications, and we do not currently use Google Analytics, Google Tag Manager, Meta Pixel or comparable advertising trackers on this website.
4. Who may receive the data
Data may be processed by service providers that are necessary to operate the website and communicate with you, including the hosting provider LH.pl Sp. z o.o., email services used with the Gmail account, and WhatsApp when you choose to contact us through WhatsApp. Data may also be disclosed to authorities or other entities where required by law.
When a tour or transfer requires a third-party attraction, guide or activity provider, only the information reasonably necessary to arrange the requested service may be shared with that provider.
5. International processing
Some communication providers, including Google and Meta/WhatsApp, operate global infrastructure. Depending on the service and your location, data may be processed outside the European Economic Area under the safeguards and transfer mechanisms used by those providers.
6. How long we keep data
- Enquiries that do not lead to a booking are normally kept for up to 12 months after the last contact, unless a longer period is necessary for a legal claim or another lawful reason.
- Data connected with a confirmed booking is kept for the duration of the service and afterwards for the periods required by applicable tax/accounting law and for the time necessary to establish, exercise or defend claims.
- Short-lived form anti-abuse records are limited to an active window of approximately 10 minutes and expired temporary files are removed automatically during subsequent form requests.
- Technical server logs may be retained by the hosting provider for operational and security purposes according to its service and security policies.
7. Your rights
Subject to the conditions set by the GDPR, you may request access to your personal data, rectification, erasure, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland.
8. Is providing data mandatory?
Providing information through an enquiry form is voluntary, but the fields marked as required are necessary for us to understand and respond to the request. If you do not provide the information needed to arrange a service, we may be unable to prepare or confirm the booking.
9. Automated decisions
We do not use personal data collected through this website for automated decision-making or profiling that produces legal or similarly significant effects.
10. External services and maps
Some transfer pages offer an interactive map using the Leaflet library and OpenStreetMap tiles. These external map resources are not loaded automatically: they are loaded only after you choose “Load map”. At that point your browser connects to external servers, which may receive technical connection data such as your IP address and browser headers. External links to WhatsApp, review platforms and social networks are also governed by the privacy practices of those services once you visit them.
11. Changes to this policy
We may update this policy when the website, service providers or legal requirements change. The current version and update date are published on this page.
Last updated: 15 September 2026