Dear Guests, respecting your privacy and ensuring that you know who and how your personal data is processed, we present below information that will help you determine this:

1. Personal Data Controller

The controller of your personal data is RÓŻA S.C. Piecha Róża, Piecha Grzegorz with its registered office at ul. Graniczna 9c, 43-180 Orzesze, Poland, Tax ID (NIP): 6351290156 — operator of the resort Róża Wellness & Spa (ul. Sztormowa 3, 78-132 G r z y b o w o) — hereinafter referred to as the Controller; the Controller processes the following personal data:

  • First name, Last name,
  • Residential address,
  • E-mail address,
  • Phone number.

We do not have a data protection officer. All matters related to the protection of personal data should be sent to the Controller at the e-mail address kontakt@roza-spa.pl

2. Purpose of data processing

Your personal data is processed for the purpose of contract performance. Data may be entrusted to entities supporting the Controller (hosting provider, online booking system provider) only to the extent necessary to provide the services; it is not made available to other recipients for marketing purposes.

3. Legal basis

The legal basis for processing your personal data is Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), i.e., the performance of the contract for a recreational stay at our facility.

4. Data provision requirement

Providing data is necessary for concluding the contract; in case of failure to provide data, it is impossible to conclude the contract.

5. Rights regarding personal data

You have the right to:

  • Request from the Controller access to your personal data, rectification, erasure or restriction of processing of personal data,
  • Object to such processing,
  • Data portability,
  • Lodge a complaint with the supervisory authority,
  • Withdraw consent for the processing of personal data.

6. Automated decision-making

Your personal data is not subject to automated decision-making, including profiling.

7. Data retention period

Your personal data will be stored for the period specified in the regulations regarding the obligation to archive documentation.

Last update date: 18.07.2026