1. General Information

This privacy policy applies to the website operating under the URL: roza-spa.pl

The website operator and personal data controller is: RÓŻA S.C. Piecha Róża, Piecha Grzegorz, ul. Graniczna 9c, 43-180 Orzesze, Poland, Tax ID (NIP): 6351290156 — operator of the resort Róża Wellness & Spa, ul. Sztormowa 3, 78-132 G r z y b o w o

Operator's contact email address: kontakt@roza-spa.pl

2. Legal Basis for Data Processing

Your personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Personal Data Protection Act of 10 May 2018.

The processing is based in particular on: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(a) GDPR (consent — including marketing and analytical cookies), Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (legitimate interest — handling inquiries and securing the website).

3. Purpose of Data Processing

  • Processing reservations and providing hotel services
  • Providing SPA and wellness services
  • Direct marketing of offered services
  • Handling inquiries through the contact form
  • Fulfilling legal obligations (e.g., issuing invoices)

4. Data Retention Period

Personal data is stored:

  • For service provision - for the period required by legal regulations
  • For marketing purposes - until consent is withdrawn
  • For contact forms - for the period necessary to handle the inquiry

5. Data Recipients

Recipients of personal data may only be entities supporting the operation of the website and the resort:

  • The website hosting provider
  • The online booking system provider (rezerwacje.roza-spa.pl)
  • Google Ireland Ltd. — for Google Analytics (only after consent), reCAPTCHA and YouTube services

In connection with the use of Google services, data may be transferred outside the European Economic Area with the safeguards provided for in the GDPR (including standard contractual clauses, EU-U.S. Data Privacy Framework).

6. User Rights

The user has the right to:

  • Access their personal data
  • Rectify data
  • Erase data
  • Restrict processing
  • Data portability
  • Object to processing
  • Withdraw consent for personal data processing
  • Lodge a complaint with the President of the Personal Data Protection Office (UODO)

7. Cookie Information

The website uses cookies for:

  • Ensuring proper website functionality
  • Implementing processes necessary for full page functionality
  • Analytics and research as well as audience auditing (only after consent)

Detailed information about the cookies used can be found in the Cookie Policy.

8. Cookie Management

On the first visit to the website, a consent banner is displayed in which the user can accept all, reject all or customize individual cookie categories. The decision can be changed at any time using the "Manage Consent" option available in the page footer. The user can also change their browser settings at any time to block cookie handling or to receive information each time they are placed on their device.

9. Google reCAPTCHA

The contact form is protected by Google reCAPTCHA, which serves to protect against spam and abuse (legitimate interest of the controller). This service is subject to the Google Privacy Policy and Terms of Service.

10. CCTV Monitoring

CCTV monitoring is carried out on the premises of the resort (reception and the corridor in the SPA area) to ensure safety and order and to protect persons and property (Art. 6(1)(f) GDPR — legitimate interest of the controller). Recordings are made available only to authorized persons and only in cases of absolute necessity. Detailed rules are set out in the Resort Rules available on the Downloads page.

11. Contact Regarding Personal Data

For matters related to personal data protection, please contact us:

  • Email: kontakt@roza-spa.pl
  • Phone: +48 698 104 955
  • Address: ul. Sztormowa 3, 78-132 G r z y b o w o

Last update date: 18.07.2026