Privacy Policy

1. Data Controller

The controller of your personal data is the company Remigiusz Szczechowicz, Tax ID (NIP) 557-111-66-61, registered at Padniewo 59, 88-300 Mogilno, Poland.

For data-protection matters, contact us by email at biuro@zagrodabobra.pl, via the contact form on this site, or in writing at the address above.

The Controller has not appointed a Data Protection Officer (DPO). Matters concerning your personal data are handled directly by the Controller through the channels listed above.

2. Purposes and Legal Bases of Processing

We process your personal data for the following purposes:

• Sending notifications about the opening of Zagroda bOBRA, construction progress and commercial information about our own services (e.g., kayaking trip dates, seasonal offers) — legal basis: Art. 6(1)(a) GDPR (your explicit consent given when subscribing to the mailing list) and Art. 10(2) of the Polish Act on Providing Services by Electronic Means.
• Fulfilling our GDPR accountability obligations — legal basis: Art. 6(1)(c) GDPR.

3. Scope of Data Processed

We process the data you voluntarily provide in the form: name (or nickname) and email address. Additionally, in order to document the fact of consent (accountability, Art. 7 GDPR) and to prevent abuse, we log: submission timestamp, the submitter’s IP address, browser type (User-Agent), the URL of the page from which the submission was sent, and the version of the consent text displayed. We treat IP addresses as personal data within the meaning of GDPR.

4. Retention Period

• Data submitted to receive notifications and commercial information: kept until consent is withdrawn or the opening notification is sent (GDPR Art. 13(2)(a) — criteria for determining the period).
• Consent metadata (accountability, Art. 7 GDPR): retained with the contact data for the same period and additionally for 3 years after consent withdrawal — solely as proof of consent in case of a supervisory authority audit.
• After these periods data is permanently deleted or anonymised.

5. Recipients of Data

Your data may be shared with the following processors, acting solely on our documented instructions:

• Cloudflare, Inc. (USA) — site hosting (Cloudflare Pages), CDN, DDoS and bot protection (Turnstile), traffic statistics (Cloudflare Web Analytics — cookieless, aggregated, no individual user tracking), and email routing for the zagrodabobra.pl domain (Cloudflare Email Routing). Transfer based on EU Standard Contractual Clauses (SCC) approved by the European Commission.
• Resend, Inc. (USA) — transactional email delivery. Transfer based on EU Standard Contractual Clauses (SCC).

Your data is not sold or shared with any third parties for marketing.

6. Your Rights

In connection with the processing of your personal data, you have the following rights:

• Access to your data (Art. 15 GDPR).
• Rectification of your data (Art. 16 GDPR).
• Erasure (“right to be forgotten”, Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR).
• Object to processing (Art. 21 GDPR).
• Withdraw consent at any time, without affecting lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR).
• Lodge a complaint with the Polish Data Protection Authority (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl) if you believe processing violates GDPR.

To exercise any right, contact us via the contact form, email biuro@zagrodabobra.pl, or in writing at the controller’s address (Padniewo 59, 88-300 Mogilno, Poland).

7. Voluntariness

Providing personal data is voluntary but necessary to receive opening-notification updates and commercial information about our services. Without it, we cannot fulfil that purpose.

8. Automated Decision-Making

Your data is not subject to automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

9. Cookies and Traffic Statistics

The Zagroda bOBRA website does not use cookies for marketing or user profiling.

We collect traffic statistics (visit counts, country of origin, device type, pages visited) through Cloudflare Web Analytics — this tool operates without cookies and does not build a profile of your activity across websites. Data is aggregated on Cloudflare’s servers; we do not store any identifiers or advertising tags in your browser. As a result, using our site does not require an analytics-cookie consent (there are none to accept).

Cloudflare Turnstile (form bot protection; to be activated in a later phase) operates in Managed mode — also without tracking cookies.

10. Changes to This Policy

This privacy policy may be updated to reflect changes in how we process data. The current version is published on this page along with the last-modified date. Material changes will be announced with reasonable notice.

Last updated: 15 May 2026.