RODO DOCUMENTATION

Drzewna Apartments | Tomasz Stefanowicz Real Estate

Data Controller:

Tomasz Stefanowicz Real Estate
ul. Drzewna 20, 65-060 Zielona Góra
Tax ID (NIP): 8942987016
tomasz.stefanowicz@gmail.com | +48 790 635 582

The document contains:

1. Privacy Policy

2. GDPR Information Clause for Guests

3. Information Clause – Video Surveillance

4. Template of the Record of Processing Activities

Version: 1.1 | Date: March 2026

DOCUMENT 1: PRIVACY POLICY

1. Personal Data Controller

The controller of your personal data is:

Company:
Tomasz Stefanowicz Real Estate

Address:
ul. Drzewna 20, 65-060 Zielona Góra

Tax ID (NIP):
8942987016

E-mail:
tomasz.stefanowicz@gmail.com

Telephone:
+48 790 635 582

Brand:
Drzewna Apartments

The Controller has not appointed a Data Protection Officer (DPO). In matters related to personal data protection, you may contact the Controller directly via the e-mail address provided above.

2. Scope of Processed Data

Depending on the purpose, we process the following personal data:

1. first and last name

2. telephone number

3. e-mail address

4. invoice data (residential/business address, Tax ID)

5. identity document data (in the case of direct reservations – in accordance with legal requirements)

6. number of guests and duration of stay

7. reservation and correspondence history

3. Purposes and Legal Bases of Processing

3.1 Execution of reservations and rental agreements

Legal basis: Article 6(1)(b) GDPR – processing necessary for the performance of a contract.
Scope: contact details, guest data, payment data, reservation history.

3.2 Legal obligations

Legal basis: Article 6(1)(c) GDPR – compliance with legal obligations.
Scope: issuing invoices and accounting documents, guest registration records, tax obligations.

3.3 Legitimate interest of the Controller

Legal basis: Article 6(1)(f) GDPR – legitimate interest.
Scope: video surveillance for ensuring safety and property protection, pursuing claims, preventing abuse.

3.4 Marketing of own services

Legal basis: Article 6(1)(a) GDPR – consent of the data subject.
Scope: sending offers, promotions, and information about new services by e-mail or SMS. Consent is voluntary and may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Withdrawal of consent: send an e-mail to tomasz.stefanowicz@gmail.com with the text “Marketing opt-out”.

4. Sources of Data Collection

We obtain personal data:

1. directly from you (during reservation, telephone contact, e-mail or SMS communication)

2. through reservation platforms (e.g. Booking.com, Airbnb, Vrbo)

3. through the website

5. Data Recipients

Your data may be transferred to the following categories of recipients:

1. accounting office servicing the Controller

2. IT system providers (reservation systems, CRM, e-mail)

3. payment operators (e.g. Stripe, PayU, SumUp, Przelewy24)

4. reservation platforms through which the reservation was made

5. entities authorized under legal regulations (e.g. public authorities, courts)

6. Transfer of Data Outside the European Economic Area (EEA)

Some of our providers (e.g. Airbnb Inc., Booking Holdings Inc., Stripe Inc.) are based or process data outside the EEA, including in the United States. Data transfers take place solely on the basis of appropriate safeguards provided for in Article 46 GDPR, in particular standard contractual clauses approved by the European Commission. Detailed information about safeguards may be obtained by contacting the Controller.

7. Data Retention Periods

Rental agreement / reservation data – 6 years from the end of the agreement
Accounting documents and invoices – 5 years from the end of the tax year
Marketing data (with consent) – until withdrawal of consent or up to 3 years from the last contact
Video surveillance recordings – maximum 30 days

8. Rights of Data Subjects

You have the following rights:

1. Right of access (Article 15 GDPR)

2. Right to rectification (Article 16 GDPR)

3. Right to erasure (Article 17 GDPR)

4. Right to restriction of processing (Article 18 GDPR)

5. Right to object (Article 21 GDPR)

6. Right to data portability (Article 20 GDPR)

7. Right to withdraw consent at any time

8. Right to lodge a complaint with the supervisory authority – President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl

To exercise the above rights, contact the Controller at: tomasz.stefanowicz@gmail.com. A response will be provided within 30 days of receiving the request.

9. Video Surveillance

In some facilities, video surveillance is used to ensure guest safety and property protection pursuant to Article 6(1)(f) GDPR (legitimate interest of the Controller).
The surveillance covers only the common areas of the building and/or the entrance to the facility. Cameras are not installed in private areas (rooms, bathrooms). Recordings are stored for a maximum of 30 days and are then automatically overwritten. Information about surveillance is placed at the entrance to the monitored facility.

10. Voluntary Provision of Data

Providing data is voluntary, however necessary for concluding and performing the rental agreement. Failure to provide data required for the reservation makes it impossible to complete the reservation.

11. Cookies and Analytical Tools

When using the Controller’s website, cookies and analytical tools (e.g. Google Analytics) may be used. We distinguish:

1. Necessary cookies – essential for proper website functioning

2. Analytical cookies – collecting website traffic data

3. Marketing cookies – advertising personalization
   Detailed information regarding cookies is available in a separate Cookies Policy on the website.

12. Profiling and Automated Decision-Making

The Controller does not carry out profiling of personal data or automated decision-making producing legal effects or similarly significantly affecting individuals.

13. Changes to the Privacy Policy

The Privacy Policy may be updated in connection with changes in law, organizational changes, or technological changes. The Controller will inform about significant changes via e-mail or through a notice on the website.

Date of last update: March 2026

DOCUMENT 2: GDPR INFORMATION CLAUSE FOR GUESTS

Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), we inform you that:

1. Data Controller
   Tomasz Stefanowicz Real Estate, ul. Drzewna 20, 65-060 Zielona Góra, Tax ID: 8942987016

2. Contact
   tomasz.stefanowicz@gmail.com | +48 790 635 582

3. Data Protection Officer
   The Controller has not appointed a DPO. GDPR contact: tomasz.stefanowicz@gmail.com

4. Purposes and legal bases of processing
   a) execution of reservations and rental agreements
   b) legal obligations, including guest registration and accounting
   c) safety and property protection – surveillance
   d) marketing of own services – only with your consent

5. Data recipients
   Accounting office, IT system providers, payment operators (Stripe, PayU), reservation platforms. Some recipients may be based outside the EEA.

6. Retention period
   Agreement data: 6 years. Accounting documents: 5 years. Marketing data: until withdrawal of consent. Surveillance recordings: max. 30 days.

7. Your rights
   You have the right to access data, rectification, erasure, restriction of processing, objection, data portability, withdrawal of marketing consent, and lodging a complaint with the President of UODO.

8. Voluntary provision
   Providing data is voluntary but necessary to complete the reservation.

9. Profiling
   Data is not used for profiling or automated decision-making.

To exercise your rights or obtain more information, contact us: tomasz.stefanowicz@gmail.com

DOCUMENT 3: INFORMATION CLAUSE – VIDEO SURVEILLANCE

THE FACILITY IS UNDER VIDEO SURVEILLANCE
Data Controller: Tomasz Stefanowicz Real Estate, ul. Drzewna 20, 65-060 Zielona Góra
Contact: tomasz.stefanowicz@gmail.com | +48 790 635 582

Purpose of processing: Surveillance is used to ensure guest safety and property protection.
Legal basis: Article 6(1)(f) GDPR.
Storage period of recordings: maximum 30 days.

You have the right to access data, restrict processing, and object.
You also have the right to lodge a complaint with the President of UODO.