Privacy

In accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 2016 No. 119, p. 1 with subsequent amendments) (“GDPR”), we inform that:

1. The administrator of your personal data provided via electronic communication means, in particular through contact forms on websites and portals, as well as personally delivered in offices and branches or via mail, including in particular: a) first and last name, b) correspondence address, c) email address, d) phone number, e) date of birth (if required), f) credit card number (if required) is Grupa Inwestycyjna Hossa S.A. in Gdańsk, ul. Cypriana Kamila Norwida 1, 80-280 Gdańsk, registered in the National Court Register under number 0000006925 (hereinafter the "Administrator"), which is part of the Hossa Capital Group.

2. The entities of this group are: Grupa Inwestycyjna Hossa S.A. in Gdańsk (registered in the National Court Register under KRS number: 0000006925),

a) Hossa.biz Spółka z o.o. in Gdańsk (registered in the National Court Register under KRS number: 0000295112),

b) Garnizon Sp. z o.o. in Gdańsk (registered in the National Court Register under KRS number: 0000243263),

c) Gdynia 8 sp. z o.o. in Gdańsk (registered in the National Court Register under KRS number: 0000240578),

d) OCTO Hotels Sp. z o.o. in Gdańsk (registered in the National Court Register under KRS number: 0000643859).

3. Contact details of the Administrator's Data Protection Officer: IOD@hossa.gda.pl. The Administrator processes your personal data for the following purposes:

– contact and handling of inquiries submitted via the electronic contact form service and handling of requests (based on Article 6(1)(b) and (f) GDPR);

– provision of services to you based on concluded contracts, orders, reservations, or requests (based on Article 6(1)(b) GDPR);

– fulfillment of legal obligations incumbent on the Administrator imposed by applicable law (based on Article 6(1)(c) GDPR);

– conducting analyses, compilations, statistics, reports for internal needs of each of the entities of the Hossa Capital Group (if they may receive your personal data), which constitutes a legitimate interest of the Administrator, as well as pursuing claims or defending against claims directed at the Administrator (based on Article 6(1)(f) GDPR);

– marketing and commercial purposes, i.e. presenting and delivering to you by the Administrator and the entities of the Hossa Capital Group, based on separately given voluntary consents, advertising offers, commercial information, newsletters, and other informational, promotional, and marketing materials concerning the activities of the Administrator, the entities of the Hossa Capital Group, and entities cooperating with the Administrator and the entities of the Hossa Capital Group (hereinafter: "Trading Partners of the Administrator and the Entities of the Hossa Capital Group") via email to the address you provided, using means of direct remote communication through phone calls, SMS messages, and using other telecommunication terminal devices to the phone number you indicated (based on Article 6(1)(a) GDPR).

4. Providing your personal data is voluntary, but without it we will not be able to provide services to you.

5. Regardless of the above, we inform you that for the purposes and to the extent referred to in this Personal Data Processing Policy, your data may be shared by the Administrator with other entities of the Hossa Capital Group so that the entity of the Hossa Capital Group to which the data has been disclosed becomes the administrator of that data (i.e., processes it on the basis of its own processing grounds) or receives it for processing on behalf of the Administrator.

6. In the event that the entity of the Hossa Capital Group, to which your personal data has been disclosed by the Administrator, becomes the data controller of those data, the provisions of this Personal Data Processing Policy concerning the Administrator shall apply accordingly to that entity.

7. In particular, we point out that the provided personal data may – based on separate consents given by you and within the scope covered by those consents – be used by entities of the Hossa Capital Group for marketing purposes, i.e., to present and deliver to you by the Administrator and/or entities of the Hossa Capital Group advertising offers, commercial information, newsletters, and other informational, promotional, and marketing materials concerning the activities of the Administrator, the entities of the Hossa Capital Group, and the Trading Partners of the Administrator and/or entities of the Hossa Capital Group via email to the address provided by you and/or entities of the Hossa Capital Group at the email address provided by you, using means of direct remote communication through phone calls, SMS messages, and using other telecommunication terminal devices to the phone number you indicated.

8. The consent given for the processing of personal data may be withdrawn at any time (this will not affect the lawfulness of processing your personal data based on such consent before its withdrawal).

9. Where personal data are processed based on voluntarily given consent, the Administrator will process them for a maximum period of 5 years from the last contact for the purposes indicated in point 3 letter e above, or until the consent is withdrawn or for another period resulting from legal provisions. In other cases, your data will be stored for a period permitted by law to enable you to exercise your rights, as well as, where applicable, to allow evidence of the history of financial settlements between you and the Administrator.

10. The provided personal data may be recorded by the Administrator in an automated manner in IT systems and/or non-automated manner, organized, stored, retrieved, reviewed, used, disclosed by transmission, made available. Personal data may also be limited, deleted, and destroyed. Provided personal data may be subject to profiling, i.e., automated analysis and processing of predictions about your preferences or future behaviors to determine which offer you might be most interested in by the Administrator.

11. Recipients of your personal data may be the Administrator's suppliers, including companies providing IT services or delivering IT solutions to the Administrator, and companies conducting marketing activities, including participating and/or performing activities related to presenting and delivering advertising offers, commercial information, newsletters, and other informational, promotional, and marketing materials concerning the operations of the Administrator and/or entities of the Hossa Capital Group and Trading Partners of the Administrator and entities of the Hossa Capital Group (if they will have a legal basis for processing your personal data).

12. As a rule, your personal data is not transferred outside the European Economic Area (EEA). Such processing may, however, occur in connection with marketing and commercial purposes carried out with the involvement of business partners or suppliers from outside the EEA. In any case, this transfer will take place in compliance with the standards arising from the GDPR. You may contact the Administrator to obtain a copy of the applied safeguards.

13. You have the right to request from the Administrator, under the conditions specified in the GDPR:

– access to personal data,

– information about the purpose, scope, method, and form of processing,

– correction of personal data,

– deletion or restriction of data processing,

– transfer of data to another data controller.

14. Exercise of the rights mentioned above is possible at any time by submitting an appropriate request to the Administrator at the following contact address: info@hossa.gda.pl

If you believe that the processing of your personal data by the Administrator violates the provisions of law, you have the right to lodge a complaint with the competent supervisory authority (the President of the Personal Data Protection Office).

Cookie Policy

Furthermore, we kindly inform that the Administrator:

1. Operates this website (hereinafter the "Service").

2. Prioritizes the privacy protection of Users acquired through the Service and ensures the security of their personal data at the highest level, respecting Users' rights of access to personal data, correction, supplementation, deletion, or restriction of processing.

3. Does not automatically collect any data about Users through the Service, except for information contained in cookies, which constitute IT data, in particular text files stored on the User's device intended for using the website pages of the Service. Cookies generally contain the name of the website they come from, the storage time on the end device, and a unique number. The Administrator places cookies on the end device of Service Users and has access to them.

4. Informs that restrictions on using cookies may affect some functionalities available within the Service.

5. The Service uses cookies for the purposes of:

– optimizing the provision of electronic services via the Service;

– adjusting the content of displayed web pages to the individual preferences of the User and optimizing their use of the Service's website pages;

– studying traffic on the Service's web pages;

– reporting and supporting advertising and information emission;

– creating statistics regarding Users' usage of the Service;

– maintaining User sessions after logging in, so that the User does not need to re-enter login and password on each subpage;

– using social media features to promote the Service or, based on the User's consent, to use their data for commercial and marketing purposes, including delivering newsletters.

6. Indicates that the following types of cookies are used within the Service:

– session – temporary; used while creating a session by the User, stored on the User's device until logging out, leaving the website, or closing the software (web browser);

– privacy policy cookies – to confirm that the User has been informed about the use of cookies by the Service;

– necessary – enabling the use of the Service;

– statistical – for collecting statistical data via Google Analytics tools [Cookie administrator: Google Inc. based in the USA];

– advertising – for displaying ads tailored to the User's needs using an application allowing effective marketing strategy management: Google Marketing Platform [Cookie administrator: Google Inc. based in the USA],

– presenting multimedia content – retrieved from external services: www.youtube.com [Cookie administrator: Google Inc. based in the USA];

– using social media functions to promote the Service: twitter.com [Cookie administrator: Twitter Inc. based in the USA] and Facebook.com [Cookie administrator: Facebook Inc. based in the USA or Facebook Ireland based in Ireland], Instagram.com [Cookie administrator: Instagram Inc. based in the USA]. We recommend reading the privacy policies of these companies to learn their rules of cookie use in statistics.

7. Informs that Users of the Service can change cookie settings at any time in the browsers used. These settings can be changed to block automatic handling of cookies in the web browser settings or to notify about each placement of cookies on the User's device. Detailed information about the possibility and methods of handling cookies is available in the settings or help of the web browser.