Privacy policy

1. Data controller

The controller of your personal data is Strony WWW Pomorze Aleksander Szypryt, ul. Miła 6/2, 77-100 Bytów, NIP 5862357079, Poland - the maker of Alfa PMS.

For any data protection matter, e-mail kontakt@stronywwwpomorze.pl or write to the company address. We have not appointed a data protection officer, as we are not required to.

2. Scope of this policy

This policy covers data collected on alfapms.app: through the "Book a demo" form, in e-mail correspondence and in server logs.

It does not cover guest, staff and owner data that hotels and apartment operators enter into the Alfa PMS system. Our client is the controller of that data, and we process it on their behalf under a data processing agreement (Art. 28 GDPR).

3. What data we collect

• from the form: full name, property or company name, e-mail address, phone number, property type, number of rooms or apartments and your message,
• from correspondence: any data you include in your e-mail,
• technical data: IP address, browser and system type, date and time of the visit and the page visited - recorded automatically in server logs.

Providing data is voluntary, but without your name and e-mail address we cannot reply.

4. Purposes and legal bases

• replying to your enquiry and preparing a demo and offer - Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(a) (consent given in the form),
• further correspondence about the demo - Art. 6(1)(f) GDPR (our legitimate interest in business conversations),
• entering into and performing a contract if you choose Alfa PMS - Art. 6(1)(b) GDPR,
• accounting and tax obligations - Art. 6(1)(c) GDPR,
• site security, abuse detection and incident handling (server logs) - Art. 6(1)(f) GDPR,
• establishing, exercising and defending legal claims - Art. 6(1)(f) GDPR.

5. Who we share data with

We never sell data or share it with other companies for marketing. Access may be granted only to:

• our hosting and e-mail provider (servers in Poland), acting as a processor under a data processing agreement,
• our accounting office, if a contract is signed and invoices are issued,
• public authorities, only where required by law.

6. Transfers outside the European Economic Area

We do not transfer data outside the EEA. The website, database and e-mail run on servers in Poland.

7. How long we keep data

• enquiries and correspondence - until the conversation ends, no longer than 12 months after the last contact, unless we sign a contract,
• client data - for the term of the contract and then until claims become time-barred,
• accounting records - for 5 years from the end of the year in which the tax payment was due,
• server logs - for the period set by our hosting provider and no longer than needed for security,
• data processed on the basis of consent - until consent is withdrawn.

8. Your rights

You have the right to:

• access your data and receive a copy,
• rectify your data,
• have your data erased,
• restrict processing,
• data portability,
• object to processing based on our legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, e-mail kontakt@stronywwwpomorze.pl. We will reply without undue delay and within one month at the latest.

You may also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or with the supervisory authority in your country of residence.

9. Profiling and automated decisions

We do not make decisions about you based solely on automated processing and we do not profile your data.

10. Cookies and third-party tools

This site uses no analytics or marketing cookies and embeds no advertising scripts, tracking pixels, or third-party maps or videos.

Fonts are served from our own server, so your IP address is not passed to font providers.

Technical cookies may only be set when logging into the site administration panel - they are necessary for it to work.

Your language choice is kept in the address (e.g. /en/), not in cookies.

11. Security

The connection to the site is encrypted (HTTPS). Only authorised people can see form submissions, and admin accounts are protected with strong passwords.

12. Changes to this policy

We update this policy when the law or the way the site works changes. The current version is always available at this address.

Last updated: 28 September 2026