1. Controller of the Portal’s technical data
The controller of your personal data in connection with use of the guest portal hostante.com (and hostante.pl and hostante.eu) itself (sessions, authentication, analytics, support, the Portal Operator’s own marketing) is The Break spółka z ograniczoną odpowiedzialnością (The Break sp. z o.o.), registered office at ul. Rogatkowa 49D, 04-773 Warszawa, Polska, KRS 0000770003, NIP 9512477738, REGON 382485820.
Contact for data matters: contact@breakmake.pl, tel. +48 572 411 556.
For purchases of Additional Services the controller is the Seller for the given reservation — see its own Privacy Policy. In that context the Portal Operator acts as a processor on the Seller’s behalf (art. 28 GDPR).
2. Legal bases and purposes
We process data under the GDPR for the following purposes:
- providing the Portal and its proper operation (sessions, authentication, cart) and technical support — Art. 6(1)(b) and (f) (Portal Operator’s legitimate interest);
- Portal security and fraud prevention — Art. 6(1)(f) (legitimate interest);
- compliance with the Portal Operator’s legal obligations, including those arising from the platform-services (SaaS) agreement and tax/accounting rules — Art. 6(1)(c);
- analytics — only with consent given in the cookie banner — Art. 6(1)(a);
- Portal Operator’s own marketing (e.g. information about new Portal features) — only with consent — Art. 6(1)(a).
3. Scope of data processed
- session and cart identifiers (incl. Portal localStorage);
- technical metadata: IP address, browser/device identifier, access times — for security and diagnostics;
- support data: correspondence with the Portal Operator on Portal-technical matters;
- analytics data — only after consent to analytics cookies;
- marketing consents given to the Portal Operator (where applicable) — together with the date.
4. Data recipients
- Seller — to the extent the use of the Portal is connected to a specific reservation and required to perform the Additional Services;
- The Guest’s payment is made directly to the Seller through Stripe Technology Europe, Limited (STEL) — an Irish e-money institution supervised by the Central Bank of Ireland (ref. C187865), which acts as a separate, independent controller for executing payments — the Portal Operator has no access to the Guest’s payment-instrument authentication data. The Portal Operator receives from Stripe only limited transaction data necessary to settle its commission (e.g. amount, payment identifiers);
- IT infrastructure providers: Supabase (database and authentication), Vercel (application hosting), Resend (transactional e-mail) — acting as processors on the Portal Operator’s behalf;
- Seller’s reservation system / PMS (Guesty) — exchange of reservation data to the extent necessary for the Portal to function;
- authorities entitled under the law — only where such an obligation arises from the law.
5. Transfers outside the EEA
Some of the Portal Operator’s infrastructure providers (e.g. Vercel, Resend) may process data outside the European Economic Area, including in the USA. Such transfers take place on the basis of European Commission Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, ensuring an adequate level of data protection. Stripe Technology Europe, Limited (STEL) — an Irish e-money institution supervised by the Central Bank of Ireland (ref. C187865) is established in Ireland (EEA) — executing the payment does not involve a transfer to a third country.
6. Retention period
- technical data and logs — generally up to 12 months, longer if required by law or to establish / pursue claims;
- support data — for the time needed to handle the request and the limitation period for claims;
- data processed on the basis of consent — until consent is withdrawn.
7. Your rights
You have the right to:
- access your data and obtain a copy;
- rectification, erasure or restriction of processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw consent at any time (without affecting prior lawful processing).
To exercise your rights, write to contact@breakmake.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).
8. Cookies
The Portal uses cookies and similar technologies — details and consent management in the Cookie Policy.
9. Voluntary provision of data
Providing the data necessary for the Portal to function is voluntary but required to use the Portal. Data processed on the basis of consent (analytics, the Portal Operator’s marketing) are fully voluntary and do not affect access to the Portal.