Privacy Policy

1. Data controller

The controllers of your personal data in connection with the Additional Services contract purchased through the Portal (orders, performance, complaints, statutory tax and accounting duties) are joint controllers (art. 26 GDPR) operating under the shared HeyRent brand:

• Renters spółka z ograniczoną odpowiedzialnością (Renters sp. z o.o.), registered office at ul. Jana Sebastiana Bacha 26A, 02-743 Warszawa, Polska, KRS 0000678215, NIP 5213782041, REGON 367317066
• Polish Holiday Rentals spółka z ograniczoną odpowiedzialnością (Polish Holiday Rentals sp. z o.o.), registered office at ul. Jana Sebastiana Bacha 26A, 02-743 Warszawa, Polska, KRS 0000598008, NIP 6762500419, REGON 363581493

Essence of the arrangement (art. 26(2) GDPR). The joint controllers jointly determine the purposes and means of processing Guest data within one shared guest database and marketing operated under the HeyRent brand, and jointly ensure information duties and data security. The Seller that is party to your specific contract (and thus the controller of that sale’s data and the issuer of the sales document) is the entity operating the property of your reservation, as indicated in the reservation confirmation and on the sales document.

Contact point. Regardless of the internal allocation of roles, you may exercise your rights against either joint controller (art. 26(3) GDPR). Shared contact point for data matters: hey@heyrent.com, tel. +48 91 311 11 12.

Portal-side processor. The joint controllers entrust personal data to the Portal Operator — The Break spółka z ograniczoną odpowiedzialnością (The Break sp. z o.o.) — for processing on their behalf under a data-processing agreement (art. 28 GDPR). The Portal Operator is also a separate controller of only the technical data of the Portal itself (sessions, authentication, analytics, technical support) — not of your purchase or payment data; see the Platform Privacy Policy.

2. Legal bases and purposes

We process data under the GDPR for the following purposes:

• conclusion and performance of the Additional Services contract and handling of payments and complaints — Art. 6(1)(b);
• compliance with legal obligations, including tax and accounting — Art. 6(1)(c);
• establishing, pursuing or defending claims (Seller’s legitimate interest) — Art. 6(1)(f);
• marketing of the Seller’s services — solely based on your express consent — Art. 6(1)(a).

3. Scope of data processed

• contact and identification data: first name, surname, e-mail, phone number;
• reservation and stay data: property, stay dates, reservation number;
• order data: selected Additional Services, amounts, preferences (e.g. dietary);
• payment data: processed solely by Stripe Technology Europe, Limited (STEL) — an Irish e-money institution supervised by the Central Bank of Ireland (ref. C187865), which provides the Seller with its Stripe account (a connected account); neither the Seller nor the Portal Operator processes or stores full payment-card details;
• check-in / stay data (if provided during online check-in);
• marketing consents together with the date given.

4. Data recipients

Data may be shared with the following categories of recipients:

• The Seller’s payment-services provider — Stripe Technology Europe, Limited (STEL) — an Irish e-money institution supervised by the Central Bank of Ireland (ref. C187865) — the Seller uses its Stripe account to process payments; STEL is a separate, independent controller for payment-transaction processing. The Portal Operator does not intermediate payments and is not part of the payment-data flow;
• Portal Operator (The Break sp. z o.o.) — as processor on the Seller’s behalf and, for the Portal infrastructure itself, as a separate controller (see Platform Privacy);
• Seller’s reservation system / PMS (Guesty) — processes reservation and check-in data on the Seller’s behalf;
• Portal Operator’s IT providers (Supabase, Vercel, Resend) — act as processors on the Portal Operator’s behalf; details, including any transfers outside the EEA (e.g. to the USA on the basis of European Commission SCCs or the EU-U.S. Data Privacy Framework), are described in the Platform Privacy Policy;
• authorities entitled under the law — only where such an obligation arises from the law.

5. Retention period

• contract and payment data — for the term of the contract and the limitation period for claims (generally 6 years for consumer claims and 3 years for business-related claims, under art. 118 of the Polish Civil Code);
• accounting documents — for the period required by law (generally 5 years);
• data processed on the basis of consent — until consent is withdrawn.

6. Data protection

The Seller and the Portal Operator apply appropriate technical and organisational measures, including transport encryption (TLS), access control and the handling of payments solely by the Seller’s payment-services provider (outside the Portal Operator’s infrastructure).

7. Your rights

You have the right to:

• access your data and obtain a copy;
• rectification, erasure or restriction of processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time (without affecting prior lawful processing).

To exercise your rights, write to hey@heyrent.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

8. Cookies

The Portal uses cookies and similar technologies. Cookies are set by the Portal Operator and described in the Cookie Policy.

9. Voluntary provision of data

Providing data is voluntary but necessary to conclude and perform the Additional Services contract and to process payments. Without it, an order cannot be placed.