The Polish language version of this policy is the binding one. This English version is provided for convenience; in the event of any discrepancy, the Polish version prevails.
Your data is processed by two joint controllers:
The two companies jointly determine the purposes and means of the processing (art. 26 GDPR). The essence of the arrangement between them is available on request.
Contact point for all matters concerning personal data: privacy@girlstel.com. You may exercise your rights against either joint controller independently, but writing to this address is the fastest way.
Your stay in the GIRLSTEL space, the guest portal (guest.girlstel.com) together with your account and the chat, and the bookable services: luggage storage, laundry and coworking. The marketing site girlstel.com is covered by a separate policy.
We do not process payment card data - it is handled by Stripe as an independent controller.
| Purpose | Legal basis |
|---|---|
| Booking, stay, bookable services, check-in and check-out handling | art. 6(1)(b) GDPR - performance of a contract |
| Guest portal account and support chat | art. 6(1)(b) GDPR |
| Access codes to doors and lockers | art. 6(1)(b) and (f) - safety of people and property |
| Notifications to staff about bookings and orders | art. 6(1)(b) and (f) - efficient handling of the stay and services |
| Accounting and tax obligations | art. 6(1)(c) GDPR |
| Security of systems, technical server records, detection of abuse | art. 6(1)(f) - legitimate interest |
| Securing, pursuing and defending claims | art. 6(1)(f) GDPR |
You set the door code (6 digits) yourself in the guest portal. The system writes it into the locks for the duration of your stay and removes it after check-out.
Door and locker codes are data concerning your safety, not only your privacy. For that reason they are visible in the guest portal only after you log in and only during your stay; the check-in page containing the code is deleted from the server within 7 days of check-out. Staff have access to the codes to the extent needed to handle your stay. Do not pass your code to third parties - access is personal.
The account is created automatically when a booking appears in your name, and gives you access to your bookings, your check-in and the chat.
An account with no booking and no message attached to it is deleted automatically: within 7 days if it was never opened, and within 30 days if it was opened. An account with a booking history is deleted 12 months after the last activity. Deleting the account does not delete accounting data, which we are required to keep under tax law - see below.
In the chat we ask only for information needed to handle your stay. Please do not send health data, identity documents or other sensitive data there - we do not need them and we do not want to store them.
We delete the chat conversation in full, automatically, once 6 months have passed since the last message in it.
Exception: if the content of the conversation or the circumstances indicate that a complaint, a dispute or a claim may arise, we secure that conversation and do not delete it after 6 months. We then keep it until the matter is concluded and for one year afterwards, and if no proceedings are started - no longer than until the claims become time-barred. A secured conversation is used for that purpose only.
Stripe (payments, outside our control - acting as an independent controller), Exely (the booking system), the hosting provider (server in Berlin, EEA), e-mail, and booking intermediaries in respect of their own bookings.
Notifications to staff are sent via the Telegram messenger (Telegram Messenger Inc.). Depending on the service they contain:
Notifications concerning coworking and the chat contain no data that would identify you - staff look up the details in the system.
We do not sell data and we do not share it with third parties for marketing purposes.
Apart from that, the data stays within the European Economic Area.
| Category | Period |
|---|---|
| Booking and stay data (name, contact details) | anonymised after 3 years - the period runs to the end of the calendar year (art. 118 of the Civil Code) |
| Accounting and tax data | 5 years from the end of the tax year (art. 74 of the Accounting Act, art. 86 of the Tax Ordinance) |
| Guest portal account | 12 months from the last activity; empty account - 7 or 30 days |
| Chat | 6 months from the last message, deleted automatically; a conversation secured for a dispute - see section 7 |
| Door access code in the locks | until check-out |
| Check-in page containing the access code | 7 days from check-out |
| Confirmation that you have read this policy | 3 years |
| Records of messages and links sent | 24 months |
| Technical server records (IP address) | 90 days |
| Backups | 7 days locally and 7 days on the backup server |
Data covered by proceedings, a complaint or a dispute is kept until the matter is concluded and for one year afterwards, irrespective of the periods above.
You have the right of access to your data, and the rights to rectification, erasure, restriction of processing, objection to processing based on legitimate interest, and data portability. We handle such requests within 30 days of their receipt at the contact address.
One limitation we state openly: data which we are required to keep under tax and accounting law cannot be deleted before the statutory period expires. At your request we restrict its processing (art. 18 GDPR) - it remains solely for accounting purposes and is not used for anything else.
You have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
The processing of data necessary for your booking and stay is based on the contract (art. 6(1)(b) GDPR), not on your consent. By ticking the box in the form you confirm that you have read this Policy and the Rules of the Space - you are not giving consent to processing, because consent is not the basis here and withdrawing it could not invalidate the booking.
We state the effective date of each version at the top of the document. We inform you about material changes at the next contact.
End of text.
This policy covers the stay, the guest portal and the bookable services. The girlstel.com website (contact form, cookies) has a separate policy: girlstel.com/polityka.