Privacy policy

1. Who the data controller is

The controller of personal data is Horeca Scandale Group Klesyk spółka jawna (a registered partnership under Polish law) with its registered office in Kraków, Plac Nowy 9, 31-056 Kraków, Poland, tax identification number NIP 6762479464, statistical number REGON 123206491, entered in the register of entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) under number KRS 0000523045 by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register, which operates the Le Scandale Club at ulica Zaruskiego 5 in Zakopane.

Contact on personal data matters: rezerwacje@scandalezakopane.pl, telephone +48 530 331 531, address for correspondence Plac Nowy 9, 31-056 Kraków, Poland.

We have not appointed a data protection officer. On all matters concerning data, please write to the address above.

2. What data we collect

• When you book a table or an entry ticket through the website: your name, telephone number, e-mail address, the number of people, the date and table chosen, the packages chosen, the booking password and any notes entered in the form.
• When you pay online: information that a payment has been made, its status and its amount. We do not receive or store payment card details or online banking credentials. These are handled by the payment operator.
• From CCTV at the Club: the image of people present in the area covered by CCTV. CCTV does not record sound.
• From photographs and video material from events: the image of people taking part in the event.
• From correspondence: the data given in an e-mail message or in a telephone conversation, to the extent needed to deal with the matter.
• Automatically when you visit the website: IP address, browser and system type, the date and time of the request and the referring address. These data are saved in the server logs and serve to keep the website secure and working properly.

3. For what purpose and on what basis we process data

We do not take decisions by automated means and we do not profile visitors.

4. How long we keep data

• Booking data: for the time needed to carry out the booking, and then until the limitation period for claims under the contract expires.
• Accounting documents: 5 years counted from the end of the calendar year in which the tax obligation arose.
• CCTV recordings: 30 days, and then automatically overwritten. Where a recording constitutes evidence in proceedings, until those proceedings have been finally concluded.
• Correspondence: for the time needed to deal with the matter, and then until the limitation period for claims expires.
• Server logs: for the period resulting from the configuration of the infrastructure provider, no longer than is needed to ensure security.
• Data processed on the basis of consent: until that consent is withdrawn.

5. Who we pass data to

We entrust data only to entities that process it on our instructions and under a data processing agreement, or to which disclosure is necessary in order to provide the service:

• PayPro Spółka Akcyjna, the operator of the Przelewy24 service, a national payment institution supervised by the Polish Financial Supervision Authority, in respect of handling online payments. The operator is a separate controller of payment data.
• Supabase, the provider of the database in which bookings are stored.
• Cloudflare, the provider of the infrastructure on which the website runs and of outgoing mail handling.
• Google Ireland Limited, for the reCAPTCHA service that protects the booking and contact forms against spam. reCAPTCHA loads only after a form is opened and analyses how it is used (including the IP address and browser data); it may also set its own cookies. The legal basis is our legitimate interest in protecting the forms against abuse, Article 6(1)(f) GDPR. Google's policy: policies.google.com/privacy.
• The accounting office serving the Club, in respect of accounting documents.
• Bodies entitled under the law, in particular law enforcement authorities, at their request supported by a legal basis.

Some infrastructure providers may process data outside the European Economic Area. In such a case the transfer takes place on the basis of standard contractual clauses approved by the European Commission.

We do not sell data and we do not pass it on to third parties for marketing purposes.

6. CCTV

1. The Club premises are covered by CCTV. The purpose is to ensure the safety of people and property, and the basis is the legitimate interest of the controller, that is Article 6(1)(f) GDPR.
2. CCTV covers the entrance to the Club, circulation areas, the rooms and the bars. It does not cover the toilets, the cloakroom or the smoking room.
3. CCTV does not record sound.
4. We keep recordings for 30 days, after which they are automatically overwritten.
5. The area covered by CCTV is marked with information signs at the entrance.
6. We do not keep a list of persons banned from entry, nor any other database of guests beyond bookings. The decision on entry is taken on the spot, on the basis of the criteria set out in the Club Rules.

7. Photographs and video material from events

1. During events we take photographs and video material of a reportage character. We publish them on the website and on the Club's social media and use them in promotional material relating to the Club's activity, including event reports and announcements.
2. The basis is Article 81(2)(2) of the Act on Copyright and Related Rights, under which no permission is required to disseminate the image of a person who constitutes merely a detail of a whole such as a gathering or a public event; and, as regards the GDPR, our legitimate interest in documenting and promoting our own activity.
3. Material in which a person is presented individually, in particular portrait and posed photographs, and material used in paid advertising and on posters, is published solely with that person's separate, voluntary consent. Consent may be withdrawn at any time.
4. Information that material is being recorded is displayed at the entrance to the Club.
5. Please send any request to remove a publication containing your image to rezerwacje@scandalezakopane.pl. We remove such a publication without undue delay and no later than within 14 days.

8. Cookies and external services

1. The website uses cookies and similar technologies, including the browser's local storage.
2. Necessary cookies keep the website working and remember your choice as to consent and your confirmation that you are of age. They always operate, because without them the website will not work properly and your choice could not be remembered.
3. We activate analytics and marketing cookies only after consent has been given in the banner displayed on your first visit. Without consent they are not loaded.
4. If marketing consent has been given, after a booking is sent we pass the e-mail address and phone number from the form to Google in hashed form (SHA-256), solely to measure the effectiveness of Google Ads (enhanced conversions). Without marketing consent we do not pass these data.
5. Consent may be changed or withdrawn at any time using the Cookie settings button available in the website footer. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn. Once consent is withdrawn we delete the related cookies.
6. Cookie settings may also be changed in your browser, including blocking them entirely. Blocking necessary cookies may make it impossible to use the booking form.

9. What rights you have

You have the right to:

• access your data and receive a copy of it
• have incorrect data rectified or incomplete data completed
• have data erased, where we have no basis for processing it further
• restrict processing
• data portability, for data processed on the basis of a contract or consent
• object to processing based on a legitimate interest, including to CCTV and to the publication of your image
• withdraw consent at any time, where processing is based on consent
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ulica Stawki 2, 00-193 Warsaw, Poland, if you consider that we process data unlawfully

It is enough to send a request to rezerwacje@scandalezakopane.pl. We reply without undue delay and no later than within one month.

10. Is providing data compulsory

Giving your name, telephone number and e-mail address is voluntary, but it is necessary in order to make a booking. Without those details we cannot confirm a booking or contact you about it. Giving a booking password is voluntary, and if none is given the booking is identified by the surname of the person making it. All other data, including the notes in the form, are provided voluntarily.

11. Changes to this policy

We may change this policy, for example when we add a new tool or change the way bookings are handled. The current version is always available at scandalezakopane.pl, together with the date it was last updated.

This document is a translation of the Polish original. In the event of any discrepancy between the language versions, the Polish version available at scandalezakopane.pl prevails.