Privacy Policy
This is an English translation for convenience. The Polish version is legally binding: Polish version.
In force from 31 August 2026.
This document explains what we do with the data of people who write to us through the form on triplogicroi.com, and with the data of trip participants entered into trip books. These are two different matters and we describe them separately, because we have a different role in each.
1. Who is responsible for the data
The controller of the data of people who contact us is Joanna Falkowska-Czubkowska, ul. Przytulna 20B lok. 25, 80-176 Gdańsk. Contact on data protection matters: joanna@triplogicroi.com, tel. +48 665 999 686. We have not appointed a data protection officer. There is no such obligation at this scale.
2. What data we collect from agencies
| Type | What exactly |
|---|---|
| Contact | Agency name, first name and surname of the contact person, email address, phone number |
| About your needs | Destination of the next trip, type of trip, number of days, number of participants, number of trips per season, whether a tour leader travels with the group |
| Billing | Details for the bill, order and payment history |
| Correspondence | Emails, messages and files you send us |
| About use of the website | Pages visited, approximate location at country and city level, device and browser type. Collected only with consent, see the Cookie Policy |
3. Purposes and legal bases
- To respond to a request for the price list and prepare a quote: Art. 6(1)(b) of the General Data Protection Regulation (GDPR), steps taken before entering into a contract.
- To perform the contract and maintain trip books: Art. 6(1)(b) GDPR.
- To issue bills and keep sales records: Art. 6(1)(c) GDPR, tax obligations.
- To measure how the website performs (Meta, Hotjar): Art. 6(1)(a) GDPR, only with consent given in the banner.
- To pursue or defend claims: Art. 6(1)(f) GDPR, our legitimate interest.
We do not send a newsletter and we do not add anyone to a mailing list on the basis of the form alone. We write about the matter someone contacted us about.
4. Trip participants’ data: here we only act on the agency’s behalf
The trip book holds participants’ data: first name, booking number, sign-ups for optional excursions, declared diets and allergies, and consents to contact. They are entered by the agency or by the participant.
The controller of this data is the travel agency, not us. We are the processor within the meaning of Art. 28 GDPR and we process it solely on the documented instructions of the agency, so that the book and the panels work. On request, we sign a separate data processing agreement.
A declared diet or allergy may be information about health, that is, a special category of data under Art. 9 GDPR. That is why the participant provides it themselves, voluntarily, and only if they want the restaurant to know about it. It is visible to the tour leader and the agency, not to the whole group.
What this means in practice:
- We do not build a shared database from this data and we do not combine one agency’s data with another agency’s data.
- We do not sell it or share it with anyone other than the providers listed in section 6.
- The agency can export it to a spreadsheet at any time, including on the day the cooperation ends.
- After the contract ends, we delete it or return it to the agency, as the agency decides.
- A participant who wishes to exercise their rights contacts the agency. If they write to us, we pass the matter on to the agency and inform them that we have done so.
5. Consents to contact collected in the book
The participant ticks the marketing consent themselves, in the book, and sees next to it what it covers. Anyone who has not ticked it does not go onto the agency’s mailing list and cannot be added to it manually. Every message sent on this basis contains a link to withdraw consent. The controller for this consent is the agency.
6. Who we share data with
We do not sell data. We use providers without whom the website would not work:
| Provider | Purpose | Where it processes data |
|---|---|---|
| Vercel | Hosting of the website, books and panels | EU and USA |
| Cloudflare | Storage of photos used in the books | EU and USA |
| Google Workspace | Email joanna@triplogicroi.com | EU and USA |
| Resend | Sending notifications about form submissions | EU and USA |
| Telegram | Notification of a new submission. It receives the agency name, email address and phone number | Outside the EEA |
| Meta Platforms | Measuring ad effectiveness, only with consent | USA |
| Hotjar | Website usage statistics, only with consent | EU |
We also share data with our accounting office and, where necessary, with a legal adviser and with authorities entitled to receive it under the law.
7. Transfers outside the European Economic Area
Some providers process data outside the EEA, mainly in the United States. In such cases, we rely on standard contractual clauses approved by the European Commission, or on an adequacy decision if the provider is covered by one.
8. How long we keep data
- Enquiries that did not lead to cooperation: up to 12 months from the last contact, after which we delete them. On request, we delete them immediately.
- Customer data: for the duration of the contract and for the limitation period for claims.
- Bills and sales records: 5 years, counting from the end of the tax year in which the tax obligation arose.
- Trip participants’ data: for the period set by the agency, and no longer than until the contract with the agency ends.
- Data from measurement tools: in line with the periods given in the Cookie Policy.
9. Your rights
You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. You may withdraw consent at any time. Withdrawal does not affect anything we did lawfully before it.
Write to joanna@triplogicroi.com. We reply within one month.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.
10. Is providing data mandatory?
No, but without an email address and phone number we cannot send you the price list or a quote. That is exactly what the form is for. Without billing details, we cannot issue a bill.
11. Security
Access to the panels is protected by logins and passwords, the connection is encrypted, and only people who need access to agencies’ files have it. We do not store payment card data. We settle payments by bank transfer on the basis of a bill.
12. Automated decisions
We do not profile anyone and we do not make decisions about anyone solely by automated means. The quote from the form is arithmetic based on the price list, not a decision within the meaning of Art. 22 GDPR. The final price is confirmed by a person.
13. Changes
We may change this document. The date at the top shows when we last changed it. We inform customers affected by significant changes by email.