1. General information and scope of the Policy

This document outlines key information concerning the processing of your personal data by companies belonging to the ‘Wieliczka’ Salt Mine Group in connection with your use of the websites operating under the kopalnia.pl domain, in particular information pages, booking pages, contact forms, the online store, the ‘Salt Mill’ Guest Rooms and communication tools, including AI-powered chatbots (hereinafter referred to collectively as Websites).

This Policy also concerns the processing of your personal data in connection with establishing or maintaining contact with companies belonging to the ‘Wieliczka’ Salt Mine Group via other communication channels, including e-mail, telephone calls or postal correspondence.

For the purposes of this Policy, the ‘Wieliczka’ Salt Mine Group is understood to comprise the following companies:

Company	Registered office	Registration data
Kopalnia Soli “Wieliczka” S.A.	Park Kingi 1, 32-020 Wieliczka	National Court Register No. (KRS): 0000278401, NIP (VAT ID): 6830003427, REGON (National Business Registry Number): 000041683; share capital: 21,000,000.00 PLN, paid in full.
Kopalnia Soli “Wieliczka” Turystyka Sp. z o.o.	Park Kingi 10, 32-020 Wieliczka	National Court Register No. (KRS): 0000030908, NIP (VAT ID): 6831480313, REGON (National Business Registry Number): 351197769; share capital: 810,000.00 PLN
Kopalnia Soli „Wieliczka” Wsparcie Sp. z o.o.	Park Kingi 10, 32-020 Wieliczka	National Court Register No. (KRS): 0000095741, NIP (VAT ID): 6831705025, REGON (National Business Registry Number): 351428631; share capital: 470,000.00 PLN

Henceforth, each individual company shall be referred to as a Company; and collectively they shall be referred to as the Group Companies.

Each Company acts as a separate data controller in the context of its own processing operations, where it bears responsibility for the processing or independently determines the purposes and means of data processing.

Depending on the nature of your relationship with a particular Company – for example, an enquiry or a booking you have made, a purchase from the online store, a stay at a given venue, a complaint you have lodged, B2B communications, contacting a Company or uring a specific subpage, the controller of your personal data is the relevant Group Company.

2. Identifying the relevant data controller

The relevant data controller is to be identified primarily on the basis of the content of the relevant website, form, Terms and Conditions, booking confirmation, invoice, correspondence or information provided in connection with the service in question.

Process / Relationship	Relevant data controller
Pages or forms concerning a specific offer, service, venue or event	The Company linked to the specific offer, service, venue or event..
Bookings, enquiries, hotel stays, services provided by the Grand Sal Hotel or the ‘Salt Mill’ Guest Rooms	As a general rule, the data controller in these cases is Kopalnia Soli “Wieliczka” Turystyka Sp. z o.o., unless otherwise stated in the documents or in the form.
Online store and order processing, including the store assistant chatbot	The Company named as the seller or service provider in the store’s Terms and Conditions, the order confirmation or the sales document. If the seller is Kopalnia Soli “Wieliczka” Turystyka Sp. z o.o., that Company is the relevant data controller.
Contact forms and general communications	The relevant Company based on the content of the enquiry. If an enquiry has been submitted to the wrong company, it may be forwarded to the relevant Group Company for processing.
Newsletters, marketing, analytics and advertising	Company responsible for particular communication, campaign, service or marketing initiative concerning its offering. Data may also be processed by service providers or other companies acting as data recipients in connection with the technical management of the domain.
Video surveillance	Company managing the monitored facility or area. Further details should be set out in a separate video surveillance clause available at the venue or at the location specified on the Website.
Relations with business partners, suppliers, institutional clients and their representatives	Company that is a party to a given relationship, conducts negotiations, enters into a contract or participates in a partnership.

If a particular Service concerns more than one Company, each of those companies may act as a separate data controller. In this case, each controller processes the relevant personal data for its own purposes and under its own responsibility.

To make it easier to get in touch regarding personal data protection matters, you may use the contact point for the Data Protection Officer for the Group Companies at iod.ksw@kopalnia.pl

3. Purposes and grounds for personal data processing

In accordance with Articles 13 and 14 of the General Data Protection Regulation, we hereby inform you that personal data may be processed for the following purposes and on the following legal grounds. The relevant Company applies only purposes and legal grounds corresponding to the relevant process.

Purposes of data processing	Legal grounds for data processing
Ensuring proper operation of the Services, ICT security and the basic features of the website.	Article 6(1)(f) of the General Data Protection Regulation – the controller’s legitimate interest in ensuring the operation of the Services, their security and basic functionality.
Receiving inquiries, providing responses, presenting an offer, making a booking or taking steps leading to the conclusion of a contract, including via an information chatbot.	Article 6(1)(b) of the General Data Protection Regulation – taking action at the request of the data subject prior to entering into a contract or in connection with the performance of a contract; Article 6(1)(f) of the General Data Protection Regulation – legitimate interest, namely handling enquiries and liaising with individuals representing a client, ordering party or a business partner.
Setting up and managing user accounts, if such a feature is available on the Website.	Article 6(1)(b) of the General Data Protection Regulation – provision of services via electronic means and the performance of a contract; Article 6(1)(f) of the General Data Protection Regulation – legitimate interest, namely ensuring account security and handling any claims.
Processing and fulfilling orders placed via the online store, including handling payments, deliveries, order details and after-sales communication.	Article 6(1)(b) of the General Data Protection Regulation – the conclusion and performance of a contract for the sale of goods or the provision of services; Article 6(1)(c) of the General Data Protection Regulation – obligations arising from tax and accounting regulations; Article 6(1)(f) of the General Data Protection Regulation – legitimate interest, namely communication with the customer, ensuring the security of transactions, and establishing, pursuing or defending against claims.
Handling complaints and enquiries concerning services, products, stays or the operation of the Websites.	Article 6(1)(b) of the General Data Protection Regulation – processing requests concerning a contract; Article 6(1)(c) of the General Data Protection Regulation – obligations arising from legal provisions, including those pertaining to complaints or guarantees; Article 6(1)(f) of the General Data Protection Regulation – legitimate interest, namely contacting individuals acting on behalf of the complainant and handling claims.
Carrying out obligations concerning issuing and retention of accounting documents, receipts and invoices.	Article 6(1)(c) of the General Data Protection Regulation – legal obligation incumbent on the controller, arising in particular from tax legislation and the Accounting Act.
Carrying out promotional and marketing activities, including distribution of newsletters and other marketing communications, provided the user has given the required consent for the relevant communication channel.	Article 6(1)(f) of the General Data Protection Regulation (legitimate interest – direct marketing of products and services) in connection with consent given in accordance with Article 398 of the Electronic Communications Act).
Compiling analytics and statistics concerning user activity on the Websites, where cookies or similar technologies other than strictly necessary ones are used.	Article 6(1)(f) of the General Data Protection Regulation (legitimate interest – carrying out analytical and statistical activities relating to the User for the purpose of developing and improving services).
Advertising, measuring campaign effectiveness, personalising advertisements and using extended conversions, including the use of tools provided by Google, Meta, Benhauer/Salesmanago, Hotjar and others. Installing cookies for this purpose may require obtaining additional consent in accordance with separate legal provisions.	Article 6(1)(f) of the General Data Protection Regulation (legitimate interest –the Company’s own marketing and optimisation of marketing activities).
Handling queries, providing support and presenting information about services, products and offerings using an information chatbot.	Article 6(1)(b) of the General Data Protection Regulation – taking steps prior to entering into a contract, for example in the cases of enquiries concerning quotes, bookings, services or products; Article 6(1)(f) of the General Data Protection Regulation – legitimate interest, namely providing customer support, responding to enquiries and improving communication.
Operation of the store assistant chatbot, including user verification via the order number and e-mail address provided at the time of purchase, providing information on order status, shipment or delivery.	Article 6(1)(b) of the General Data Protection Regulation – performance of a contract for the sale of goods or the provision of a service relating to the fulfilment of an order; Article 6(1)(f) of the General Data Protection Regulation – a legitimate interest in secure verification of the identity of the user asking questions concerning orders, preventing unauthorised data disclosure, providing customer service and defending against claims.
Analysis of the chatbot’s performance, improving responses, ensuring security and enhancing user experience, where such an analysis is carried out.	Article 6(1)(f) of the General Data Protection Regulation – legitimate interest, namely improving the quality of service, enhancing the tool’s performance and ensuring security.
Fulfilment of obligations stemming from child protection standards, including receiving, documenting and investigating reports or incidents concerning the safety of minors – to the extent required by law and in accordance with established child protection standards.	Article 6(1)(c) of the General Data Protection Regulation - legal obligation incumbent on the data controller in conjunction with the Act on Combating the Threats of Sex Offences and the Protection of Minors.
Establishing, investigating or defending against claims, including debt recovery.	Article 6(1)(f) of the General Data Protection Regulation – legitimate interest, namely establishing, pursuing and defending against claims, and recovering debts.
Contact with representatives of customers, clients, suppliers and business partners.	Article 6(1)(f) of the General Data Protection Regulation – legitimate interest, namely maintaining business relationships, facilitating cooperation and communication with individuals acting on behalf of other entities.

There are two main areas in which chatbots may be used on Websites:

• information chatbot, which enables Users to obtain information concerning services, products, offers, bookings or the terms and conditions of use of the Websites;
• store assistant chatbot – available in the online store, which enables customers to check the status of their order or delivery by entering their order number and the e-mail address used at the time of purchase.

The underlying mechanism for conducting a conversation with a chatbot may be based on artificial intelligence solutions that analyse the content of a query and generate responses automatically.

The responses provided by the information chatbot are intended to be helpful and informative; in particular, they may concern services, products, offerings, bookings, the terms of use of the Website or other information made available by the data controller.

The store assistant chatbot may provide information concerning the given order, in particular its status, shipment or delivery, following a successful verification of the order number and the e-mail address used at the time of purchase.

While using the store chatbot assistant, the User may be asked to provide order number and the e-mail address used to place the order. Once this information has been successfully verified, the chatbot may only access the data necessary to process the query regarding the order, such as order ID, the customer’s email address, the recipient’s first name, surname and address, the recipient’s telephone number, the billing address, the order status, order date, order total, discount code, total after discount, list of products, parcel number, courier company, parcel tracking link and selected delivery method.

Users should not enter any personal data belonging to the special categories within the meaning of Article 9 of the General Data Protection Regulation, data relating to criminal convictions or offences, as well as any other information that is not relevant to the query.

If the chatbot requires cookies other than strictly necessary ones, such cookies should be disclosed in the consent management panel and should only be activated once the appropriate consent has been obtained. The use of the chatbot should not be conditional upon acceptance of the Privacy Policy. Users should be informed about the processing of their personal data; however, consent is required only where it is required by law, for example in the case of analytical, functional or marketing cookies, extended conversions or marketing communications.

Data provided during a conversation with a chatbot should not be used to train external AI models in a way that allows the user to be identified, unless the user is specifically informed about such a possibility and there is an appropriate legal basis for such processing.

4. Cookies, other similar technologies and extended conversions

As Users use the Websites, the relevant Group Companies or a supplier acting on their behalf may collect information such as cookie identifiers, device identifiers, IP addresses, geolocation data, information about User activity on the Websites, as well as other information collected via cookies or similar technologies. In some circumstances, this information may constitute personal data.

Cookies are bits of data, specifically text files, which are stored on the user’s device and are intended to facilitate the use of websites. Cookies usually contain the name of the website from which they originate, the length of time they are stored on the end device and a unique number.

The following categories of cookies or similar technologies may be used on the Websites:

• essential cookies – used to ensure the proper operation of the Websites and their basic features;
• functional cookies – used to store settings or to enable the use of selected features of the Websites, where applicable;
• analytical and statistical cookies – used to measure and analyse how the Websites are used;
• marketing cookies – used for advertising and remarketing activities, measuring campaign effectiveness and utilising extended conversions.

Non-essential cookies are used once the user’s consent has been obtained, where such consent is required by law. Users can manage their preferences via the banner or the consent management panel – in particular, Cookiebot; this includes giving consent to all categories of cookies, selecting only certain categories, or refusing consent altogether. Users may withdraw their consent or change the preferences using the consent management panel.

Detailed information concerning cookies, including their names, providers, purposes and retention periods, should be available upon expanding the consent management panel, in particular by clicking the Cookiebot icon or the ‘Details’ tab in the cookie banner. The user may also change their cookie settings at any time in their web browser’s settings. Restricting cookies may affect some of the features offered by the Websites.

Extended conversions provided by Google may be used on the Websites. If the User provides data such as an e-mail address or telephone number on the Website, this data may be converted into a technical identifier using a hashing feature and submitted to Google for the purpose of measuring the effectiveness of advertising campaigns and attributing conversions to previous interactions with an advertisement. If the User uses Google services, Google may link their activity on the Websites with their account or profile in accordance with its own privacy policy. Extended conversions should only be triggered if the User has given the required consent in the consent management panel, in particular consent to marketing cookies and similar technologies.

5. Recipients of personal data

The recipients of personal data may include authorised employees and associates of the relevant Group Companies, as well as entities providing services to these Companies; this concerns in particular:

• entities providing IT support, hosting, maintenance, security and development services in connection with the Websites;
• organisations involved in handling the booking, sales, payment, invoicing, accounting and settlement processes;
• banks, payment service providers, postal operators, courier companies, parcel locker operators and entities providing delivery or transfer services;
• marketing agencies, organisations running advertising campaigns, and providers of analytics, marketing, remarketing and statistical tools, including Google, Meta, Hotjar, Benhauer/Salesmanago and similar providers;
• providers of communication tools, chatbots and AI-based solutions, including ChatLab Sp. z o.o., to the extent necessary to support the relevant functionality;
• other Group Companies - only where the matter in question concerns the given Company, the transfer of data is necessary to provide customer support, deliver a service, ensure the operation of the Websites, or arises from the organisation of the Group;
• entities entitled to obtain data on the basis of provisions of law.

Detailed information about cookies and the entities which may receive data in connection with the use of cookies and similar technologies are available in the consent management panel, in particular via the Cookiebot.

6. Source of data on representatives of clients, suppliers and business partners

If the User is a representative of a client, contracting party, supplier or business partner, the relevant Group Company may process their contact details, including first name, surname, e-mail address, telephone number, job title and details identifying the entity they represent, in connection with an existing business relationship or with a view to establishing one. If the data was not obtained directly from the relevant individual; it may have been provided by a client, a contracting party, a supplier or a business partner whom that individual represents.

7. Data retention period

Personal data will be retained for a period relevant to the purpose of its processing, in particular:

• for the duration of the contract, order, booking, performance of a service or use of a particular feature of the Websites;
• for the duration of the correspondence or contact, and subsequently for the period necessary to demonstrate the course of the communication or to defend against claims;
• for the period required by law, in particular by tax and accounting regulations, if the data is contained in accounting records;
• until a valid objection to the processing of data has been lodged – where the basis for processing is a legitimate interest of the data controller;
• until consent is withdrawn – where processing is based on consent; this does not affect the lawfulness of the processing carried out prior to its withdrawal;
• for the period specified in the cookie settings or the consent management panel, but no longer than necessary for the specific purpose – in the case of data processed using cookies other than strictly necessary ones;
• for the content of conversations with an information chatbot — for a period no longer than 180 days from the end of the conversation, unless longer retention is necessary to handle enquiries, complaints, legal obligations, or to establish, pursue or defend against claims;
• in the case of data processed in connection with the use of the store assistant chatbot — for a period no longer than 180 days from the end of the conversation, unless longer retention is necessary to process an order, enquiry or complaint, to comply with legal obligations, or to establish, pursue or defend against claims;
• in the case of data processed for the purpose of analysing the performance of chatbots — for the period necessary to carry out such an analysis; however, statistical summaries, reports and analyses not including any personal data may be retained for a longer period, in particular for the purpose of comparing the effectiveness and usage patterns of chatbots across successive periods;
• for the period specified in the relevant legislation, adopted standards and archiving rules – in the case of documentation pertaining to the standards for the protection of minors.

Once the relevant retention period has expired, personal data will be deleted, anonymised or archived if further retention is required by law or is necessary for establishing, pursuing or defending against legal claims.

8. Rights of data subjects

In relation to the processing of personal data, the Users have the following rights, to the extent provided for by the General Data Protection Regulation:

• the right to access their personal data;
• the right to rectify their personal data;
• the right to erase their personal data;
• the right to restrict the processing of their personal data;.
• the right to data portability;
• the right to object to the processing of data – where data is processed on the basis of a legitimate interest;
• the right to withdraw consent – where data is processed on the basis of consent;
• the right to lodge a complaint with the President of the Personal Data Protection Office.

The Users may exercise their rights by contacting the relevant Group Company or by sending a message to the Data Protection Officer. In the case of cookie consent, the settings can also be changed in the consent management panel, in particular via Cookiebot.

9. Voluntary provision of data

The provision of personal data is voluntary; however, it may be necessary in order to use certain features of the Websites, place an order, make a booking, enter into and perform a contract, handle an enquiry or complaint, or check the status of an order via the store assistant chatbot. The provision of data is mandatory where such an obligation arises from legal provisions, in particular tax and accounting regulations.

10. Automated decision-making

When using the Websites, Users are not subjected to decisions based solely on automated processing, which would expose the Users to legal effects or affect them significantly in any different way. The Chatbot may automatically analyse the content of a query and generate a response; however, it is intended to be used for the purpose of obtaining support and receiving information.

11. Transfer of Data Outside the European Economic Area

In connection with the use of analytical, marketing, communication and cloud-based tools, as well as artificial intelligence-based solutions, personal data may be transferred outside the European Economic Area, in particular to the United States of America.

In such cases, the transfer of data takes place in accordance with the requirements set out in the General Data Protection Regulation, in particular on the basis of a decision confirming an adequate level of protection, if the recipient is covered by the relevant mechanism, or on the basis of standard contractual clauses approved by the European Commission and additional safeguards, where required.

12. Video surveillance

Selected locations on the premises owned or managed by Group Companies, including selected buildings, entrances, passageways, outdoor areas, infrastructure elements and other locations specified in separate information notices, may be covered by video (CCTV) surveillance. As a rule of thumb, only the video footage from the cameras is recorded without sound, unless otherwise stated in a notice displayed at the relevant location.

The data controller for CCTV data is the Company responsible for managing the relevant venue or area. Detailed information concerning video surveillance, including its purpose, legal basis, the area covered by the surveillance, the retention period for recordings and the rights of data subjects, should be provided in a separate information notice concerning CCTV surveillance.

13. Changes to this Policy

Group Companies may update this Policy, in particular in the event of changes to relevant laws, the structure of the Websites, the scope of services provided, the tools used or the rules governing the processing of personal data. The current version of the Policy is published on the Websites.