Last updated: 2026-07-02
1. Data Controller
The controller of personal data on this portal is Bali Turistic (owner: UJAREK, Jaroslaw Borowski, VAT ID PL8392518338). Contact: kontakt@ujarek.com.
2. Data Collected
The portal collects:
- from users registering accounts: email, name, password (encrypted), country, optionally phone;
- from venue owners (claims): venue contact data, claim justification;
- automatically from visitors: IP address, browser, country, pages visited, time on site (Google Analytics 4);
- in contact form: name, email, message content.
3. Purpose of Processing
Data is processed for:
- enabling portal use and account management;
- verifying venue profile claims;
- communication with users;
- traffic analysis and optimisation (Google Analytics 4 — anonymised);
- legal obligations (taxes, accounting for paid plans).
4. Legal Basis
Processing is based on:
- Art. 6(1)(b) GDPR — contract performance;
- Art. 6(1)(f) GDPR — legitimate interest (analytics, security);
- Art. 6(1)(a) GDPR — consent (newsletter, marketing cookies).
5. Recipients
Data may be transferred to:
- hosting provider (Hetzner Online GmbH, Germany);
- analytics provider (Google Ireland Limited);
- payment operator Przelewy24 (for paid plans);
- email provider (LH.pl);
- public authorities under applicable law.
6. Retention Period
- account data — until deletion or 3 years from last login;
- accounting data (paid plans) — 5 years (tax obligation);
- server logs — 90 days;
- Google Analytics — 26 months.
7. User Rights
Under GDPR you have the right to:
- access your data;
- rectification;
- erasure ("right to be forgotten");
- restriction of processing;
- data portability;
- objection to processing;
- complaint to the supervisory authority.
To exercise these rights, write to kontakt@ujarek.com.
8. Cookies
The portal uses cookies for:
- maintaining logged-in user session (necessary);
- remembering language preferences (functional);
- traffic analysis (Google Analytics — can be rejected).
9. Transfer Outside EEA
Google Analytics may transfer data to the USA. Google Ireland Limited uses standard EU contractual clauses ensuring GDPR-level protection.
10. Policy Changes
The policy may be updated. The date of last change is at the top. Significant changes are communicated by email to registered users.