Privacy Policy

Effective from: April 2026 · Last updated: June 2026

1. What data we collect

We collect personal data only when you actively provide it to us, specifically:

• Contact form: name, email address, phone number, preferred date, number of guests, and any message you write
• WhatsApp / phone bookings: name, phone number, and booking details you share during the conversation
• Cookies: technical cookies required for the website to function, and analytics cookies (if you consent)

We do not collect payment data - all payments are made in person on the day of the tour.

2. How we use your data

Your data is used solely for the following purposes:

• Processing and confirming your tour or transfer booking
• Communicating with you before, during, and after your booking
• Answering enquiries submitted via the contact form
• Improving our website (aggregated, anonymised analytics only)
• Measuring our advertising and showing relevant ads (Google Ads / remarketing) - only if you accept marketing cookies

We only use your data for advertising or remarketing if you accept marketing cookies in the cookie banner (see section 4). We never sell your personal data to third parties.

3. Legal basis for processing (GDPR)

• Contract performance (Art. 6(1)(b) GDPR): processing your booking and delivering the service
• Legitimate interests (Art. 6(1)(f) GDPR): responding to enquiries and improving our service
• Consent (Art. 6(1)(a) GDPR): analytics and marketing cookies (Google Analytics, Google Ads) - you can withdraw consent at any time via cookie settings
• Legal obligation (Art. 6(1)(c) GDPR): retaining booking records required by Polish tax and accounting law

4. Cookies and consent

Our website uses the following categories of cookies:

• Essential cookies - remember your language preference (yk_lang) and your cookie consent choice (yk_cookie_consent). These are strictly necessary and cannot be disabled.
• Analytics cookies (Google Analytics 4) - used to understand how visitors use our website in aggregate (e.g. _ga, _ga_*). These are only loaded if you click "Accept all" in the cookie banner. If you click "Essential only" or have not yet made a choice, no analytics or marketing cookies are set: Google Analytics and Google Ads run in cookieless consent mode and store no identifiers until you consent. To display the page correctly, Google Fonts (and Google Maps, when you open the map) still load and may transfer your IP address to Google.
• Marketing cookies (Google Ads) - used to measure ad performance and conversions and to show relevant ads / remarketing (e.g. _gcl_*). These are only loaded if you click "Accept all".

Withdrawing consent: you can change your cookie choice at any time by clicking Cookie settings. You may also clear cookies via your browser settings, which will cause the consent banner to reappear on your next visit.

5. Data retention

We retain your personal data for as long as necessary to fulfil the purpose for which it was collected:

• Booking information: up to 5 years (to meet tax and accounting obligations under Polish law)
• Enquiry data (no booking made): up to 12 months
• Cookie data: as defined by each cookie's expiry (typically 1-2 years)

6. Your rights under GDPR

As a data subject, you have the following rights:

• Right of access: request a copy of the data we hold about you
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion of your data ("right to be forgotten")
• Right to restriction: request that we limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: withdraw cookie consent at any time without affecting prior processing

To exercise any of these rights, contact us at hello@yourkrakow.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

7. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. Our website uses HTTPS encryption for all data transmitted between your browser and our servers.

8. Third-party services

We use the following third-party services that may process your data:

• WhatsApp (Meta Platforms Ireland Ltd.) - used for booking communications and customer support. Subject to Meta's Privacy Policy.
• Google Fonts (Google LLC) - typography is loaded from Google's CDN. Subject to Google's Privacy Policy.
• Google Analytics 4 (Google Ireland Ltd. / Google LLC) - website analytics. Only loaded after you accept analytics cookies via the cookie banner. Subject to Google's Privacy Policy.
• Google Ads (Google Ireland Ltd. / Google LLC) - measuring advertising performance and conversions, and remarketing. Only loaded after you accept marketing cookies via the cookie banner. Subject to Google's Privacy Policy.
• SMS notification provider - used to send booking notifications by SMS; receives the phone number you provide when booking.
• Website hosting and email provider - stores website data and handles email correspondence on our behalf, within the EU.

9. International data transfers (outside the EEA)

Some of the third-party services listed above are operated by companies headquartered in the United States. When you interact with those services, your data may be transferred outside the European Economic Area, including to the United States.

• Google LLC (Analytics, Ads, Fonts): certified under the EU-U.S. Data Privacy Framework. Transfers are also covered by the European Commission's Standard Contractual Clauses (SCCs).
• Meta Platforms (WhatsApp): covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

You have the right to obtain a copy of the safeguards that apply to these transfers - please contact us by email and we will provide them.

10. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available at yourkrakow.com/privacy-policy. Significant changes will be communicated on the website.

11. Contact

For any questions about this Privacy Policy or how we handle your data, please contact: