Privacy Policy

Effective from: April 2026 · Last updated: October 2026

1. What data we collect

We collect personal data only when you actively provide it to us, specifically:

• Contact form: name, email address, phone number, preferred date, number of guests, and any message you write
• WhatsApp / phone bookings: name, phone number, and booking details you share during the conversation
• Cookies: technical cookies required for the website to function, and analytics cookies (if you consent)

We do not collect payment data - all payments are made in person on the day of the tour.

2. How we use your data

Your data is used solely for the following purposes:

• Processing and confirming your tour or transfer booking
• Communicating with you before, during, and after your booking
• Answering enquiries submitted via the contact form
• Improving our website (aggregated, anonymised analytics only)
• Measuring our advertising and showing relevant ads (Google Ads / remarketing) - only if you accept marketing cookies

We only use your data for advertising or remarketing if you accept marketing cookies in the cookie banner (see section 4). We never sell your personal data to third parties.

3. Legal basis for processing (GDPR)

• Contract performance (Art. 6(1)(b) GDPR): processing your booking and delivering the service
• Legitimate interests (Art. 6(1)(f) GDPR): responding to enquiries and improving our service
• Consent (Art. 6(1)(a) GDPR): analytics and marketing cookies (Google Analytics, Google Ads) - you can withdraw consent at any time via cookie settings
• Legal obligation (Art. 6(1)(c) GDPR): retaining booking records required by Polish tax and accounting law

4. Cookies and consent

Our website uses the following categories of cookies:

• Essential cookies - remember your language preference (yk_lang) and your cookie consent choice (yk_cookie_consent). These are strictly necessary and cannot be disabled.
• Analytics cookies (Google Analytics 4) - used to understand how visitors use our website in aggregate (e.g. _ga, _ga_*). These are only loaded if you click "Accept all" in the cookie banner. If you click "Essential only" or have not yet made a choice, no analytics or marketing cookies are set: Google Analytics and Google Ads run in cookieless consent mode and store no identifiers until you consent. To display the page correctly, Google Fonts (and Google Maps, when you open the map) still load and may transfer your IP address to Google.
• Booking source (yk_wejscie, kept in your browser for 30 days) - if you click "Accept all", we remember which website, link or ad brought you to us, so that a booking you make shows where it came from. Without your consent nothing is stored: a booking then only records the page it was made on. Withdrawing consent deletes it.
• Marketing cookies (Google Ads) - used to measure ad performance and conversions and to show relevant ads / remarketing (e.g. _gcl_*). These are only loaded if you click "Accept all".

Withdrawing consent: you can change your cookie choice at any time by clicking Cookie settings. You may also clear cookies via your browser settings, which will cause the consent banner to reappear on your next visit.

5. Data retention

We retain your personal data for as long as necessary to fulfil the purpose for which it was collected:

• Booking information: up to 5 years (to meet tax and accounting obligations under Polish law)
• Enquiry data (no booking made): up to 12 months
• Cookie data: as defined by each cookie's expiry (typically 1-2 years)

6. Your rights under GDPR

As a data subject, you have the following rights:

• Right of access: request a copy of the data we hold about you
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion of your data ("right to be forgotten")
• Right to restriction: request that we limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: withdraw cookie consent at any time without affecting prior processing

To exercise any of these rights, contact us at hello@yourkrakow.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

7. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. Our website uses HTTPS encryption for all data transmitted between your browser and our servers.

8. Third-party services

We use the following third-party services that may process your data:

• WhatsApp (Meta Platforms Ireland Ltd.) - used for booking communications and customer support. Subject to Meta's Privacy Policy.
• Google Fonts (Google LLC) - typography is loaded from Google's CDN. Subject to Google's Privacy Policy.
• Google Analytics 4 (Google Ireland Ltd. / Google LLC) - website analytics. Only loaded after you accept analytics cookies via the cookie banner. Subject to Google's Privacy Policy.
• Google Ads (Google Ireland Ltd. / Google LLC) - measuring advertising performance and conversions, and remarketing. Only loaded after you accept marketing cookies via the cookie banner. Subject to Google's Privacy Policy.
• SMS notification provider - used to send booking notifications by SMS; receives the phone number you provide when booking.
• Website hosting and email provider - stores website data and handles email correspondence on our behalf, within the EU.

9. International data transfers (outside the EEA)

Some of the third-party services listed above are operated by companies headquartered in the United States. When you interact with those services, your data may be transferred outside the European Economic Area, including to the United States.

• Google LLC (Analytics, Ads, Fonts): certified under the EU-U.S. Data Privacy Framework. Transfers are also covered by the European Commission's Standard Contractual Clauses (SCCs).
• Meta Platforms (WhatsApp): covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

You have the right to obtain a copy of the safeguards that apply to these transfers - please contact us by email and we will provide them.

9a. The YourKrakow mobile app

The YourKrakow app for phones (Android and iOS) works without an account and without signing in. It contains no advertising and nothing that follows you across other apps or websites. This section explains what happens to data in the app.

• Bookings: the form in the app sends our server the same data as the form on the website: your name, phone number, email address, the date, the time, the number of guests and your notes, and for an airport transfer also the direction and the flight number if you give it. We process it as described in sections 1 to 6.
• Location: the app asks for it only to show your position on the map and walking times to places. Your position is used on your phone only, while the app is open. We do not send it to our server or to anyone else, and we do not store it anywhere. The app also works without location permission.
• Data kept on your phone: the chosen language, your answers to the first-launch questions, saved places, the list of requests you have sent, and the name, phone and email from your last form (so you do not have to type them again). This data does not leave your phone. You can remove it in the app under “More”, then “Start over”, or by uninstalling the app.
• Map and photos: the app loads the map from OpenFreeMap, the line of a walking route from the OpenStreetMap routing service (run by FOSSGIS e.V., Germany), and some photos from Wikimedia Commons. These services receive the IP address of your phone, as with any internet connection, and which part of the map or which places of the guide to show. They do not receive your position or anything from the booking form.
• Other apps: the “Take me there”, “WhatsApp” and “Share” buttons open Apple Maps, Google Maps, WhatsApp or another app you choose. From that moment the privacy rules of that app apply.
• Anonymous usage counts: to see which parts of the app are useful, the app sends our own server (not an analytics company) counts of what was done in it: which screens, places, routes and guide chapters were opened, which map filters were used, whether a walk was started and finished, which place was saved or shared, taps on WhatsApp and on a free hour, whether the search was opened and which kind of result was chosen (never the words typed), whether location was allowed, and whether a booking form was opened, stopped at a field, sent or failed. With them go the app language, the system (Android or iOS), the app version, the day and a random number that is new every time the app is started. They contain no name, no contact details, no position, no time of day and no identifier of your phone. We do not store your IP address with them and we do not link them to you or to your booking. This happens only if you switch on “Anonymous usage statistics”, which the app offers once at first launch; it is off until you do, and you can switch it off again at any time under “More”. Counts older than 400 days are deleted.
• Reminders: if you tap “Remind me about this booking”, the app asks your phone for permission to show notifications and sets the reminder on the phone itself. Nothing is sent to us and no notification service is involved. “Start over” removes the reminders.

To have booking data on our server deleted, write to hello@yourkrakow.com. We reply within 30 days.

10. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available at yourkrakow.com/privacy-policy. Significant changes will be communicated on the website.

11. Contact

For any questions about this Privacy Policy or how we handle your data, please contact: