1. Data controller and contact

The data controller is FHU NAUTIC Aleksander Cichosz, ul. Dworcowa 52, 84-100 Gnieżdżewo, Poland, tax identification number (NIP) 591-148-10-30, business registration number (REGON) 191345068 (the “Controller”).

You can use these contact details for personal data enquiries. The basic data protection rules are set out in Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

2. What data do we process and where does it come from?

• Buyer details: first name and surname, email address, telephone number and information supplied in correspondence.
• Booking details: order number, ticket identifier and QR code, selected sailings, dates and times, numbers of standard and concession tickets, children under 3, and bicycles or scooters.
• Journey administration: payment and booking status, check-in for individual legs, check-in time, changes, refunds and staff activity history.
• Billing details: payment amount and method, transaction identifiers, receipt number, invoice buyer details, address and NIP, and, where necessary, information required to issue a refund.
• Technical data: IP address or identifiers derived from it, request and error information, security logs and browser session data, to the extent resulting from the services used.
• Notifications: email address and selected sailing date if you request an availability notification, and records of messages sent about an order.

We obtain data mainly from you, from a person making a purchase on your behalf, from the payment provider and during booking administration. When you use the company details lookup, information may be retrieved from the Polish Ministry of Finance’s public register using the NIP provided.

A group booking may be recorded under one contact person’s details. The ticket form does not require the names of all children; it records the number in the relevant category. Do not send health information or copies of identity documents unless staff have explained why they are needed and how to provide them securely.

3. Purposes and legal bases

Messages necessary to handle a purchase, such as tickets, payment enquiries or notices of sailing changes, do not require marketing consent. Accepting the terms and conditions or simply reading this policy does not constitute marketing consent.

4. Do you have to provide your details?

Online purchases require a first name, surname, email address and telephone number. The system will not complete the order without the mandatory details. Purchases from staff require a first name and surname; email and telephone details are optional. Without an email address, you receive a printed ticket rather than an email ticket.

Mandatory invoice details depend on the type of buyer and legal requirements. Optional details and consent to additional services are not conditions of buying a ticket. Providing personal data is voluntary, but in certain circumstances necessary to supply the requested service or comply with a legal obligation.

5. Who may receive the data?

• Authorised staff and crew, to the extent needed for sales, check-in, contact and journey administration.
• LH.pl sp. z o.o., the hosting and email provider, for storage and handling of website data, the order database and correspondence; also technical support or backup providers within the scope of their assigned services.
• PayPro S.A. (Przelewy24) and other entities involved in the chosen payment. The payment provider may act as an independent controller for its own obligations.
• Accounting or legal service providers and authorities legally entitled to receive data.
• Google, Microsoft and Meta, providers of the analytics and advertising tools described below. The data involved depends on service configuration and user choices. Provider roles follow the terms of the relevant services; not all providers act solely on the Controller’s instructions.

Entities processing data on our behalf do so under an appropriate contractual arrangement. Entering invoice details and using the NIP lookup sends a query containing the NIP to the Polish Ministry of Finance’s VAT taxpayer register API.

6. Analytics, advertising and international processing

We use tools to understand how visitors use the website, improve its operation and measure advertising performance:

• Google Analytics — statistics about visits, traffic sources and website activity, using online identifiers and information about devices, browsers and approximate location. The provider is Google, including Google Ireland Limited. Google Privacy Policy.
• Microsoft Clarity — analysis of clicks, scrolling, heatmaps and session replays to improve the website. Website usage data is collected through cookies and similar technologies; Microsoft may also use it for advertising under its service terms. The provider is Microsoft, including Microsoft Corporation. Microsoft Privacy Statement.
• Meta Pixel — measuring advertising performance and creating audiences, including remarketing. Data may include visits, website events, identifiers and device information. Meta may combine this with data about users of its services. The provider for the European region is Meta Platforms Ireland Limited. Meta Privacy Policy.

We rely on your consent to process data for optional analytics and advertising. You can refuse or withdraw consent in the cookie settings. Consent is not a condition of buying a ticket. The operation of these tools depends on the consent given and the settings of each service.

Using international service providers may involve processing data outside the European Economic Area, including in the United States. A transfer may rely on a European Commission adequacy decision where it covers the recipient, or on standard contractual clauses together with the required safeguards. Contact us for information about safeguards relating to your data and how to obtain a copy.

7. Cookies and consent management

The website uses cookies and similar technologies, such as browser local and session storage. These support the cart, purchase session and remembered choices and, for optional tools, analytics and advertising.

• Necessary: enable the requested service, purchasing and storage of consent choices.
• Analytics: help us understand website use and improve its operation.
• Marketing: measure advertising and tailor it to audiences.

We use Complianz to manage cookie choices. The consent panel allows you to accept or reject optional cookies and change your preferences. Open it using the cookie settings button or cookie icon on the website. Simply using the website does not constitute consent to optional cookies.

Details of cookies, their providers, purposes and lifetimes are available in the separate Cookie Policy. You can also delete and block cookies in your browser settings. Blocking necessary mechanisms may affect the cart or purchase process.

8. How long do we keep data?

Retention depends on the purpose. Not all order data needs to be retained as long as an accounting document.

• Bookings and journeys: for the time needed to perform the contract and settle changes, then to the extent necessary for complaints or the establishment, exercise or defence of claims, taking account of the applicable limitation periods.
• Tax and accounting records: for the legally required period, calculated under the rules applicable to the document concerned; it may be extended where provided for by law.
• Incomplete and unpaid orders: for the time needed to investigate payments, errors or misuse and any claims. Expiry of a five-minute hold on places does not delete the order data.
• Correspondence: until the matter is concluded, then to the extent needed to demonstrate how it was handled or protect legal claims.
• Availability notifications: until the request is fulfilled, consent is withdrawn or the selected date is no longer relevant; evidence of consent may be retained for the period necessary to demonstrate compliance.
• Logs, backups and technical data: for a period justified by system protection and recovery; data relating to a specific incident may be retained until the incident and associated claims are resolved.
• Optional analytics or marketing: according to the purpose and period disclosed for the service, and no longer than the legal basis allows. Withdrawing consent ends processing based solely on that consent.

Once the period necessary for these purposes ends, data is subject to deletion or anonymisation. Contact the Controller for information about retention relating to a specific matter.

9. Your rights

Subject to the GDPR, you may request access to and a copy of your data, rectification, erasure or restriction of processing. Where provided for by the GDPR, you also have the right to data portability and to object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time.

You may withdraw consent at any time without affecting the lawfulness of earlier processing. Not every right applies to every purpose: for example, a statutory duty to retain a tax document may prevent its immediate deletion.

Send requests to info@tramwaj-wodny.pl. To protect personal data, we may request proportionate information to verify your identity. We normally respond within one month; where the GDPR permits an extension, we will inform you and explain the reasons.

You may lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl, or, where the GDPR provides, another competent supervisory authority.

10. Automated system operations and staff review

The system automatically checks availability, hold periods, payment status and whether places can be allocated, and prepares tickets and messages. A late payment with insufficient availability on one leg requires staff assistance. Order data and check-in history help resolve discrepancies.

If an automated outcome is unclear, for example a paid order is missing from the passenger list, contact staff and ask for a review. A technical status alone should not be treated as a final determination of the customer’s rights.

This automation supports booking fulfilment. Meta Pixel and enabled advertising features may create audiences based on website activity, which constitutes profiling for advertising purposes. Ad personalisation itself does not determine entitlement to travel.

11. Messages and external services

We use contact details to send tickets and information about payments, bookings and changes to sailings. After your journey, we may send a request for feedback on the service. Our legitimate interest in this case is obtaining customer feedback and improving service quality (Article 6(1)(f) GDPR). You can object to this use of your data. If a message constitutes marketing, sending it requires the appropriate consent to electronic communications. Purchasing a ticket does not constitute that consent.

The website and tickets may contain links to maps, reviews and other services. When you open a link, the external provider processes data under its own privacy policy. Using embedded services, such as Google Maps or Google reCAPTCHA security tools, may involve sharing technical device and connection data with their provider. Information about services covered by consent controls is available in the cookie panel and Cookie Policy.

Data entered directly into a payment provider’s form is also processed under that provider’s privacy rules.

12. Protecting your ticket and policy updates

The QR code is linked to an order and used to verify boarding. Do not publicly share the code, ticket number or ticket file. For a shared booking it may cover the whole group and the return journey.

Booking data is intended for customer and journey administration. Do not publish information that could allow others to use your ticket. Report suspected unauthorised access to your ticket or data to the Controller.

This policy is updated when services, processing purposes or legislation change. Updating the document does not replace any consent required for a new processing purpose. The preparation date and version number appear at the beginning of this document.