Privacy policy

Data controller

The controller of your personal data is Bartosz Kołodziej, running a sole proprietorship, Łubowo 127, 62-260 Łubowo, Poland, tax ID (NIP) 7842438640 (“Tripto”, “we”).

For any matter concerning personal data, write to kontakt@tripto.pl (we reply in Polish and English). We have not appointed a data protection officer — privacy matters are handled directly by the controller.

Key points

• You can browse the service without an account and without providing any data.
• We do not sell personal data or share it with other companies for their marketing.
• The GetYourGuide widget runs only after your consent (Umami statistics use no cookies); you can change it at any time via “Cookie settings” in the footer.
• We send the newsletter only after you confirm your sign-up via a link in an e-mail (double opt-in); you can unsubscribe with one click.
• Your data is stored on servers in the European Economic Area; some providers are based in the USA — in that case we use the safeguards described below.

Browsing the service and technical logs

When you open Tripto pages, your browser connects to our server, which automatically processes basic technical data.

• Data: IP address, date and time of the request, the requested page, the referring page, browser and operating system type, error information.
• Purpose: delivering the page, operating and troubleshooting the service, ensuring security, including limiting the number of requests from a single address (protection against spam and attacks).
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in keeping the service running and secure.
• Retention: technical logs — as a rule no longer than 30 days; the IP address used for rate limiting is kept only in the server’s memory for a few minutes up to an hour. We keep information longer only where needed to investigate a specific security incident.
• Recipients: our server provider (Hetzner) and database provider (Supabase).

User account

An account lets you save favourite and visited places and add reviews. You can create one with an e-mail address and password, sign in with a link sent by e-mail, or with a Google account.

When signing in with Google you use a Google service, in which Google processes your data as a separate controller under its own privacy policy. We receive from Google only the data listed above — we have no access to your Google password.

To delete your account, write to kontakt@tripto.pl from the address linked to the account. Together with the account we delete your saved places and the attraction reviews you added (and for hosts — also property listings), except for data we must keep longer, such as sales records.

• Data: e-mail address, hashed password, user identifier, dates of account creation and sign-ins, and when signing in with Google — the data Google shares according to your settings (e-mail address, first and last name, profile picture URL, Google account identifier).
• Purpose: creating and maintaining the account, signing in, securing the account, contacting you about the account (e.g. address confirmation, password reset).
• Legal basis: Art. 6(1)(b) GDPR — performance of the account contract under the terms of service; security — Art. 6(1)(f) GDPR.
• Retention: until the account is deleted; after deletion — to the extent necessary until the limitation period for possible claims expires.
• Recipients: Supabase (database and authentication), Resend (delivery of sign-in e-mails), Hetzner (hosting); when signing in with Google — Google Ireland Ltd.

Saved places

• Without signing in: your list of favourite places is stored only in your browser’s storage (localStorage). It is not sent to our server until you sign in.
• After signing in: favourite and visited places are stored in your account (places saved earlier in the browser are moved to it) so they are available on every device.
• Legal basis: Art. 6(1)(b) GDPR — providing the service you use.
• Retention: until you remove a place from the list or delete the account; browser data — until you clear it in your browser settings.
• Recipients: Supabase (database), Hetzner (hosting).

Attraction reviews

Signed-in users can add reviews of attractions.

Reviews are published immediately after submission — before that they only pass an automatic filter for prohibited content. Reviews that break the rules are removed after a report or check. We do not verify whether the author actually visited the place.

• Data: rating (1–5), review text, optionally the month of the visit, dates added and edited, review status and the link to your account.
• Purpose: publishing the review with the attraction, automatic filtering of prohibited content, handling reports and removing reviews that break the rules.
• Legal basis: Art. 6(1)(b) GDPR — providing the review publishing service; moderation and handling reports — Art. 6(1)(f) GDPR (our legitimate interest in reliable content and in countering illegal content).
• Publicly visible: rating, text, month of visit, date and a pseudonym in the form “Traveler #1234”. We do not publish your e-mail address or your name — but please do not include personal data in the review text.
• Retention: until the review is removed (at your request or as a result of moderation) or the account is deleted.
• Recipients: users of the service (public content), Supabase, Hetzner.

Correction suggestions

The “Suggest a correction” form on an attraction page lets you tell us about outdated opening hours, prices, description or location.

• Data: the suggestion, the attraction and type of change, optionally a contact you provide (e.g. e-mail), date of the report.
• Purpose: verifying and making the correction, contacting you about the report if needed.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in keeping information in the service up to date.
• Retention: for as long as needed to review the report and document the change; we delete contact details at your request.
• Recipients: Supabase, Hetzner.

Contact and partnership requests

When you write to kontakt@tripto.pl or send the partnership form on the Polish “Dla obiektów” (for businesses) page:

• Data: e-mail address, first and last name, and in the partnership form also phone (optional), organisation name, business segment, the attraction concerned and your message — plus any other information you choose to give us.
• Purpose: replying to your message, correspondence, partnership discussions, handling content reports and complaints.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in handling correspondence; Art. 6(1)(b) GDPR where the message concerns entering into or performing a contract; Art. 6(1)(c) GDPR where the law requires us to respond (e.g. a complaint, a report of illegal content).
• Retention: for as long as needed to deal with the matter and then — where the correspondence may be relevant to claims — until the limitation period expires.
• Recipients: our e-mail provider (Resend), Supabase (storing partnership requests), Hetzner.

Newsletter “Gdzie ten weekend?”

We send the newsletter only to people who signed up themselves and confirmed their sign-up.

Withdrawing consent does not affect the lawfulness of mailings sent before the withdrawal.

• Data: e-mail address, language, where in the service you signed up, sign-up date, confirmation date, unsubscribe date.
• Purpose: sending the newsletter with trip ideas and news about Tripto.
• Legal basis: your consent — Art. 6(1)(a) GDPR, together with the consent to receive commercial information by electronic means required by the Polish Electronic Communications Law; keeping proof of consent and of unsubscription — Art. 6(1)(f) GDPR (demonstrating compliance).
• How it works: after you sign up we send an e-mail with a confirmation link (double opt-in) — only clicking it activates the subscription. Every newsletter contains a one-click unsubscribe link. You can also sign up by ticking the optional box when ordering a poster.
• Retention: until you withdraw consent (unsubscribe). After unsubscribing we stop sending the newsletter and keep the e-mail address with the dates of sign-up, confirmation and unsubscription as proof of consent and of its withdrawal until the limitation period for possible claims expires.
• Recipients: Resend (e-mail delivery), Supabase (subscriber database), Hetzner.

Poster orders

When you order a map poster (a PDF/PNG file to download):

Payments (card, BLIK, Przelewy24) are handled by Stripe Payments Europe Ltd. You enter card and payment details directly on the Stripe page — we have no access to them. For processing payment data, fraud prevention and its legal obligations, Stripe acts as a separate controller under its own privacy policy.

• Data: e-mail address, language, poster configuration (the selected place, texts and settings you enter in the editor), format and price, date of accepting the terms and of the consent to immediate supply of digital content, order status, Stripe payment identifiers, any discount code used, and if you enter a tax ID on the Stripe payment page — invoicing data (company name or name, billing address, tax ID).
• Purpose: concluding and performing the contract, accepting payment, generating the file and sending the download link (valid for 30 days), issuing proof of sale, handling complaints, tax and accounting.
• Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (tax and accounting obligations), Art. 6(1)(f) GDPR (establishing, exercising or defending claims).
• Retention: sales records and accounting data — 5 years from the end of the calendar year in which the tax payment deadline expired; other order data — until the limitation period for claims expires.
• Recipients: Stripe (payments and collection of invoicing data), Resend (e-mail with the download link), Supabase, Hetzner, our invoicing and accounting software provider, the Polish National e-Invoicing System (KSeF) (for invoices issued to businesses), tax authorities where required by law.

Accommodation: availability enquiries

When you send a host an availability enquiry through the form on a property listing:

Once the host receives the enquiry, the host becomes a separate controller of your data and is responsible for what they do with it (e.g. correspondence, booking, payments). Tripto is not a party to the accommodation contract and does not handle payments for the stay.

• Data: first and last name, e-mail address, optionally a phone number, dates of stay, number of adults and children, your message, the date of the enquiry and the status set by the host.
• Purpose: forwarding the enquiry to the selected property (by e-mail and in the host panel) so that it can reply to you, sending you a confirmation that the enquiry was sent, and protecting the form against abuse.
• Legal basis: Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract with the property; protection against abuse — Art. 6(1)(f) GDPR.
• Retention: 12 months from sending the enquiry; after that it is automatically deleted from our database.
• Recipients: the property you contact and our providers (hosting, database, e-mail delivery).

Accommodation: review invitations and verified reviews

Only people who sent an enquiry through Tripto can review a property.

No invitation is sent if the property is not published. If you did not stay at the property, simply ignore the message. You can object to such invitations at any time by writing to kontakt@tripto.pl.

• Data: first name and e-mail address from the enquiry (to send the invitation), the author signature, ratings, review text, confirmation of the stay, date added, link to the enquiry.
• Purpose: a one-off e-mail invitation to review the stay after the departure date (link valid for 120 days), publishing the review on the listing and ensuring that reviews come from people who contacted the property.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in running a trustworthy review system; publishing the review — Art. 6(1)(b) GDPR (the service you use by submitting a review).
• Publicly visible: the author’s first name and last-name initial (in the form entered in the review form), ratings, review text, date and any public reply from the host. We do not publish your e-mail address or other enquiry data.
• Retention: until the review is removed (at your request or as a result of moderation) or the listing is deleted; once the enquiry is deleted (after 12 months) the review remains but is no longer linked to the enquiry.
• Recipients: users of the service (public content), the host, our providers (hosting, database, e-mail delivery).

Accommodation: host account and listing

Hosts can be businesses or private individuals. When you add and manage a property listing:

When you locate the property in the listing wizard, the address you enter is sent from our server to the Nominatim service (OpenStreetMap Foundation, United Kingdom) — the service does not receive your IP address or account data.

If a business provides the contact person’s details in its listing (e.g. an employee’s details), we obtain them from that business — the categories of data are described above, and that person has the rights described in this policy.

• Data: account data (e-mail, identifier), type of host (private individual or business), company name and tax ID (NIP) for businesses, first and last name of the contact person, phone, e-mail address, website, property address and coordinates, description, photos, prices, amenities, house rules, replies to reviews and moderation history.
• Purpose: creating, moderating and publishing the listing, forwarding guest enquiries, contacting you about the listing, and fulfilling the obligation to inform guests whether the provider is a trader.
• Legal basis: Art. 6(1)(b) GDPR — performance of the listing contract under the accommodation terms; Art. 6(1)(c) GDPR — information obligations towards consumers; Art. 6(1)(f) GDPR — moderation, security and defence against claims.
• Publicly visible on the listing: property name, address and location on the map, phone number (shown after a click), website, the contact person’s first and last name or the company name and tax ID, photos, description, prices, ratings, replies to reviews and the Premium highlight label. We do not publish the host’s e-mail address.
• Retention: for as long as the listing is maintained and, after deletion, to the extent necessary until the limitation period for possible claims expires.
• Recipients: users of the service (public data), our providers (hosting, database, photo storage, e-mail delivery, address lookup on the map).

Accommodation: Premium orders and invoices

When you buy a Premium highlight for a listing:

• Data: e-mail address, property and plan variant, amount, dates of the order and of the highlight period, acceptance of the terms and your request to start the service before the withdrawal period ends, Stripe payment identifiers, and invoicing data collected on the Stripe payment page: name or company name, billing address and — if you provide it — tax ID (NIP).
• Purpose: concluding and performing the contract, accepting payment, issuing an invoice (outside Stripe, submitted to KSeF), handling withdrawals and complaints, tax and accounting.
• Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (tax and accounting obligations), Art. 6(1)(f) GDPR (establishing, exercising or defending claims).
• Retention: invoices and accounting records — 5 years from the end of the calendar year in which the tax payment deadline expired; other order data — until the limitation period for claims expires.
• Recipients: Stripe (payments and collection of invoicing data), our invoicing and accounting software provider, the Polish National e-Invoicing System (KSeF) run by the Minister of Finance (for invoices issued to businesses), tax authorities where required by law, our providers (hosting, database, e-mail delivery).

Accommodation: e-mails to hosts and listing statistics

• E-mails: we send hosts messages related to running the listing — including notifications of new enquiries and listing matters, Premium activation confirmations, a reminder that the Premium period is ending and (for Premium properties) a monthly report with listing statistics. Legal basis: Art. 6(1)(b) GDPR — performance of the contract. These are not marketing messages; if you do not want to receive reports, write to kontakt@tripto.pl.
• Listing statistics: we count views and clicks (e.g. on the phone number or website) in aggregate, without cookies, without storing IP addresses and with bot traffic filtered out. We store only per-property, per-day counters that do not identify the visitor.

Statistics without cookies

Separately from Umami statistics, our own server counts simple events in the service — e.g. viewing an attraction page, clicking a partner link, saving a place or searching. Events are sent without cookies and without user identifiers, and we do not store the IP address (it is used only momentarily for rate limiting).

Purpose: understanding which features and content are useful, and settling accounts with affiliate partners. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in developing the service. These records are designed not to identify you; we do not link them to your account.

Visitor statistics (Umami)

For visitor statistics we use Umami, an analytics tool that does not use cookies. Umami runs on our own server (stats.tripto.pl) in Germany.

• Umami does not store or read cookies or any other information on your device and does not track you across websites — so it runs without consent from the cookie banner.
• Scope: the address of the page visited (without the part after “#”, without map coordinates and without order tokens), referrer, device type, browser, operating system, language, screen size, country derived from the IP address, and events in the service (e.g. clicking a partner offer, starting a payment, a purchase — with the order ID and amount, without email or other contact details).
• Purpose: aggregated statistics and improving the service. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in developing the service. We do not link this data to your account.
• Recipient: Hetzner Online GmbH as provider of the server on which our Umami instance runs (data centre in Nuremberg, Germany). Statistics data is not transferred to Umami Software, Inc. or outside the EEA.

Affiliate links and the GetYourGuide widget

• Affiliate links: for some attractions and accommodation we place links to Booking.com (via the CJ Affiliate network — redirect through the jdoqocy.com domain) and GetYourGuide. If you make a booking or purchase, we may receive a commission; this does not change the price. After clicking you go to the partner’s website, where the partner — together with the affiliate network — processes your data (including setting its own cookies on its domain) as a separate controller under its own privacy policy. From partners we receive aggregated commission information that does not allow us to identify you.
• GetYourGuide widget: we show ticket and tour offers from GetYourGuide Deutschland GmbH in a widget loaded from GetYourGuide servers only after your marketing consent (in the cookie banner or with the show-offers button in the widget itself). Once loaded, GetYourGuide receives, among other things, your IP address, browser information and the page address, and may store its own cookies or similar data in your browser.
• Legal basis: the widget — your consent (Art. 399 of the Polish Electronic Communications Law, Art. 6(1)(a) GDPR); placing affiliate links — Art. 6(1)(f) GDPR (funding the service).

Maps, images and location

• Maps: map tiles are downloaded by your browser directly from OpenFreeMap servers. The tile server receives your IP address, browser information and the map area displayed — this is necessary to display the map.
• Images: attraction photos are loaded from our domain img.tripto.pl (stored in Cloudflare R2), and some from Wikimedia Commons servers (thumb.wikimedia.org, Wikimedia Foundation, USA). These servers see your IP address and browser information to the extent needed to deliver the file.
• Location (“Near me”): if you use the feature showing attractions nearby and allow it in your browser, approximate coordinates (rounded to about 10 m) are used to position the map and appear in the page address. We do not store them in your account and remove them from the page address passed to our statistics (Umami).
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in displaying maps and images; location — Art. 6(1)(b) GDPR (a feature started at your request).

Recipients and providers

We use providers who process data on our behalf (processors) under data processing agreements or — where indicated — as separate controllers:

Data may also be received by: property hosts (the enquiries you send them), other users (public content such as reviews and listings), and public authorities and other bodies entitled under the law (e.g. tax authorities, courts) where we are required to disclose it.

• Hetzner Online GmbH — servers and application hosting, including the Umami statistics server (stats.tripto.pl); Germany (EEA).
• Supabase Inc. — database and authentication; data stored in the AWS eu-west-1 region (Ireland, EEA); US company — possible access from the USA based on standard contractual clauses or the Data Privacy Framework.
• Cloudflare, Inc. — storing and delivering images (img.tripto.pl, R2); USA — Data Privacy Framework / standard contractual clauses.
• Resend (Plus Five Five, Inc.) — e-mail delivery (sign-in, newsletter, orders, enquiries and notifications); USA — Data Privacy Framework / standard contractual clauses.
• Stripe Payments Europe Ltd. — payments and collection of invoicing data; Ireland (EEA), with possible transfer to Stripe, Inc. in the USA (Data Privacy Framework); a separate controller for payment data.
• Google Ireland Ltd. — Google sign-in; Ireland (EEA), with possible transfer to Google LLC in the USA (Data Privacy Framework); a separate controller for Google sign-in.
• GetYourGuide Deutschland GmbH — offers widget (only after consent); Germany (EEA); a separate controller.
• CJ Affiliate (Conversant LLC) and Booking.com B.V. — affiliate links (redirect after a click); USA / Netherlands; separate controllers.
• OpenFreeMap — map tiles downloaded by the browser; EEA.
• OpenStreetMap Foundation (Nominatim) — address lookup in the accommodation wizard, requests sent from our server; United Kingdom (European Commission adequacy decision).
• Wikimedia Foundation (Wikimedia Commons) — some images loaded by the browser; USA.

Transfers outside the EEA

Some providers are based in the USA or the United Kingdom. Data is transferred outside the European Economic Area only using the mechanisms of Chapter V GDPR: a European Commission adequacy decision (including for the United Kingdom and for companies certified under the EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the European Commission.

The exception are resources that your browser downloads directly from an entity outside the EEA (e.g. images from Wikimedia Commons) — in that case the transfer occurs in connection with displaying the page you requested. You can obtain a copy of information on the safeguards used by writing to kontakt@tripto.pl.

Your rights

Under the GDPR you have the right to:

To exercise your rights, write to kontakt@tripto.pl. We will reply without undue delay and within one month at the latest (in justified cases this may be extended by two further months — we will inform you if so). We may ask for information needed to confirm your identity, e.g. a message from the address linked to your account.

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl) — or with the supervisory authority of your place of residence in the EU, if you believe we process your data unlawfully.

• access your data and obtain a copy (Art. 15 GDPR),
• rectify inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability for data you provided to us, where we process it on the basis of consent or contract by automated means (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 6(1)(f) GDPR) on grounds relating to your particular situation (Art. 21 GDPR); we will then stop processing unless we demonstrate compelling legitimate grounds overriding your interests or grounds for establishing, exercising or defending claims,
• withdraw consent at any time (newsletter — via the link in the e-mail; cookies and the widget — in “Cookie settings”), without affecting the lawfulness of processing before the withdrawal.

Is providing data required

Providing data is voluntary. Without certain data, however, we cannot provide a given service: without an e-mail address you cannot create an account, subscribe to the newsletter or receive a poster; without your name, e-mail address and dates you cannot send an accommodation enquiry; without the data required by tax law we cannot issue an invoice. Fields marked as optional (e.g. phone, month of visit) can be skipped.

Technical data (e.g. IP address) is processed automatically because a page cannot be displayed without it.

Automated decisions and profiling

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Umami statistics and our own statistics are used only for aggregated traffic analysis. Automated form protections (e.g. limits on the number of messages, anti-spam filters) only temporarily block excessive requests.

Children

The service can be browsed without age restrictions. Accounts and the newsletter are intended for people aged 16 or over; younger people may use them only with the consent of a parent or legal guardian. If we learn that we process a child’s data without such consent, we will delete it — you can let us know at kontakt@tripto.pl.

Data security

We use technical and organisational measures appropriate to the risk, including: encrypted connections (HTTPS), storing passwords only as hashes, row-level access control in the database, limiting access to data to people who need it, rate limits and anti-spam protection of forms, data minimisation (e.g. statistics without cookies and IP addresses) and automatic deletion of accommodation enquiries after 12 months.

No system is completely immune to threats. If a personal data breach occurs that is likely to result in a high risk to your rights, we will inform you in accordance with the GDPR.

Changes to this policy

We update this policy when the features of the service, our providers or the law change. The current version is always available on this page with the date of the last update.

We will additionally inform registered users and hosts of material changes affecting them by e-mail or a notice in the service. If a change would require new consent, we will ask for it separately.