privacy policy

At Beyond Cracow Julia Marszałkowska, we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy outlines how we collect, use, process, and safeguard your personal information when you visit our website, book our tours, or use our transfer services in accordance with the General Data Protection Regulation (EU GDPR) 2016/679.

1. Data Controller

The Data Controller responsible for processing your personal data is:

• Company Name: Beyond Cracow Julia Marszałkowska
• Registered Address: ul. Podhalan 11, 34-730 Mszana Dolna, Poland
• Tax Identification Number (NIP): 6793180594
• Contact Email: office@beyondcracow.com
• Contact Phone: +48 666 717 716

2. What Personal Data We Collect

We collect personal information that you provide to us directly when making a booking, requesting a quote, or contacting us via our website, email, or telephone. This may include:

• Contact Information: Full name, email address, phone number, and country of residence.
• Booking & Transfer Details: Flight numbers, arrival/departure times, pickup and drop-off addresses, hotel names, date of service, and number of passengers.
• Special Requests: Information regarding child safety seats, accessibility requirements, or specific requests.
• Payment & Billing Details: Payment status, transaction IDs, and billing address (payment card details are handled directly by secure third-party payment gateways).

3. Purposes and Legal Basis for Data Processing

We process your personal data for the following purposes and under the following legal grounds:

Service Fulfillment & Contract Performance (Art. 6(1)(b) GDPR):

To process your bookings, coordinate drivers, purchase museum/attraction tickets, communicate pickup schedules, and provide tour and transfer services.

Customer Service & Inquiries (Art. 6(1)(f) GDPR):

To respond to your inquiries, feedback, or support requests sent via contact forms, email, or phone (based on our legitimate interest in providing effective client support).

Legal & Accounting Obligations (Art. 6(1)(c) GDPR):

To issue invoices, manage tax records, and comply with mandatory financial and accounting laws in Poland.

Legitimate Business Interests (Art. 6(1)(f) GDPR):

To handle potential claims, ensure service quality, and maintain safety and security.

4. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to third parties. Your personal data is only shared with trusted third parties strictly necessary for fulfilling your booking:

• Drivers & Transport Partners: Assigned drivers receiving relevant operational details (e.g., pickup location, name, passenger count, flight number) to execute your transfer.
• Ticketing Offices & Attractions: Museums, historic sites, national parks, or thermal baths that require nominal participant lists for ticket reservations (e.g., Auschwitz-Birkenau Memorial, Salt Mine).
• Payment Processors: Secure third-party payment service providers handling payment processing.
• IT & Accounting Services: Professional hosting providers, IT support, and licensed accounting offices operating under contractually binding confidentiality agreements.

5. Data Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Booking Data: Retained for the duration of the service provided and until the expiration of statutory claims.
• Financial & Accounting Data: Retained for 5 years following the end of the tax year in which the transaction occurred, in compliance with Polish tax law.
• Communication Data: Retained for up to 2 years from the last contact for customer service purposes.

6. Your Rights Under GDPR

Under European data protection laws, you have the following rights regarding your personal information:

• Right of Access: Request confirmation of whether we hold your personal data and receive a copy.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no legal requirement for us to retain it.
• Right to Restriction of Processing: Request that we temporarily limit processing your personal data.
• Right to Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: Object to the processing of your personal data based on legitimate interests.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (PUODO) (Urząd Ochrony Danych Osobowych).

To exercise any of these rights, please contact us via email at office@beyondcracow.com

7. Cookies and Website Analytics

Our website uses cookies and similar storage needed for the shopping cart, booking forms, account login and payment services. Optional traffic analytics and advertising tools are not currently enabled. You can manage cookies through your browser settings; disabling essential cookies may affect booking functionality.

Our contact, enquiry and booking forms use Google reCAPTCHA for protection against spam and automated abuse. See Google’s Privacy Policy and Terms of Service for information about this service.

8. Updates to This Policy

We reserve the right to update or modify this Privacy Policy as necessary to reflect legal requirements or operational changes. The latest version will always be accessible on our website with the effective date updated.

Last Updated: October 2026