TriPlace Website Privacy Policy

Version effective as of 1 September 2026.

Table of contents

• § 1. General provisions
• § 2. Personal data controllers
• § 3. Purposes, legal bases and scope of data processing
• § 4. Data recipients and transfers outside the EEA
• § 5. Data retention periods
• § 6. Rights of data subjects
• § 7. Cookies and similar technologies
• § 8. Data security
• § 9. Final provisions

§ 1. General provisions

1. This Privacy Policy describes the rules for processing personal data in connection with the use of the website www.triplace.pl (hereinafter: the “Service”), the use of TriPlace services, and marketing and promotional activities carried out by TriPlace. In particular, this Policy applies to Users, Creators, visitors to the Service, persons contacting TriPlace, and persons appearing in promotional materials.

2. This Policy fulfils the information obligations arising from Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: the “GDPR”).

3. Capitalised terms have the meanings assigned to them in the Terms of Service, unless this Policy provides otherwise.

§ 2. Personal data controllers

1. The controller of personal data processed in connection with the operation of the Service and TriPlace’s activities is TRIPLACE Spółka z Ograniczoną Odpowiedzialnością (a Polish limited liability company) with its registered office in Tuszyn, ul. Karłowicza 3, 95-080 Tuszyn, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001241968, NIP 7282911324, REGON 544800216, with a share capital of PLN 5,000 (hereinafter: the “Service Provider” or “TriPlace”).

2. In matters concerning personal data, TriPlace may be contacted at privacy@triplace.pl.

3. A Creator is a separate controller of a User’s data to the extent that the Creator receives such data in connection with a specific order and independently uses it to perform the Agreement, including information provided directly by the User during a conversation. TriPlace remains the controller of data processed as part of the operation of the Service, including account data, order data, and chat history stored in the Service.

§ 3. Purposes, legal bases and scope of data processing

1. Creating and maintaining an account. TriPlace processes first name, surname, email address, and authentication data necessary to create and operate an account. For Creators carrying on a business activity, we also process the business name and NIP. The profile also contains a profile photo, logo, or avatar selected by the User or Creator; for a public Creator profile, at least one of these elements must be provided. The legal basis for processing is Article 6(1)(b) GDPR — performance of a contract for the provision of electronic services.

2. Order handling and preparation of the Travel Plan. TriPlace processes identification data of the User and Creator, order history, and information provided in the order form, in particular the travel destination and dates, transport and accommodation preferences, interests, and budget. The User may provide additional information in open-text fields of the form and in the chat with the Creator. Open-text fields and chat are not intended for providing special categories of personal data unless the Service expressly requests such data. The legal basis for processing data necessary to handle the order is Article 6(1)(b) GDPR — performance of a contract for the provision of electronic services. After completion of the order, the order and chat history remains available in the Service to ensure continuity of account history and to handle potential complaints and disputes; in this respect, the legal basis is also Article 6(1)(f) GDPR — TriPlace’s legitimate interest.

3. Enquiries and marketing contact. TriPlace processes, from among the following data, only the data voluntarily provided by the person concerned: first name and surname, email address, telephone number, social media identifier or profile address, and the content of the enquiry. A person may indicate one or several preferred contact methods.

   1. Contact regarding a specific enquiry. If a person asks to be contacted or requests information about a specific offer, we use the data provided to respond and take steps at that person’s request. The legal basis is Article 6(1)(b) GDPR — performance of a contract for the provision of electronic services, where the contact is intended to lead to the conclusion of a contract, or Article 6(1)(f) GDPR — our legitimate interest in handling the enquiry.

   2. Newsletter and direct marketing. After obtaining voluntary consent, we use the indicated data to send the newsletter and for marketing contact through the channels selected by the person concerned: email, telephone, SMS, or the indicated social media. The legal basis for processing is Article 6(1)(a) GDPR — voluntary consent, and electronic or telephone contact is carried out in accordance with Article 398 of the Polish Electronic Communications Law. Consent may be withdrawn at any time separately for each channel.

   3. Partner offers. TriPlace communicates information about partners’ offers solely in its own name and does not disclose a person’s contact details to partners for this purpose.

   4. Collection of data outside the Service. We also collect contact data directly at trade fairs, events, and street promotional activities, using a paper or electronic form. When collecting data, we provide basic information about the processing and a link or QR code leading to the full Privacy Policy. We retain the information necessary to demonstrate what consent was given, when it was given, and which contact channels it covered.

4. Photos, recordings, and other promotional materials. TriPlace processes the image, voice, and content of statements of persons appearing in promotional materials, as well as contact details and correspondence necessary to agree and document how the material may be used.

   1. Materials featuring a specific person. If a person is a recognisable subject of a photograph, recording, or statement, we use their image, voice, or statement for promotional purposes on the basis of consent referred to in Article 6(1)(a) GDPR — voluntary consent — and within the scope of the permission granted to disseminate their image. Consent or permission may be given in writing, electronically, or orally, including as a statement captured in a recording.

   2. Material depicting several people. If material we receive depicts several recognisable people and those persons are not merely background or part of a larger whole, we contact each of them before using the material. At the first contact, we also inform them of the source from which we obtained the material and provide the information required by Article 14 GDPR.

   3. Persons forming part of a larger whole. We do not obtain individual permission to disseminate the image of a person who is only an element of a larger whole, such as a gathering, a public event, or a wider view of a place, provided that their image is not the main subject of the material. Such use is based on Article 81(2)(2) of the Polish Act on Copyright and Related Rights and, for GDPR purposes, on Article 6(1)(f) GDPR, i.e. TriPlace’s legitimate interest in documenting and promoting events and the company’s activities.

   4. Documenting arrangements. We retain data of the person providing the material, the content of correspondence, and information confirming consents and arrangements in order to use the material correctly and protect against potential claims. The legal basis is Article 6(1)(f) GDPR — TriPlace’s legitimate interest in protecting its rights.

5. Disclosure of a Creator’s telephone number. We disclose a Creator’s telephone number to a User ordering a Travel Plan only after obtaining the Creator’s voluntary consent. The legal basis is Article 6(1)(a) GDPR — the Creator’s voluntary consent.

6. Complaints and claims. We process identification data, order data, contact history, and information concerning consents and statements given in order to handle complaints and to establish, pursue, or defend claims. The legal basis is Article 6(1)(f) GDPR — TriPlace’s legitimate interest in protecting its rights.

7. Analytics and improvement of the Service. After consent is given to the “Statistics” category, we use Google Analytics 4 and Microsoft Clarity. These tools process information about how the Service is used, such as pages visited, source of the visit, device type, browser and operating system, approximate location, time of use, clicks, and other events configured in the Service. Clarity also records scrolling behaviour and cursor movements and creates heatmaps and session replays; content entered into form fields is covered by Clarity’s masking mechanisms. We use the data to create statistics, assess how features operate, and improve the usability of the Service. The legal basis is Article 6(1)(a) GDPR and the consent required under Article 399 of the Polish Electronic Communications Law.

8. Advertising measurement and remarketing. After consent is given to the “Marketing” category, we use Google Ads and Meta Pixel. These tools record events connected with use of the Service, including arrival from an advertisement, viewing specific pages, registration, and purchase, in order to measure campaign effectiveness, attribute conversions to advertisements, create audiences, and conduct remarketing and ad targeting. The legal basis is Article 6(1)(a) GDPR and the consent required under Article 399 of the Polish Electronic Communications Law.

§ 4. Data recipients and transfers outside the EEA

1. We disclose data only where this is necessary to achieve the purposes described above. Data recipients include:

   1. Creators — to the extent of data necessary to fulfil a specific order;

   2. providers of infrastructure and technical services, in particular Vercel and Render, as well as email providers and other service providers necessary for the operation of the Service;

   3. payment service providers, in particular Stripe — to the extent necessary to process transactions;

   4. Google, Microsoft, and Meta — in connection with the analytics and advertising tools described in § 3 and § 7;

   5. social media platform operators — when we communicate through those platforms, publish materials, or run campaigns;

   6. entities supporting us in promotional activities, e.g. marketing agencies, photographers, video editors, and printing companies — to the extent necessary to carry out the commissioned activities;

   7. recipients of the Service and Internet users — with respect to data and materials intended for public publication;

   8. authorised public authorities — where the obligation to disclose data results from law.

2. As a rule, and to the extent permitted by available technical and organisational capabilities, your personal data is processed within the European Economic Area (EEA). However, some of our providers offer services globally, so data may also be processed outside the EEA, in particular in the United States. In such cases, data transfers take place in accordance with Chapter V GDPR, in particular on the basis of a European Commission adequacy decision under the EU-U.S. Data Privacy Framework — for entities participating in that framework — or on the basis of Standard Contractual Clauses, where applicable.

§ 5. Data retention periods

1. We retain account data for as long as the account exists. Order and chat history remain available after individual orders are completed for as long as the account is active. After the account is deleted, we retain only data whose further storage is required by law or is necessary to establish, pursue, or defend claims.

2. We retain transaction and settlement data for the period required by tax and accounting regulations.

3. We retain data relating to complaints and claims for the time needed to handle the matter and for the applicable limitation period for claims.

4. We use images, voices, statements, and promotional materials for the period covered by the consent or permission granted or until the purpose for which they were obtained has been completed. After effective withdrawal of consent, we cease new publications based on that consent and remove the material from channels under our control to the extent possible. We retain information confirming the granting and withdrawal of consent for the period necessary to protect against claims, without further promotional use of the material.

5. We retain contact data relating to a specific enquiry for the time needed to handle it and, if no contract is concluded, for no longer than 12 months from the last meaningful contact. Data used for newsletters and marketing is retained until consent is withdrawn or for 36 months from the last active interaction with the person concerned, whichever occurs first. After consent is withdrawn, we retain limited information confirming that it was previously given and withdrawn where this is necessary to defend against claims.

6. Detailed data processed in analytics and advertising tools is retained for the period necessary to achieve the relevant purpose, in accordance with the retention settings configured in the relevant service. Aggregated or anonymised statistics that no longer allow a specific person to be identified may be retained for longer for business analysis purposes.

§ 6. Rights of data subjects

1. In connection with the processing of personal data, you have, in the cases specified in the GDPR:

   1. the right of access to personal data (Article 15 GDPR), including the right to obtain a copy of the data;

   2. the right to rectification (Article 16 GDPR);

   3. the right to erasure (Article 17 GDPR);

   4. the right to restriction of processing (Article 18 GDPR);

   5. the right to data portability (Article 20 GDPR), where processing is based on consent or a contract and is carried out by automated means;

   6. the right to object (Article 21 GDPR), where processing is based on a legitimate interest;

   7. the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;

   8. the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

2. To exercise your rights, you may contact us at the email address specified in § 2(2).

3. Withdrawal of consent for one purpose or contact channel does not affect any other consents given. After withdrawal of marketing consent, we cease further contact within the scope covered by that withdrawal.

4. A User may independently delete or modify some of the data contained in their profile using the features of the Service.

§ 7. Cookies and similar technologies

1. The Service uses cookies and similar technologies, including tags, pixels, and browser storage mechanisms. They are used for the technical operation of the Service and — after obtaining the appropriate consent — for statistics and marketing activities.

2. Essential technologies. We use them to enable the features of the Service, in particular session maintenance and login, security, payment processing, and remembering cookie choices. These technologies are not used for remarketing or to create an advertising profile. Their use does not require consent to the extent that it is necessary to provide a service requested by the user in accordance with Article 399(3) of the Polish Electronic Communications Law.

3. Statistics. After consent is given to this category, we activate Google Analytics 4 and Microsoft Clarity. These tools are used to measure traffic, analyse how the Service is used, and improve its features and usability. The scope of the analytics is described in § 3(7).

4. Marketing. After consent is given to this category, we activate Google Ads and Meta Pixel. These tools are used to measure campaign effectiveness and conversions, create audiences, conduct remarketing, and target advertisements. The scope of these activities is described in § 3(8).

5. Google Tag Manager is used for the technical management of tags used in the Service and to pass consent settings to the relevant tools. The user’s choice itself is handled by the cookie banner mechanism.

6. On the first visit, the Service displays a cookie consent panel that allows the user to accept all optional technologies, reject them, or select the “Statistics” and “Marketing” categories separately. Taking no action, closing the panel, or continuing to use the website is not treated as consent. The selected settings are remembered for 6 months using a technology necessary to manage preferences. The User may change or withdraw their choice at any time using the “Cookie settings” link available in the Service.

7. Withdrawal of consent prevents further use of optional technologies to the extent covered by the withdrawal. This does not affect the lawfulness of processing carried out before consent was withdrawn.

§ 8. Data security

1. We apply technical and organisational measures appropriate to the nature of the data processed and the related risks in order to protect data against loss, unauthorised access, alteration, or disclosure.

2. The connection to the Service is encrypted, and access to data is limited to persons and entities that need it to perform their duties or provide services to TriPlace.

3. With respect to analytics and marketing tools, we limit the scope of recorded events and parameters, filter directly identifying data, and mask confidential data such as email addresses, passwords, and payment information.

§ 9. Final provisions

1. This Policy is updated when the manner in which data is processed, the tools used, or the applicable laws change.

2. The current version of this Policy is always available in the Service. We will inform users of material changes in the Service and, where the nature of the change requires it, also by email using the contact details held by TriPlace.