TriPlaceTriPlace

PRIVACY POLICY FOR THE TRIPLACE ONLINE PLATFORM

Effective as of 6 October 2026

Table of contents

§ 1. General Provisions

  1. This Privacy Policy describes the rules governing the processing of personal data in connection with use of the website www.triplace.pl (the “Platform”), use of TriPlace services, including the Interest Map and the Matching Function, and marketing and promotional activities carried out by TriPlace. The Policy applies in particular to Users, Creators, Matching Participants, visitors to the Platform, persons contacting TriPlace and persons appearing in promotional materials.

  2. This Policy fulfils the information obligations arising from Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”).

  3. Capitalised terms have the meanings assigned to them in the Terms of Service unless this Policy provides otherwise.

§ 2. Data Controllers

  1. The controller of data processed in connection with operation of the Platform and TriPlace’s activities is TRIPLACE spółka z ograniczoną odpowiedzialnością, with its registered office in Tuszyn, ul. Karłowicza 3, 95-080 Tuszyn, entered in the Register of Entrepreneurs of the National Court Register under KRS No. 0001241968, NIP 7282911324, REGON 544800216, share capital PLN 5,000 (the “Service Provider” or “TriPlace”).

  2. For matters concerning personal data, the contact address for TriPlace is privacy@triplace.pl.

  3. A Creator is a separate controller of a User’s personal data to the extent that the Creator receives such data in connection with a specific assignment and independently uses it to perform the Agreement, including information provided directly by the User in a conversation. TriPlace remains the controller of data processed as part of operation of the Platform, including Account data, Order data and chat history stored on the Platform.

§ 3. Purposes, Legal Bases and Scope of Data Processing

  1. Account creation and maintenance. TriPlace processes first name, surname, e-mail address and authentication data required to create and maintain an Account. For Creators conducting business activity, we also process the business name and NIP number. A profile also contains a profile photo, logo or avatar selected by the User or Creator; for a public Creator profile, at least one of these elements must be provided. The legal basis for processing is Article 6(1)(b) GDPR – performance of an agreement for the provision of electronic services.

  2. Handling an Order and preparing a Travel Plan. TriPlace processes identifying data of the User and the Creator, Order history and information provided in the Order form, in particular the destination and travel dates, transport and accommodation preferences, interests and budget. The User has the option to provide additional information in open-text fields in the form and in the chat with the Creator. Open-text fields and chat are not intended for the provision of special categories of personal data unless the Platform expressly requests such data. The legal basis for processing data necessary to handle an Order is Article 6(1)(b) GDPR – performance of an agreement for the provision of electronic services. After completion of an assignment, Order and chat history remain available on the Platform in order to preserve continuity of the Account history and to handle any complaints and disputes; in this respect the legal basis is also Article 6(1)(f) GDPR – TriPlace’s legitimate interest.

2a. Recommending Creators on the basis of the preference questionnaire. If a User uses the Creator recommendation function based on the preference questionnaire, TriPlace processes the answers provided in that questionnaire in order to present the User with up to five Creators matched to the indicated preferences. The recommendation is generated according to the parameters described in the Terms of Service and is informational in nature; it does not produce legal effects for the User or limit the User’s ability to select another Creator. The legal basis for processing is Article 6(1)(b) GDPR – performance of the electronic service initiated by the User.

2b. Interest Map and Matching Function. TriPlace processes the e-mail address, countries or travel destinations selected by the Matching Participant, information provided in the preference questionnaire, data connected with handling the submission and communications concerning the Matching Function, the history of matches and invitations, and information on consents given and withdrawn. If a Matching Participant decides to exchange contact details with matched persons, the scope of data additionally includes the data selected by that person, in particular first name, e-mail address, telephone number or an identifier or profile address on Facebook, Instagram or LinkedIn. We process data necessary to provide the Matching Function in order to record interest in selected destinations, handle the questionnaire, send operational communications, identify potential travel companions and carry out the matching process; the legal basis is Article 6(1)(b) GDPR – performance of the free electronic service ordered by the Matching Participant. The operational communications supported by the Matching Function include confirmation that destinations have been recorded, information on how to remove them, an invitation or reminder to complete the questionnaire, messages concerning a match found, and a request for a decision on sharing selected contact details. Data is disclosed to other matched persons only after separate, active consent has been given by the Matching Participant whose data is to be disclosed, on the basis of Article 6(1)(a) GDPR, and only with respect to the data fields selected by that person. The public Interest Map displays an aggregated number of active interests for a given destination: where the number is at least 1, the exact number of interested persons is displayed, and where the number is 0, the message “Be the first” or an equivalent message is displayed. The Map does not disclose e-mail addresses, Account identifiers, exact registration dates or other contact details. Processing of source data for the purpose of creating these public statistics is based on Article 6(1)(f) GDPR – TriPlace’s legitimate interest in presenting destination popularity and developing the Matching Function.

  1. Enquiries and marketing. TriPlace processes, from among the following data, the information voluntarily provided by the relevant person: first name and surname, e-mail address, telephone number, an identifier or profile address on social media, and the content of the enquiry. A person is free to indicate one or more preferred contact methods.

    1. Contact concerning a specific enquiry. If a person requests contact or information concerning a specific offer, we use the data provided to respond and take action at that person’s request. The legal basis is Article 6(1)(b) GDPR – performance of an agreement for the provision of electronic services where the contact is aimed at entering into an agreement, or Article 6(1)(f) GDPR – our legitimate interest in handling the enquiry.

    2. Newsletter and direct marketing. After obtaining voluntary consent, we use the specified data to send a newsletter and conduct marketing communications through the channels selected by the person: e-mail, telephone, SMS or specified social media. The legal basis for data processing is Article 6(1)(a) GDPR – voluntary consent, while electronic or telephone contact is carried out in accordance with Article 398 of the Polish Electronic Communications Law. The person has the right to withdraw consent at any time separately for each channel. The marketing consent granted also covers information about TriPlace services, including Creators and Travel Plans relating to destinations selected in the Matching Function.

    3. Partner offers. TriPlace communicates information about partner offers only in its own name and does not disclose a person’s contact details to partners for this purpose.

    4. Collection of data outside the Platform. We also collect contact details directly at trade fairs, events and street activities, using paper or electronic forms. When collecting data, we provide basic information on processing and a link or QR code leading to the full Privacy Policy. We retain information necessary to demonstrate what consent was given, when it was given and which communication channels it covered.

  2. Photos, recordings and other promotional materials. TriPlace processes the image, voice and statements of persons appearing in promotional materials, as well as contact details and correspondence necessary to agree and document the permitted use of the material.

    1. Materials featuring a specific person. If a person is a recognisable subject of a photo, recording or statement, we use that person’s image, voice or statement for promotional purposes on the basis of consent under Article 6(1)(a) GDPR – voluntary consent – and within the scope of the permission granted to disseminate the person’s image. Accepted forms of consent or permission are written, electronic or oral declarations, including statements recorded on audio or video.

    2. Material depicting several persons. If material received depicts several recognisable persons and those persons are not merely background or an element of a larger whole, we contact each of them before using the material. At the first contact, we also inform them of the source from which we obtained the material and provide the information required under Article 14 GDPR.

    3. Persons forming part of a larger whole. We do not obtain individual permission to disseminate the image of a person who is only an element of a larger whole, e.g. an assembly, public event or wider view of a place, where that person’s image is not the main subject of the material. Such use is based on Article 81(2)(2) of the Polish Act on Copyright and Related Rights and, for GDPR purposes, on Article 6(1)(f) GDPR, i.e. TriPlace’s legitimate interest in documenting and promoting events and the company’s activities.

    4. Documenting arrangements. We retain the data of the person providing the material, the content of correspondence and information confirming consents and arrangements in order to use the material properly and protect against potential claims. The legal basis is Article 6(1)(f) GDPR – TriPlace’s legitimate interest in protecting its rights.

  3. Disclosure of a Creator’s telephone number. We disclose a Creator’s telephone number to a User ordering a Travel Plan only after obtaining the Creator’s voluntary consent. The legal basis is Article 6(1)(a) GDPR – the Creator’s voluntary consent.

  4. Complaints and claims. We process identifying data, Order data, contact history and information concerning consents and declarations for the purpose of handling complaints and establishing, pursuing or defending claims. The legal basis is Article 6(1)(f) GDPR – TriPlace’s legitimate interest in protecting its rights.

  5. Analytics and improvement of the Platform. After consent to the “Statistics” category has been given, we use Google Analytics 4 and Microsoft Clarity. These tools process information about how the Platform is used, such as pages visited, source of the visit, device type, browser and operating system, approximate location, time spent, clicks and other events configured on the Platform. Clarity also records page scrolling and cursor movements and creates heat maps and session replays; content entered into form fields is subject to Clarity’s masking mechanisms. We use the data to create statistics, assess how functions operate and improve the usability of the Platform. The legal basis is Article 6(1)(a) GDPR and consent required under Article 399 of the Polish Electronic Communications Law.

  6. Advertising measurement and remarketing. After consent to the “Marketing” category has been given, we use Google Ads and Meta Pixel. These tools record events connected with use of the Platform, including arrival from an advertisement, viewing specified pages, registration and purchase, in order to measure campaign effectiveness, attribute conversions to advertisements, create audience groups and conduct remarketing and ad targeting. The legal basis is Article 6(1)(a) GDPR and consent required under Article 399 of the Polish Electronic Communications Law.

§ 4. Data Recipients and Transfers Outside the EEA

  1. We disclose data only where necessary to achieve the purposes described above. Data recipients include:

    1. Creators – to the extent necessary to perform a specific Order;

    2. infrastructure and technical service providers, in particular Vercel and Render, as well as e-mail providers and other service providers necessary for operation of the Platform;

    3. payment operators, in particular Stripe – to the extent necessary to handle transactions;

    4. Google, Microsoft and Meta – in connection with the analytics and advertising tools described in § 3 and § 7;

    5. social-media platform operators – where we communicate through those platforms, publish materials or run campaigns;

    6. entities supporting our promotional activities, e.g. marketing agencies, photographers, video editors and printers – to the extent necessary to perform the commissioned activities;

    7. recipients of the Platform and Internet users – with respect to data and materials intended for public publication;

    8. matched Matching Participants – solely within a specific match, after separate consent has been obtained from each Matching Participant whose data is to be disclosed, and only with respect to the data selected by that person;

    9. authorised public authorities – where disclosure is required by law.

  2. Creators do not receive lists of e-mail addresses or other data enabling identification of persons interested in a specific country through the Interest Map or Matching Function, unless a separate functionality providing for such disclosure is introduced in the future and an appropriate legal basis for the disclosure exists.

  3. As a rule, and to the extent permitted by available technical and organisational solutions, your personal data is processed within the European Economic Area (EEA). Some of our providers operate globally. Processing outside the EEA, in particular in the United States, takes place where required by the global services used. In such cases, data transfers take place in accordance with Chapter V GDPR, in particular on the basis of an adequacy decision of the European Commission under the EU-U.S. Data Privacy Framework for entities covered by that mechanism, or on the basis of Standard Contractual Clauses where applicable.

§ 5. Data Retention Periods

  1. We retain Account data for as long as the Account is maintained. Order and chat history remain available after individual assignments have ended for as long as the Account remains active. After deletion of the Account, we retain only data whose continued retention is required by law or necessary to establish, pursue or defend claims.

  2. Transaction and settlement data is retained for the period required under tax and accounting laws.

  3. Data connected with complaints and claims is retained for the time necessary to handle the matter and for the applicable limitation period for claims.

  4. We use images, voice, statements and promotional materials for the period covered by the consent or permission granted or until the purpose for which they were obtained has ended. Following effective withdrawal of consent, we cease making new publications based on that consent and remove the material from channels under our control to the extent possible. Information confirming the granting and withdrawal of consent is retained for the period necessary to protect against claims, without further promotional use of the material.

  5. Contact details connected with a specific enquiry are retained for the duration of handling the enquiry and, if no agreement is concluded, for no longer than 12 months from the last material contact. Data used for newsletters and marketing is retained until consent is withdrawn or for 36 months from the person’s last active interaction, whichever occurs first. After withdrawal of consent, we retain limited information confirming that consent was previously given and withdrawn where this is necessary to defend claims.

  6. Data processed in connection with the Matching Function is retained for no longer than 3 years from the date on which the relevant interest was registered. If the Matching Participant deletes the interest or withdraws from further matching earlier, active data processed solely for the purpose of providing the Matching Function is deleted or anonymised without undue delay unless further retention is necessary on another legal basis. Data selected for disclosure within a specific match is processed for the period necessary to carry out that match. Information on the granting, scope and withdrawal of consent and the history of disclosures made are retained for longer only where and to the extent necessary to demonstrate compliance with the law and to establish, pursue or defend claims. Data used for marketing on the basis of separate consent is retained in accordance with paragraph 5.

  7. Detailed data processed in analytics and advertising tools is retained for the period necessary to achieve the relevant purpose, in accordance with the retention settings configured in the relevant service. Aggregated or anonymised statistics that no longer permit identification of a specific person are retained for longer for business analysis purposes.

§ 6. Rights of Data Subjects

  1. In connection with the processing of personal data, you have, in the cases specified in the GDPR:

    1. the right of access to personal data (Article 15 GDPR), including the right to receive a copy of the data;

    2. the right to rectification (Article 16 GDPR);

    3. the right to erasure (Article 17 GDPR);

    4. the right to restriction of processing (Article 18 GDPR);

    5. the right to data portability (Article 20 GDPR), where processing is based on consent or contract and is carried out by automated means;

    6. the right to object (Article 21 GDPR), where processing is based on a legitimate interest;

    7. the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;

    8. the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

  2. To exercise your rights, contact us at the e-mail address indicated in § 2 paragraph 2.

  3. Withdrawal of consent for one purpose or communication channel does not affect any other consent given. After withdrawal of marketing consent, we cease further contact within the scope covered by that consent.

  4. A User has the right to independently delete or change some of the data contained in the User’s profile using the Platform functionalities.

  5. Within the Matching Function, a Matching Participant has the right to delete a registered interest in a specific destination, withdraw from further matching, withdraw consent to disclosure of contact details and obtain information about the recipients of disclosed data and the data disclosed. A logged-in User has access to the functionalities available in the Account; in other cases, requests are submitted to the address indicated in § 2 paragraph 2 from the e-mail address used in the Matching Function or after another appropriate identity verification process. Once data has been disclosed to another Matching Participant, TriPlace does not guarantee deletion of copies of that data remaining outside its control, but it ceases further disclosure within the scope covered by an effective withdrawal of consent.

§ 7. Cookies and Similar Technologies

  1. The Platform uses cookies and similar technologies, including tags, pixels and browser storage mechanisms. They are used for the technical operation of the Platform and, after appropriate consent has been obtained, for statistics and marketing activities.

  2. Essential technologies. We use them to operate Platform functionalities, in particular session maintenance and login, security, payment handling and remembering cookie preferences. These technologies are not used for remarketing or creation of an advertising profile. Their use does not require consent to the extent that it is necessary to provide a service requested by the user in accordance with Article 399(3) of the Polish Electronic Communications Law.

  3. Statistics. After consent to this category has been given, we activate Google Analytics 4 and Microsoft Clarity. These tools are used to measure traffic, analyse how the Platform is used and improve its functionalities and usability. The scope of the analysis is described in § 3 paragraph 7.

  4. Marketing. After consent to this category has been given, we activate Google Ads and Meta Pixel. These tools are used to measure campaign effectiveness and conversions, create audience groups, conduct remarketing and target advertising. The scope of these activities is described in § 3 paragraph 8.

  5. Google Tag Manager is used for technical management of tags used on the Platform and for passing consent settings to the relevant tools. The user’s choice itself is handled by the cookie banner mechanism.

  6. On the first visit, the Platform displays a cookie consent panel that allows the user to accept all optional technologies, reject them, or separately select the “Statistics” and “Marketing” categories. Taking no action, closing the panel or continuing to use the website is not treated as consent. The selected settings are stored for 6 months using a technology necessary to manage preferences. The User has the right to change or withdraw the choice at any time through the “Cookie settings” link available on the Platform.

  7. Withdrawal of consent blocks further use of optional technologies within the scope covered by the withdrawal. It does not affect the lawfulness of processing carried out before consent was withdrawn.

§ 8. Data Security

  1. We apply technical and organisational measures appropriate to the nature of the data processed and the related risks in order to protect data against loss, unauthorised access, alteration or disclosure.

  2. The connection to the Platform is encrypted, and access to data is restricted to persons and entities that need it to perform their tasks or provide services to TriPlace.

  3. With respect to analytics and marketing tools, we limit the scope of recorded events and parameters, filter directly identifying data, and mask confidential data such as e-mail addresses, passwords and payment information.

§ 9. Final Provisions

  1. This Policy is updated when the method of data processing, the tools used or applicable laws change.

  2. The current version of the Policy is always available on the Platform. We will inform users of material changes on the Platform and, where the nature of the change requires it, also by e-mail using contact details held by TriPlace.