Privacy Policy
Last updated: 21 April 2026
This privacy policy describes how JP DEV sp. z o.o. ("CampBooker", "we") processes personal data of CampBooker platform users, in accordance with Regulation (EU) 2016/679 (GDPR) and Polish personal data protection law. The Polish version is authoritative.
1. Data controller
The data controller is JP DEV sp. z o.o., registered in Poland. Tax ID (NIP): 8961649757. Data protection contact: privacy@campbooker.pl.
2. Scope of data
We process identification data (name, email), billing data (tax ID, business address), operational data (reservations, access logs), and technical data (IP address, session identifier). We do not collect sensitive data within the meaning of Art. 9 GDPR unless the site operator enters it (e.g. guest pet information) — in that case responsibility rests with the operator as an independent controller.
3. Legal basis
We process data under: (a) Art. 6(1)(b) GDPR — performance of contract (account, subscription); (b) Art. 6(1)(c) GDPR — legal obligations (accounting, KSeF, VAT); (c) Art. 6(1)(f) GDPR — legitimate interest (security, fraud detection, aggregated statistics); (d) Art. 6(1)(a) GDPR — consent (marketing, optional analytics).
4. Retention period
Accounting and invoice data: 5 calendar years from the end of the accounting year under the Polish Accounting Act and Tax Ordinance (7 years in case of audit proceedings). Access and security logs: 6 months. Account data after subscription closure: 30 days for restoration, then anonymisation. Backups: up to 14 days rotation. Marketing consents: until withdrawal.
5. Sub-processor list
The current full sub-processor list (with location, data categories, retention period, and each provider's privacy policy) is available at /subprocessors. We notify you of changes at least 14 days in advance.
6. Cookies
We use three categories of cookies: (a) Essential — session, CSRF, language and theme preference (no consent required); (b) Analytics — aggregated usage statistics (optional, off by default); (c) Marketing — communication personalisation (optional, off by default). Preferences can be changed at any time via the "Cookie settings" link in the footer.
7. Data subject rights
Under GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure ("right to be forgotten", Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent at any time. We process requests within 30 days, free of charge (unless the request is manifestly unfounded). Contact: privacy@campbooker.pl.
8. Supervisory authority
You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, if you believe that your data is processed unlawfully.
9. International transfers
Most processing happens within the EEA (Hetzner DE, Sentry EU, Aftermarket PL, KSeF PL). Some operations require transfers outside the EEA: Stripe, Inc. (US, subscription billing) and Cloudflare, Inc. (US, edge network for DNS/CDN/proxy) — both based on Standard Contractual Clauses (SCC 2021/914), with Stripe additionally covered by a Data Processing Addendum. Full list with legal bases at /subprocessors.
10. Children under 13
CampBooker is not directed to persons under 13. We do not knowingly collect data of children under that age. If we learn of such data, we will delete it without delay.
11. Policy changes
We reserve the right to update this policy. We announce material changes by email at least 14 days in advance. The last change date is shown at the top of the document.