This is a translation provided for convenience. In the event of any discrepancy between this English version and the Polish original, the Polish version prevails.
In short: we store your data in order to provide the service and issue invoices. We use Google Analytics (through Google Tag Manager) for anonymous traffic analysis. We do not sell data to third parties for marketing purposes. You have the right to access, correct and delete your data.
1. Data controller
The controller of the personal data of Customers using the erphome.pl platform is:
ERP HOME SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Złota 43, 98-220 Zduńska Wola, Poland
KRS: 0001136400 · NIP: 8291755545 · REGON: 540097406
email: [email protected]
You can contact us at the email address above on any matter concerning the processing of personal data.
2. What data we collect and why
2.1. Customer data (apartment owners)
| Data category | Purpose of processing | Legal basis | Retention period |
|---|---|---|---|
| Name and surname, email address | Account registration, login, communication, issuing invoices | Art. 6(1)(b) GDPR (contract) | For the life of the account + 60 days from suspension |
| Phone number | Contact on matters relating to the service (optional) | Art. 6(1)(b) GDPR (contract) | For the life of the account + 60 days from suspension |
| Tax identification number (NIP) | Issuing VAT invoices | Art. 6(1)(c) GDPR (legal obligation) | 5 years (tax obligation) |
| IP address, server logs | Security, error diagnostics | Art. 6(1)(f) GDPR (legitimate interest) | 90 days |
| Payment data (transaction reference) | Settlements, invoices | Art. 6(1)(c) GDPR (legal obligation) | 5 years (tax obligation) |
2.2. Apartment Guest data
Guest data (name and surname, email, phone, stay dates) is collected through the booking form and saved solely in the Customer account. The Customer is its controller within the meaning of the GDPR. erphome.pl processes that data as a processor on the Customer instruction.
We do not use Guest data for our own marketing purposes and do not share it with third parties without the Customer consent.
3. Sharing of data
Your data may be shared only with:
- Technical infrastructure providers, that is hosting servers (EU) and the database provider, and only to the extent necessary to provide the service.
- Payment operators, that is Przelewy24 (PayPro SA) and Stripe Inc., and only the data necessary to process the payment.
- Google LLC: (1) through Google Tag Manager and Google Analytics 4 for anonymous analysis of traffic on the erphome.pl marketing site (data anonymised, the IP address truncated before storage); (2) as the storage location for encrypted backups of the Platform database (Google Drive), including Customer and Guest data, in order to protect against data loss. Google LLC is certified under the EU-US Data Privacy Framework.
- Telegram Messenger Inc., only if the Customer configures this integration for their apartment themselves: the content of the Guest booking enquiry is passed to the Customer Telegram chat as a new booking notification.
- Public authorities, only on request and to the extent required by law.
We do not sell, rent or share data with anyone for advertising or marketing purposes.
4. Transfers outside the EEA
Some of the services we use process data outside the European Economic Area:
- Stripe Inc. (USA), a payment operator certified under the EU-US Data Privacy Framework.
- Google LLC (USA), the provider of Google Tag Manager and Google Analytics and the storage location for backups (Google Drive), certified under the EU-US Data Privacy Framework. Analytics data is anonymised before transfer.
- Telegram Messenger Inc. (outside the EU), only for Customers using the Telegram notification integration. Data is transferred on the basis of standard contractual clauses (SCC) approved by the European Commission.
In every case we apply mechanisms ensuring the level of data protection required by the GDPR.
5. Your rights (GDPR)
You can request information about what data of yours we hold and how we process it.
You can correct inaccurate data or complete incomplete data directly in the panel or by contacting us.
You can request the deletion of your data. We will delete it without delay, except for data we are required by law to retain (invoices, for instance).
You can request that processing be restricted while an objection is considered or the accuracy of the data is verified.
You can receive your data in CSV or JSON format and move it to another service.
You can object to processing based on legitimate interest (server logs, for instance).
To exercise any of the rights above, contact us at [email protected]. We reply within 30 days.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl) if you consider that we process your data unlawfully.
6. Cookies
We use cookies in two categories:
6.1. Essential cookies (no consent required)
| Name | Purpose | Lifetime |
|---|---|---|
PHPSESSID |
Session of a logged-in user in the owner panel | Until the browser is closed |
erp_consent |
Record of your decision on consent to analytics cookies | 365 days |
6.2. Analytics and functional cookies (with consent)
The cookies below are set only after consent is given through the banner on the site:
| Provider | Name | Purpose | Lifetime |
|---|---|---|---|
| Google Analytics 4 | _ga |
Identifying unique users (anonymously), analysing site traffic | 2 years |
| Google Analytics 4 | _ga_* |
Analytics session: distinguishing a user session | 2 years |
| Google Tag Manager | _gcl_* |
GTM containers: managing analytics scripts | 90 days |
You can withdraw consent at any time by clicking "Cookie settings" in the site footer or by deleting the cookies in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.
Legal basis: Art. 6(1)(a) GDPR (consent) for analytics and functional cookies.
7. Data security
- The connection to the Platform is encrypted using HTTPS (TLS 1.2+).
- Passwords are stored as hashes (bcrypt), so we have no access to your password.
- Access to the database is restricted and requires authentication.
- We create data backups regularly.
- In the event of a data security breach we will notify you and the competent supervisory authority within 72 hours, if the breach poses a risk to your rights.
8. Changes to the privacy policy
We will inform you of material changes to the privacy policy by email at least 14 days in advance. The current version is always available at https://erphome.pl/polityka-prywatnosci.
9. Contact
On matters concerning privacy and data protection, contact us at:
ERP HOME SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Złota 43, 98-220 Zduńska Wola, Poland
KRS: 0001136400 · NIP: 8291755545 · REGON: 540097406
Email: [email protected]
We reply within one business day.