Privacy policy

Last updated: October 23, 2026

Data controller

The controller of your personal data is Navia Rent Sp. z o.o., ul. Władysława Zarembowicza 33 lok. 48, 54-530 Wrocław. For anything about personal data, write to [email protected]. We have not appointed a data protection officer, so all data matters are handled at this address.

What data we collect and why

• Booking: name, e-mail, phone, dates of stay, number of guests, your message to us, chosen extras and, if you want an invoice, company or personal details (name, tax ID, address). We need them to conclude and perform the rental contract, send the confirmation and the door code and handle cancellation on the “My booking” page (Art. 6(1)(b) GDPR), to issue invoices and keep accounts (Art. 6(1)(c) GDPR), and to pursue or defend legal claims (Art. 6(1)(f) GDPR).
• Contact, business and investor forms: name, e-mail, phone, company name and your message. We use them to reply and prepare an offer: based on your consent (Art. 6(1)(a) GDPR) and on steps you ask for before entering into a contract (Art. 6(1)(b) GDPR).
• Discount code: the e-mail address we send the one-time code to, and the language of the site. We send the code at your request (Art. 6(1)(b) GDPR).
• Phone, e-mail and WhatsApp: the details you give us when you write or call. We use them to reply and help with your matter (Art. 6(1)(f) GDPR, our legitimate interest: communicating with guests and clients).

Do you have to give us your data

Giving your data is voluntary, but without it we cannot accept a booking, reply to an enquiry or send a discount code. Invoice details are needed only if you want an invoice.

Who we share data with

We share data only with the companies we need to handle a booking or an enquiry. They process it on our instructions under a contract with us:

• IAI S.A. (Idobooking) — booking system
• Sharelock — electronic locks, door codes and cleaning
• Brevo (Sendinblue SAS) — sending e-mails
• Cloudflare, Inc. — site hosting, mail and backups
• Google (Gmail) — mailbox
• A server provider in Poland — server for the site and database
• Fakturownia sp. z o.o. — invoices
• Accounting office — bookkeeping
• Meta Platforms (WhatsApp) — when you write to us on WhatsApp

Online payments are handled by Autopay S.A., based in Sopot, as a separate controller. You give your card or bank details directly to them — we never see them, we only learn whether the payment went through. Data may also go to public authorities where the law requires it.

Transfers outside the European Economic Area

Cloudflare and Google are based in the USA and may process data there too. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to ensure an adequate level of protection; they also use standard contractual clauses approved by the Commission. You can get a copy of these safeguards by writing to us.

How long we keep data

• Bookings: for the stay and its settlement, then for 5 years from the end of the year in which the tax for that year fell due — as tax law requires. If there is a dispute, until it ends.
• Enquiries sent through the site's forms: 12 months from receipt, then deleted automatically.
• Discount codes: 12 months after the code expires, then we erase the e-mail address.
• E-mail and WhatsApp correspondence: as long as the matter it concerns; if it concerns a booking, as long as the booking.

Your rights

You have the right to access your data, have it corrected, erased or restricted, and to data portability. You may also object at any time to processing based on our legitimate interest and withdraw your consent — withdrawal does not affect the lawfulness of earlier processing. To use these rights, write to the address above. If you believe we process data unlawfully, you can complain to the President of the Personal Data Protection Office (UODO) in Poland.

Automated decisions

We do not make decisions about you solely by automated means and we do not profile you.

Cookies

Cookies are small files stored by your browser. navia.rent uses no advertising or tracking cookies, so we do not ask for consent. The site uses only what it needs to work:

• Cloudflare, which delivers and protects the site, may store the technical cookie __cf_bm that tells people from bots. It expires after 30 minutes.
• Visit statistics are collected by Cloudflare Web Analytics, without cookies and without recognising anyone: it counts page visits, where visitors came from, their country, device type and how fast pages load.
• The booking form keeps the booking in progress in your browser's storage (sessionStorage), so it is not lost when you come back from paying. It is cleared when you close the tab.
• The locations map loads map tiles from OpenFreeMap, which sees your browser's IP address. It stores no cookies.
• The panel for owners and staff (panel.navia.rent) uses session and form-protection cookies, without which you cannot sign in.