Privacy policy

Who we are

Maciej Adamski Sp. z o.o. ("AURI", "we"), registered in Poland, makes the AURI booking system for hotel spas. This policy covers three kinds of data: from this website, from staff accounts, and from guests of the hotels we work for.

Data we collect

• This website: what you type into the contact or demo form (name, work email, property, country, message). The forms are sent through Web3Forms.
• This website: Google Analytics records page visits and sets its own cookies.
• Staff accounts: name, work email and password. We store passwords only as bcrypt hashes. We log staff actions for traceability.
• Guests of a hotel: each hotel runs its own AURI instance. It holds guest names, contact details, bookings, treatments booked and payment status. The hotel is the controller and its own privacy notice applies. AURI is the processor.

How we use it

• Form messages: to answer you. We do not sell them or share them for marketing.
• Staff account data: to sign you in, keep an audit trail, and send service notices such as planned maintenance or security advice.
• Guest data: only to run the hotel's booking system, on the hotel's instructions. See the data processing agreement.

We do not use personal data to train AI models.

Cookies

Google Analytics sets cookies that count visits to this website.

On a hotel's booking pages, AURI sets only the cookies needed to keep you signed in and to hold a booking. The hotel's own notice describes them.

How long we keep it

• Form messages: 24 months from our last contact, then deleted.
• Staff accounts: for the length of the hotel's contract plus 12 months, then anonymised.
• Guest data: the hotel sets the retention period on its instance.

Your rights

Under GDPR you can ask to see your data, correct it, delete it, restrict or object to its use, receive it in a machine-readable file, and withdraw consent. People in the UAE and Saudi Arabia have similar rights under their data protection laws.

Write to [email protected]. We confirm receipt within 2 business days and answer within one month. If we refuse, we tell you why. You can complain to your data protection authority; in Poland that is UODO.

For guest data held by a hotel, write to the hotel first. We help the hotel answer.

Where data is kept

AURI runs on Google Cloud. Each hotel's instance runs in one Google Cloud region, agreed with the hotel before setup. If local law requires data to stay in the country, we settle that before setup too.

Some services we use are in the United States. For transfers outside the EU and EEA we rely on the EU Standard Contractual Clauses. The data processing agreement lists these services.

Contact

• Email: [email protected]
• Post: Maciej Adamski Sp. z o.o., Poland. We send the registered address on request.
• Data protection officer: Maciej Adamski, acting.