1. Controller and contact details
The controller of your personal data is Agnieszka Niziałek, trading as Biuro Podróży Tour Retour Agnieszka Niziałek.
- Office name
- Biuro Podróży Tour Retour Agnieszka Niziałek
- Registered address
- Aleja Jana Pawła II 63F, 27-400 Ostrowiec Świętokrzyski, Poland
- NIP (tax identification number)
- 6611340834
- REGON (business registry number)
- 292896748
- Contact for data matters
- biuro@tour-retour.pl — include the office name and “Personal data” in the subject line.
Phone: +48 509 938 928 or +48 41 262 05 78.
Contact person: Agnieszka Niziałek. - Data protection officer
- For data matters, contact the controller directly at the email address above. It remains to be confirmed whether a person has been formally appointed as data protection officer; naming the controller does not identify a data protection officer.
Information from the office’s data protection documents
The information notice (Annex B1) identifies Agnieszka Niziałek, Biuro Podróży Tour-Retour, Aleja Jana Pawła II 63F, 27-400 Ostrowiec Świętokrzyski, as the controller. It covers entering into and performing travel contracts, in addition to the website inquiries described below. Data necessary to enter into a contract is provided voluntarily; without it, the contract cannot be concluded.
The office’s documentation provides for individually authorized staff to process customer and contract data within their assigned duties, subject to confidentiality and safeguards against unauthorized access. A staff authorization does not appoint a data protection officer and does not establish a basis for the other office to access the shared mailbox.
2. Scope of this notice
Document obejmuje tę część polskiego serwisu oraz zapytania dotyczące ofert agencji: wyjazdów na wszystkie kontynenty, rejsów, biletów lotniczych, ubezpieczeń podróżnych oraz ofert Last Minute. Obejmuje kontakt przed rezerwacją oraz opisane w klauzuli informacyjnej przetwarzanie związane z zawarciem i wykonaniem umowy. Serwis nie zawiera obecnie płatności internetowych, panelu klienta ani automatycznego systemu rezerwacji.
Booking, entering into a contract, and arranging travel may require additional data and a separate notice provided at the relevant stage. This document is not the policy of the Tour Retour Travel office in the USA or of the other Polish office.
3. Data you provide
The form includes your full name, email, optional phone number, and information about your planned trip: category, destination, dates, departure location, number of adults and children, children’s ages, budget, preferences, and inquiry. Provide only the information needed to answer your inquiry. At this stage, do not provide your PESEL number, identity documents, card details, health information, or children’s last names.
You complete the form and prepare the message locally in your browser. The website’s code does not send form fields to a server or store them in a database. When you select “Open email app,” the content is passed to your email app; we receive the message only after you send it. Your email app may save a draft. The copy button places the content on your device’s clipboard.
Providing data is voluntary. Fields marked with an asterisk are required to prepare an inquiry using the form; without a reply address, we cannot respond by email. You can also contact us by phone. You do not need to complete the form to browse the website.
4. Purposes and legal bases
- Entering into and performing a travel contract
- Article 6(1)(b) GDPR — processing necessary to enter into and perform the contract, as described in the office’s information notice. The data required for a particular booking will be specified at that stage.
- Preparing a travel proposal at your request
- Article 6(1)(b) GDPR — steps before entering into a contract, where the inquiry concerns a contract to which you would be a party.
- Other questions and contact with a company or group representative
- Article 6(1)(f) GDPR — the legitimate interest in handling correspondence and responding to inquiries.
- Establishing, exercising, or defending legal claims
- Article 6(1)(f) GDPR — protecting the office’s rights where retaining the correspondence is actually necessary.
- Handling data rights requests
- Article 6(1)(c) GDPR in conjunction with Articles 12–22 GDPR.
The form does not subscribe you to a newsletter or include marketing consent. A response to your inquiry does not require you to select a general consent to data processing. The website’s code does not profile customers or make automated decisions that produce legal effects.
5. Who receives your data
People authorized by the controller, the email provider, and technical support providers may be involved in handling correspondence. Their access must be based on their tasks and appropriate data protection arrangements. Where required by law, data may be provided to the relevant authorities.
Depending on the booking, the office’s information notice identifies cooperating tour operators, airlines, ship operators, transport companies, reservation systems and insurers as possible recipients. The actual recipient and scope of data depend on the service selected.
When you choose a travel option, the agency may act as an intermediary in contact with a tour operator, carrier, or insurer. Before data is shared for a booking, the specific entity, purpose of the transfer, and its role must be identified. Simply browsing travel options does not send your form data to these companies.
Shared email address
Biuro Podróży Tour Retour Agnieszka Niziałek and Biuro Podróży Tour Retour Jan Kropielnicki use the shared mailbox biuro@tour-retour.pl. Each office has separate access to it. Correspondence sent to this address may therefore be accessible to people acting on behalf of both offices. Your choice of form identifies the office you are contacting; it does not, by itself, restrict access to messages in the shared mailbox. The form adds the selected office’s name to the message body. The controller responsible for this section of the website is identified in section 1.
To be confirmed: the specific provider of the shared mailbox, the scope of authorization for people reading messages, and the arrangements and basis for both offices’ mutual access to the data. The companies’ separate use of Google services does not establish who provides this particular mailbox.
6. How long we retain data
For contracts, the office’s information notice provides for retention for the time necessary to fulfil the processing purposes, demonstrate proper performance of the contract, handle complaints and meet periods required by applicable law. It does not specify a fixed number of years for every record.
Retention periods are determined by considering the purpose of the contact, completion of the matter, any booking, the actual need to protect against claims, and statutory obligations relating to specific records. This does not mean that every inquiry is retained for the maximum limitation period.
To be confirmed by the office: the retention period or clear deletion criteria for completed inquiries, WhatsApp messages, backups, and technical data. The periods actually applied have not yet been established, so no arbitrary number of months or years has been specified.
7. Your rights
Subject to the conditions set out in the GDPR, you may request access to your data and a copy of it, rectification, erasure, or restriction of processing. The right to data portability applies to data processed by automated means on the basis of a contract or consent. You may object to processing based on legitimate interests on grounds relating to your particular situation.
If you give consent for a separate purpose, you may withdraw it without affecting the lawfulness of earlier processing. Address your request to the office identified in section 1. As a rule, you should receive a response within one month; any extension in a justified case requires that you be informed within that period. The extent of identity verification should be proportionate to the matter.
You may lodge a complaint with the President of the Polish Personal Data Protection Office. Information about your rights and how to exercise them is available on the UODO website.
8. WhatsApp and external websites
WhatsApp is an optional way to contact us. The website button is a regular link, not an embedded chat. Clicking it opens WhatsApp; simply viewing the page does not run its scripts. When you send a message, the recipient receives its content and information shared by your profile, such as your phone number and name.
The platform’s own practices, recipients, and transfers are described in the WhatsApp Privacy Policy for the EEA. You can call or email instead. Following a link to the U.S. website or another external website means using a separate service; this project does not transfer form content there.
10. Transfers outside the EEA
It is not currently possible to guarantee that all data remains in the European Economic Area. OpenAI states that it also processes data outside the EEA; using WhatsApp and the email provider may involve further transfers.
To be established for both offices: the specific providers, countries of processing, relevant roles, and legal bases and safeguards used for transfers. Details of these arrangements and how to obtain information about the safeguards require confirmation by the relevant office.
Guidance on the rules for transferring data outside the EEA is published by the European Data Protection Board.
11. Legal framework and updates
This privacy notice was prepared for the Polish office’s operations and contact with customers in Poland, taking into account the GDPR and Poland’s Electronic Communications Law. The family connection to the U.S. office does not automatically make California law applicable to all the activities described.
- GDPR — Regulation (EU) 2016/679
- Electronic Communications Law — Act of July 12, 2024
- EDPB — informing individuals and handling their rights
- EDPB — data minimization and storage limitation
Last updated: October 15, 2026. This notice will be updated as further information is confirmed or the way inquiries are handled changes.