1. Controller and contact details
The controller of your personal data is Jan Kropielnicki, trading as Biuro Podróży Tour Retour Jan Kropielnicki.
- Office name
- Biuro Podróży Tour Retour Jan Kropielnicki
- Registered address
- Aleja Jana Pawła II 63F, 27-400 Ostrowiec Świętokrzyski, Poland
- NIP (tax identification number)
- 6611004295
- REGON (business registry number)
- 290515653
- Contact for data matters
- biuro@tour-retour.pl — include the office name and “Personal data” in the subject line.
Phone: +48 695 564 484 or +48 41 262 05 78.
Contact person: Jadwiga Kropielnicka. - Data protection officer
- For data matters, contact the controller directly at the email address above. It remains to be confirmed whether a person has been formally appointed as data protection officer; naming the controller does not identify a data protection officer.
Information from the office’s data protection documents
The authorization document (Annex D1a, dated 25 May 2018) identifies Biuro Podróży Tour-Retour Jan Kropielnicki as the controller. This is a separate controller from Agnieszka Niziałek’s office. The authorization is an internal staff document, not a customer information notice; it does not establish the office’s complete retention rules or all processing purposes.
The office’s documentation provides for individually authorized staff to process customer and contract data within their assigned duties, subject to confidentiality and safeguards against unauthorized access. A staff authorization does not appoint a data protection officer and does not establish a basis for the other office to access the shared mailbox.
2. Scope of this notice
Document obejmuje tę część polskiego serwisu oraz zapytania o wycieczki indywidualne i szkolne, wyjazdy grupowe i zakładowe, wynajem autokarów oraz czarter samolotów. Dotyczy kontaktu przed dokonaniem rezerwacji. Serwis nie zawiera obecnie płatności internetowych, panelu klienta ani automatycznego systemu rezerwacji.
Booking, entering into a contract, and arranging travel may require additional data and a separate notice provided at the relevant stage. This document is not the policy of the Tour Retour Travel office in the USA or of the other Polish office.
3. Data you provide
The form includes your full name, email, optional phone number, and information about your planned trip: category, destination, dates, departure location, number of adults and children, children’s ages, budget, preferences, and inquiry. Provide only the information needed to answer your inquiry. At this stage, do not provide your PESEL number, identity documents, card details, health information, or children’s last names.
You complete the form and prepare the message locally in your browser. The website’s code does not send form fields to a server or store them in a database. When you select “Open email app,” the content is passed to your email app; we receive the message only after you send it. Your email app may save a draft. The copy button places the content on your device’s clipboard.
Providing data is voluntary. Fields marked with an asterisk are required to prepare an inquiry using the form; without a reply address, we cannot respond by email. You can also contact us by phone. You do not need to complete the form to browse the website.
4. Purposes and legal bases
- Preparing a travel proposal at your request
- Article 6(1)(b) GDPR — steps before entering into a contract, where the inquiry concerns a contract to which you would be a party.
- Other questions and contact with a company or group representative
- Article 6(1)(f) GDPR — the legitimate interest in handling correspondence and responding to inquiries.
- Establishing, exercising, or defending legal claims
- Article 6(1)(f) GDPR — protecting the office’s rights where retaining the correspondence is actually necessary.
- Handling data rights requests
- Article 6(1)(c) GDPR in conjunction with Articles 12–22 GDPR.
The form does not subscribe you to a newsletter or include marketing consent. A response to your inquiry does not require you to select a general consent to data processing. The website’s code does not profile customers or make automated decisions that produce legal effects.
5. Who receives your data
People authorized by the controller, the email provider, and technical support providers may be involved in handling correspondence. Their access must be based on their tasks and appropriate data protection arrangements. Where required by law, data may be provided to the relevant authorities.
Arranging a trip may require working with a carrier, accommodation provider, or another service provider. Specific transfers of travelers’ data must be established before booking. At the group inquiry stage, please provide the group size and a general profile, without named lists of students or employees.
Shared email address
Biuro Podróży Tour Retour Agnieszka Niziałek and Biuro Podróży Tour Retour Jan Kropielnicki use the shared mailbox biuro@tour-retour.pl. Each office has separate access to it. Correspondence sent to this address may therefore be accessible to people acting on behalf of both offices. Your choice of form identifies the office you are contacting; it does not, by itself, restrict access to messages in the shared mailbox. The form adds the selected office’s name to the message body. The controller responsible for this section of the website is identified in section 1.
To be confirmed: the specific provider of the shared mailbox, the scope of authorization for people reading messages, and the arrangements and basis for both offices’ mutual access to the data. The companies’ separate use of Google services does not establish who provides this particular mailbox.
6. How long we retain data
Retention periods are determined by considering the purpose of the contact, completion of the matter, any booking, the actual need to protect against claims, and statutory obligations relating to specific records. This does not mean that every inquiry is retained for the maximum limitation period.
To be confirmed by the office: the retention period or clear deletion criteria for completed inquiries, WhatsApp messages, backups, and technical data. The periods actually applied have not yet been established, so no arbitrary number of months or years has been specified.
7. Your rights
Subject to the conditions set out in the GDPR, you may request access to your data and a copy of it, rectification, erasure, or restriction of processing. The right to data portability applies to data processed by automated means on the basis of a contract or consent. You may object to processing based on legitimate interests on grounds relating to your particular situation.
If you give consent for a separate purpose, you may withdraw it without affecting the lawfulness of earlier processing. Address your request to the office identified in section 1. As a rule, you should receive a response within one month; any extension in a justified case requires that you be informed within that period. The extent of identity verification should be proportionate to the matter.
You may lodge a complaint with the President of the Polish Personal Data Protection Office. Information about your rights and how to exercise them is available on the UODO website.
8. WhatsApp and external websites
WhatsApp is an optional way to contact us. The website button is a regular link, not an embedded chat. Clicking it opens WhatsApp; simply viewing the page does not run its scripts. When you send a message, the recipient receives its content and information shared by your profile, such as your phone number and name.
The platform’s own practices, recipients, and transfers are described in the WhatsApp Privacy Policy for the EEA. You can call or email instead. Following a link to the U.S. website or another external website means using a separate service; this project does not transfer form content there.
10. Transfers outside the EEA
It is not currently possible to guarantee that all data remains in the European Economic Area. OpenAI states that it also processes data outside the EEA; using WhatsApp and the email provider may involve further transfers.
To be established for both offices: the specific providers, countries of processing, relevant roles, and legal bases and safeguards used for transfers. Details of these arrangements and how to obtain information about the safeguards require confirmation by the relevant office.
Guidance on the rules for transferring data outside the EEA is published by the European Data Protection Board.
11. Legal framework and updates
This privacy notice was prepared for the Polish office’s operations and contact with customers in Poland, taking into account the GDPR and Poland’s Electronic Communications Law. The family connection to the U.S. office does not automatically make California law applicable to all the activities described.
- GDPR — Regulation (EU) 2016/679
- Electronic Communications Law — Act of July 12, 2024
- EDPB — informing individuals and handling their rights
- EDPB — data minimization and storage limitation
Last updated: October 15, 2026. This notice will be updated as further information is confirmed or the way inquiries are handled changes.