Privacy Policy

The Controller, i.e., the entity that decides how your personal data will be used, is EXPLORAHEAD Travel Agency. Email: explorahead@gmail.com Tax ID (NIP): [TO BE COMPLETED] Business ID (REGON): [TO BE COMPLETED]

We only collect data that is necessary to provide our services. Your data is processed for the following purposes: Travel Consulting Services: • Data type: First name and last name, email address, phone number, date of birth, travel preferences (destination, dates, accommodation, attractions). • Purpose: Preparation of offers, travel plans, and flight and accommodation proposals. • Legal basis: Performance of a contract or pre-contractual actions (Art. 6(1)(b) GDPR). Handling Complaints and Claims: • Data type: First name and last name, email address, service-related data. • Purpose: Processing complaints and defense against potential claims. • Legal basis: Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest of the Controller (Art. 6(1)(f) GDPR). Contact and Ongoing Support: • Data type: Email address, phone number. • Purpose: Responding to inquiries and providing service information. • Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR). Marketing Purposes: • Data type: Email address. • Purpose: Sending newsletters and travel opportunity information. • Legal basis: Your voluntary consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time.

We store your data only for the time necessary to fulfill specific purposes: • Travel and consulting services: Data related to the service is stored for 2 years from the end of cooperation, unless a legal obligation (e.g., accounting) requires a longer period (5 years for settlement documents). • Legal obligations (taxes, accounting): For 5 years, counting from the end of the calendar year in which the tax payment deadline expired. • Defense against claims: Until the statute of limitations for potential claims arising from the contract expires (in accordance with the Civil Code). • Marketing: Until you withdraw your consent or object.

Your data is safe with us. We do not sell, rent, or exchange your personal data with third parties for their own marketing purposes. Your data may only be shared to the necessary extent with the following categories of recipients: • Data processors acting on our behalf: Trusted IT service providers, hosting companies, and accounting firms that support our ongoing operations under data processing agreements. • Government authorities or other authorized entities: Only in cases where the obligation to share data arises directly from legal provisions (e.g., border controls, tax offices).

In accordance with GDPR provisions, you have the following rights regarding your personal data: • Right of access to data: You have the right to obtain information about whether we process your personal data and, if so, to what extent. • Right to rectification: If your data is incorrect or incomplete, you have the right to request its correction or completion. • Right to erasure: You have the right to request the deletion of your data if there is no longer a legal basis for its processing. • Right to restriction of processing: In certain situations, you have the right to request that we limit the use of your data to storage only. • Right to data portability: You have the right to receive your data in a structured, commonly used format and to transfer it to another controller. • Right to object: You have the right to object to the processing of your data if we do so based on our legitimate interest (e.g., for analytical purposes). • Right to withdraw consent: If we process data based on your consent (e.g., newsletter), you can withdraw it at any time. This does not affect the lawfulness of processing carried out before the withdrawal. • Right to lodge a complaint: If you believe that we are processing your data in violation of regulations, you have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO). How can you exercise your rights? Simply contact us at: explorahead@gmail.com

We ensure that your data is completely secure. We have implemented modern technical measures and organizational procedures that protect information from accidental loss, unauthorized access, or modification. We continuously monitor our IT infrastructure for potential threats to provide you with the highest level of digital protection.

We reserve the right to update this Privacy Policy to ensure it always complies with applicable regulations. Each new version will be published on our website with the date of the last change. In the event of key amendments, we will inform you directly by email. Last updated: February 2026