The Surfers

Privacy Policy

Privacy and Cookie Policy of the Hossa Group

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as “GDPR”), we inform you that this Privacy Policy is prepared in accordance with the GDPR as implemented in Poland under the Act on the Protection of Personal Data (further referred to as “RODO”) we inform you that:

1. The controller of your personal data, which you provide via electronic communication channels, in particular via contact forms on websites and portals, as well as provided in person at offices and branches, and via mail, including in particular:

a) first and last name,

b) postal address,

c) e-mail address,

d) telephone number,

e) date of birth (if required),

f) credit card number (if required),

is Hossa.biz SpóÅ‚ka z o.o. in GdaÅ„sk, ul. Cypriana Kamila Norwida 1, 80-280 GdaÅ„sk,

registered in the National Court Register under the number 0000295112 (hereinafter

‘Administrator’), which is part of the Hossa Capital Group. The entities of this group are:

a) Grupa Inwestycyjna Hossa S.A. in Gdańsk (registered in the National Court Register at

under the KRS number: 0000006925),

b) Hossa.biz SpóÅ‚ka z o.o. in GdaÅ„sk (registered in the National Court Register at

under the KRS number: 0000295112),

c) Garnizon Sp. z o.o. in Gdańsk (registered in the National Court Register under

KRS number: 0000243263),

d) Gdynia 8 sp. z o.o. in Gdańsk (registered in the National Court Register under

KRS number: 0000240578),

e) OCTO Hotels Sp. z o.o. in Gdańsk (registered in the National Court Register under

KRS number: 0000643859).

2. Contact details of the Data Protection Officer of the Administrator: IOD@hossabiz.pl.

3. The Administrator processes your data for the following purposes:

a) contacting and handling requests made using the electronic contact form service and handling requests (based on Article 6(1)(b) and (f) RODO);

b) to carry out the services provided to you, based on contracts, orders, bookings or orders concluded (based on Article 6(1)(b) of the RODO);

c) to comply with a legal obligation imposed on the Administrator by applicable law (based on Article 6(1)(c) of the RODO);

d) to perform analyses, compilations, statistics, reports for the internal needs of each of the entities of the Hossa Capital Group (insofar as they may receive your data), which constitutes a legitimate interest of the Administrator, as well as the assertion of claims or the defence against claims made against the Administrator (based on Article 6(1)(f) RODO);

e) marketing and commercial purposes, i.e. to present and transmit to you by the Administrator and entities of the Hossa Capital Group, based on separately expressed voluntary consent, advertising offers, commercial information, newsletters, and other information, promotional and marketing materials regarding the Administrator's activities, Hossa Capital Group Entities and entities cooperating with the Administrator and Hossa Capital Group Entities (hereinafter referred to as ‘Trading Partners of the Administrator and Hossa Capital Group Entities’) via e-mail to the e-mail address provided by you, with the use of means of direct remote communication via telephone calls, text messages and with the use of other telecommunication terminal equipment to the telephone number indicated by you (based on Art. 6(1)(a) RODO).

4.  The provision of your data is voluntary, but without it, we will not be able to provide services to you.

5. Notwithstanding the above, we would like to inform you that for the purposes and to the extent referred to in this Personal Data Processing Policy, your data may be provided by the Administrator to other Hossa Capital Group Entities in such a way that the Hossa Capital Group Entity to which the data has been provided becomes the controller of such data (i.e. processes it on an independent basis for processing) or receives it for processing on behalf of the Administrator.

6. If a Hossa Capital Group Entity to which your data has been provided by the Administrator becomes the controller of that data, the provisions of this Personal Data Processing Policy relating to the Administrator shall apply mutatis mutandis to that Entity.

7. In particular, we would like to point out that the personal data provided may - based on separate consents given by you and to the extent covered by such consents - be used by Hossa Capital Group Entities for marketing purposes, i.e. to present and transmit to you by the Administrator and/or Business Entities of the Hossa Capital Group advertising offers, commercial information, newsletters and other information, promotional and marketing materials regarding the activities of the Administrator, Business Entities of the Hossa Capital Group and the Administrator's Business Partners and/or Business Entities of the Hossa Capital Group via e-mail to the e-mail address provided by you, using means of direct remote communication via telephone calls, text messages and with the use of other telecommunication terminal devices to the telephone number provided by you.

8. Consent given for the processing of personal data may be withdrawn at any time (however, this will not affect the lawfulness of the processing of your data based on such consent that took place until the time of withdrawal).

9. Where personal data are processed based on voluntarily given consent, the Administrator will process them for a maximum period of 5 years from the last contact for the purposes indicated in point 3(e) above, or until the consent given is withdrawn, or for any other period prescribed by law. In other cases, your data will be kept for the period allowed by law to enable you to assert your rights, as well as, where applicable, to ensure that the history of financial settlements between you and the Administrator can be demonstrated.

10. The personal data provided may be recorded by automated means in computer systems and/or by non-automated means, organising, storing, retrieving, reviewing, using, disclosing by sending, or making available. Personal data may also be subject to restriction, deletion, and destruction. The personal data provided may be subject to profiling, i.e., their automated analysis and the development of predictions about your preferences or future behaviour for the Administrator to determine which offer you may be most interested in.

11. The recipients of your data may be the Administrator's suppliers, including companies providing IT services or solutions to the Administrator and companies carrying out marketing activities, including participating in and/or performing activities related to the presentation and transmission of advertising offers, commercial information, newsletters and other information, promotional and marketing materials relating to the activities of the Administrator and/or Hossa Capital Group Entities, as well as the Administrator's Business Partners and Hossa Capital Group Entities (provided that they have a legal basis for the processing of your data).

12. As a general rule, your data will not be transferred outside the European Economic Area (EEA). However, such processing, where applicable, may occur in connection with marketing and commercial purposes carried out with business partners or suppliers outside the EEA. In any case, this transfer will take place in compliance with the standards under the RODO. You may contact the Administrator to obtain a copy of the protection measures applied.

13. You have the right to request from the Controller, under the terms of the RODO:

a) access to your data

b) to request information on the purpose, scope, manner, and forms of processing.

c) rectification of personal data,

d) erasure or restriction of processing,

e) transfer of data to another controller.

14. The exercise of the rights referred to above shall take place through the submission by you, at any time, of an appropriate request addressed to the Administrator at the contact address given below: info@hossabiz.pl.

15. If you believe that the Administrator's processing of your data violates the law, you have the right to complain to the competent supervisory authority, namely the President of the Office for the Protection of Personal Data (UrzÄ…d Ochrony Danych Osobowych, UODO).

Cookies Policy:

Furthermore, we kindly inform you that the Administrator:

1. operates this Internet Service (hereinafter the ‘Service’).

2. is guided by considerations of protecting the privacy of Users obtained through the Website and ensures the security of their data at the highest level, respecting the right of Users to access their data, the right to rectify and supplement their data, to delete it, or to restrict its processing.

3. The Website does not automatically collect any data on Users, except information contained in cookies, which are IT data, in particular text files, which are stored on the Website User's terminal equipment and are intended for use on the Website. As a rule, cookies contain the name of the website they come from, the time they are stored on the terminal equipment, and a unique number. The Administrator places cookies on the Service User's terminal equipment and has access to them.

4. It informs that restrictions on the use of cookies may affect some of the functionalities available on the Website.

5. The Website uses cookies to:

- Optimising the provision of electronic services through the Website;

- adjusting the content of the displayed websites to the individual preferences of the User and optimising his/her use of the Website;

- researching traffic on the Website;

- reporting and support of advertising and information;

- creation of statistics on the use of the Website by Users;

- maintaining a User session after logging in, so that the User does not have to re-enter his/her login and password on each sub-page;

- to use the functions of social networks to promote the Services or, based on the consent of the User to whom the data refers, to use them for commercial and marketing purposes, including the delivery of newsletters.

6. Indicates that the following cookies are used within the Service:

- session cookies - temporary; used during the creation of a session by the User, they are stored in the User's terminal equipment until the User logs out, leaves the website, or switches off the software (web browser);

- privacy policy (cookies) - to confirm that the User has been informed of the use of cookies by the Website;

- essential - to enable the use of the Website;

- statistical - for the collection of statistical data through Google Analytics tools [cookie provider: Google Inc. with headquarters in the USA];

- advertising - for the presentation of advertising tailored to the User's needs using an application that allows effective management of the marketing strategy: Google Marketing Platform [cookie provider: Google Inc. based in the USA],

- presenting multimedia content - downloaded from external services: www.youtube.com [cookie provider: Google Inc. based in the USA];

- using the social networking function to promote the Service: x.com [cookie provider: X Corp. based in the USA] and Facebook.com [cookie provider: Facebook Inc. based in the USA or Facebook Ireland based in Ireland], Instagram.com [cookie provider: Instagram Inc. based in the USA].

7. Users may change their cookie settings in their browsers at any time. These settings can be changed in such a way as to block the automatic handling of cookies in the settings of the web browser or inform about each time they are placed in the equipment of a User of the Service. Detailed information on the possibility and methods of using cookies is available in the settings or help of your web browser.