Cookies Policy
Personal Data Protection Policy
The administrator of your personal data - processed for the purposes specified below - is lucky2go Sp. z.o.o., with its registered office in Katowice, 40-085, Adama Mickiewicza 29 street, entered into the National Court Register kept by the District Court Katowice-East in Katowice, 8th Commercial Division under KRS no.: 0000729174, REGON 380073970 and holding NIP no.: 634-29-28-642, with a share capital of PLN 5.000,0 As a part of the User’s use of hotel booking services and assistance in insurance reservation (acting as an Insurer’s agent).
The Administrator of the customer's data is eSky.pl S.A. with its registered office in Katowice, 40-265, Murckowska 14a street, and those personal data are processed according to rules defined in Privacy Policy. Lucky2go Sp.z.o.o. remains the independent administrator of data of the service Users for the purposes related to the use of the website and the services provided through it, regardless of the external Partners, and in this scope, the Administrator may process the personal data also obtained for the Partners.
Personal Data Protection Inspector: Grzegorz Gawin
e-mail: dpo@lucky2go.com
Purpose | Explanation | Legal basis | Processing length (when will your data be removed) |
Creating an account on the Website according to the terms and conditions (hereinafter referred to as the “Terms and Conditions”). | This relates to data processing that is necessary to create an account at lucky2go.com and use it, for example, to verify the correctness of the data or to review transactions. The process of creating the account is automated. If you experience any problems with creating the account, you can contact the Call Center. Every user is authorized to create the account. No initial verification is required. | Article 6 section 1 letter b) of the GDPR and Article 22 section 2 letter a) of the GDPR |
Throughout the period of the account service, however, if the account is not created or removed, the data is archived and will not be used for purposes other than those related to determining, pursuing or defending counterclaims. |
Entering into an agreement on providing service according to the Terms and Conditions. | Regardless of whether you create the account at lucky2go.com or you are an unregistered user, you can use services according to the Terms and Conditions, e.g. book a ticket or make a hotel reservation. Personal data gathered in the process of ordering a service are processed (e.g. they will be shared with airlines or other service providers, e.g. eSky.pl SA) to finalize the service. The agreement may also be concluded through the Call Center. The agreement is executed automatically. Every user is authorized to conclude the agreement. No initial verification is required. |
Article 6 section 1 letter b) of the GDPR and Article 22 section 2 letter a) of the GDPR | Throughout the period of the service and until the statute of limitations on the counterclaims expires, however if the agreement is not concluded and the service is not provided according to the Terms and Conditions or after the period of provision of the service expires, the data will be archived and will not be used for purposes other than those related to determining, pursuing or defending counterclaims. |
Performing the obligations under the agreement on providing service according to the Terms and Conditions. | Regardless of whether you create the account at lucky2go.com or you are an unregistered user, you can use services according to the Terms and Conditions, e.g. book a ticket or make a hotel reservation. Personal data gathered in the process of ordering a service are processed (e.g. they will be shared with airlines or other service providers, e.g. eSky.pl SA) to perform the obligations under the agreement. You may also select additional options while ordering a service (according to the Terms and Conditions), if you select these options, your data will also be processed for the purposes of providing this additional service. The agreement is concluded automatically unless the service is operated by Call Center. Every user is authorized to receive the service. No initial verification is required. |
Article 6 section 1 letter b) of the GDPR and Article 22 section 2 letter a) of the GDPR | Throughout the period of the service and until the statute of limitations on the counterclaims expires, however if the agreement is not concluded and the service is not provided according to the Terms and Conditions or after the period of provision of the service expires, the data will be archived and will not be used for purposes other than those related to determining, pursuing or defending counterclaims. |
For the eSky marketing purposes. | If marketing is done through emails - you will be asked to give additional permission - see details below. In such a case, the data accessed from the account or during the transaction process and while the service is being provided and for this period. The indicated purpose may be achieved by displaying a personalized advertisement based on profiling. According to the GDPR, profiling is any form of automated personal data processing that involves the use of personal data for evaluation of personal aspects of a natural person, in particular for analysis or prognosis of the aspects related to this natural person’s performance at work, their financial situation, health, personal preferences, interests, credibility, behaviour, location and movement; | Article 6 section 1 letter f) of the GDPR | Until objection is made and after it is made only for the purposes of defence against claims (throughout the statute of limitations on the claims arising from infringement of personal interests). |
For the purposes of achieving public and legal (e.g. taxes) responsibilities related to the agreement on providing service according to the Terms and Conditions. | This refers to the performance of obligations assigned to the Data Administrator under Polish law | Article 6 section 1 letter c) of the GDPR | Until the statute of limitations on the public and legal obligations (e.g. taxes) expires. |
For the purposes of keeping the Website safe. | This is about preventing unauthorized access to the electronic communication network and sharing malicious codes, stopping attacks, such as “service denial” and protecting computer systems and electronic communication network from damage. | Article 6 section 1 letter f) of the GDPR | Until an effective objection is made (see details below) or until the statute of limitations on counterclaims expires, e.g. those related to breach of safety rules on the Website -> whichever event occurs first. |
For the purposes of a statistical analysis, including a financial analysis, and using its results to improve the quality of the services offered by the Data Administrator. | The analysis is performed “manually”. The analysis aims to identify transactions that constitute a breach of the agreement (without the intention of payment) for the purpose of pursuing the rights by the Data Administrator. | Article 6 section 1 letter f) of the GDPR | Until an effective objection is made or until the statute of limitations on counterclaims expires, e.g. those related to breach of safety rules on the Website -> whichever event occurs first. |
For the purposes of sending the newsletter. | In such a case, you will be asked for additional permission and to provide your email address. In such a case, the data accessed from the account or during the transaction process and while the service is being provided and for this period. The indicated purpose may be achieved by displaying personalized advertisements based on profiling. According to the GDPR, profiling is any form of automated personal data processing that involves the use of personal data for evaluation of personal aspects of a natural person, in particular for analysis or prognosis of the aspects related to this natural person’s performance at work, their financial situation, health, personal preferences, interests, credibility, behaviour, location and movement; | Article 6 section 1 letter a) of the GDPR | Until the permission is withdrawn and after it is withdrawn only for the purposes of defence against claims (throughout the statute of limitations on the claims arising from infringement of personal interests). |
For the purposes of sending “price alerts”. | In such a case, you will be asked for additional permission and to provide your email address. In such a case, the data accessed from the account or during the transaction process and while the service is being provided and for this period. The indicated purpose may be achieved by displaying a personalized advertisement based on profiling. According to the GDPR, profiling is any form of automated personal data processing that involves the use of personal data for evaluation of personal aspects of a natural person, in particular for analysis or prognosis of the aspects related to this natural person’s performance at work, their financial situation, health, personal preferences, interests, credibility, behaviour, location and movement; | Article 6 section 1 letter a) of the GDPR | Until the permission is withdrawn and after it is withdrawn only for the purposes of defence against claims (throughout the statute of limitations on the claims arising from infringement of personal interests). |
For the purposes of displaying the so-called web push. | In such a case, you will be asked for additional permission. Web push delivers a question to the User that will appear in the address bar and will ask the User for his permission to receive web push notifications. The User may accept or block the notifications. The content of notifications is created by the browser and interference is not permitted. | Article 6 section 1 letter a) of the GDPR | Until the permission is withdrawn and after it is withdrawn only for the purposes of defense against claims (throughout the statute of limitations on the claims arising from infringement of personal interests). |
For the purposes of geolocation that is used to display personalized advertisements. | In such a case, you will be asked for additional permission. | Article 6 section 1 letter a) of the GDPR | Until the permission is withdrawn and after it is withdrawn only for the purposes of defense against claims (throughout the statute of limitations on the claims arising from infringement of personal interests). |
For the purposes of performing the obligations related to the enforcement of the laws specified in the GDPR. | In such a case, the data are processed only within the scope that is necessary to identify and verify the identity of the person who makes the request. | Article 6 section 1 letter c) of the GDPR | For the purposes of defense against claims, throughout the statute of limitations on the claims arising from infringement of personal interests. |
For the purposes of determining, pursuing or defending against counterclaims related to: - providing services according to the Terms and Conditions (within this scope, processing complaints); - performing obligations arising from the GDPR (to adhere to the regulations). |
In such a case, the data is processed only within the scope necessary for the purposes of investigation, determining the claims or defending against the claims. | Article 6 section 1 letter f) of the GDPR | Throughout the statute of limitations on the claims, both the claims against the Data Administrator and those assigned to the Data Administrator. The administrator of data in scope regarding creating an account and servicing as client is eSky.pl SA The administrator of data concerning entering data and processing client's data on the issued invoice is lucky2go Sp. z.o.o. |
Execution of contract with the Administrator | If you are an employee/co-worker/member of the board with which the contract has been concluded, your data such as first name, last name, contact details, position, order data shall be processed for the purpose of order realisation, as well as tax purposes and securing claims, while maintaining the rights set out in this Privacy Policy. Business conversations with employees may be recorded in order to verify the correctness of information and the quality of services provided. |
Article 6 section 1 b) c) and f) GDPR | For the period of service provision and until the limitation of mutual claims, except if the contract is not concluded and the service is not provided in accordance with the Regulations or after the service is completed, the data shall be archived and not used except for the purpose of investigating, defending or establishing mutual claims. |
This website uses the Google Analytics service for analysis of websites offered by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, United States. It enables assigning data from various devices to the User's identifier and allows analysis of actions taken by this User from the level of observed devices (also Firebase and Optimize services are in use).
Google will use this information at the request of the website operator to evaluate your use of the website so that can compile reports on website activity of users and provide other website and internet services to website operator. Data processing for these purposes also lies in the legitimate interest of the Website operator. Legal basis for using Google Analytics: art. 6.1.f) GDPR. More information about the terms and conditions of using this service and data protection can be found at https://www.google.com/analytics/terms/en.htmland https://policies.google.com/?hl=en.
The user can prevent the saving of cookies by selecting the appropriate settings in his browser. In this case, the User will not be able to take full advantage of all functions of the website. You may also prevent Google from collecting and processing data generated by cookies and data related to your use of the website (including its IP address) by downloading and installing the add-on available at https://tools.google.com/dlpage/gaoptout?hl=en. To set a resignation cookie, please click here.
In the case of mobile devices, the functions described above are implemented by Firebase: on the terms set out in: https://firebase.google.com/support/privacy.
In order to propose the services most tailored to the expectations of the Users, the website uses the Google Ads display system and uses Google's conversion tracking functionality to personalize online ads based on interests and location. The IP anonymization option is controlled by Google Tag Manager using the internal setting. This setting is configured in such a way that the anonymisation required by law for privacy protection includes IP addresses. Ads are displayed based on search requests on sites that are part of the Google Display Network. The user can also choose the type of Google ads displayed to them, or disable Google ads based on interests by using the ad settings page. It can also disable third-party cookies by using the opt-out tool provided by the Network Advertising Initiative.
If you do not want to receive any personalized ads, you may opt out of the option to display these ads using the Google ad settings page
For more information on how Google uses cookies, please see Google's privacy policy.
Data collected and stored on this site are used for purposes related to the optimization of its operation. This is done using technologies provided by Hotjar Ltd. (https://www.hotjar.com). These data may be used to generate profiles of Users using a pseudonym. Cookies can also be used for this purpose. Data collected using the Hotjar technology is not used to identify the identity of the User visiting this site and will not be combined with the personal data of the User using a pseudonym, unless he agrees to do so. The User may at any time withdraw the consent for Hotjar to collect User's data from sites that support this technology. To do this, go to https://www.hotjar.com/legal/compliance/opt-out and click "Disable Hotjar" or turn on "Do not Track" in your browser .
With the help of Criteo technology (provided by Criteo GmbH, Unterer Anger 3, 80331 Munich and/or in Criteo Group, Address: 32 Rue Blanche, 75009 Paris, France), information about User behavior related to browsing websites and online content of the Service Provider is collected for marketing purposes, as well as cookies are created on these sites and content (in the form only anonymized). This allows Criteo to analyze the User's behavior related to the websites viewed and display them at the time he visits other websites with targeted product recommendations in the form of an advertising banner. The data collected by Criteo will only be used to improve advertising content. The letter "i" (information) can be found on each banner displayed. If the user activates the mouse pointer with this letter and clicks it, a page will appear explaining the system and opt-out options. Clicking the "opt-out" option will result in setting a cookie with information about the cancellation, which will prevent the display of this banner in the future. These data will not be used in any other way or transferred to third parties. For more information about Criteo and the opportunity to object to anonymous analysis of User behavior related to site browsing, please visit http://www.criteo.com/en/privacy/.
Using RTB House technology (provided by RTB House SA, Złota 61/101, 00-819 Warsaw, Poland), information about the User's behavior related to browsing websites and online content is collected for marketing purposes. This allows RTB House to analyze the User's behavior related to the websites viewed and display product recommendations in the form of an advertising banner when visiting the website. Clicking the "opt-out" option will result in setting a cookie with information about the cancellation, which will prevent the display of this banner in the future. These data will not be used in any other way or transferred to third parties. For more information about RTB House and the possibility to object to anonymous analysis of User's behavior related to website browsing, please visit https://www.rtbhouse.com/privacy-center/.
Using Adara technology (provided by Adara, Inc. (“Adara”), a California corporation, with offices at 2625 Middlefield Road #827, Palo Alto, CA 94306, USA,), information about the User's behavior related to browsing websites and online content is collected for marketing purposes. This allows to analyze the User's behavior related to the websites viewed and display product recommendations in the form of an advertising banner when visiting the websites. Clicking the "opt-out" option will result in setting a cookie with information about the cancellation, which will prevent the display of this banner in the future. These data could be used or transferred to third parties. For more information about and the possibility to object to anonymous analysis of User's behavior related to website browsing, please visit https://adara.com/privacy-promise/.