Last updated 10 August 2026
1. Who is responsible for your data
The controller of personal data collected through this website is Rockenue Tech sp. z o.o., with its registered seat in Kraków, ul. Józefa Chełmońskiego 118/4, 31-348 Kraków, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, XI Commercial Division of the National Court Register, under KRS 0001246600, NIP 9452331438, REGON 544967330, share capital PLN 5,000.
For any question about this policy or to exercise a right described in section 8, write to karol at rockenue.com. We have not appointed a Data Protection Officer, as we are not required to; enquiries reach a named person directly.
2. The short version
This website has no analytics, no advertising, no tag manager, no social media embeds and no third-party fonts. It sets no cookies at all in an ordinary visit, which is why you were not asked to accept any. The only personal data we collect is what you type into the contact form, plus the technical records described in section 4.
3. If you use the contact form
The form at /contact collects your name and email address, which are required, and optionally your hotel, telephone number, approximate number of rooms, property management system and your message. Along with the submission we record your IP address and browser user-agent string.
Why we ask. The name, email and message exist so we can answer you. The hotel, phone, rooms and property system are there so the first reply can be useful rather than a request for more information — leaving them blank does not stop us replying.
Why we record your IP address. Solely to limit how many submissions can come from one connection in an hour. Without it the form is an open relay for anyone with a script. It is not used to identify or profile you, and it is never shared for any other purpose.
Legal basis. Where you are enquiring about becoming a customer, Article 6(1)(b) GDPR — steps taken at your request before entering into a contract. Otherwise, and for the IP address and user-agent, Article 6(1)(f) GDPR — our legitimate interest in responding to business correspondence and in keeping the form from being abused. You may object to processing based on legitimate interests at any time; see section 8.
Please do not send us sensitive information.This is a business enquiry form. Do not include health data, payment card numbers, or anyone else's personal data through it.
4. What is recorded automatically
Server logs. Our hosting provider records standard request data — IP address, timestamp, the page requested, user-agent — as part of operating the service and protecting it from abuse. Article 6(1)(f) GDPR.
Error monitoring. If something breaks in your browser we receive a technical error report through Sentry, which processes it in the European Union. It is configured not to attach personal data automatically, and it samples rather than records every page view. Article 6(1)(f) GDPR — our legitimate interest in a working website.
5. Who else processes it
We do not sell personal data, and we do not share it for anyone else's marketing. The following providers process it on our instructions, under contract, and only to run this site:
| Railway | Application hosting and server logs. |
|---|---|
| Neon | The database holding enquiries. Hosted in the EU (AWS eu-central-1, Frankfurt). |
| Twilio SendGrid | Delivers the notification email when you submit the form. United States — see below. |
| Sentry | Error monitoring, processed in Sentry's European Union region. |
We may also disclose data where the law requires it, or to establish or defend a legal claim.
6. Transfers outside the EEA
Enquiry data is stored in the European Union. One transfer leaves it: the notification email is delivered through Twilio SendGrid in the United States, which necessarily involves the contents of your message. That transfer is made under the European Commission's Standard Contractual Clauses and the provider's certification under the EU–US Data Privacy Framework. You can ask us for details of the safeguards in place.
7. How long we keep it
Contact-form enquiries: 24 months from the date you send them, after which they are deleted automatically. We chose 24 months because a hotel that enquires today may decide a year later, and we would rather have the context than ask you to repeat yourself. If you would like yours deleted sooner, ask and we will do it.
Where an enquiry turns into a business relationship, the correspondence moves into that relationship's records and is kept for as long as the contract and Polish tax and accounting law require.
Server logs and error reports are kept for a short period on a rolling basis by the providers named above.
8. Your rights
Under the GDPR you have the right to access your personal data and receive a copy, to have inaccurate data corrected, to have data erased, to restrict processing, to data portability, and to object to processing based on our legitimate interests. Exercising any of them costs nothing and does not require a reason beyond an objection.
Write to karol at rockenue.com. We answer within one month.
If you think we have handled your data badly, you can complain to the Polish supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw. You may also complain to the authority where you live or work.
9. Is it required?
No. Providing your details is entirely voluntary — nothing on this site is behind a form. Without a name and an email address we cannot reply, which is the only consequence.
We do not make automated decisions about you, and we do not profile you.
10. Guest data on hotel booking sites
This is a different role and worth stating plainly. When a guest books on a hotel's own website running on our platform, the hotel is the controller of that guest's dataand Rockenue Tech acts as a processor on the hotel's instructions. That processing is governed by our agreement with the hotel and by the hotel's own privacy policy, published on the hotel's domain — not by this document. Those sites also use cookies, which this one does not.
The Article 28 terms governing that processing, including our sub-processors and security measures, are published in full in our Data Processing Agreement.
11. Changes
If we change this policy we will change the date at the top. Where a change materially affects people who have already contacted us, we will tell them directly rather than rely on them re-reading this page.