ApartmanLink Privacy Policy

This policy explains how Aquatrek Solutions P.S.A., the owner of the ApartmanLink brand, collects and uses personal data and what rights you have.

Summary

• The controller is Aquatrek Solutions P.S.A. of Łódź, Poland. Write to us at [email protected].
• We use data to build and run your website, reply to you and meet our legal obligations.
• We do not sell personal data. Apart from one offer of our e-book, we send tips and offers about our own services only by e-mail and only to hosts who agreed to receive them in the request form, and you can withdraw your consent at any time. We send the e-book offer once to hosts who did not buy a plan, even without that consent, by e-mail and, if they gave a number, by SMS; you can unsubscribe from it in each of these messages (section 3). The coaching that comes with a purchased e-book (e-mails and one SMS) is part of the purchase (point 20 of the Terms).
• We process the data of guests on your website for you and on your instructions. For our own purposes we process only technical data needed for security, visit statistics without cookies and, on websites at an apartmanlink.com address and only with the guest's consent, data for our ads on Facebook and Instagram (section 8).
• On our pages for hosts, and only with your consent, we also use the Google Ads tag to measure our ads and show them to you (section 10).
• On our pages for hosts, and only with your consent, we also use our own al_path cookie to check which of our ads, over several days, lead to a request and a purchase. This data stays with us (section 3).
• When you send a request on our pages for hosts, publish your website on a trial basis or click "Order with obligation to pay", we also store which of our ads brought you to these pages earlier that day. We look only at that day, without cookies and regardless of your choice in the cookie notice, and this data also stays with us (section 3).
• When you send a request, publish your website on a trial basis or buy a plan or the e-book, we inform Meta of this so that we can measure the effectiveness of our ads and show them to similar people. We also inform Meta each time you click a payment option for the e-book (the e-book purchase button, the Apple Pay button or the Google Pay button), even if you do not complete the purchase. We do this from our server, without cookies and regardless of your choice in the cookie notice (section 3).
• You can object at any time to processing based on legitimate interest and to direct marketing (section 11).
• You also have the right of access, rectification, erasure and other rights. You can complain to the Croatian AZOP or the Polish UODO.

1. Who is the controller

The controller of your personal data is Aquatrek Solutions P.S.A. (prosta spółka akcyjna, a simple joint-stock company incorporated under Polish law), the owner of the ApartmanLink brand. For the data of guests on property websites, the host is the controller, except for the processing we carry out for our own purposes (section 8).

• Registered office: ul. Romana 20A, 93-370 Łódź, Poland
• Entered in the Polish National Court Register (KRS) under number 0001044483
• Tax number (NIP): 7292750466 · VAT ID: PL7292750466 · statistical number (REGON): 525692626
• E-mail: [email protected]
• WhatsApp: +48 534 874 104

We have not appointed a data protection officer because we are not legally required to. Send any privacy question to the e-mail address above or by post to our registered office.

2. Who this policy covers

This policy applies to:

• visitors to apartmanlink.com and its subdomains (such as hr.apartmanlink.com), including our page for hosts;
• hosts who request a free website, including hosts for whom we prepare a website after a conversation with them;
• hosts who use a paid plan ("customers");
• buyers of the e-book on hr.apartmanlink.com/ebook, even if they are not hosts;
• guests and other visitors of property websites (section 8);
• people whose data appeared in public business profiles we analysed (section 9);
• people who report illegal content to us;
• anyone who contacts us by e-mail or WhatsApp.

3. What data we process and why

We process data only for the purposes listed in the table and in sections 8–10, on the legal basis stated for each purpose under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

You enter your card details directly with Stripe. We do not store them; we only see, for example, the card brand and the last four digits. Stripe keeps your card so that the monthly plan can be charged every month and the annual and three-year plans can renew automatically, unless you switch renewal off or cancel the subscription.

On the e-book page, Stripe's script may be loaded once the page has finished loading, so that the Apple Pay or Google Pay button can be shown on devices that support it. Through it, Stripe collects data about your device and browser to prevent fraud (Stripe then processes this data as an independent controller) and sets its own necessary cookies (Cookie Policy). The legal basis is Art. 6(1)(f): our and Stripe's legitimate interest in secure payments and fraud prevention.

A published website is publicly available and search engines may index it. Whatever you publish on it, such as your name or phone number, is visible to all visitors. If you do not buy a plan after the free publication, the website is no longer public and only you can see it in the panel.

4. Where we get data from

• From you: the form, the panel and your messages.
• From our conversation with you: if you ask us in person or by phone to prepare a website for you, we enter your name and e-mail or phone number in our panel.
• From the listing at the link you sent us and, where needed, from other public sources about your property, such as your existing website. We collect these only at your request, when we build your website or when you ask us to refresh it.
• From public sources about places near the property, such as Wikipedia and Wikimedia Commons, with the author and licence credited. These are usually not personal data.
• From Stripe: payment confirmation and status and, for the e-book purchase, also the details you enter on the Stripe payment page or that Apple Pay or Google Pay passes to Stripe (full name, e-mail, phone number and billing address). From the EU VIES system: the result of checking your VAT number.
• From the calendars (iCal) you connect. A platform calendar may also contain a reservation link and the last four digits of the guest's phone number, but we store only the booked dates.
• From public business profiles on Google Maps and public listings, for market analysis (section 9).

5. Who we share data with

We do not sell personal data. We share it only with the recipients in the table, and only as far as they need it. We have data processing agreements with our processors (Art. 28 GDPR).

6. Transfers outside the EEA

Some providers (Railway, Cloudflare, Resend and Anthropic, our mailbox provider, and Stripe, WhatsApp, Meta and Google for part of the processing) process data in the USA or access it from there. Where the recipient is on the list of organisations in the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (Commission Implementing Decision (EU) 2023/1795).

In other cases, the transfer relies on standard contractual clauses (Commission Implementing Decision (EU) 2021/914). The mechanism for each provider is shown in the table in section 5, and you can request a copy of these safeguards at [email protected].

7. How long we keep data

When a period ends, we delete or permanently anonymise the data. Copies in backups are deleted in the next regular backup deletion cycle.

8. Guests on property websites

For the data of guests who visit a property website or send an enquiry, the host is the controller and we are the host's processor. The exceptions, where we are an independent controller for our own purposes, are listed at the end of this section.

• On the host's behalf, we process data from the enquiry form: name, e-mail, phone number, dates of stay, number of guests, chosen payment method and message. We show the enquiry in the host's panel and notify the host by e-mail (with the guest's details) and by SMS (without the guest's details).
• On the host's behalf, we send the guest e-mails about the enquiry: that it was received, the host's decision and, if the guest pays the full amount or a deposit by bank transfer, the host's bank details, the amount and the payment deadline, with reminders, and the confirmation of payment or a cancellation. Replies go to the host's e-mail address. We never send guests SMS messages.
• We display booked dates from the host's calendars (iCal). We publish confirmed bookings and the bookings the host accepted that are awaiting payment (only the dates and the enquiry number, without the guest's name or contact details) in a calendar file at a secret address, which the host can add to other platforms such as Airbnb.
• The WhatsApp button opens the WhatsApp app. WhatsApp then processes the message, and we cannot see it.
• Guests pay the host directly, by bank transfer or on arrival. Guests' payments do not go through ApartmanLink.
• Apart from the exceptions below, we do not use guest data for our own purposes, only in line with the host's instructions and a data processing agreement. We delete it without delay when the host deletes it; enquiries older than 12 months are deleted automatically unless the host sets a different period, and all other data 30 days after our contract with the host ends. Copies in backups are deleted in the next regular cycle.
• Exception: as an independent controller, we process technical data needed to secure our servers (IP address, time of request), based on legitimate interest (Art. 6(1)(f)), for up to 30 days, unless it is needed to investigate a specific incident.
• Exception: as an independent controller, we count visits to property websites (also on hosts' own domains) for our own statistics and service development, without cookies and without storing IP addresses, as described in section 3, based on legitimate interest (Art. 6(1)(f)).
• Exception: on property websites at an apartmanlink.com address (not on hosts' own domains), if the guest consents in the cookie notice, we use the Meta Pixel and the Meta Conversions API for our own ads (section 10), jointly with Meta as described there. We send Meta only the pages visited and the actions taken (e.g. sending the enquiry form or clicking WhatsApp, e-mail or phone), never the content of an enquiry or the guest's contact details. Hosts do not receive this data or access to our ad audiences. We do not use the Google Ads tag on property websites.

For questions about how a host uses your data, contact the host; the host's contact details are on the property website. If you contact us instead, we will forward your request to the host without delay. Our obligations towards the host are set out in the Data Processing Agreement, which forms part of the Terms of Service.

9. Data from public business listings (Art. 14 GDPR)

In October 2026 we analysed public business profiles of accommodation on Google Maps in Rovinj, Medulin and Novalja. We wanted to find out how many properties have their own website.

• Data: property name, phone number, website address, location and category from the profile, and labels we derived from them, e.g. whether the property has its own website and whether an agency runs it. For some properties, we compared this with public listings on Airbnb (name, location, price, rating). If a profile is run by an individual, this may be personal data.
• Source: public Google Maps profiles, obtained through the data provider DataForSEO, and public listings on Airbnb.
• Purpose and legal basis: market analysis and statistics, e.g. the share of properties without their own website. The basis is our legitimate interest in understanding the market in which we offer our service (Art. 6(1)(f)).
• Use: we do not use this data for unsolicited e-mails, text messages or WhatsApp messages, or for calls. We publish only aggregated results, never data about individual properties.
• Retention: we keep it until 31 December 2026 at the latest, then delete or permanently anonymise it.

We do not inform these people individually, because that would involve disproportionate effort and unsolicited contact, so we publish this notice instead (Art. 14(5)(b) GDPR). You can object or ask us to delete your data at any time at [email protected]; please give your phone number or property name so we can find the record.

10. Cookies

On apartmanlink.com (including subdomains such as hr.apartmanlink.com) and on property websites, we use cookies and similar technologies that the website needs to work, such as for logging in to the panel. These do not require your consent, and the list is in our Cookie Policy.

Marketing cookies (Meta Pixel) are set on ApartmanLink's own pages and on property websites at an apartmanlink.com address (not on hosts' own domains), and only if you consent to them in the cookie notice. Your choice applies to all pages at the same address (for example hr.apartmanlink.com). With the same consent, our server also sends the same events to Meta (Meta Conversions API), with the identifiers from these cookies, your IP address and browser data and, when you send our form requesting a free website, publish your website for the first time, click "Order with obligation to pay" or complete a payment, your hashed e-mail address, phone number and identifier in our system; this makes measuring our ads more reliable. Even without this consent, we pass the request, the trial publication of your website and the purchase on to Meta: from our server, without cookies and without cookie identifiers, based on legitimate interest (section 3). Your choice in the cookie notice determines whether the Meta Pixel and cookie identifiers are used. From property websites we send Meta only the pages visited and the actions taken, never the content of an enquiry or contact details (section 8). For collecting data through the Meta Pixel and the Conversions API and sending it to Meta, we and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR, Meta Business Tools Terms): we are responsible for informing you and, where processing is based on consent, also for obtaining it, and you can exercise your rights with us or with Meta. Meta then processes the data as an independent controller under its own privacy policy.

On ApartmanLink's pages for hosts (our page for hosts, demo setup and purchase), with the same consent, we also use the Google Ads tag. It loads only after you consent; without consent nothing is sent to Google. Google receives the identifiers from its cookies, the pages visited, your IP address and browser data, and the moment you send a request or complete a purchase (with its number and the amount excluding VAT), and processes them as an independent controller under its own privacy policy. We do not use the Google Ads tag on property websites.

On our pages for hosts, and only with your consent, we also use our own al_path cookie to check which of our ads, over several days, lead to a request and a purchase. This data stays with us (section 3).

You can change or withdraw your consent at any time under "Cookie settings" at the bottom of the page; withdrawing consent does not affect the lawfulness of processing before the withdrawal. We do not use analytics cookies: we count visits without cookies (section 3). Before introducing analytics cookies, we will update this policy.

11. Your rights

Regarding your data, you have the following rights:

• access to your data and a copy of it (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• portability of the data you gave us, where we process it based on a contract or consent (Art. 20);
• withdrawal of consent at any time, which does not affect the lawfulness of processing before withdrawal (Art. 7(3)).

Right to object (Art. 21). Where we process data based on legitimate interest, you can object at any time on grounds relating to your particular situation. We will then stop, unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. If you object to processing for direct marketing, we will no longer process your data for that purpose.

You can object at any time, by writing to [email protected], to the events in section 3 (request, trial publication, purchase, click on a payment option for the e-book) being passed on to Meta. From then on, we will not send any events with your data to Meta from our server. We do not know who clicks a payment option for the e-book, so you object to that click being passed on by turning on the Global Privacy Control (GPC) signal in your browser. When your browser sends it, we do not pass the click on without your consent. In the cookie notice, you decide whether the Meta Pixel is used in your browser.

You can also object, by writing to [email protected], to us storing visits from our ads with your request, trial publication and purchase (section 3, "Measuring our campaigns"). From then on, we will not store them, we will delete those already stored and we will not include you in the counts.

Deleting your account. You can ask us to delete your account with "Delete account" in your panel or by e-mail. We confirm the request by e-mail and complete it within one month. Invoices, accounting records and proof of consents remain for the periods in section 7, because the law requires them or we need them to defend legal claims.

Send your request to [email protected]. We reply free of charge within one month; in complex cases we may extend this by two further months and will tell you so. If we cannot confirm your identity, we will ask for additional information.

You have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where the alleged infringement took place:

• Agencija za zaštitu osobnih podataka (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, [email protected], www.azop.hr
• Prezes Urzędu Ochrony Danych Osobowych (President of the Polish Personal Data Protection Office, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, [email protected], www.uodo.gov.pl. It is our lead supervisory authority because our main establishment is in Poland.

12. Do you have to give us your data

We need your name, e-mail and listing link to prepare your website and send you the link. Without them we cannot fulfil your request. Your phone number is optional. For a paid plan we also need invoicing details, because tax law requires them. If you want guests to pay you by bank transfer, we need your bank details to send them to the guest. For the e-book purchase, Stripe asks for your e-mail (delivery), full name and billing address (tax law) and phone number (the voucher and contact about the purchase); without them the purchase is not possible.

13. Artificial intelligence and automated decisions

When building websites, we use artificial intelligence tools for texts, translations and photo selection. We send these tools property data, not your contact details. When you edit your website, we send the texts you write to the same tools, which check them (safety, facts and style) and translate them into the website's other languages. The check gives you advice on facts and style, and you decide whether to follow it. Texts it finds unsafe cannot be published until you change them, and contact details and links in texts are always blocked, because guests contact you through the website. Texts with contact details are blocked before they are sent to the check. Under its contract, the provider (Anthropic) processes the data only for us and may not use it to train its models.

A member of our team reviews the website before we send it, and you can edit it in the panel. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).

14. How we protect data

We use appropriate technical and organisational measures, including:

• encrypted connections (HTTPS);
• access to data only for people who need it for their work;
• passwords and login links stored only as a cryptographic hash;
• regular backups.

If a personal data breach occurs, we will report it to the supervisory authority and inform you where the GDPR requires.

15. Children

Our service is intended for adults who rent out accommodation. We do not knowingly collect children's data.

16. Changes to this policy

We update this policy when we change the service or when the law requires it. The current version and the date of the last change are always on this page, and we notify customers of significant changes by e-mail before they take effect.

This policy is available in Croatian and English; both versions have the same content.

Last updated: 11 November 2026.