Privacy and Cookie Policy

Last updated: 8 August 2026

1. Who we are — controller and business status

The controller of your personal data is the natural person operating the Morze Rejsów Website:

2. Purposes and legal bases for processing

Providing personal data is voluntary, but necessary data are required to use the contact form and receive a cruise proposal.

3. Data collected and minimisation

We apply the principle of data minimisation under Article 5(1)(c) GDPR and process only information necessary for the relevant purpose. We do not intentionally collect excessive data.

Data provided voluntarily through the Website form

Name, email address, telephone number (optional), message content and cruise preferences. With an enquiry we may store technical information about its source: the subpage of our Website where the form was sent, UTM campaign parameters present in the address and — if the browser provides a referrer — only the origin of the referring page (protocol and domain, without path or query parameters). This is used to handle the enquiry and for basic evaluation of acquisition sources. The data are stored in the application’s SQLite database on the production server and are available only after authentication to the protected CRM panel.

The persistent CRM record does not store the IP address, a pseudonym/hash of the IP address, User-Agent or a full copy of the raw form request. Information needed temporarily for abuse rate-limiting and spam assessment may be used while processing the request, but is not attached to the customer record.

Data collected automatically

Technical server logs may include the IP address, date and time of the request, requested URL, HTTP response code, browser information (User-Agent) and referring page. These logs are used for security, diagnostics and abuse prevention and have a separate retention period described in section 6. Data from analytics and marketing tools are processed only after the relevant consent; the exact scope depends on the provider configuration actually enabled.

4. Recipients and GDPR roles

Your data may be made available only to the extent necessary for the relevant processing purpose:

* To the extent that the Meta Business Tools terms provide for joint controllership of event data collected through Meta Pixel, responsibilities between the Controller and Meta Platforms Ireland Ltd. are allocated under Article 26 GDPR and the Meta Controller Addendum. Data-subject rights remain rights under the GDPR; information on how Meta handles them is available in Meta documentation.

Telegram — operational notifications. A Telegram bot may send the Controller only a general notification that a new enquiry has appeared in the protected CRM. The message does not contain the customer’s name, email, telephone number, enquiry text, trip parameters or the enquiry number/identifier. Customer data remain in the CRM.

The Controller does not sell personal data to third parties.

5. Transfers to third countries (USA)

Use of Google, Meta or Cloudflare may involve transfers of, or access to, data from outside the European Economic Area, in particular from the United States. The transfer mechanism depends on the relevant provider and its current status: it may be an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is covered by it, or Standard Contractual Clauses (SCCs) together with any required supplementary safeguards. Current transfer information is provided in the privacy documentation of the relevant provider.

6. Data retention periods

We apply the storage-limitation principle. The periods below are our retention policy and are technically enforced where we control the relevant system. If legislation requires longer storage or data are needed to establish, pursue or defend claims, the necessary scope may be retained for the period arising from that legal basis.

7. Your rights

Under the GDPR you have:

• right of access (Article 15);
• right to rectification (Article 16);
• right to erasure (Article 17), where there is no basis for further processing;
• right to restriction of processing (Article 18);
• right to data portability (Article 20), where applicable;
• right to object (Article 21) to processing based on legitimate interests, including related profiling;
• right to withdraw consent at any time (Article 7(3)) without affecting processing carried out before withdrawal;
• right not to be subject to solely automated decisions in the situations covered by Article 22.

To exercise these rights, contact {{PRIVACY_CONTROLLER_EMAIL}}. We respond within the periods set by Article 12 GDPR, generally within one month.

You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

8. Profiling and automated decisions

If you consent to marketing cookies, your data may be used for advertising profiling.

What does this mean?

Based on your activity on the Website — in particular pages visited, such as particular ports and cruise routes, and offers clicked — tools such as Meta Pixel and Google Ads may be used to tailor advertising shown on Facebook, Instagram and across the Google advertising network.

Legal basis

The basis for this profiling is your consent under Article 6(1)(a) GDPR, expressed by accepting marketing cookies.

Does this affect your rights?

No. Profiling on our Website does not constitute automated decision-making producing legal effects or similarly significantly affecting you within Article 22(1) GDPR. It is used only to improve advertising relevance. The data are not used by us for other solely automated decisions.

You may withdraw consent to marketing cookies at any time (see section 9), which will stop Website-side profiling to the corresponding extent.

9. Cookies and similar technologies

Legal basis

In Poland, storing information on a user’s device or accessing information already stored is governed primarily by Articles 399–400 of the Act of 12 July 2024 — Electronic Communications Law (Prawo komunikacji elektronicznej), and at EU level by Article 5(3) of Directive 2002/58/EC (ePrivacy). Technologies involving personal-data processing are also subject to the GDPR, including its requirements for valid consent and withdrawal.

Consent mechanism — Basic Consent Mode v2

The Website uses its own consent-management panel and Basic Consent Mode v2. On the first visit you may accept all categories, reject all optional categories or choose categories separately. Analytics and marketing are disabled by default. Before your decision, external Google Analytics, Google Ads / Google Tag Manager and Meta Pixel tags are not downloaded and do not send data to those services.

Rejecting optional technologies does not restrict access to the Website. Your choice is remembered for no more than {{COOKIE_CONSENT_MAX_AGE_DAYS}} days, or less if we change the consent-mechanism version earlier. You can change or withdraw consent at any time through the “Cookie settings” button in the footer.

Categories

The exact list of external cookies may change with provider configuration. The current mechanism and consent rules are described in the Cookie Policy.

Consent log

For accountability, the server stores only: a random consent ID, notice version, a cryptographic hash of the immutable notice snapshot, selected categories, method of choice, language and time. The log does not store the IP address, visited page URL, User-Agent, name, email address or CRM enquiry identifier. A snapshot of each notice version is kept separately as a technical document without user data so we can determine the content to which a visitor responded.

10. Analytics and marketing tools

Google Tag Manager and Google Analytics 4

If a Google Tag Manager or Google Analytics 4 identifier is configured in production, the relevant tools are loaded only after the appropriate consent. Where GTM is used, the container receives the Consent Mode v2 state and its tags should have proper consent requirements. If GTM is used for GA4, we do not simultaneously run a second direct GA4 installation, to avoid duplicate measurement.

Google services are provided by Google Ireland Limited and/or the relevant Google group companies. The data scope depends on the specific tag configuration and may include information about pages visited, device, traffic source, events and online identifiers. We do not describe these data as “anonymous” merely because Google limits or processes IP addresses in a particular manner. More information: Google Privacy Policy.

Meta Pixel

If a Meta Pixel ID is configured in production, the script is loaded only after marketing consent. It may be used for conversion measurement, audience building and remarketing on Facebook and Instagram. After withdrawal, the Website revokes the relevant consent state, removes recognised first-party cookies for that category to the extent technically possible and reloads the page; cookies or data in Meta domains/systems remain governed by Meta mechanisms and browser settings. Provider: Meta Platforms Ireland Ltd. More information: Meta Privacy Policy.

11. Partner (affiliate) links

Partner/affiliate links are marked on the Website with [Advertisement] and may affect the order or manner in which offers are presented.

Partners may include, among others, MSC Cruises, Costa Cruises, Royal Caribbean, Norwegian Cruise Line, Princess Cruises, Virgin Voyages, Celebrity Cruises, Dreamlines and GetYourGuide.

Clicking a partner link may result in a cookie being set by the partner site for affiliate attribution. The Controller does not control cookies or privacy policies of external sites; please review their documents before providing personal data.

12. Liability and complaints

Contracts with cruise lines

The Controller is not a party to the travel contract and is not responsible for performance of the contract by the cruise organiser. The Website does not enable bookings or payments — a cruise is booked and paid for directly with the cruise line or organiser, for example MSC Cruises or Costa Cruises. Complaints about the cruise, booking changes, delays or refunds should be addressed to the entity with whom you contracted, in accordance with its terms and applicable law.

Complaints about the Website

Complaints concerning morzerejsow.com, Website content or personal-data processing may be sent to the Controller at the address in section 15. We respond within 14 business days.

13. Data security

We use appropriate technical and organisational measures, including:

• SSL/TLS transmission encryption (TLS 1.2+);
• Cloudflare CDN, DDoS protection and WAF;
• a containerised Node.js application and SQLite database on an EU production server;
• access to data only for authorised persons and only to the necessary extent;
• regular application-image updates, daily backups of persistent data with a maximum 14-day retention and backup integrity checks;
• dedicated Nginx logs with daily rotation and a maximum 90-day retention.

14. Changes to this Privacy Policy

The Controller may update this Policy to reflect changes in law or data-processing practices. The last-updated date appears at the top of the page. Material changes will be announced in a visible place on the Website.

15. Contact

For personal-data protection matters:

We respond to GDPR-rights requests without undue delay, generally within one month of receipt. In the circumstances provided for by Article 12(3) GDPR, that period may be extended; the data subject will be informed of the extension and reasons.