WHAT IS THE PRIVACY POLICY?

We would like to familiarize you with the details of the processing of your personal data by us in order to give you full knowledge and comfort in using our website.

Due to the fact that we operate in the Internet industry ourselves, we know how important it is to protect your personal data. Therefore, we make special efforts to protect your privacy and the information you provide to us.  

We carefully select and apply appropriate technical measures, in particular those of a programming and organizational nature, ensuring the protection of personal data being processed. Our site uses encrypted data transmission (SSL), which ensures the protection of data identifying you.

In our Privacy Policy you will find all the most important information regarding the processing of your personal data by us. We ask you to read it and we promise that it won’t take you more than a few minutes.

Who is the administrator of the website www.thecinnamontours.pl?

The website administrator is Cinnamon Tours PVT Ltd, address: Mehiliya Residencies, Millawa, Kurunegala, Sri Lanka, with tax identification number 102908910 (i.e.: us).

PERSONAL DATA

What legal act regulates the processing of your personal data?

Your personal data is collected and processed by us in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27/04/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Journal of Laws UE L 119, p. 1), commonly referred to as: GDPR. To the extent not regulated by the GDPR, the processing of personal data is regulated by the Personal Data Protection Act of May 10, 2018 .

Who is the administrator of your personal data?

The administrator of your personal data is Cinnamon Tours PVT Ltd with headquarters in Kurunegala, Mehiliya Residencies, 60000, Kurunegala, Sri Lanka, with tax identification number 102908910,entered into the register under number PV 00208549, mobile: +34 624 968 783, e-mail: kontakt@thecinnamontours.pl.

You can contact us about your personal data by: 

  • e-mail: kontakt@thecinnamontours.pl,
  • traditional mail: Mehiliya Residencies, 60000, Kurunegala, Sri Lanka,
  • mobile: +34 624 968 783.

The personal data administrator has appointed a Representative to represent him in the scope of obligations arising from the GDPR.

The representative of the personal data controller is: 

In matters related to your personal data, you can contact the Personal Data Administrator’s Representative via:

  • e-mail: 
  • traditional mail: 
  • phone: 

HOW DO WE PROCESS YOUR PERSONAL DATA YOU PROVIDE TO US?

What personal data do we process and for what purposes do we process it?

On our website, we offer you many different services for which we process different personal data, based on different legal bases. 

Objective

Personal data

Legal basis for processing

Data storage time

conclusion and performance of the contract

name, surname, correspondence address, e-mail address, telephone number

article 6 ust. 1 lit. b) GDPR, i.e. processing in order to take action at your request, before concluding a contract and processing necessary for the performance of a contract to which you are a party

until the expiration of the limitation period for claims regarding the performance of the contract

ensuring continuity of communication and enabling contact with the Administrator in matters of business activity

name, surname, e-mail address, telephone number, correspondence address

Art. 6 ust. 1 lit. f) GDPR, i.e. processing in order to implement the Administrator’s legitimate interest, consisting in maintaining continuity of communication and enabling contact with the Administrator in matters of business activity

until you object to the processing of personal data

contact form

name, surname, e-mail address, telephone number

article 6 ust. 1 lit. f) GDPR i.e. processing in order to implement our legitimate interest, consisting in maintaining continuity of communication and enabling contact with us in matters of business activity

until you object to the processing of personal data

website traffic analysis

residence address, IP address

Art. 6 ust. 1 lit. f) GDPR, i.e. processing in order to implement our legitimate interest consisting in analyzing customer traffic on the website

until you object to the processing of personal data

direct marketing of own goods and services, including remarketing

residence address, IP address

Art. 6 ust. 1 lit. f) GDPR, i.e. processing in order to implement our legitimate interest in direct marketing of our own services, including remarketing 

until you object to the processing of personal data

determination, investigation and enforcement of claims and defense against claims in proceedings before courts and other state authorities 

name, surname, address of residence, PESEL number, NIP, REGON, e-mail address, telephone number, IP number, bank account number, payment card number

article 6 ust. 1 lit. f) GDPR i.e. processing in order to implement our legitimate interest, consisting in determining, pursuing and enforcing claims and defending against claims in proceedings before courts and other state authorities

until the expiration of the limitation period for claims regarding the performance of the contract

fulfillment of legal obligations resulting from legal provisions, in particular tax and accounting regulations

name, surname, company, PESEL number, NIP or REGON number, e-mail address, telephone number, correspondence address, payment card number

Art. 6 ust. 1 lit. c) GDPR i.e. processing is necessary to fulfill the legal obligations incumbent on us, resulting from legal provisions, in particular tax and accounting regulations

until the expiry of the legal obligations incumbent on the Administrator, which justified the processing of personal data

Voluntary provision of personal data

Providing the required personal data by you is voluntary, but it is a condition for us to provide services to you. 

Recipients of personal data

The current list of entities to which we disclose your personal data can be found here. 

Automated decision making (including profiling)

We do not make decisions about you in an automated manner and we do not use profiling.

Will we transfer your personal data outside the EEA or to an international organization?

In order to use Google tools, your personal data may be transferred to the United States, where Google LLC servers are located.

Google LLC is included in the list of entities participating in the “Privacy Shield”* certification program (link: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active), and also uses model contractual clauses on data security approved by the European Commission .

In order to use Facebook tools, your personal data may be transferred to the United States, where Meta Inc. servers are located.

Meta Inc. is included in the list of entities participating in the Privacy Shield program (link: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active), in terms of the Workplace service and advertising options and measurement tools. Meta Platforms Ireland Limited transfers data to Meta Inc. based on Facebook’s European Data Transfer Addendum, which incorporates standard new contractual clauses that entered into force in 2022. More information can be found here: https://www.facebook.com/legal/terms/dataprocessing/update, https://www.facebook.com/legal/EU_data_transfer_addendum/update. 

*Remember that the Privacy Shield is no longer a law in force in the European Union, but a program that sets certain standards of personal data protection for entities with their servers in the United States. Currently, it is a form of certification, entities entered into the Privacy Shield meet certain standards of personal data protection.

WHAT RIGHTS DO YOU HAVE IN RELATION TO US PROCESSING YOUR PERSONAL DATA?

Based on the GDPR, you have the right to: 

  • request access to your personal data,
  • request rectification of your personal data,
  • request deletion of your personal data,
  • requests to limit the processing of personal data,
  • object to the processing of personal data,
  • requests to transfer personal data.

If you submit any of the above-mentioned requests to us, without undue delay – and in any case within one month of receiving the request – we will provide you with information about the actions taken in connection with your request. 

If necessary, we may extend the monthly period by another two months due to the complexity of the request or the number of requests.

In any case, we will inform you within one month of receiving the request to extend the deadline and provide you with the reasons for the delay.

Right of access to personal data (Article 15 of the GDPR)

You have the right to obtain information whether we process your personal data. If we process your personal data, you have the right to: 

  • access to personal data,
  • obtaining information about the purposes of processing, categories of personal data being processed, recipients or categories of recipients of this data, the planned period of storing your data or the criteria for determining this period, about your rights under the GDPR and the right to lodge a complaint to the President of the Office for Personal Data Protection, about the source of this data, about automated decision-making, including profiling, and about the safeguards applied in connection with the transfer of this data outside the European Union;
  • obtain a copy of your personal data.

If you want to request access to your personal data, submit your request to the following address: kontakt@thecinnamontours.pl.

Right to rectification of personal data (Article 16 of the GDPR)

If your personal data is incorrect, you have the right to request us to correct your personal data immediately. You also have the right to request us to supplement your personal data. If you want to request rectification or supplementation of your personal data, submit your request to the following address: kontakt@thecinnamontours.pl.

The right to delete personal data, the so-called “right to be forgotten” (Article 17 of the GDPR)

You have the right to request the deletion of your personal data when: 

  • your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • you have withdrawn a specific consent to the extent that personal data was processed based on your consent;
  • your personal data has been processed unlawfully;
  • you have objected to the processing of your personal data for the purposes of direct marketing, including profiling, to the extent that the processing of personal data is related to direct marketing;
  • you have objected to the processing of your personal data in connection with the processing necessary to perform a task carried out in the public interest or processing necessary for purposes arising from legitimate interests pursued by us or a third party.

Despite submitting a request to delete personal data, we can process your data further in order to establish, pursue or defend claims, about which you will be informed.

If you want to request the deletion of your personal data, submit your request to the following address:  kontakt@thecinnamontours.pl.

The right to submit a request to limit the processing of personal data (Article 18 of the GDPR)

You have the right to request the restriction of the processing of your personal data when: 

  • you question the correctness of your personal data – in this case, we will limit the processing of your personal data for a period of time that allows you to check the correctness of this data;
  • the processing of your data is unlawful, and instead of deleting your personal data, you request the restriction of the processing of your personal data;
  • your personal data are no longer needed for the purposes of processing, but they are needed to establish, pursue or defend your claims;
  • you have objected to the processing of your personal data – until it is determined whether our legitimate interests override the grounds indicated in your objection.

If you want to request the restriction of the processing of your personal data, submit your request to the following address: kontakt@thecinnamontours.pl.

Right to object to the processing of personal data (Article 21 of the GDPR)

You have the right to object at any time to the processing of your personal data, including profiling, in connection with: 

  • processing necessary to perform a task carried out in the public interest or processing necessary for purposes arising from legitimate interests pursued by the Personal Data Administrator or a third party;
  • processing for direct marketing purposes.

If you want to object to the processing of your personal data, please submit your request to the following address: kontakt@thecinnamontours.pl.

The right to request the transfer of personal data (Article 20 of the GDPR)

You have the right to receive your personal data from us in a structured, commonly used and machine-readable format and to send it to another personal data controller.
By default, we will provide you with your personal data in CSV format. If you prefer the data to be made available to you in a different format, indicate your preferred format in your request. Where possible, we will try to make the data available to you in the format you prefer.

You can also request that we send your personal data directly to another administrator (if technically possible).

If you want to request the transfer of your personal data, please submit your request to the following address: kontakt@thecinnamontours.pl.

Can you withdraw your consent to the processing of personal data?

You can withdraw your consent to the processing of your personal data at any time. Withdrawal of consent to the processing of personal data does not affect the lawfulness of the processing carried out by us on the basis of your consent before its withdrawal.

If you want to withdraw your consent to the processing of your personal data, submit your request to the following address: kontakt@thecinnamontours.pl.

If you want to withdraw your consent to the processing of personal data for the purpose of providing the “Newsletter” service, you can unsubscribe here [link do strony unsuscribe]. 

Complaint to the supervisory authority 

If you believe that the processing of your personal data violates the provisions on the protection of personal data, you have the right to lodge a complaint with the supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged violation.

In Poland, the supervisory authority within the meaning of the GDPR is the President of the Office for Personal Data Protection, which replaced GIODO on May 25, 2018.

You will find more information here.

Cookies

General information

When browsing the websites of the Website, “cookies” are used, hereinafter referred to as Cookies, i.e. small text information that is saved on your end device in connection with the use of the Website. Their use is aimed at the correct operation of the websites of the Website.

These files allow you to identify the software you use and adapt the Website individually to your needs.

Cookie files usually contain the name of the domain they come from, their storage time on the device and the assigned value.

Security 

The cookies we use are safe for your devices. In particular, it is not possible to get viruses or other unwanted software or malware to your devices through Cookies.

Types of Cookies

We use two types of cookies: 

  • Session cookies: they are stored on your device and remain there until the end of the browser session. The saved information is then permanently deleted from your device’s memory. The session cookies mechanism does not allow you to download any personal data or any confidential information from your device.
  • Persistent cookies: they are stored on your device and remain there until you delete them. Ending the session of a given browser or turning off the device does not delete them from your device. The mechanism of persistent cookies does not allow you to download any personal data or any confidential information from your device.

Obstacles

We also use third-party cookies for the following purposes: 

  • configuration of the Website;
  • popularizing the Website using YouTube.com, the administrator of which is Google Ireland Ltd. based in Ireland, the Privacy Policy is available at the following link: https://policies.google.com/privacy?hl=pl&gl=pl;
  • creating statistics that help to understand how website users use websites, which allows improving their structure and content through Google Analytics analytical tools, whose administrator is Google Ireland Ltd. based in Ireland, Google’s Privacy Policy is available at the following link: https://policies.google.com/privacy?fg=1;
  • defining the Customer’s profile in order to display tailored materials in advertising networks, using the Google Ads online advertising tool, whose administrator is Google Ireland Ltd. based in Ireland, Google’s Privacy Policy is available at the following link: https://policies.google.com/privacy?fg=1;
  • collecting information about the User’s behavior using the Facebook Pixel tool, whose administrator is Meta Platforms Ireland Limited, based in Ireland, the Facebook Privacy Policy is available at the following link: https://www.facebook.com/help/cookies/.

To learn about the rules of using Cookies, we recommend that you read the privacy policies of the above-mentioned companies.

Cookies may be used by advertising networks, in particular the Google network, to display advertisements tailored to your preferences. Cookies may be used by advertising networks, in particular the Google network, to display advertisements tailored to your preferences.

To view and edit information about your preferences collected by the Google advertising network, you can use the tool available at the link https://www.google.com/ads/preferences/.

Using the web browser settings or using the service configuration, you can independently and at any time change the settings for Cookies, specifying the conditions for their storage and access by Cookies to your device. You can change these settings so as to block the automatic handling of Cookies in the web browser settings or to inform about them each time they are placed on your device. Detailed information about the possibilities and ways of handling Cookies are available in the settings of your software (web browser).