1. We will collect personal data directly from you (through the account, during the transaction process etc.). The data may be gathered from other sources only for the purposes of operating the service. This refers to the information gathered from the entities that operate the service that you ordered (airlines, hotels etc.). The scope of the data covers only the information that is necessary to confirm the order payment.
2. Providing personal data is always voluntary, however it is necessary to fulfil the above purposes.
3. Personal data processed for the purposes of operating the service according to the Terms and Conditions are shared with the entities that provide a service selected by the User, including their subcontractors, e.g. airlines, hotels, payment intermediaries, GDS (Global Distribution System) etc. Regardless of the purpose of data processing, the only persons that can access your personal data will be the authorised employees and the Data Administrator's subcontractors who signed the appropriate data transfer agreements with the Data Administrator (please contact the Personal Data Protection Inspector for more details).
4. informing the Data Administrator and the employees who process personal data, about their responsibilities arising from this Regulation and other EU or Member Countries' laws on the protection of personal data and advise them on this issue;
5. monitoring adherence to the GDPR, other EU or Member Countries' laws on the protection of personal data and the policies of the Data Administrator or a processing entity in the field of personal data, including distribution of responsibilities, actions that raise awareness, training the employees that take part in the operations related to data processing or audits connected to that;
6. offering recommendations on evaluating the effects on data protection upon request and monitoring the protection;
7. cooperating with a supervising authority;