Privacy notice
Updated: 1 November 2026
1. Controller and contact
The controller responsible for personal data processed in connection with this website is:
For privacy enquiries and to exercise your rights, contact us at the email address below. Please do not submit health information or payment details.
MFU TOURISTIK SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. 1 Maja 39, 71-627 Szczecin, Polska
marcin.kosmala@mfu-reisen.de
2. Purpose and scope of this website
This website supports business cooperation with hotels, tour operators and distribution partners. Offer and contact pages are restricted to approved users. The legal notice, privacy notice and sign-in page remain accessible without signing in. No consumer bookings or payments are processed here.
3. Technical operation and security
When you visit, we process connection data required to serve the website, including your IP address and information about the requested connection. This supports delivery, session security and prevention of abuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in secure, reliable operation.
Routine application access logs record the method, response status, data volume and duration, but not full request URLs or IP addresses. Security and error logs may contain additional technically necessary information in individual cases. Logs rotate when size limits are reached. Where a security incident occurs, relevant evidence may be retained separately until it is resolved.
To limit automated sign-in and form attempts, we temporarily store a counter and a keyed value derived from your IP address. The control table does not store the raw IP address. These values technically expire within two hours and are removed by regular clean-up runs.
4. Sign-in and necessary cookies
For access control, we process usernames, password verification values rather than plaintext passwords, account approval and permissions. Website access does not grant permission to the internal backoffice. The legal bases are Article 6(1)(b) GDPR for access agreed with you and Article 6(1)(f) GDPR for access security and management of business contacts.
We use only technically necessary cookies: sessionid for the signed-in session (browser session, server-side validity up to eight hours), csrftoken to protect against unwanted form actions (up to one year), and mfu_language to remember your explicitly selected language (one year). These cookies do not contain advertising profiles. Blocking them may prevent sign-in and forms from working.
5. Hotel and partner enquiries
Forms collect company/hotel, region, contact person, email address, optional telephone number, offer details and message. We also record receipt and the version of the privacy notice acknowledged. Required fields allow us to identify and answer the enquiry. Providing a telephone number is optional. The form cannot be submitted without the required details.
Details are stored in the protected enquiry area and reviewed by authorised staff. Submitting the form does not send an automatic email. Article 6(1)(b) GDPR applies to pre-contractual steps you request where you are personally the prospective contracting party. For company employees and contact persons, we rely on Article 6(1)(f) GDPR and our legitimate interest in handling business enquiries. Acknowledging this notice is not consent to advertising.
6. Email and further business communication
When you email us or we answer an enquiry, we process sender/recipient details, communication content and necessary metadata. The legal bases in section 5 apply accordingly. Information is shared with hotels or distribution partners only where necessary for the cooperation you request. We do not sell contact details or automatically subscribe form users to newsletters.
7. Service providers and recipients
The website and database are hosted on a server in Nuremberg by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Domain and email services are provided by cyber_Folks S.A., ul. Wierzbięcice 1B, 61-569 Poznań, Poland. Technical providers may process data within the services assigned to them.
Access is restricted to authorised staff and appointed technical support where needed for operation, maintenance or restoration. Separate protected recovery copies may be held by technical support. Other recipients may include authorities or professionally confidential advisers where required by law or necessary to establish or defend legal claims.
8. Retention and backups
We retain enquiries and correspondence while needed to handle them and any resulting cooperation. Personal details are then deleted unless statutory obligations, unresolved claims or legitimate documentation needs require further retention. Contract and accounting records are subject to the applicable statutory retention periods. Access accounts are disabled and deleted when entitlement ends, unless further retention is necessary.
Regular daily database backups are removed after 35 days once a new backup has been created successfully. Hetzner also maintains seven rotating daily server backups. Separate pre-change backups and recovery copies held by technical support are deleted when their recovery or evidence purpose ends; the 35-day period does not automatically apply to them. Backups are access-protected and used for recovery. Deletions made in the meantime are taken into account when restoring data.
9. Analytics, external content and international transfers
This website does not use audience analytics, advertising trackers, remotely loaded fonts or embedded map services. Images and design assets are served by our own web server. External source links are opened only when clicked, at which point the relevant provider’s privacy policy applies.
No routine transfers of personal data outside the European Economic Area are envisaged for the website operation described here. We do not make automated decisions with legal or similarly significant effects or conduct related profiling.
10. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure and restriction of processing. You also have a right to data portability where the statutory conditions apply. Where processing is based on consent, you may withdraw it at any time for the future without affecting the lawfulness of earlier processing.
Right to object: you may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. To exercise your rights, contact the email address above. Where necessary, we may request proportionate information to verify your identity.
11. Complaints and supervisory authority
You may lodge a complaint with a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. For the controller established in Poland, the authority is the Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland.