1. Scope and publisher identity
This policy describes the supplied static implementation of curiosityzestory.christmas. Curiosityzestory is an independent editorial guide, not Sofitel Grand Sopot, Accor or a casino operator. The publisher entity, company number and registered address displayed in the footer are expressly illustrative. They are not a verified legal registration. The actual operator must replace those particulars and confirm its hosting and email arrangements before collecting personal information in a live business context.
2. Information collected while browsing
The site code does not create visitor accounts, request payment information, deploy analytics, embed remote maps or load advertising pixels. Pages, illustrations, scripts and styles are served as static files. Homepage photographs are loaded separately from Unsplash’s image delivery service, as described in section 5. Your hosting provider may nevertheless process standard connection information, such as an IP address, requested URL, browser details and request time, to deliver and protect the website. This build does not identify a deployed host or assert a particular server-log retention period.
The contact form validates entries in your browser and prepares an email link. It does not submit information to a website database or remote form service. Nothing is sent until you choose to open your email application and send the draft. At that point your email provider and the receiving mail service process the message under their respective arrangements.
3. Browser storage and choices
We use one localStorage record to remember cookie preferences, including the selection time and the optional categories you choose. It is not an HTTP cookie, but is covered here because it stores information on your device. The site treats the record as expired after 180 days. Rejecting non-essential storage leaves all editorial content accessible. No analytics or optional functional tools are installed, even if you select those categories. Ordinary requests for homepage photographs are not controlled by these settings and may occur before a choice is made. See the cookie policy for the storage inventory and removal instructions.
4. Purposes and lawful bases
Remembering a privacy preference supports the essential operation of the consent interface. Where GDPR applies, a live operator should document the relevant legitimate interest and any applicable device-storage exemption. Responding to an email may rely on legitimate interests in handling correspondence or on steps requested before a contract, as appropriate. Externally hosted photographs provide visual context; the actual operator must assess and document an appropriate lawful basis for the associated data processing and any international transfers. Any future optional tracking would require a separate, accurate notice and a valid legal basis before activation; a preference saved in this build does not authorise undisclosed new processing.
5. Third parties and international transfers
No third-party analytics or form processor is integrated into these files. Links to Accor, visitor information, mapping and support websites take you to independent services when clicked. Those services control their own data practices. Booking information is provided to the booking service, not to this guide.
The homepage uses photographs delivered from images.unsplash.com. Loading these images sends your IP address and ordinary request metadata to that provider without requiring you to click an external link. The images use referrerpolicy="no-referrer" to instruct your browser not to send the referring page address. This does not prevent the provider from receiving your IP address or recording delivery requests. Lazy loading may defer a request until an image approaches the visible part of the page, but it is not a consent mechanism. Read Unsplash’s privacy policy, opens a new tab for its practices.
A deployed host, image delivery service or email provider may use infrastructure outside your country; the real operator must identify its processors and any necessary transfer safeguards rather than relying on this policy as proof of an arrangement.
6. Retention and security
The preference record expires logically after 180 days and is removed or replaced when the site next checks it; browser-cleared storage disappears earlier. Form entries are not saved by the site, although your browser or email application may retain drafts. Browsers may cache downloaded photographs; the image provider’s server-log retention has not been independently verified. No verified mailbox-retention schedule is represented here. A live operator should keep correspondence only as long as necessary for the enquiry and applicable obligations, protect access and review deletion regularly. Please do not email identification documents, health records or payment-card data.
7. GDPR, CCPA and privacy contact
Depending on your location and the law’s applicability, you may request access, correction, erasure, portability or restriction, object to relevant processing and withdraw consent without affecting earlier lawful activity. Eligible California residents may have rights to know, delete and correct personal information, and to opt out of sale or sharing without discrimination. This implementation does not sell or share personal information for cross-context behavioural advertising and does not deploy targeted advertising.
The designated privacy and DPO enquiry route is [email protected]. This address is generated for the domain; mailbox operation and a statutory DPO appointment are not verified. Do not send sensitive evidence until an actual operator is confirmed. You may also complain to your competent supervisory authority, including Poland’s Personal Data Protection Office, opens a new tab. Material changes to deployed processing should be reflected in an updated policy.