Legal information
Cookie policy
What the hotelspot website stores in your browser, why it does so and how you can change your choice at any time.
What cookies are
Cookies are small text files that a website stores in your browser. Browser storage works in a similar way: localStorage (data stays until deleted) and sessionStorage (data is removed when you close the tab). The website stores short pieces of information there, which stay on your device and are not sent to the server with every request. This policy describes all of these mechanisms.
Who is responsible for cookies
The website is operated by Spotstay Sp. z o.o. with its registered office in Kraków, ul. Cystersów 13/6, 31-553 Kraków, Poland, KRS: 0001096818, NIP: 6762665735, REGON: 528200240. For questions about cookies and privacy, write to kontakt@hotelspot.pl.
How we ask for consent
We manage consent ourselves, without an external consent tool. On your first visit we show a window where you can accept all cookies, reject them or choose categories (preferences, statistics, marketing). Until you consent to a category, we do not load its tools (Google Analytics and Microsoft Clarity, or the Meta pixel), we do not store entries of that category in your browser, and Google Consent Mode (v2) has all consents set to denied.
You can change your choice at any time: the “Manage cookies” link in the footer reopens the window. Withdrawing consent deletes the stored entries of that category. Consent is valid for 12 months or until we change tools or categories; then we ask again. We delete browser storage entries and cookies set on the hotelspot.pl domain immediately when you withdraw consent. Cookies set on providers' domains (e.g. clarity.ms, bing.com, facebook.com) are not accessible to us: they expire according to their validity, and until then you can delete them in your browser settings.
Essential (no consent needed)
This data is needed for the website or the feature you are using to work. Apart from the cookie that stores your consent choice, we keep it in browser storage, and it is not used for tracking. This also includes interface state for the duration of your visit (closed windows and bars, hints already shown, marks on watched demo videos): we keep it in sessionStorage, it disappears when you close the tab, and it serves only to remember your choice in the interface (user-interface customisation which, under Article 29 Working Party Opinion 04/2012, does not require consent).
We also count page views with Vercel Web Analytics. It stores no cookies or identifiers in the browser and cannot identify a person, so it runs without consent.
Preferences (after consent)
We permanently remember in your browser storage the language version you chose and the fact that you sent the contact form (so the demo form is not shown to you again). We store them only after you consent to preferences; without consent we keep this information in the page memory only, until the end of your visit.
Analytics (after consent)
With your consent to analytics cookies we use Google Analytics 4 (Google Ireland Limited) to learn which content is useful, and Microsoft Clarity (Microsoft Ireland Operations Limited), which creates click maps and anonymous session recordings. Clarity masks text typed into form fields.
Marketing (after consent)
We use the Meta Pixel to measure the performance of ads on Facebook and Instagram. The provider is Meta Platforms Ireland Limited.
When you submit a form and have accepted all cookies, we also send the same event to Meta from our server (Conversions API). It includes the identifiers from the _fbp and _fbc cookies, your IP address, browser details and SHA-256 hashes of your e-mail address, phone number, first name and last name. Without consent we send nothing, neither from the browser nor from the server.
Third-party services
- Google property search (audit forms): the phrase you type is sent to the Google Places API through our server, so Google does not receive your IP address or set cookies for it.
- Stripe payments: online payment takes place on the Stripe page, which sets its own cookies needed for payment security, as described in Stripe's policy.
- Google Calendar: the booking window is loaded only after you click the button. From then on Google may set its own cookies as described in its privacy policy.
- Google Fonts: the Inter font is loaded from Google servers. Google does not set cookies for this, but it receives your IP address.
- Vercel: website hosting. The server keeps standard technical logs (IP address, time, page address) without cookies.
Current list of cookies
The list below comes from our register of cookies and browser storage entries, which we update with every change of tools on the site. Each entry has a category, provider, purpose and retention period.
Consent register, contact and GPC signal
The controller of your consents is HotelSpot (Spotstay Sp. z o.o.). To be able to demonstrate that consent was given (Art. 7(1) GDPR), we keep in a register: a random consent ID (the one you see in the consent window), the chosen categories, the window version, date and time, how consent was given, the page address without parameters, the browser type and a truncated, hashed IP address (the address cannot be reconstructed from it). We keep entries for 3 years from the moment consent was given.
For privacy matters and withdrawal of consent write to kontakt@hotelspot.pl. You can also withdraw consent yourself in the window opened by the “Manage cookies” link. Withdrawal does not affect the lawfulness of processing before it.
We respect the Global Privacy Control (GPC) signal from your browser: with GPC enabled we do not apply implied consent to marketing. Your explicit choice in the consent window always takes precedence.
How to manage cookies
Apart from the banner, you can delete and block cookies and site data in your browser settings. If you clear the site data, you will see the banner again on your next visit.
- Google Chrome: Settings, Privacy and security, Cookies and site data.
- Mozilla Firefox: Settings, Privacy & Security, Cookies and Site Data.
- Safari: Settings, Privacy, Manage Website Data.
- Microsoft Edge: Settings, Cookies and site permissions.
Changes to this policy
We update this policy whenever we change the tools used on the site. The current version is always available at this address.
Last updated: 30 September 2026