Privacy and cookies
This explains how we process data when you use Anything.camp. Analytics is optional. You can browse and send an enquiry without agreeing to analytics.
Version 2026-10-30.1
Controller and contact
The data controller is U x Machina Sp. z o. o., Hoża 86/410, 00-682 Warsaw, Poland. KRS: 0001164449, REGON: 541310138, VAT number: PL7011253145. For privacy matters, email kontakt@anything.camp or write to our postal address.
Enquiries and bookings
We process your name, email address, optional phone number, message, travel dates, selected packages and quote to respond, check availability and take steps at your request before entering into a contract, and then perform that contract (GDPR Article 6(1)(b)). Required fields are needed to handle your enquiry. Without them we cannot respond or check the dates. We do not use enquiries for marketing. Please do not include sensitive information or details we do not need for your trip.
Website operation and security
Our hosting provider processes connection data, including IP address, time, requested resource and browser information, to deliver the website and prevent abuse. Server error diagnostics help us fix faults. Our legal basis is our legitimate interest in operating and securing the service (GDPR Article 6(1)(f)). We do not use session recording or advertising profiling. Fonts and consent software are served by our website; images are served from Google Cloud Storage.
Optional Google Analytics 4
Only after you agree do we start Google Analytics 4 to understand visit numbers and the pages people view. Google receives cookie identifiers and page, session, browser and connection information. A network request exposes your IP address to Google; GA4 states that it does not store individual IP addresses. Analytics is not anonymous. The legal basis is your consent (GDPR Article 6(1)(a) and Article 399 of the Polish Electronic Communications Law). We strip query strings and fragments from page URLs before sending page views. We do not send form contents, names, email addresses, phone numbers or selected travel dates. Google Signals, user-provided data collection, advertising personalisation and automatic form tracking are disabled. Before consent and following rejection we send no analytics signals to Google, including cookieless signals.
Cookies and changing your choice
The necessary ac_consent cookie remembers your choice, its date, a random identifier and the notice version for up to 182 days; it is not used to measure visits. After consent, GA4 may set _ga and _ga_G5JW1FCPLQ to distinguish browsers and sessions for up to 182 days, without renewing their expiry on subsequent visits. These are first-party cookies on anything.camp. Signed-in administrators use separate necessary authentication cookies; these are not needed to browse the public website. You can always select “Cookie settings” or “Withdraw analytics consent” in the footer. Withdrawal stops further measurement and deletes analytics cookies in this browser; it does not affect the lawfulness of earlier processing or automatically erase data already sent. You can contact us to request erasure. We remember rejection for as long as acceptance. After expiry or a material change in purposes, we ask again.
Recipients and international transfers
We use Google Cloud (hosting and files), MongoDB Atlas (database), Resend / Plus Five Five, Inc. (enquiry-related emails), Sentry / Functional Software, Inc. (server diagnostics), and, with consent, Google Analytics. Authorised staff and providers have access to the extent needed to handle enquiries and deliver services. Providers and subprocessors may process data outside the EEA, including in the United States. Their published processing terms provide transfer mechanisms, including European Commission Standard Contractual Clauses; an adequacy decision may apply to qualifying recipients. Contact kontakt@anything.camp for information about safeguards and how to obtain a copy. We do not sell personal data.
Retention
We review unconverted enquiries monthly and delete them after 12 months unless a documented ongoing matter justifies longer retention. Contract-related data is kept for the contract and afterwards only to the extent and for the time required by accounting/tax rules or needed to establish, exercise or defend legal claims; the period depends on the document and applicable statutory limits. Legal obligations rely on GDPR Article 6(1)(c), and protecting claims on Article 6(1)(f). GA4 individual user and event data is retained for 2 months without resetting on new activity; aggregated reports may last longer. Minimal cookie-choice evidence is kept for 12 months: identifier, choice, language, dates and notice version, without name, email, IP address or GA identifier. Consent evidence supports our accountability obligations (GDPR Article 6(1)(c), read with Articles 5(2) and 7(1)). Copies in email, logs and backups follow separate provider retention cycles and are reviewed when handling erasure requests.
Your rights
You may request access, rectification, erasure and restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests and withdraw analytics consent at any time. Email kontakt@anything.camp; we may request only the information needed to verify your identity safely. You may complain to the President of the Polish Personal Data Protection Office (uodo.gov.pl). We do not make decisions producing legal effects about you solely by automated means, including profiling.