Privacy Policy

1.1. The controller of your personal data is Smart Lockers Sp. z o.o., ul. Trakt Brzeski 94A, 05-077 Warsaw, Poland, KRS 0001071782, tax ID (NIP) 9522239035, REGON 524739314 (we).

1.2. For data protection matters write to [email protected] or to our registered office address; you can also call +48 784 951 977.

1.3. We handle every matter concerning personal data, including the exercise of your rights, through the contact details above.

This policy covers: the luggage24.pl website, online booking (the booking form and the Confirmation page in the booking application at luggage24.pl/booking), the Locations with Lockers and Kiosks, and contact with us by phone, WhatsApp and e-mail.

3.1. The table below shows why, on what basis, for how long and to whom we pass data. We do not make solely automated decisions (section 13).

3.2. Periods are counted from the end of the contract unless the table says otherwise. After the period we delete or anonymise the data.

4.1. In the booking form you enter your phone number (the only identifying field), choose the booking details and tick the acceptance of the Terms and the Privacy Policy. The form is protected by the Cloudflare Turnstile bot check.

4.2. Payment is made on the hosted Stripe Checkout page. Stripe collects your e-mail address, name and the card or other payment method details. Card details never reach us; we store payment identifiers, amounts and the type of payment method.

4.3. Stripe Payments Europe, Limited (Ireland) acts as our processor when carrying out the payment and as an independent controller for fraud and money-laundering prevention, legal compliance and product improvement, under its own privacy policy: stripe.com/privacy. Stripe's data protection officer: [email protected]. Data may be transferred to the USA under the EU-US Data Privacy Framework and standard contractual clauses.

4.4. Stripe may e-mail a payment receipt and offer to save your details in Link; these features run on Stripe's terms.

5.1. We send booking messages: the payment link, payment reminder (SMS), PIN, confirmation, cancellation, refund, and a change or move of the Locker.

5.2. Channels: SMS through SMSAPI (sender "Luggage24"), WhatsApp through Meta Platforms Ireland Limited (for bookings made over WhatsApp) and e-mail from [email protected] through MailerSend. We measure e-mail delivery and opens and clicks on the links in our messages.

5.3. After you collect your luggage we may ask for a review (at most 3 SMS or e-mail messages, between 8:00 and 20:00). You can object at any time by writing or calling us (section 1); the SMS sender "Luggage24" cannot receive replies, so replying STOP does not work.

We pass data to providers that supply services to us, under processing agreements or as independent controllers:

• Stripe Payments Europe, Limited (Ireland) - payments; stripe.com/privacy;
• LINK Mobility Poland sp. z o.o. (SMSAPI, Poland) - sending SMS; smsapi.pl;
• MailerSend (MailerLite group, EU) - sending e-mail; mailersend.com/legal/privacy-policy;
• Meta Platforms Ireland Limited - WhatsApp; meta.com/privacy;
• Cloudflare, Inc. - edge network and the Turnstile check; cloudflare.com/privacypolicy;
• the locker control system provider - receives the data needed to operate the Lockers, without the Customer's name, phone number or e-mail;
• Google Ireland Limited - Google Analytics 4, Google Ads, Tag Manager, Google Maps, Google Fonts in the booking application; policies.google.com/privacy;
• Microsoft Ireland Operations Limited - Microsoft Clarity; privacy.microsoft.com;
• Ahrefs Pte. Ltd. - visit statistics without cookies; ahrefs.com/privacy-policy;
• CookieYes Limited - consent management; cookieyes.com/privacy-policy;
• the team messenger provider - internal notifications about bookings (section 7.2);
• the hosting provider (Poland) - hosting of the website and the booking application;
• public authorities and other entities entitled by law.

On request we will name the specific recipients of your data (section 10).

7.1. Some recipients (Google, Microsoft, Cloudflare, Stripe) belong to groups based in the USA. We transfer data under the EU-US Data Privacy Framework where the recipient is certified to it, and otherwise under standard contractual clauses. You can get a copy of the safeguards on request.

7.2. The team messenger provider is based in the United Arab Emirates. We pass there only the data our team needs to handle your booking, where this is necessary for the performance of the contract (Article 49(1)(b) GDPR).

8.1. Locations are monitored by CCTV around the clock for the safety of people and property and to pursue claims (Article 6(1)(f) GDPR).

8.2. We keep recordings no longer than the purpose of monitoring requires, and where a recording is evidence in a case, until the proceedings end. They may be passed to law enforcement at its request. You have the right to object (section 10).

The website and the booking application use cookies and similar technologies. Analytics and ad measurement run only with your consent given in CookieYes, which you can change at any time. Details: the Cookie Policy.

10.1. You have the right to: access your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), objection to processing based on legitimate interest (Article 21), and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal (Article 7(3)).

10.2. To exercise your rights, write to [email protected] or to our registered office address, or call +48 784 951 977. We may ask for the details needed to confirm your identity, for example the phone number used for the booking and the booking number.

10.3. We reply within one month of receiving the request; where necessary we may extend that period by two months and will tell you so. We handle erasure requests after verifying your identity; we do not delete data we must keep by law (for example accounting records) before the retention period ends.

If you believe we process data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl (Article 77 GDPR).

The phone number and payment details are necessary to conclude and perform the Locker rental contract; without them we cannot accept a booking. Consent to analytics and advertising cookies is voluntary, and refusing it does not limit your use of booking and the Lockers.

We do not make decisions with legal effect solely by automated means and we do not profile Customers. Our providers run checks on their side: Stripe Radar assesses payment abuse risk and Cloudflare Turnstile tells people from bots. A payment can be declined by these mechanisms; if it happens, contact us.

Our services are not aimed at children. An Online booking may be made by a person with legal capacity.

We publish the current version on this page with its date. Last updated: 1 November 2026 (2026-11-01). We announce material changes on the website before they take effect.