1. What are cookies
This Cookie Policy explains how Room Profit Sp. z o.o., with its registered office at ul. Marszałkowska 89 lok. 44, 00-693 Warszawa, Polska, entered in the register of entrepreneurs under KRS number 0001098472, NIP 521-345-67-89, REGON 524 891 372, uses cookies and similar tracking technologies on the profit.dapokl.com website and the associated dashboard. Cookies are small text files that a website places on the terminal equipment of a visitor and that the visitor's browser sends back to the website on later visits. They allow the site to recognise the visitor's device and to store limited information such as language preferences, authentication state, and session identifiers. Similar technologies include local storage entries maintained by the browser, session storage, IndexedDB databases, and, in the case of the mobile-optimised dashboard, small unique identifiers stored in browser storage APIs. Throughout this document the term "cookies" is used generically to cover all such technologies unless a specific distinction is drawn.
This Policy is part of our commitment to lawful and transparent processing of personal data. It should be read together with our Privacy Policy at /legal/privacy, our Terms of Service at /legal/terms, and — where relevant to the way the Service handles guest data flowing from Profitroom Suite — with our Data Processing Addendum at /legal/dpa.
2. Categories of cookies used on this site
We divide the cookies we set into three functional categories. We do not use advertising, remarketing, cross-site tracking, or behavioural profiling cookies of any kind, and we do not embed third-party advertising technologies such as ad-network beacons, conversion pixels for advertising platforms, or social plugins that read cookies without consent.
2.1 Strictly necessary cookies
These cookies are indispensable for the operation of the website and the dashboard. Without them the site cannot function properly: sessions cannot be maintained, forms cannot be submitted with cross-site request forgery protection, and preferences cannot be preserved between page loads. Strictly necessary cookies do not require prior consent under Article 173(3)(2) of the Polish e-services law because they are strictly needed to provide the service explicitly requested by the visitor.
2.2 Analytics cookies
These cookies help us understand aggregate usage patterns of the website so that we can improve navigation, page performance, and content clarity. We use privacy-preserving, cookieless analytics wherever possible (Plausible Insights OÜ). Where a cookie is still set for analytics reasons, it is set only after the visitor has given explicit consent through the consent banner.
2.3 Preference cookies
These cookies remember choices you make on the site, for example the preferred language or the accessibility settings you have activated. They enhance your experience by avoiding the need to repeat those choices on each visit. Preference cookies are set only after you have given consent, unless they are strictly necessary to remember a preference required for the security of the session.
3. Cookies in use
The tables below list the cookies actually set on profit.dapokl.com at the effective date of this Policy. If we change the set of cookies used, we update this table accordingly.
3.1 Strictly necessary
- rp_session — first-party session cookie set by profit.dapokl.com to keep the visitor authenticated after login. Duration: browser session. Purpose: authentication continuity.
- rp_csrf — first-party cookie set by profit.dapokl.com to prevent cross-site request forgery attacks on form submissions. Duration: 24 hours. Purpose: security.
- rp_locale — first-party cookie set by profit.dapokl.com to remember the currently displayed language during the session. Duration: 30 days. Purpose: user interface continuity.
- rp_consent — first-party cookie recording which cookie categories the visitor has consented to; without this cookie the consent banner would appear on every page load. Duration: 12 months. Purpose: consent management.
3.2 Analytics
- _pk_id — first-party cookie set by Plausible when the visitor enables analytics consent, used to distinguish unique daily visitors in an aggregated way. Duration: 24 hours. Purpose: aggregated visit counts.
- _pk_ses — first-party session cookie used by Plausible to identify a visit in progress. Duration: 30 minutes. Purpose: visit continuity.
3.3 Preferences
- rp_theme — first-party cookie remembering the light or dark theme selected in the dashboard. Duration: 12 months. Purpose: user interface preference.
- rp_currency — first-party cookie remembering the preferred display currency on the pricing page. Duration: 12 months. Purpose: user interface preference.
4. Legal basis
For strictly necessary cookies we rely on the exemption in Article 173(3)(2) of the Ustawa z dnia 18 lipca 2002 r. o świadczeniu usług drogą elektroniczną, which permits the storage of information in the terminal equipment of the user when it is strictly necessary to provide a service explicitly requested. Where a strictly necessary cookie also involves processing of personal data (for example the session identifier linked to an authenticated user), that processing is based on Article 6(1)(b) GDPR — the performance of a contract — and, in respect of security-related cookies, on Article 6(1)(f) GDPR — the legitimate interest of Room Profit and its Customers in maintaining a secure Service.
For non-essential cookies (analytics and preferences that are not indispensable) we rely on the visitor's freely given, specific, informed, and unambiguous consent, obtained through the consent banner, in compliance with Article 173(1) of the Polish e-services law and Article 6(1)(a) GDPR.
5. Consent mechanism and withdrawal
On the first visit to profit.dapokl.com, a consent banner appears at the bottom of the page. It offers three equally prominent actions: accept all non-essential cookies, reject all non-essential cookies, or open a granular panel to accept only selected categories. No non-essential cookie is set before an explicit choice is made. Continuing to browse without interacting with the banner does not count as consent. The choice is stored in the rp_consent cookie and can be reviewed and modified at any time from the "Cookie settings" link in the footer of every page. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
6. Browser controls
Independently of our consent tool, every modern browser lets you view, block, and delete cookies. Below is a summary of where the controls are located. Because browser vendors update their user interfaces frequently, please consult the current help documentation of your browser if the menu structure has changed.
- Google Chrome — Settings, Privacy and security, Third-party cookies (or "Cookies and other site data" in older versions). You can allow or block cookies for specific sites and clear browsing data on exit.
- Mozilla Firefox — Settings, Privacy and Security, Enhanced Tracking Protection and Cookies and Site Data. Firefox offers a "Strict" mode that blocks known cross-site trackers by default.
- Apple Safari — Preferences, Privacy. Safari applies Intelligent Tracking Prevention by default and lets you block all cookies or remove specific site data.
- Microsoft Edge — Settings, Cookies and site permissions, Manage and delete cookies and site data. Edge also offers three levels of tracking prevention (Basic, Balanced, Strict).
Blocking or deleting strictly necessary cookies will impair the operation of the Service; for example you may find yourself repeatedly logged out or unable to submit forms.
7. Local storage
In addition to cookies we use limited local storage entries to cache non-sensitive user interface state, such as the last selected tab in a data grid, the collapsed or expanded state of a side panel, and offline draft messages that would otherwise be lost on page reload. These entries do not contain personal data and are not transmitted to the server. They can be cleared through the browser's site-data controls. The specific keys currently used include rp_layout (which panels are open), rp_grid_prefs (column widths and sort order in the reservations grid), and rp_draft_messages (offline drafts pending upload once the connection is restored). None of these keys carries a persistent identifier that could be used to profile or track the visitor across other websites.
Session storage, unlike local storage, is cleared automatically when the browser tab is closed. We use it to hold short-lived state such as the currently displayed step of a multi-step wizard and the temporary form values that a user has entered but not yet submitted. IndexedDB is used sparingly for a small offline cache of look-up tables (currencies, country codes, room-type descriptions) that would otherwise be reloaded on every page transition. We do not use browser fingerprinting techniques (canvas fingerprinting, audio-context fingerprinting, or evercookies) and we do not participate in identity-graph services that combine signals from multiple websites to build a persistent profile of a natural person.
8. Third-party embeds
Our public pages load web fonts from Google Fonts (fonts.googleapis.com) using self-hosted fallback where possible. When Google Fonts is used, the request may transmit the visitor's IP address to Google Ireland Limited under a legitimate-interest basis (secure delivery of the font file). No cookie is set by this request in the visitor's browser. If a visitor's browser is configured to block third-party requests, our pages continue to render with the fallback font. We do not embed social media plugins, video players from third parties, or advertising scripts on our marketing pages.
9. Do Not Track
Some browsers transmit a Do Not Track (DNT) header. Because a common industry standard on the correct behaviour of servers upon receipt of DNT has not been established, we do not currently rely on DNT to opt visitors out of analytics or preference cookies. Instead we ask each visitor to make an explicit choice through the consent banner. This ensures that visitors have equal control regardless of the browser or device they use.
10. Cookies under the Polish e-services law
Article 173 of the Ustawa z dnia 18 lipca 2002 r. o świadczeniu usług drogą elektroniczną implements the requirement to obtain consent from the user before storing information on, or accessing information already stored in, the user's terminal equipment, except where this is strictly necessary to provide a service explicitly requested. Room Profit interprets and applies this obligation in line with the guidance issued by the Prezes Urzędu Ochrony Danych Osobowych (UODO) on the interplay between cookie consent and the GDPR standard of consent. In practice this means that our consent request meets all the criteria of Article 4(11) and Article 7 GDPR: it is freely given, specific, informed, unambiguous, and as easy to withdraw as to give.
11. Contact for cookie questions
Questions and requests concerning this Cookie Policy may be sent to privacy@profit.dapokl.com or to Room Profit Sp. z o.o., Data Protection Officer, ul. Marszałkowska 89 lok. 44, 00-693 Warszawa, Polska. Our Data Protection Officer is Katarzyna Nowak-Wiśniewska. Where relevant, complaints may also be filed with the Prezes Urzędu Ochrony Danych Osobowych at ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
12. Changes to this Policy
We may update this Cookie Policy from time to time to reflect changes in the cookies actually in use, to introduce a new sub-processor for analytics, or to align the document with new regulatory guidance. When we make a material change we update the "Effective date" at the top of the page and, where the change increases the categories of data collected, we re-request consent from returning visitors through the consent banner. The previous version of this Policy is kept in our internal versioning system and can be provided on request to demonstrate the changes made.