Privacy

The controller determining the purposes and means of processing your personal data is:

• Penzión Tatry - Tatranská Lomnica 123, 059 60 Vysoké Tatry
• E-mail: [email protected] · Phone: +421 900 123 456

Depending on how you communicate with us, we process the following categories of personal data:

• Identification and contact data - name and surname, e-mail, phone number, optionally address.
• Reservation data - stay dates, room type, number of persons, reservation note.
• Guest registration data - date of birth, nationality, address, identity document number (identity card or passport) to the extent required by applicable law, for every person staying, including children; the main guest fills in the details of the other people.
• Identity document photograph - front side of identity card or passport, only where our property requires it and only based on your explicit consent given in the digital check-in form.
• Payment data - amount, method and status of the payment and of any refund. You enter your card details directly with the payment service provider; we never see them.
• Communication - contact form messages and enquiries (e.g. for the restaurant or a venue), live chat messages and copies of the e-mails and text messages we send you.
• Guest profile - stay history, spending, loyalty discount and notes (e.g. your preferences), if we keep guest records.
• Reviews and waitlist - the name and text of a review you send us, and your contact details and dates if you join the waitlist for a freed-up date.
• Reviews from other sites - reviews taken, with the author's consent, from our property's public profiles on other sites (for example Google or Booking.com): the author's first name and surname initial, the text, rating and date. We state the source of each one with a link to the original.
• Marketing consent - whether and when you agreed to receive offers or unsubscribed, and your date of birth if you voluntarily provide it with your consent for a birthday offer. We do not use the date of birth from guest registration for this purpose.
• Technical data - information from cookies and about website use (see section 6).

We process your data only for predefined purposes and always on a specific legal basis:

We keep personal data only for as long as necessary to fulfil the purpose for which it was obtained, or for the period required by law.

• Reservation and accommodation data - 3 years after the end of the stay, after which the personal data in the reservation is irreversibly anonymised. Issued accounting documents are kept for 10 years under accounting law.
• Identity document number and other guest registration data - 5 years after the end of the stay, after which they are deleted automatically.
• Identity document photograph - automatically deleted 90 days after check-in.
• Contact form messages and enquiries - 3 years after receipt, after which they are deleted automatically.
• Copies of the e-mails we send you - the recipient and content are deleted 90 days after the message is queued for sending. Only a technical record without recipient or content remains, which prevents the same message from being sent again.
• Records of sent text messages - 12 months after sending.
• Waitlist entry - 30 days after the date you were interested in.
• Guest profile - 3 years after your last stay, after which it is irreversibly anonymised.
• Reviews - for as long as they are published on the website; we will remove them at your request.
• Reviews from other sites - for as long as they are shown on the website, at most until the author withdraws consent; we will remove them at the author's request.
• Data processed on the basis of consent - until consent is withdrawn. We keep a record that you unsubscribed from marketing so that we do not send you further offers.

We do not sell your data or share it with third parties for their own marketing purposes. It may be processed by processors who run the website and reservations for us, and by other recipients to the extent needed for the given purpose:

• Ubytora - the reservation system and website on which we process the data (hosting and technical infrastructure),
• Resend - sending e-mails (reservation confirmations, reminders, replies),
• GoSMS - sending text messages about your stay, if we send them,
• the payment service provider for the payment method you choose (Stripe, GoPay, Besteron or Comgate) - processing the online payment and its refund,
• an accounting system, if we use one (e.g. iDoklad, SuperFaktúra, FLOWii, Vyfakturuj, eFaktúra) - issuing the accounting document,
• Tawk.to - live chat, if we use it, and only after you allow functional cookies,
• Google - traffic measurement (Google Analytics, Google Tag Manager), if we use it, only with your consent to analytics cookies, and Google Maps, which loads only after you consent to functional cookies or click the map,
• OpenStreetMap - map tiles for the surroundings map; they load only after you consent to functional cookies or click the map, the provider then receives your IP address but stores no cookies,
• public authorities where the law requires it (e.g. guest registration records at the request of the police).

Some of these recipients may process data outside the European Economic Area (e.g. in the USA). In that case the transfer is based on standard contractual clauses approved by the European Commission or on the EU-US Data Privacy Framework.

Our website uses cookies to ensure basic functionality and - based on your consent - for traffic measurement, live chat and maps (Google Maps, surroundings map). For details, see the Cookie Policy document.

In connection with the processing of your personal data, you have the following rights under the GDPR:

• Right of access - to obtain information about what data we process about you.
• Right to rectification - to request correction of inaccurate or incomplete data.
• Right to erasure - to request deletion where there is no legal reason to keep the data.
• Right to restriction of processing and right to portability of data.
• Right to object to processing and right to withdraw consent at any time.

We have taken appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. Data transfer between your browser and the server is encrypted using HTTPS.

If you have questions about the processing of personal data or wish to exercise your rights, please contact us. If you believe that processing is not compliant, you have the right to lodge a complaint with the supervisory authority.