Privacy Policy
Privacy Policy
Last updated:
This policy explains which personal data we process when you visit kwet.sk, book a stay, write to us or subscribe to our newsletter, why we do it, how long we keep the data and what your rights are. We follow Regulation (EU) 2016/679 (GDPR), Slovak Act No. 18/2018 Coll. on the Protection of Personal Data and Act No. 452/2021 Coll. on Electronic Communications. The Slovak version of this policy prevails.
1. Who processes your data
The controller is Vladimír Škrobák, Nám. Sv. Floriána 353/14, 013 03 Varín, Slovakia, company ID (IČO): 46887253.
For questions about personal data or to exercise your rights, e-mail info@kwet.sk or call 0911 309 080. We have not appointed a data protection officer, as the law does not require one for processing of our scale.
2. What data we process and why
Booking a stay. We process your name, e-mail, phone, number of guests, note, the dates of the stay and, for a gift, the recipient's name, so that we can handle and confirm the booking and communicate with you before and during the stay. The legal basis is the performance of a contract and steps taken at your request before entering into it (Art. 6(1)(b) GDPR). We cannot handle a booking without a name and e-mail. Details the law requires for the guest register (such as ID number and address) are not collected on the website; they are recorded on arrival.
Order, payment and invoice. For an order we also process your billing address, for a company purchase the company name, company ID, tax ID and VAT ID, and the payment details (amount, date of payment), so that we can handle the order and issue the invoice once it is paid. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and, for invoices, our legal obligation under the Accounting Act and the VAT Act (Art. 6(1)(c) GDPR).
Contact form. We process your name, e-mail, phone and message to reply to you. If you ask about a stay, these are steps before entering into a contract (Art. 6(1)(b) GDPR); for other questions, our legitimate interest in answering messages (Art. 6(1)(f) GDPR). The message is not stored on the website; it reaches us by e-mail.
Newsletter. We process your e-mail and name to send news about KWET, available dates and offers, based on your consent (Art. 6(1)(a) GDPR). You can withdraw consent via the unsubscribe link in every e-mail or by writing to us. You confirm the sign-up from a link in an e-mail (double opt-in); as proof of consent we keep the time of sign-up and confirmation, the version of the consent text and a one-way fingerprint (hash) of your IP address. We do not track whether you open our e-mails or what you click.
Protecting forms from abuse. When a form is sent, Cloudflare Turnstile checks that you are not a robot, and we count attempts from one IP address and one e-mail. For this purpose we store the IP address and e-mail only as a one-way fingerprint (hash) from which the original cannot be recovered. The legal basis is our legitimate interest in the security of the website (Art. 6(1)(f) GDPR).
Analytics and marketing. If you agree in the cookie banner, we measure traffic (Google Analytics 4) and advertising performance (Google Ads). The legal basis is your consent (Art. 6(1)(a) GDPR and Section 109(8) of Act No. 452/2021 Coll.). Without consent these tools are not loaded at all.
Map. The Google map on the Contact page loads only after you click “Show map” or if you have allowed cookies. When it is shown, Google receives your IP address and may store cookies under its own policy.
Running the website. On every visit the server processes technical data (IP address, browser type, time and address of the request) to deliver the page and protect it from attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
3. How long we keep data
| Data | Retention |
|---|---|
| Booking (name, e-mail, phone, note, gift recipient) | 3 years after the end of the stay, then the personal data are anonymised. The dates and status remain without personal data for statistics. An unpaid order is cancelled after its due date and the dates are released. For a paid order we keep the buyer's details for as long as the invoice is kept. |
| Contact form messages | In our mailbox for at most 24 months after sending. If a booking follows, the booking period applies. |
| Newsletter | Until you unsubscribe or withdraw consent. Unconfirmed sign-ups 30 days. After unsubscribing only a one-way fingerprint (hash) of the address, so that it isn't added again by mistake. |
| IP and e-mail fingerprints (form protection) | From 15 minutes to 30 days depending on the form, then deleted. |
| Cookies | See the table in the Cookies section. |
| Invoices and credit notes (with the customer's details) | 10 years from the end of the year of issue (Accounting Act), then deleted. |
5. Who receives the data
We do not sell data. It is processed on our behalf by these processors, with whom we have a contract or whose terms include a data processing agreement:
- Vercel Inc. (USA): website hosting and image storage.
- ChiselStrike Inc., Turso service (USA): database of bookings, orders, invoices and newsletter subscribers.
- Cloudflare, Inc. (USA): checking that forms are not sent by robots (Turnstile).
- WEBSUPPORT, s.r.o. (Slovakia), our e-mail provider: delivery of form messages, order e-mails, invoices and the newsletter.
- Google Ireland Limited and Google LLC (USA): with consent Google Analytics, Google Ads and Google Tag Manager; the map on the Contact page.
We may also disclose data to public authorities where the law requires it.
6. Transfers outside the EU
Some processors (Vercel, Turso, Cloudflare, Google) are based in the USA or may transfer data there. Transfers rely on the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
7. Your rights
- access to your personal data and a copy (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16),
- erasure when the data are no longer needed or you withdrew consent (Art. 17),
- restriction of processing (Art. 18),
- portability of data you gave us under a contract or consent (Art. 20),
- objection to processing based on legitimate interest (Art. 21),
- withdrawal of consent at any time, without affecting processing before the withdrawal (Art. 7(3)).
To exercise your rights, e-mail info@kwet.sk or write to the controller's address. We will reply within one month. If you believe we process data unlawfully, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk.
We do not use automated decision-making or profiling with legal effects.
8. Security
The website communicates only over encrypted connections (HTTPS) and has a strict content policy that blocks scripts from unknown sources. Only the operator can access the data, through a password-protected administration. We keep personal data to a minimum: the website does not collect ID numbers or addresses and stores IP addresses only as fingerprints.
9. Changes to this policy
We will update this policy when our processing or the law changes. The current version is always on this page, with the date of the last change at the top.