SK
ENPrivacy policy
This is an English translation provided for convenience. In the event of any discrepancy, the Slovak version prevails.
We care about protecting your personal data. This page explains what personal data we process about you as a guest or website visitor, for what purposes, how long we keep it and what rights you have.
1. Controller
The controller of your personal data is:
- Company name
- FinMedia, a.s.
- Registered office
- Bencúrova 14, 821 04 Bratislava, Slovakia
- Company ID (IČO)
- 35 770 201
- Registration
- Commercial Register of the Municipal Court Bratislava III, Section Sa, File No. 2175/B
- Establishment
- Chalets Gardenia, Donovaly 1044, 976 39 Donovaly, Slovakia
- rezervacie@chaletsgardenia.sk
- Phone
- +421 901 722 855
2. Data protection officer
The controller has appointed a data protection officer (DPO) whom you can contact with any questions about the processing of your personal data: Ing. Ján Margetín, email: margetin@chaletsgardenia.sk.
3. Purposes, legal bases and retention
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Booking and providing accommodation (concluding and performing the contract) | name, email, phone, address, dates of stay, number of guests, payment details, any special requests | performance of a contract – Art. 6(1)(b) GDPR | for the duration of the contract; thereafter as set out below |
| Guest register and reporting the stays of foreign nationals | name, date of birth, nationality, permanent address, type and number of identity document, visa number, purpose and length of stay | legal obligation – Art. 6(1)(c) GDPR; Act No. 404/2011 Coll. on the Residence of Foreigners, Act No. 582/2004 Coll. on Local Taxes and the bylaws of the municipality of Donovaly | 5 years |
| Accounting and tax | billing details (name, address, where applicable company name, company ID and VAT ID), payment data | legal obligation – Art. 6(1)(c) GDPR; Act No. 431/2002 Coll. on Accounting, Act No. 222/2004 Coll. on VAT | 10 years from the end of the year to which the records relate |
| Communication before, during and after the stay; handling enquiries and complaints | name, email, phone, content of communication | performance of a contract and pre-contractual steps – Art. 6(1)(b) GDPR; legitimate interest – Art. 6(1)(f) GDPR | as long as necessary, no longer than 3 years after the end of the stay |
| Newsletter with news and offers | email, name | for guests who have stayed with us – legitimate interest in offering our own similar services (Art. 6(1)(f) GDPR together with Act No. 452/2021 Coll. on Electronic Communications); for others – consent (Art. 6(1)(a) GDPR) | until you unsubscribe or withdraw consent |
| Protecting property and personal safety by CCTV (entrance and car park; no cameras inside the apartment) | video recordings | legitimate interest – Art. 6(1)(f) GDPR | no more than 15 days, then automatically overwritten; longer only if needed as evidence in proceedings |
| Website traffic statistics (Google Analytics) | online identifiers (cookies), device and browser data, pages viewed, approximate location | consent – Art. 6(1)(a) GDPR | no more than 14 months; cookies 2 years or until consent is withdrawn |
| Establishing, exercising and defending legal claims | data relevant to the claim | legitimate interest – Art. 6(1)(f) GDPR | until the limitation period expires or proceedings end |
You can unsubscribe from the newsletter at any time via the link in every message or by email. You may withdraw your consent at any time; this does not affect the lawfulness of processing before withdrawal. We do not use your personal data for automated decision-making or profiling.
4. Recipients
We do not sell your personal data or share it with third parties for their marketing purposes. Only authorised persons of the controller, bound by confidentiality, have access to it, together with the following recipients:
- processors acting on our behalf under a data processing agreement: the operator of the Previo hotel and booking system (PREVIO s.r.o., Czech Republic), the accounting firm CRI Market s. r. o., the payment gateway provider, the web hosting and email provider, and Google Ireland Limited (Google Analytics – only with your consent),
- public authorities where required by law (e.g. the Police of the Slovak Republic for reporting the stays of foreign nationals, the municipality of Donovaly for the local accommodation tax, the tax authorities, law enforcement authorities),
- banks and payment service providers when processing payments.
5. Transfers outside the EU
We process your personal data within the European Union. A transfer to a third country may only occur if you consent to analytics cookies or to displaying the Google map on our website (see section 6). In that case data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework, on the basis of the European Commission’s adequacy decision.
6. Website, cookies, analytics and map
- Web hosting: when you visit the website, the server automatically logs technical data (IP address, time of access, browser type). We process it on the basis of our legitimate interest in operating and securing the website and keep it for no more than 30 days.
- Google Analytics: if you consent to analytics cookies, we use Google Analytics 4 provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for anonymous traffic statistics – e.g. number of visits, pages viewed, device type and approximate location derived from the IP address (the IP address itself is not stored). Data is kept in Google Analytics for no more than 14 months. Without your consent Google Analytics is not loaded.
- Previo booking system: the booking form is loaded from the servers of PREVIO s.r.o. and may use strictly necessary cookies required to complete a booking.
- Google map: the map is only loaded after you consent – in the cookie banner (Maps category) or by clicking “Show map”. Only then does your browser connect to the servers of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which may process your IP address and store cookies. The legal basis is your consent (Art. 6(1)(a) GDPR and Section 109(8) of Act No. 452/2021 Coll.). For more information see Google’s privacy policy.
Cookie overview
| Name | Provider | Purpose | Category | Expiry |
|---|---|---|---|---|
| cg_consent | chaletsgardenia.sk | stores your cookie choice | essential | 12 months |
| booking system cookies | PREVIO s.r.o. | running the booking form | essential | set by the provider |
| _ga, _ga_* | distinguishing visitors for traffic statistics | analytics | 2 years | |
| NID, AEC and others | displaying and running the Google map | maps | up to 13 months |
7. Your rights
You have the right:
- of access to your personal data and to a copy of the data we process about you (Art. 15 GDPR),
- to rectification of inaccurate or incomplete data (Art. 16 GDPR),
- to erasure where the data is no longer needed, you have withdrawn consent or it was processed unlawfully (Art. 17 GDPR) – data we must keep by law will be erased once the statutory period expires,
- to restriction of processing (Art. 18 GDPR),
- to data portability for data you provided under a contract or consent (Art. 20 GDPR),
- to object to processing based on legitimate interest and, at any time, to processing for direct marketing (Art. 21 GDPR),
- to withdraw your consent at any time,
- to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk, or with the supervisory authority in your country of residence.
You can exercise your rights by email to rezervacie@chaletsgardenia.sk, via the data protection officer, or by post to our registered office. We will handle your request free of charge and without undue delay, within one month at the latest. If we have reasonable doubts about your identity, we may ask you to verify it in a proportionate way.
8. Obligation to provide data
Providing the data needed for a booking is a contractual requirement, and providing identity document data is a legal requirement. Without it we cannot accommodate you. Providing your email for the newsletter is voluntary.
9. Security
We have taken appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, destruction or loss – in particular access restricted to authorised persons with individual credentials, encrypted data transfer on the website and contractual data protection safeguards with our processors. Anyone who handles personal data is bound by confidentiality, including after their engagement ends.
10. Changes to this policy
We may update this information, in particular when legislation or our processing changes. The current version is always published on this page. This version is effective from 1 November 2026 and replaces the Personal Data Processing Terms of 17 November 2020.