Privacy Policy

Your privacy matters to us. This document explains what personal data we process, why, on what legal basis, who we share it with, how long we keep it, and what rights you have.

1. Data controller

Your personal data is jointly controlled by the following two controllers under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection:

For any matters concerning the processing of your personal data, contact us by email at ahoj@apartmanbojnice.sk, by phone at +421 917 212 796, or via WhatsApp at +421 944 423 411.

(hereinafter jointly "we" or "the controller")

2. What data we process

Reservation and pre-stay communication

• first and last name
• phone number and/or email address
• stay dates and number of guests
• any other information you provide us in a message

Stay data (guest registration)

Under Act No. 253/1998 Coll. on reporting residence of Slovak citizens and Act No. 404/2011 Coll. on residence of foreigners, we are legally required to keep a register of accommodated guests. This includes:

• first name, last name, date of birth, nationality
• ID document number and type
• permanent address
• arrival and departure dates

Payment data

• data required for invoicing or issuing receipts under Act No. 431/2002 Coll. on accounting

Website technical data

Our website is hosted by Cloudflare, Inc. When you visit, server logs automatically record certain data (IP address, browser type, request time). We use these for site security and protection against abuse, and we keep them only as long as necessary.

Functional browser storage

The only client-side storage we use is a single value under the key theme — your display preference (light/dark mode) — saved in localStorage. This is not a cookie in the meaning of the ePrivacy Directive and does not require your consent.

3. Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR) — reservation and accommodation
• Legal obligation (Art. 6(1)(c) GDPR) — guest registration and accounting records
• Legitimate interest (Art. 6(1)(f) GDPR) — website security, abuse prevention, and mutual communication

We do not carry out marketing processing (e.g. newsletters). If we ever introduce it, we will first ask for your explicit consent.

4. Recipients and data transfers

We process your data internally and share it only to the extent necessary:

• Cloudflare, Inc. — website hosting; transfers to the USA are based on the EU-US Data Privacy Framework and standard contractual clauses under Art. 46 GDPR
• Bojnice municipal office / residence registry — for the mandatory guest register
• Tax authority and accountant — to the extent required by accounting and tax law
• WhatsApp (Meta Platforms Ireland Ltd.) — if you choose to communicate via WhatsApp. Meta processes your messages and metadata as an independent controller under its own terms.
• Plausible Analytics — anonymous, aggregated website traffic statistics (visit count, country, device type, referral source). Plausible does not use cookies, does not store your IP address or any data that could identify you, and processes data within the EU

We do not sell your data to third parties and we do not use it for profiling or automated decision-making with legal effects.

5. How long we keep your data

• Pre-stay communication (emails, WhatsApp messages) — typically 3 years from last contact
• Reservation and invoicing records — 10 years under the Slovak Accounting Act
• Guest register — as required by applicable Bojnice municipal ordinances
• Server logs — typically up to 30 days

After these periods, we securely delete or anonymise the data.

6. Your rights

Under GDPR, you have the right to:

• access your personal data and obtain a copy
• rectification of inaccurate or incomplete data
• erasure ("right to be forgotten") — to the extent this does not conflict with our legal obligations
• restriction of processing
• data portability, where technically feasible
• object to processing based on legitimate interest
• withdraw consent at any time, if processing was based on consent
• lodge a complaint with the supervisory authority

You can exercise these rights by email at ahoj@apartmanbojnice.sk or in writing at the controller's address. We will respond within 30 days.

The supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

7. Cookies and similar technologies

Our site does not use advertising cookies or similar tracking technologies, and we do not display a consent banner because we do not need one.

For basic visitor statistics we use Plausible Analytics, a privacy-focused service that does not use cookies, does not store your IP address or any data that could identify you, and provides only aggregated metrics (visit count, country, device type, referral source). This kind of processing does not require consent under GDPR or the ePrivacy Directive.

The only client-side storage is a display preference (light/dark mode) in localStorage, which is purely functional and does not require your consent.

The fonts on this site (Cormorant Garamond) are hosted directly on our server; no data is transferred to third parties when they load.

8. Changes to this policy

We may update this policy from time to time. The current version is always on this page. We will notify you of substantive changes by email if we are actively communicating with you.

Effective date: 8 May 2026