Privacy policy

Working draft for the accommodation provider’s review. Highlighted details and optional provisions must be completed and approved before bookings are launched. This draft is not yet used to conclude bookings through the website preview.

Ubytovanie u Maťka a Kubka, Ždiar 281 · working draft, version 1.0 · updated 10 October 2026 · effective from: [EFFECTIVE DATE FOLLOWING APPROVAL]

This policy explains what personal data we process when you book or stay with us, contact us or visit this website. It also explains why we process it, how long we keep it, whom we share it with and what rights you have.

How the website preview works

The website at umatkakubka.tatrabyte.sk contains a Rezerva booking calendar and, below it, a non-binding enquiry form for stay packages, gift vouchers and groups. Booking requests and enquiries are currently received by TatraByte, which is preparing the website. Your name and email are required; you may add your telephone number, dates, guest numbers, accommodation or package choice and a message as needed. Enquiries are delivered by email through Resend. The form checks a time-based security token and the number of submissions from the same network; it does not require payment or consent to newsletters.

The booking calendar is loaded from Rezerva. When you submit a booking request through it, we store your name, contact details, dates, accommodation choice and extras, and confirm your stay personally. You may also contact the owners at umatkakubka@gmail.com or +421 904 380 473 to arrange your stay. Other sections of this working draft also describe planned features; the accommodation provider must confirm their use and retention periods before launch.

1. Who is responsible for your data

The controller is Mgr. Vladimír Mačák, place of business: Ždiar 281, 059 55 Ždiar, business registration number (IČO) 46 505 164, registered in the Trade Register of the Poprad District Office under No. 740-27446 (“we” or “us”). We provide accommodation at Ubytovanie u Maťka a Kubka, Ždiar 281, 059 55 Ždiar.

For data protection questions and requests, contact umatkakubka@gmail.com, call +421 904 380 473 or write to the address above.

We have not appointed a data protection officer (DPO), as Article 37 of Regulation (EU) 2016/679 (GDPR) does not require us to do so.

2. Who helps us process your data

Andrej Petrulák – TatraByte, Slnečná 954/28, 059 71 Ľubica, business registration number (IČO) 57647194 (“TatraByte”), provides technical operation of our website, Rezerva booking system and contact form. TatraByte processes your data only on our behalf and under our instructions, under an agreement pursuant to Article 28 GDPR. It is not a party to your booking contract, does not use your data for its own purposes, does not combine it with data from other properties and does not sell it. Other recipients are listed in section 7.

3. What data we process

When you book a stay

Your first and last name, email, telephone number, dates, room, apartment or entire guest accommodation, number of adults and children (children under 15 are recorded for accommodation tax purposes), country, estimated arrival time and any notes. Optional details include business billing information, newsletter consent and opting out of a review request. We also record when you accepted the terms and cancellation policy, and a hash of your IP address from which the address cannot be recovered without a secret key.

Please do not include health information or payment card numbers in your notes.

Before arrival (online check-in) or on arrival

For every guest, including children: first and last name, date of birth, permanent address, identity document type and number, nationality, and arrival and departure dates. If you are not a Slovak citizen, we complete a residence reporting form with you for you to sign. Citizens of countries outside the EU, EEA and Switzerland also provide their place of birth, purpose of stay, visa details and address during their stay in Slovakia.

We only inspect your identity document; we do not copy or scan it. We do not collect your national personal identification number (rodné číslo). If your stay does not take place, we delete your online check-in data.

When you pay

For billing documents, we process the customer’s name or business name, address, business registration number (IČO), tax identification number (DIČ), VAT number (IČ DPH) and amounts.

When you write or call us

• Enquiry form: your name, email and any optional details you add: telephone number, dates, numbers of adults and children, accommodation, package and message. The message is delivered to our email inbox and is not stored in the website’s database. To prevent misuse, the server records the number of submissions against a hash of the IP address. [CONFIRM THE DELETION PERIOD FOR SECURITY RECORDS.]
• Email and telephone: information you choose to give us.

When you leave a review after your stay

Your first name, country based on the booking language, month of stay, scores and review text.

When you visit this website

For each request, the server technically processes your IP address and browser details to deliver the page and protect the website against attacks. Technical logs are deleted within seven days at the latest.

We measure website traffic on our own server, recording only daily totals: pages opened, referring domains, device types and countries. We do not store IP addresses or any identifier that could distinguish individual visitors. Nothing is stored on or read from your device for this purpose.

4. Why we use your data and the legal basis

5. Which data you must provide

Required form fields are marked with an asterisk. For a non-binding enquiry, we need your name and email so we can reply. The planned online booking process will also require a telephone number, dates and guest numbers to confirm your stay and calculate the price and tax. You do not have to provide optional details.

We are legally required to collect data for the guest register, foreign guests’ residence reporting and accommodation tax records; we cannot accommodate you without it.

6. Our legitimate interests

• Preventing fake bookings and form misuse: fictitious bookings block dates for genuine guests, and forms can be misused to flood someone else’s inbox.
• Website security: short-lived technical logs help us identify attacks and errors.
• Establishing and defending claims: in a dispute, we need to show what you ordered and which terms you accepted.
• Guest satisfaction: one review request after a stay helps us understand what to improve.
• Traffic measurement: daily totals show us which pages are read and where visitors come from, without tracking individuals.

We will send you our legitimate interest assessment on request. You may object to processing based on legitimate interests (section 13).

7. Who receives your data

• TatraByte (Andrej Petrulák, Ľubica, Slovakia) — operates the website, booking system and form as our processor.
• Cloudflare, Inc. (USA) — hosting of the website and booking system, database, Turnstile form protection and checking whether your email domain exists (it receives only the domain, not the full address). Cloudflare also uses Turnstile signals to improve Turnstile as an independent controller.
• Resend (Plus Five Five, Inc., USA) — delivery of booking emails and contact form messages.
• [Our email provider] — receiving and storing emails.
• [Our accountant] — accounting and financial records.
• Police Force (foreign police department) — reporting foreign guests’ stays; Ždiar municipality as the tax authority when inspecting records; other public authorities on request under § 24(2) of Slovak Act No. 253/1998 Coll.
• Courts, law enforcement authorities, the Slovak Trade Inspection and other authorities — where required by law.
• Google Ireland Limited — only if you click to display the map; it receives your IP address and browser details and processes them as an independent controller.

We do not sell your data or use it for advertising on other websites.

8. Transfers outside the European Union

• USA (Cloudflare, Resend): under the European Commission’s standard contractual clauses in Implementing Decision (EU) 2021/914, incorporated into their agreements, and, where the recipient is certified, also under the adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795). Emails and delivery records are stored in the USA. [If TatraByte verifies EU jurisdiction: The booking system database is stored in the EU.]
• USA (Google, after you click the map): under Google’s policies, based on the same framework and standard contractual clauses.

We will email you a copy of the safeguards on request.

9. How long we keep your data

• Booking (contact details, notes, business billing details and newsletter consent): 24 months from creation, after which we anonymise it; dates and amounts remain without a link to you.
• Guest register, foreign guest data and accommodation tax records: until 31 December of the sixth year after the year of the stay (a stay in 2026 → until 31 December 2032), as the municipality may inspect and assess the tax until then.
• Financial documents and accounting records: 10 years after the end of the year to which they relate.
• Form messages, emails and telephone enquiries: until the matter is resolved, up to 12 months from the last communication; if an enquiry becomes a booking, the booking retention period applies.
• Review: first name and text for 24 months from submission, after which we remove them.
• Entry on the fake booking list: 30 days.
• Records of booking attempts: 2 days. Server technical logs: up to 7 days. Database backups: deleted data disappears from backups within 30 days.
• Traffic totals: [25 months]; they contain no personal data.

If a dispute, payment dispute, inspection or your request is ongoing, we postpone deletion of the relevant records until it is resolved.

10. Automatic booking checks

When a booking is submitted, the system automatically checks that a human is completing the form (Turnstile), the number of attempts from the same IP address and email within 24 hours, whether the telephone number is obviously fictitious, whether the email domain exists and accepts mail, and whether your telephone number, email or IP address is on our fake booking list. If a technical error prevents the domain check, the booking proceeds. We add data to the fake booking list only when we personally mark a booking as fake; entries last 30 days. The system sends no more than eight confirmations per email address per day.

If a check fails, you cannot complete the online booking and are offered booking by telephone on +421 904 380 473. As telephone booking is always available, this is not a decision producing legal or similarly significant effects under Article 22 GDPR. If you believe there has been a mistake, contact us and we will review it personally. We do not use marketing profiling.

11. Emails you will receive from us

• Booking messages: acknowledgement of receipt, booking confirmation, changes, reminders, arrival instructions and deposit payment requests. These form part of your booking and do not require consent.
• Review request: one request, within 14 days of departure, only after a completed stay booked directly with us. You may opt out when booking, and each request includes an unsubscribe link.
• OPTIONAL — News and offers: only with your consent. Withdraw consent using the link in any email or by writing to umatkakubka@gmail.com; we will confirm withdrawal within 30 days.

The sender is Mgr. Vladimír Mačák (Ubytovanie u Maťka a Kubka). Resend provides technical email delivery, and replies go to umatkakubka@gmail.com. We do not track email opens or clicks.

12. Cookies and storage on your device

This website does not use analytics or advertising cookies and does not load third-party content until you request it. We therefore do not display a consent banner. Only what is strictly necessary for the service you have requested is stored in your browser:

• Language choice: when you select a language, we save the mk-jazyk cookie for one year, solely to remember your choice. If you close the suggestion to switch languages, your browser remembers this in local storage (mk-language-offer) until you clear the website’s data in your browser. We do not use either for analytics or advertising.
• Booking form: when you start entering your details, Cloudflare Turnstile protection loads, stores the cf.turnstile.u item in your browser’s local storage, and processes your IP address, browser and connection details.
• Winter challenge for children: completed tasks are saved in your browser’s local storage (the mk-zimna-vyzva item). They are not sent anywhere and can be cleared using the “Start again” button.
• OPTIONAL — Stripe payment page: cookies __stripe_mid (valid for one year) and __stripe_sid (30 minutes) for card payment fraud prevention.
• Map: loads only after you click “Open map”. Google then receives your IP address and browser details and may store data in your browser under its own policies. The address is also provided as text on the page.
• Video is played from our server, and fonts are loaded from our domain.

When you first visit a Slovak-language address, we select a language based on your browser settings; if your browser is set to English, the country of your connection may also help. We do not save this estimate. You can change the language at any time using the language menu.

Traffic measurement does not store anything on your device (section 3).

13. Your rights

You have the right to:

• access your data and obtain a copy (Article 15 GDPR);
• rectification of inaccurate data (Article 16 GDPR);
• erasure (Article 17 GDPR); however, data we are legally required to retain, such as guest registers, tax records and accounting documents, cannot be erased before the statutory period ends; we can only restrict its processing;
• restriction of processing (Article 18 GDPR);
• portability of data you provided under a contract or consent (Article 20 GDPR);
• withdraw consent at any time, without affecting processing carried out before withdrawal (Article 7(3) GDPR);
• lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk, or seek a judicial remedy.

Send your request to umatkakubka@gmail.com or call +421 904 380 473. To avoid disclosing data to someone else, we may ask you to verify your identity, for example by replying from the email address used for booking or providing your booking code. We will reply without undue delay, within one month at the latest. For complex requests, we may extend this by two months; we will tell you within the first month and explain why. Requests are handled free of charge.

14. Other people’s data

If you book for several people or provide other people’s data, please inform them of this policy. We need the details of accompanying guests, including children, for the guest register and accommodation tax records required by law. The booking must be made by an adult.

15. Changes to this policy

We update this policy when our processing practices or the law change. For each booking, we retain the version shown when it was submitted; previous versions are available on request.