Informative translation – in case of any discrepancy, the Slovak version prevails. Slovak version
Privacy notice – TatraByte (Rezerva)
This notice explains how TatraByte processes personal data as a controller: data of clients who use Rezerva, of their staff with access to Rezerva and of prospective clients, and data needed for the security and operation of the platform.
Are you a guest or customer of a guesthouse, salon or restaurant? Your booking data are processed, as controller, by the business you booked with – you will find its privacy information next to the booking form. TatraByte processes these data only on that business's behalf, as a processor. Please direct any questions and requests to the business. If you write to us, we will forward your request to the business within 2 working days and let you know that we have done so.
1. Controller
Andrej Petrulák, trading as TatraByte, place of business Slnečná 954/28, 059 71 Ľubica, IČO (company ID) 57647194, DIČ (tax ID) 1130908647, registered in the Trade Register of the District Office Kežmarok, Trade Register No. 730-23421 ("TatraByte" or "we").
Contact for personal data protection matters: andrej@tatrabyte.sk, +421 915 088 580. We have not appointed a data protection officer because Article 37 of Regulation (EU) 2016/679 (GDPR) does not require us to.
2. What data, for what purpose, on what basis and for how long
| Purpose | Data subjects and data | Legal basis | How long |
|---|---|---|---|
| Concluding and performing the contract with the client, communication concerning the contract | clients – businesses and the persons acting on their behalf: name, business name, address, IČO, DIČ, e-mail, phone, order; record of acceptance of the terms and of the data processing agreement (name and e-mail of the person, time, document version) | performance of a contract – Article 6(1)(b) GDPR, if the client is a natural person; for contact persons and persons acting on behalf of legal persons, our legitimate interest in communicating with the client – Article 6(1)(f) GDPR | for the duration of the contract and 4 years after it ends |
| Invoicing and accounting | client's billing details, payments | legal obligation – Article 6(1)(c) GDPR, Section 35 of Slovak Act No. 431/2002 Coll. on accounting, Section 76 of Slovak Act No. 222/2004 Coll. on value added tax | 10 years after the end of the year to which the document relates |
| User accounts in Rezerva | clients' owners and staff: name, e-mail, role, business, password stored only as a bcrypt hash, invitations to set a password, login cookie rz_adm | for clients who are natural persons, performance of a contract – Article 6(1)(b) GDPR; for clients' staff, our and the clients' legitimate interest in individual and secure access – Article 6(1)(f) GDPR | while the account is active; it is deleted when the client cancels it, at the latest together with the client's data after the contract ends; invitations: 30 days after use or expiry |
| Login records | time, account e-mail, truncated hash of the IP address (a device fingerprint; the IP address is not stored in readable form) and the result of the login attempt | legitimate interest in detecting password guessing and unauthorised access – Article 6(1)(f) GDPR | 6 months |
| Change log in the salon administration | who made which change and when (including a description of the change, which may contain a customer's name) | legitimate interest in the security and traceability of changes – Article 6(1)(f) GDPR; the client can see the records of its own business | 12 months |
| Form protection and limiting the number of attempts | hash of the IP address, e-mail and time of the attempt, for salons and restaurants also the phone number; the number of confirmations sent to one e-mail address across all businesses (at most 8 a day) | legitimate interest in protecting the platform and third parties against flooding and misuse of the forms – Article 6(1)(f) GDPR (Recital 49 GDPR) | 2 days |
| Technical logs | data on requests to Rezerva in the Cloudflare Workers logs (e.g. address, time, error messages) | legitimate interest in dealing with errors and attacks – Article 6(1)(f) GDPR | at most 7 days |
| Availability monitoring | results of automated checks and outage alerts; they contain only the name of the business (which may include the name of a sole trader) and the type of fault, not guest data | legitimate interest in keeping the service running – Article 6(1)(f) GDPR | results: 90 days |
| Prospective clients (the "Chcem Rezervu" form) | type and name of the business, name, phone, e-mail (optional), message; hash of the IP address to limit the number of submissions (5 a day); the form rejects an obviously invented phone number and an e-mail address on a domain that does not exist (Cloudflare's DNS server receives only the domain) | steps taken at your request before entering into a contract – Article 6(1)(b) GDPR | 12 months from the last contact, if you do not become a client |
| Support | content of communication with clients and their staff | performance of a contract and legitimate interest – Article 6(1)(b) and (f) GDPR | for the duration of the contract and 4 years after it ends |
| Fulfilling obligations towards authorities and defending legal claims | data needed in the specific matter | Article 6(1)(c) and (f) GDPR | until the matter is concluded |
| Register of personal data breaches and data subject requests | description of the incident or request and the measures taken | legal obligation – Article 6(1)(c), Article 33(5) and Article 12 GDPR | 5 years from the closure of the record |
For processing based on legitimate interest, we have carried out a balancing test; we will send it to you on request. We do not send newsletters. We send clients only service notices that form part of the contract (changes to the terms, prices and subcontractors, planned maintenance, outages, security alerts). We do not use the data of prospective clients for anything other than getting back to them, and we do not pass them on to anyone.
If you do not provide us with the data needed to conclude the contract, we cannot conclude the contract with you. A Rezerva account cannot be used without an e-mail address and a password.
3. Recipients
- Cloudflare, Inc. (USA) – operation of Rezerva, database (primarily in the EU), Turnstile form protection, technical logs.
- Resend (Plus Five Five, Inc., USA) – sending e-mails (e.g. invitations, confirmations to prospective clients).
- E-mail mailbox provider – Google Ireland Limited (Ireland; Google Workspace; data may also pass through Google LLC in the USA under the EU-US Data Privacy Framework): receiving e-mails and enquiries.
- Telegram (Telegram Messenger Inc.) – delivery of outage alerts to our own account; the messages contain only the name of the business and the type of fault.
- Accounting software and accountant – KROS a.s. (Žilina; KROS Fakturácia software) and an external accountant; bank – for invoice payments.
- Public authorities (e.g. the tax office, a court, the Office for Personal Data Protection of the Slovak Republic) and a lawyer – where required by law or for the defence of claims.
We do not sell data and do not use them for profiling or automated decision-making.
4. Transfers outside the European Union
Cloudflare and Resend are companies in the USA. Transfers take place on the basis of the Commission's adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) and of standard contractual clauses (Commission Implementing Decision (EU) 2021/914). Google Ireland Limited may transfer data to Google LLC in the USA on the basis of the same framework and of standard contractual clauses that form part of the Google Workspace data processing agreement. Telegram stores data of users from the European Economic Area in data centres in the Netherlands. We will send you a copy of the safeguards on request.
5. Cookies and storage on Rezerva's pages
We use no analytics or advertising cookies on the rezerva.tatrabyte.sk pages. The "Chcem Rezervu" form and the login page are protected by Cloudflare Turnstile; after logging in to the administration, the login cookie rz_adm (180 days) is set. An overview of all items is given in the document Cookies and device storage.
6. Your rights
You have the right of access to your data, to their rectification, erasure, restriction of processing and portability, the right to object to processing based on legitimate interest, and the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk.
Send your request to andrej@tatrabyte.sk. We will reply without undue delay and at the latest within one month; for a complex request we may extend the period by two months, and we will inform you of this, with the reason, within one month. Handling requests is free of charge. To make sure we do not disclose data to someone else, we may ask you to verify your identity, for example by replying from the e-mail address you use in Rezerva.
We cannot erase data that we must keep by law (e.g. accounting documents) before the retention period expires; we will, however, restrict their processing.
7. Changes
We update this notice when the processing or the law changes. Previous versions can be found in the Rezerva legal centre; we inform clients of material changes by e-mail.