Last updated 1 October 2026.
This policy explains what personal data we process when operating the kvestor.app online reservation system, why we process it, who we disclose it to and what rights you have in relation to it. Processing in which we act as a processor is additionally governed by Annex 1 to the General terms and licence conditions.
- Who we are
- The role in which we act
- Data of customers and users
- Guest data
- Data of website visitors
- How long we keep data
- Recipients and sub-processors
- Transfers outside the European Union
- How we protect data
- Your rights
- Cookies
- Changes to this policy
1. Who we are
1.1 The controller is Assembly 11 s. r. o., with its registered office at Osadná 2, 831 03 Bratislava - mestská časť Nové Mesto, company ID: 51 239 698, tax ID: 2120665184, VAT ID: SK2120665184, registered in the Commercial Register of the Bratislava III City Court, section: Sro, insert no. 124492/B.
1.2 For data protection matters contact us at info@kvestor.app. We have not appointed a data protection officer under article 37 GDPR because the law does not require us to.
1.3 The supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, Slovakia.
2. The role in which we act
2.1 We are the controller of the data of our customers and the users they create, of billing data and of data of visitors to our website. We decide about this data and clauses 3, 5 and 6 of this policy apply to it.
2.2 We are a processor of the data a customer enters into the system, in particular the data of their guests. The controller of that data is the accommodation provider using kvestor.app. We work with it only on their instructions and to the extent needed to operate the system.
2.3 If you are a guest and wish to exercise your rights regarding data about your stay, please contact the accommodation provider you stayed with. If you contact us, we will forward your request to them without undue delay.
3. Data of customers and users
3.1 Registration and account operation. We process the name, surname, e-mail, telephone, name and address of the property, login credentials and account settings. The legal basis is performance of a contract under article 6(1)(b) GDPR.
3.2 Billing and payments. We process the business name, registered office, company ID, tax ID, VAT ID, billing e-mail and data on payments made. The legal basis is performance of a contract and compliance with a legal obligation under article 6(1)(b) and (c) GDPR. We neither process nor have access to payment card details; these are processed directly by the payment gateway provider.
3.3 Support and communication. We process the content of e-mail communication and the data needed to handle the request. The legal basis is performance of a contract and our legitimate interest in providing support under article 6(1)(f) GDPR.
3.4 Operational and security logs. We process the IP address, time of access, browser type and records of logins and changes in the account. The legal basis is our legitimate interest in securing the system and in demonstrating the actions performed under article 6(1)(f) GDPR.
3.5 Record of acceptance of the terms. We process the record of which version of the terms and conditions you agreed to at registration, and the date of registration. The legal basis is our legitimate interest in proving the content of the contract under article 6(1)(f) GDPR.
3.6 Providing the data under clauses 3.1 and 3.2 is a contractual and statutory requirement. Without it we cannot provide the service or issue a tax document.
4. Guest data
4.1 On behalf of the customer we process guest data to the extent the customer enters into the system or the guest fills in when booking or at self check-in. This is in particular the name and surname, date of birth, nationality, address, e-mail, telephone, identity document number, stay and reservation data and payment data.
4.2 The identity document number and date of birth are processed because the law requires an accommodation provider to keep them in the guest register. The scope of this data is determined by the customer as the controller.
4.3 Special categories of personal data under article 9 GDPR, such as health data, are not processed in the system. The customer is not entitled to enter them into the system.
4.4 We disclose guest data to connected sales channels and to the providers listed in clause 7 only to the extent necessary to handle a reservation, send an e-mail to a guest or process a payment.
4.5 We do not use this data for our own purposes, we do not sell it and we do not disclose it to other customers. The data of individual customers is separated in the system.
5. Data of website visitors
5.1 On the kvestor.app website we use no analytics, advertising or profiling tools and we do not track visitor behaviour across websites. Fonts and images are hosted by us, not by third parties.
5.2 The web server records ordinary operational data about requests including the IP address. The legal basis is our legitimate interest in the security and stability of the service under article 6(1)(f) GDPR.
5.3 In public forms, in particular at registration and when booking through the widget, we use Google reCAPTCHA to protect against automated abuse. The legal basis is our legitimate interest in protecting the system under article 6(1)(f) GDPR.
5.4 The booking widget is deployed on our customers’ websites. When a reservation is made it sends technical events about the course of the reservation, including the amount and currency, to the data layer (dataLayer) of that website. If the customer has a tool on its site that collects those events, the customer, not we, is the controller of that processing; we do not process this data for our own purposes. The customer’s own privacy policy and consent settings apply on the customer’s site.
6. How long we keep data
6.1 We keep account data and the data stored in it for the term of the contract. Restricting the scope of the service after the subscription period expires is not a termination of the contract and does not delete any data. After the contract ends we make the data available for download for at least 30 days and then delete it; the details are set out in Annex 2 to the terms and conditions.
6.2 We keep billing and accounting documents for the period required by tax and accounting legislation, as a rule 10 years from the end of the relevant accounting period.
6.3 We keep the record of acceptance of the terms and conditions for the term of the contract and for a further 4 years after it ends, that is, for the period during which claims under the contract may be raised.
6.4 We keep operational and security logs for no more than 12 months. We keep e-mail communication with support for no more than 3 years.
6.5 On backups, data is deleted as part of the ordinary overwrite cycle, at the latest within 90 days of its deletion from the operational database.
6.6 The retention period for guest data is determined by the customer as its controller; we delete it on their instruction or under clause 6.1.
6.7 If no one logs in to an account for 6 months and the account is at that time on the free plan or its subscription period has already ended, we notify the customer by e-mail and after a further 30 days we are entitled to terminate the contract and close the account. The data is then deleted in accordance with clause 6.1.
7. Recipients and sub-processors
7.1 We do not sell personal data and do not provide it to third parties for their own purposes. We disclose it only to the following providers, who process it exclusively for us and on our instructions, and to public authorities where the law requires it.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Application and database hosting | Finland (EU) |
| Beds24.com | Connection to Booking.com, transfer of availability, prices and reservations | European Economic Area |
| Megaubytovanie.sk | Sales channel connection | Slovakia (EU) |
| Hauzi.sk | Sales channel connection | Slovakia (EU) |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Processing of licence payments and guest online payments, licence invoicing | Ireland (EU), USA |
| Zoho Corporation B.V. (Zoho Mail) | Sending e-mails to guests and customers | Netherlands (EU) |
| Google Ireland Limited | reCAPTCHA in public forms | Ireland (EU), USA |
7.2 We notify customers of a change to this list at least 14 days in advance, following the procedure in clause A.7 of Annex 1.
7.3 Connecting to individual sales channels is optional. If a customer does not enable it, their guests' data is not passed to the provider concerned. The same applies to guest online payments.
8. Transfers outside the European Union
8.1 Data is stored on servers within the European Union. A transfer outside the European Union may occur only with the providers listed in clause 7 that have part of their infrastructure or support in a third country.
8.2 Such a transfer takes place only on the basis of a European Commission adequacy decision or on the basis of standard contractual clauses under article 46 GDPR. We will provide a copy of them on request.
9. How we protect data
9.1 Communication with the system is encrypted (HTTPS). We store passwords solely as a cryptographic hash, never in readable form.
9.2 Access to data is governed by roles and permissions that the customer sets for their users. The data of individual customers is separated in the system.
9.3 Access to and changes in data are logged. The database is backed up regularly and the backups are protected by the same measures as the operational data.
9.4 Access of our employees and suppliers to data is limited to what is necessary to perform their tasks and they are all bound by confidentiality.
9.5 If a personal data breach occurs that is likely to result in a risk to the rights of data subjects, we will report it to the supervisory authority and to the affected customers within the periods set out in articles 33 and 34 GDPR.
10. Your rights
10.1 You have the right of access to your data and to a copy of the data processed, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability and the right to object to processing we carry out on the basis of a legitimate interest.
10.2 Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before it was withdrawn.
10.3 Send your request to info@kvestor.app. We will handle it without undue delay and within one month at the latest. In justified cases we may extend this period by two months and will inform you if we do.
10.4 If we have reasonable doubts about your identity, we may request additional information needed to verify it.
10.5 You have the right to lodge a complaint with the supervisory authority named in clause 1.3.
10.6 We do not take decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.
10.7 A customer can export its data from the system at any time. The scope of exportable data, the available formats and the procedure for switching to another provider are set out in Annex 2 to the terms and conditions.
11. Cookies
11.1 On the kvestor.app website we use no cookies and no analytics or advertising tools. For that reason we also display no cookie consent banner.
11.2 In the application itself we use only strictly necessary technical means: a login token held in the browser's memory that keeps you signed in for the session and ceases to exist once the tab is closed, and the data set by Google reCAPTCHA in public forms.
11.3 The strictly necessary technical means under clause 11.2 do not require consent under section 109(8) of Act No. 452/2021 Coll. on electronic communications, because they serve solely to transmit and provide the service you have requested.
11.4 The booking widget deployed on a customer’s site does not set any cookies of its own. The customer is responsible for the cookies and tools deployed on its own site, including consent for them; see clause 5.4.
11.5 If we deploy analytics or marketing tools in the future, we will amend this policy and obtain consent in advance.
12. Changes to this policy
12.1 We may update this policy, in particular when the scope of the service changes, when a sub-processor changes or when legislation changes.
12.2 The current version is always available at this address together with the date of the last update. We inform customers of material changes by e-mail or by a notice in the application.