Privacy Policy

T&H Management, s.r.o., Štúrova 10, 811 02 Bratislava, Slovakia, Company ID 53570219, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, File No. 150463/B, operates Roset Hotel & Residence and is the controller of the personal data described in this policy.

For privacy questions and requests, contact privacy@rosethotel.sk or write to our registered address above.

This policy covers our website, direct booking service and the processing of guests' personal data in connection with their stay. We process personal data under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection.

We obtain information from you when you enquire, book or check in. We may also receive your booking details from a booking platform, travel agent, employer or another person arranging your stay.

• Answering enquiries, arranging and providing your stay, and sending booking confirmations and pre-arrival information

  Information used

  Your name, contact details, reservation and stay details, and correspondence

  Legal basis

  Steps before entering into a contract and performance of the accommodation contract — Article 6(1)(b) GDPR

• Guest registration and statutory reporting

  Information used

  The identity and stay details required by law, including date of birth, address, identity-document details and nationality where required

  Legal basis

  Legal obligation — Article 6(1)(c) GDPR

• Billing, accounting and tax records

  Information used

  Billing details, invoices, payment information and relevant reservation details

  Legal basis

  Legal obligation — Article 6(1)(c) GDPR

• Handling complaints and establishing, exercising or defending claims

  Information used

  Relevant reservation, correspondence, transaction and incident records

  Legal basis

  Applicable legal obligations and our legitimate interest in resolving disputes and protecting our rights — Article 6(1)(c) or (f) GDPR, depending on the purpose

• A thank-you and review invitation after a direct booking

  Information used

  Your name, email address and departure date

  Legal basis

  Our legitimate interest in receiving feedback and improving our services — Article 6(1)(f) GDPR

• Recording your optional permission for promotional emails

  Information used

  Your contact details and the record of your choice

  Legal basis

  Consent — Article 6(1)(a) GDPR

• Protecting people and property through CCTV

  Information used

  Images of people and vehicles in monitored areas

  Legal basis

  Our legitimate interest in security and protecting people and property — Article 6(1)(f) GDPR

• Optional website analytics and advertising

  Information used

  Online identifiers and information about website use

  Legal basis

  Consent — Article 6(1)(a) GDPR; see our Cookie Policy

Our guest profiles in Ellipse contain names, dates of birth, addresses and, where available, email addresses and telephone numbers, together with information relating to the booking and stay.

Guest registration and foreign-guest reporting are governed in particular by Act No. 253/1998 Coll. and Act No. 404/2011 Coll., as applicable. Accounting and tax obligations arise in particular under Act No. 431/2002 Coll. on Accounting, Act No. 222/2004 Coll. on VAT and Act No. 582/2004 Coll. on Local Taxes, together with applicable municipal rules.

Information needed to arrange your booking and meet statutory registration requirements is mandatory for those purposes. If it is not provided, we may be unable to complete the booking or accommodate you. Optional promotional and cookie choices are not a condition of booking or staying with us.

We inspect identity documents to verify identity. We do not make or retain scans or copies of those documents. This does not affect the recording of identity details required by law. We do not maintain health or allergy records; please avoid including unnecessary medical information in booking notes or messages.

Booking confirmations, pre-arrival information and practical messages about your stay are service communications. We currently do not send promotional email campaigns.

For direct bookings, we send a thank-you and review invitation one day after departure. It contains no promotional offers. You can object to these invitations by contacting privacy@rosethotel.sk. Booking platforms may send their own messages under their own privacy policies.

If you give optional permission for promotional emails during booking, we record that choice separately. It remains active for two years from signup unless you withdraw it earlier by emailing privacy@rosethotel.sk. Expiry or withdrawal of that permission does not automatically erase your reservation or other records retained for separate purposes. Signing an acknowledgement that you have received privacy information is not consent to promotional emails.

Our cameras monitor the parking area, entrances, reception and lobby, atrium and corridors, as well as the exterior of the property and the supplier delivery area. Three exterior cameras capture parts of Štúrova and Tallerova streets, including adjacent public areas. There is no camera inside the lift. We do not record audio. Monitored areas are marked with CCTV signs.

Ordinary footage is overwritten after seven days. An extract relating to an incident may be retained for the time needed to investigate that incident or deal with the related claim or proceedings. Relevant footage may be provided to the Police or an insurer where there is an appropriate legal basis.

Retention depends on the purpose of the record rather than one period applying to all guest information.

• Invoices and related accounting and VAT records

  Retention period or criterion

  Ten years following the year to which they relate; longer where legislation requires it

• Copies of guest registration cards held by the hotel

  Retention period or criterion

  Two years

• Signed acknowledgements of receipt of privacy information

  Retention period or criterion

  Two years

• Active optional promotional-email permission

  Retention period or criterion

  Two years from signup, or until earlier withdrawal

• Ordinary CCTV footage

  Retention period or criterion

  Seven days

• Incident extracts and records needed for a dispute or claim

  Retention period or criterion

  Until the incident, claim or proceedings are resolved and the relevant legal retention or limitation requirements have been met

• Guest profiles and associated reservation records in Ellipse

  Retention period or criterion

  Ten years from departure after your most recent stay.

Foreign guests' stay reports are submitted to the Police within five days of accommodation. This is a reporting deadline, not a five-day retention period.

Where permission expires or is withdrawn, we may still need a limited record of the choice to demonstrate compliance and respect your objection. Any such record is separate from permission to send promotional messages.

We share information where needed for the relevant service or legal purpose with these categories of recipients:

• HORECA GROUP / Ellipse for reservations, guest records and related communications; distribution and reservation services including reconline.
• Booking platforms, including Booking.com and Expedia, where your booking involves them.
• Global Payments and other relevant financial institutions for payment processing.
• H-Com for IT and email support, Microsoft for the services we use, and ACCES for external accounting.
• Website hosting, infrastructure and support providers, and the Google services described in our Cookie Policy.
• Zanex and Bolt where used to arrange transport.
• Public authorities where disclosure is legally required, and relevant insurers or professional advisers where needed for an incident or claim.

Recipients may act as our processors or as independent controllers, depending on their service and purpose. Booking platforms, payment providers and transport providers may also process information under their own privacy policies. We do not give every supplier access to every category of guest information.

Our use of international analytics, advertising, cloud and website infrastructure services may involve processing outside the European Economic Area, including in the United States. The applicable transfer arrangements depend on the service and destination and include European Commission adequacy decisions or Standard Contractual Clauses with additional safeguards where required.

For its advertising and analytics services, Google explains that it relies on the EU–US Data Privacy Framework for relevant transfers to the United States and may use Standard Contractual Clauses for other transfers. Details and the relevant terms are available in Google's international-transfer information. Microsoft describes its cloud-service arrangements in its data-location and transfer information; Cloudflare sets out its safeguards in its Data Processing Addendum.

For information about the arrangements applicable to your data, or to request a copy of the relevant safeguards, contact privacy@rosethotel.sk. Booking platforms and other independent controllers describe their own processing and transfer arrangements in their privacy policies.

Analytics and Marketing are separate optional choices on our website and booking website. Google Analytics 4 measurement runs with Analytics consent; Google Ads measurement and remarketing run with Marketing consent. You can change or withdraw either choice through Cookie preferences. Refusing these optional purposes does not prevent you from booking.

Our Cookie Policy explains the shared choice, browser storage and the Maps, Ella and tag-management connections that occur independently of these two categories.

We do not make decisions about accepting your booking or setting an individual price based solely on automated processing of your guest profile. Advertising services may use online identifiers for remarketing when you permit Marketing, as explained in our Cookie Policy.

Depending on the processing and the legal conditions, you can request access, correction, erasure, restriction or portability of your personal data. You can object to processing based on legitimate interests. An objection to direct marketing stops processing for that purpose, including related profiling. Where processing relies on consent, you can withdraw it at any time; this does not affect processing lawfully carried out before withdrawal. Erasure may be limited by legal retention duties or the need to establish, exercise or defend claims.

Contact privacy@rosethotel.sk to exercise your rights. We respond without undue delay and within one month. Where justified by complexity or the number of requests, we may extend this by up to two further months and explain why within the first month. Requests are normally free of charge. If reasonably necessary, we may ask for information to confirm your identity.

You can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovakia. Your right to seek a judicial remedy is unaffected.

We use appropriate technical and organisational measures to protect personal data. We update this policy when our services or processing change.