Privacy Policy

The data controller responsible for processing your personal data is:

We may collect the following categories of personal data:

• Identity data: first name, last name
• Contact data: email address, phone number, postal address
• Booking data: check-in/check-out dates, number of guests, special requests
• Technical data: IP address, browser type, device information, pages visited (collected via cookies)
• Communication data: messages sent via email or contact forms

We process your personal data under the EU General Data Protection Regulation (GDPR) for the following purposes:

• Contract performance (Art. 6(1)(b) GDPR): processing bookings, managing your stay, communicating about your reservation
• Legal obligation (Art. 6(1)(c) GDPR): guest registration as required by Slovenian law (Tourism Promotion Act), tax and accounting records
• Legitimate interest (Art. 6(1)(f) GDPR): website analytics to improve our service, security monitoring
• Consent (Art. 6(1)(a) GDPR): marketing communications (only if you opt in), non-essential cookies

Under Slovenian law (Tourism Promotion Act / Zakon o spodbujanju razvoja turizma), we are required to register all guests and report their data to the Slovenian Police. This includes name, date of birth, nationality, ID/passport number, and dates of stay. This data is retained as required by law.

We may share your personal data with:

• Slovenian authorities: guest registration data as required by law
• Booking platforms: if you book through a third-party platform (e.g., Booking.com, Airbnb), your data is also governed by their privacy policies
• Service providers: website hosting, email services, and analytics tools that process data on our behalf

We do not sell your personal data. All third-party processors are bound by data processing agreements in compliance with the GDPR.

Our website uses cookies to ensure proper functionality and to analyze site usage. For full details, see our Cookie Policy.

• Essential cookies: required for the website to function (no consent needed)
• Analytics cookies: help us understand how visitors use the site (require consent)

• Booking and guest data: retained for the duration required by Slovenian tax and tourism law (up to 10 years for financial records)
• Communication data: retained for up to 2 years after your last interaction
• Cookie data: see Cookie Policy for specific retention periods

Under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Eraseyour data ("right to be forgotten"), subject to legal retention obligations
• Restrict processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time (without affecting the lawfulness of prior processing)

To exercise any of these rights, contact us at apartment.kalvista@gmail.com. We will respond within 30 days.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia:

We may update this Privacy Policy from time to time. The latest version will always be available on this page with the updated date shown above.