/
pursuant to Art. 19 and 20 of Act No. 18/2018 Coll. on the Protection of Personal Data, as amended
and Art. 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
The controller of your personal data is the business company LENSSON, s. r. o., with its registered office at Panenská 18, 811 03 Bratislava, Company ID (IČO): 35 955 562, registered in the Commercial Register of City Court Bratislava III, Section Sro, Insert No. 37609/B.
The contact details of Controller are:
e-mail: izybratislava@gmail.com
telephone number: +421919440945
In connection with the processing of personal data, the Controller has not appointed a data protection officer. As a Data Subject, you may contact the Controller regarding matters of personal data processing in writing at the address Panenská 18, 811 03 Bratislava or electronically at the email address izybratislava@gmail.com.
This Privacy Notice provides information on how the Controller obtains, stores and processes the personal data of Data Subjects. With regard to ensuring the security and protection of the personal data of Data Subjects, the Controller has adopted and implemented a range of technical and organisational measures aimed at minimising unauthorised interference and the unauthorised disclosure of and dealing with personal data. In this Privacy Notice, we also provide you with information on how the Controller protects your personal data, as well as on your rights and the means of exercising them.
This document is published on the Controller’s Website https://www.izy-stay.com/ and is publicly accessible to all Data Subjects.
The words defined in this Article that are used in the singular shall also apply to the plural and vice versa, unless the context require otherwise. The words used in any grammatical gender shall include all other grammatical genders (e.g. the words in masculine gender shall cover also the feminine gender).
The terms and definitions used in this Privacy Notice shall, unless stated otherwise, have the following meaning for the purposes of this Privacy Notice:
OSH – occupational safety and health;
Member State – a state that is a member state of the European Union or a contracting party to the Agreement on the European Economic Area;
Data Subject – any natural person whose personal data are processed by the Controller; that is, an identified or identifiable person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Privacy Notice – this Privacy Notice on the Processing of Personal Data;
Client – an entity that is in a contractual relationship with the Controller, insofar as data protection applies to it;
GDPR Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
Civil Code – Act No. 40/1964 Coll., Civil Code;
FP – fire protection;
Controller – an entity which, alone or jointly with others, determines the purposes and means of the processing of personal data; for the purposes of this Privacy Notice the business company LENSSON, s. r. o., with its registered office at Panenská 18, 811 03 Bratislava, Company ID no.: 35 955 562, registered in the Commercial Register of City Court Bratislava III, Section Sro, Insert No. 37609/B;
Recipient – a natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether or not a third party; however, public authorities which may receive personal data in the context of a particular inquiry in accordance with EU law or the law of an EU Member State are not regarded as recipients (the processing of such data by those public authorities takes place in compliance with the applicable data protection rules according to the purposes of the processing);
Processor – a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;
Third Country – a country that is not a Member State;
Third Party – any natural or legal person, authority, association, foundation or other entity or person having legal personality under the law of any jurisdiction, other than the Controller, the Recipient, the Processor or the Data Subject;
Accommodation Rules – a document regulating the conditions of temporary accommodation and the rights and obligations of the Controller as accommodation provider, and Client, and is available at the Accommodation Facility;
Accommodation Unit – a specific space within the Accommodation Facility that is the subject of the Agreement;
Accommodation Facility – the premises of a property in which the Accommodation Provider offers accommodation services, such as a hotel, hostel, lodging house, etc.;
Accommodation – temporary accommodation services for an agreed period and in an agreed part of the Accommodation Facility provided by the Accommodation Provider under the Agreement;
Job Applicant – any person who takes the relevant steps and expresses an interest in becoming an Employee of the Controller;
GTC – General Terms and Conditions of Controller (as a trader) for Accommodation;
Website – the Controller’s website, i.e. https://www.izy-stay.com/;
Employee – a natural person who, within an employment relationship, performs dependent work for the Controller as employer, or who ensures the performance of tasks for, or the satisfaction of the needs of, the Controller through agreements on work performed outside an employment relationship, or, as the case may be, a natural person (or a legal person and its employees and/or subcontractors) who ensures the performance of the Controller’s tasks through another type of contractual arrangement;
OSH Act – Act No. 124/2006 Coll. on Safety and Health Protection at Work, as amended;
Value Added Tax Act – Act No. 222/2002 Coll. on Value Added Tax;
Income Tax Act – Act No. 595/2003 Coll. on Income Tax;
Personal Data Protection Act – Act No. 18/2018 Coll. on the Protection of Personal Data, as amended;
Consumer Protection Act – Act No. 108/2024 Coll. on Consumer Protection;
Social Insurance Act – Act No. 461/2003 Coll. on Social Insurance;
Accounting Act – Act No. 431/2002 Coll. on Accounting;
Health Insurance Act – Act No. 580/2004 Coll. on Health Insurance, as amended;
Labour Code – Act No. 311/2001 Coll., the Labour Code;
Interested Party – any person who takes the relevant steps and expresses an interest in entering into an Agreement with the Controller;
Agreement – any agreement between the Controller and a Client or an Employee.
Personal data means data relating to an identified natural person or an identifiable natural person who can be identified, directly or indirectly, in particular on the basis of a generally usable identifier, another identifier such as a first name, surname, identification number, location data, or an online identifier, or on the basis of one or more characteristics or features specific to that person’s physical, physiological, genetic, psychological, mental, economic, cultural or social identity.
The processing of personal data means an operation or set of operations performed on personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, whether or not by automated means.
We obtain personal data directly from you as the Data Subject. Where personal data are not obtained directly from you as the Data Subject, such personal data may originate from publicly available sources, registers and records, or may originate from Third Parties who were authorised or obliged to provide your personal data to the Controller.
The Controller processes your personal data only in electronic form.
The Controller obtains and processes your personal data exclusively for specifically determined, explicitly stated and legitimate purposes, and personal data so obtained is further processed in a manner compatible with those purposes. Every instance of the processing of personal data by the Controller has its legal basis in Art. 6 of the GDPR Regulation (or Art. 13 of the Personal Data Protection Act). The Controller furthermore processes your personal data in accordance with the principles of the processing of personal data under Art. 5 of the GDPR Regulation (or Art. 6–12 of the Personal Data Protection Act).
The Controller processes your personal data for the specified purposes and to the following extent:
Pre-contractual relations – the Controller may obtain and process personal data for the purposes of contacting Interested Parties, prospective Clients or other Data Subjects, handling the establishment of contact for the purpose of providing information about the individual Accommodation offered by the Controller, and for the purpose of concluding the Agreement and the GTC, including where you contact us through the contact form available on the Website, by email, or by other means.
Category of Data Subjects: Interested Parties, Clients;
Scope and categories of personal data processed: in particular, ordinary personal data such as, in the case of a natural person, name and surname, and contact details (e-mail, telephone number); in the case of a legal person or a natural person-entrepreneur (where data protection applies to them), business name, contact details (e-mail, telephone number), and the name and surname of the statutory body;
Legal basis for the processing of personal data: the processing is necessary for taking steps prior to entering into the Agreement, at the request of the Data Subject, in particular pre-contractual relations – Art. 6 para 1 letter b) of the GDPR Regulation and Art. 13 para 1 letter b) of the Personal Data Protection Act;
Retention period of personal data: for the period necessary to achieve the purpose for which it was obtained;
Job Applicants – the Controller may obtain and process personal data for the purpose of contacting Job Applicants or other Data Subjects, in particular for the purposes of the Job Applicant selection procedure.
Category of Data Subjects: Job Applicants;
Scope and categories of personal data processed: in the case of a natural person: name, surname, address of permanent or temporary residence, date of birth, telephone number, contact details (e-mail, telephone number), marital status, education, certificates obtained, training completed, previous employers, and various skills and experience; in the case of a legal person or a natural person-entrepreneur (where data protection applies to them): business name, contact details (e-mail, telephone number), first name and surname of the statutory body, and the qualification of the statutory body;
Legal basis for the processing of personal data: the processing is necessary for taking steps prior to entering into a contractual relationship with the Job Applicant, in particular pre-contractual relations – Art. 6 para 1 letter b) of the GDPR Regulation and Art. 13 para 1 letter b) of the Personal Data Protection Act;
Retention period of personal data: for the duration of the selection procedure, until the application is rejected, or, if the Job Applicant is successful, for the duration of the contractual relationship;
Conclusion and existence of the contractual relationship – the Controller obtains and processes the personal data of Job Applicants, Employees, Interested Parties and Clients that are necessary for entering into and maintaining the contractual relationship, in particular for the purposes of concluding and duly performing the Agreement and the GTC, asserting any claims arising from the relevant contractual relationship, exercising and enforcing other rights and obligations arising from the Agreement, amendments to the Agreement, termination of the Agreement, keeping related records of the Agreement, and communicating with the Data Subject in connection with the Agreement.
Category of Data Subjects: Job Applicants, Employees, Interested Parties, Clients;
Scope and categories of personal data processed: in particular, ordinary personal data such as, in the case of a natural person: name and surname, birth surname, address of permanent or temporary residence, date of birth, birth (personal identification) number, identity document number, and contact details (e-mail, telephone number); in the case of a legal person or a natural person-entrepreneur (where data protection applies to them): business name, registered office/place of business, Company ID number, Tax ID number, VAT ID number, contact details (e-mail, telephone number), name and surname of the statutory body, position, entry in the Commercial Register of the Slovak Republic or another register, legal form, and IBAN;
Legal basis for the processing of personal data: the processing is necessary for the performance of an Agreement to which the Employee or Client is party as the Data Subject, or for taking steps prior to entering into the Agreement at the request of the Data Subject – Art. 6 para 1 letter b) of the GDPR Regulation and Art. 13 para 1 letter b) of the Personal Data Protection Act;
Retention period of personal data: for the duration of the Agreement, as well as for a period of 10 years following termination of the contractual relationship, having regard to any claims that may arise from the Agreement and the length of the applicable limitation periods;
Payroll and personnel administration, OSH – the Controller obtains and processes the personal data of Employees for the purpose of maintaining the Controller’s payroll and personnel records, as employer, relating to Employees, and for fulfilling the Controller’s statutory obligations as employer in connection with the employment relationship or a similar relationship, including fulfilling the Controller’s obligations relating to the safety and protection of Employees at work.
Category of Data Subjects: Employees;
Scope and categories of personal data processed: in particular, ordinary personal data such as, in the case of a natural person: name and surname, birth surname, address of permanent or temporary residence, date of birth, birth (personal identification) number, identity document number, contact details (e-mail, telephone number), IBAN;
Legal basis for the processing of personal data: the processing is necessary for the performance of an Agreement to which the Employee is party as the Data Subject – Art. 6 para 1 letter b) of the GDPR Regulation and Art. 13 para 1 letter b) of the Personal Data Protection Act; the processing is necessary for compliance with a legal obligation of the Controller under a special regulation or an international treaty by which the Slovak Republic is bound, in particular under the Labour Code, the OSH Act, the Income Tax Act, the Accounting Act, the Social Insurance Act, or the Health Insurance Act – Art. 6 para 1 letter c) of the GDPR Regulation and Art. 13 para 1 letter c) of the Personal Data Protection Act;
Retention period of personal data: for the duration of the purpose for which the data are processed, and in accordance with the statutory requirements for the retention and archiving of personal data;
Complaints – the Controller obtains and processes the personal data of Data Subjects that are necessary for conducting complaint proceedings brought by a Client, as well as proceedings concerning submissions or complaints, and for keeping records of such proceedings
Category of Data Subjects: Clients;
Scope and categories of personal data processed: in particular, ordinary personal data such as, in the case of a natural person: name and surname, contact details (e-mail, telephone number), IBAN; in the case of a legal person or a natural person-entrepreneur (where data protection applies to them): business name, contact details (e-mail, telephone number), name and surname of the statutory body, IBAN;
Legal basis for the processing of personal data: the processing of personal data is necessary for compliance with a legal obligation of the Controller under a special regulation or an international treaty by which the Slovak Republic is bound under a special regulation, in particular the Consumer Protection Act and the Civil Code – Art. 6 para 1 letter c) of the GDPR Regulation and Art. 13 para 1 letter c) of the Personal Data Protection Act;
Retention period of personal data: for a period of 2 years from the termination of the contractual relationship or from the handling of the complaint, unless applicable law provides otherwise;
Accounting and invoicing – the Controller obtains and processes the personal data of Data Subjects that are necessary for the purposes of performing concluded Agreements, and, among other things, for the purposes of invoicing (issuing a tax document), sending invoices, and maintaining accounting records.
Category of Data Subjects: Clients;
Scope and categories of personal data processed: in the case of a natural person: name and surname, birth surname, address of permanent residence, date of birth, birth (personal identification) number, and contact details (e-mail, telephone number); in the case of a legal person or a natural person-entrepreneur (where data protection applies to them): business name, registered office/place of business, Company ID number, Tax ID number, VAT ID number, contact details (e-mail, telephone number), name and surname of the statutory body, position, entry in the Commercial Register of the Slovak Republic or another register, legal form, IBAN; as well as any other personal data to the extent required under the Accounting Act, the Income Tax Act, the Value Added Tax Act, and other related legal regulations;
Legal basis for the processing of personal data: the processing is necessary for the performance of an Agreement to which the Client is party as the Data Subject – Art. 6 para 1 letter b) of the GDPR Regulation and Art. 13 para 1 letter b) of the Personal Data Protection Act; the processing of personal data is necessary for compliance with a legal obligation of the Controller under a special regulation or an international treaty by which the Slovak Republic is bound under a special regulation, in particular the Accounting Act, the Income Tax Act, and the Value Added Tax Act – Art. 6 para 1 letter c) of the GDPR Regulation and Art. 13 para 1 letter c) of the Personal Data Protection Act;
Retention period of personal data: for a period of 10 years, unless applicable law provides otherwise;
Video system – monitoring of the Controller’s premises – the Controller obtains and processes the personal data of Data Subjects for the purpose of protecting the property of the Controller, Employees and Clients within the Accommodation Facility and their health, in particular: protecting property against theft or damage, protecting public order and safety, preventing and detecting crime, reducing anonymity and the commission of criminal offences, monitoring for serious breaches of the Accommodation Rules, monitoring against the movement of unauthorised persons within the Accommodation Facility (who entered the Controller’s internal premises for a particular purpose), and securing evidence in minor-offence and criminal proceedings in cases where personal data obtained by the security camera system are used as evidence by authorities active in minor-offence or criminal proceedings.
The Controller hereby notifies Data Subjects that the premises of the Accommodation Facility are monitored by a recording video system, namely the common areas such as corridors, the kitchenette, the common room, lifts, staircases, the entrance door, and similar areas. The purpose is to detect possible criminal activity and prevent unlawful conduct, as well as to prevent damage to the property and health of the Controller or Clients. However, the degree of interference with the privacy of Data Subjects is minimal, and the monitoring is carried out in compliance with the statutory conditions. The Controller adopted this form of monitoring because less invasive means were not capable of ensuring sufficient security and protection of property and health, and has taken all reasonable measures to ensure that the consequences of the monitoring are kept to a minimum and are as mild as possible. In view of the foregoing, and in order to determine whether the Controller’s legitimate interest is the prevailing element as against the interests of Data Subjects, the Controller has additionally carried out an internal proportionality test. The result of the test was the Controller’s decision and finding that its interest in processing the personal data of Data Subjects by means of the video system is indeed legitimate and constitutes a relevant legal ground for the processing of personal data. Where the Controller processes your personal data on the legal basis of legitimate interest, we hereby specifically inform you of your right to object at any time to the processing of personal data. The Controller makes Data Subjects aware of the above information by means of an information sign reading: “Monitored by video system”.
Category of Data Subjects: Employees, Clients, any Third Parties entering the premises of the Controller’s Accommodation Facility;
Scope and categories of personal data processed: video recordings of natural persons (face, silhouette), and the visual likeness of the natural person;
Legal basis for the processing of personal data: the processing is necessary for the purposes of the Controller’s legitimate interests (protection of property, order and health, and detection of unlawful activity) – Art. 6 para 1 letter f) of the GDPR Regulation and Art. 13 para 1 letter f) of the Personal Data Protection Act;
Retention period of personal data: for a period of 15 days, unless there is suspicion of unlawful conduct – in which case the personal data are retained for the period necessary to clarify such conduct and for the duration of the relevant administrative and/or judicial proceedings;
Marketing purposes – the Controller may obtain and process personal data for the purposes of contacting Interested Parties, prospective Clients or other Data Subjects, for the purposes of providing news, information, discounts, favourable offers and other marketing information about the Controller’s Accommodation Facilities and related services.
Category of Data Subjects: Interested Parties, Clients;
Scope and categories of personal data processed: in particular, ordinary personal data such as, in the case of a natural person: name and surname, and contact details (e-mail, telephone number); in the case of a legal person or a natural person-entrepreneur (where data protection applies to them): business name, contact details (e-mail, telephone number), and name and surname of the statutory body;
Legal basis for the processing of personal data: the processing is carried out on the basis of the Data Subject’s consent to the processing of their personal data for marketing purposes – Art. 6 para 1 letter a) of the GDPR Regulation and Art. 13 para 1 letter a) of the Personal Data Protection Act;
Retention period of personal data: for the duration of the Data Subject’s consent given, and for a period of 1 year from the termination of the contractual relationship, unless applicable law provides otherwise.
Our Processors, through whom the Controller processes personal data, may also have access to your personal data, on the basis of authorisation granted to them by the Controller. The processing of personal data through a Processor is governed by a separate agreement concluded between the Controller and the Processor, under which the Processor processes your personal data on behalf of the Controller. For the processing of your personal data, the Controller uses only Processors who provide sufficient guarantees of implementing appropriate technical and organisational measures so that the processing of your personal data meets the requirements of applicable law and is consistent with this Privacy Norice, and so that the necessary and appropriate protection of your rights as a Data Subject is ensured. The engagement of a Processor to process personal data does not affect the exercise of your rights in connection with the processing of your personal data, which you may exercise with either the Controller or the Processor.
Recipients of your personal data may include the statutory bodies of the Controller (or their members); persons performing work for the Controller under an employment or similar relationship; the Controller’s associates, business partners, suppliers and contractual partners (in particular: an accounting firm, a company providing software development and maintenance services, a company providing legal services, a company providing advisory services, marketing companies, companies operating social networks, and companies providing payment gateways and other payment methods). Recipients of your personal data will also include courts, law-enforcement authorities, the tax office and other state authorities, where required by legal norms. The Controller will provide personal data to the relevant authorities and state institutions on the basis of, and in accordance with, the legal norms of the Slovak Republic
Further details and contact information regarding the Processors and Recipients are also available on request at the email address: izybratislava@gmail.com
The Controller does not transfer your personal data to a third country or to an international organisation.
In processing personal data, the Controller does not use automated decision-making or profiling.
The Controller declares that it has adopted appropriate technical and organisational measures to ensure an adequate level of security for your personal data and to protect it against unauthorised access and disclosure, unauthorised or unlawful processing, and against intentional, accidental or negligent erasure, loss, damage, destruction or alteration and breach of integrity, having regard to the nature, scope and purposes of the processing of your personal data, as well as to the risks to the rights and freedoms of Data Subjects arising from the processing of personal data. The measures adopted are regularly reviewed and monitored by the Controller.
Please take into account that when you view and use our Website, we use Cookies files. We use these primarily to ensure its proper operation, to increase your comfort in viewing and using it, and to improve your user experience. In this Privacy Notice on the Use of Cookies, we explain how you can control which Cookies we use, and you can learn more about these files.
Cookies are used to collect information from website visitors for specific purposes. They are text files containing a small amount of information that the website stores on your computer, mobile device, or other device when you view it. Through this file, the Website retains, for a certain period, information about your actions and preferences (such as login name, language preference, font size and other display settings), so that you do not have to re-enter them the next time you visit or browse the Website. Cookies have various functions and, overall, increase user comfort. Cookies may also be necessary to maintain the state of the Website during your visit.
There are various Cookies used for various purposes. Our Website primarily uses the following types of Cookies, and for the following reasons:
Necessary Cookies – are needed for the operation and functioning of our Website, enable you to log in to secured sections of the Website, and ensure other basic functionalities of the Website. This category of Cookies cannot be disabled, as without them the Website would not function properly, or would not function at all.
Analytical and Statistical Cookies – allow us to recognise and determine the number of visitors and to track how our visitors use our Website. They help us improve the way the Website works, for example by making it easier for you to find what you are looking for. We activate these Cookies only with your prior consent.
Any other Cookies – may be used e.g. to ensure the proper functioning of our services, to test parts of the Website and its functionality, and to remember information you have previously entered on the Website (remembering Cookie consent, remembering login details for the purposes of logging in to the system, and the like).
Traffic monitoring – as the Controller, we also use Cookies to track the number of visitors to our website (so-called traffic monitoring). For these purposes, we also use services such as Google Analytics.
Every website may send its own Cookies to your browser, if permitted by your web browser settings. When using our Website, you will be asked to give your consent before we place Cookies in your browser. We will respect any changes you make to the default Cookie settings. Please note, however, that disabling certain Cookies may affect the proper and error-free functioning of our Website. In such case, you may need to set certain options manually each time you visit our Website, and some services and functions may not work. Please note that all of these Cookies help us to improve the quality of our services. You can delete the usage of Cookies or restrict their use in your web browser by selecting the relevant setting in your browser.
On our Website, we primarily use our own Cookies originating directly from our Website. We do not subsequently use Third-Party Cookies on our Website.
In connection with the processing of personal data, the Data Subject may exercise the following rights, which are defined in more detail in content in the Personal Data Protection Act and the GDPR Regulation:
the right to request access to personal data concerning the Data Subject,
the right to correction of personal data,
the right to erasure of personal data,
the right to restriction of the processing of personal data,
the right to object to the processing of personal data,
the right to the portability of personal data,
the right to withdraw, at any time, consent to the processing of personal data,
the right to lodge a complaint concerning the processing of personal data by the Controller (or a motion to initiate proceedings), to the supervisory authority: the Office for Personal Data Protection of the Slovak Republic, Park One Building, Námestie 1. mája 18, 811 06 Bratislava.
The Data Subject may exercise the above rights in accordance with the Personal Data Protection Act and the GDPR Regulation, as well as other applicable legal regulations, either directly by means of a written request delivered to the Controller’s address: Panenská 18, 811 03 Bratislava, or electronically by submitting a request to the email address izybratislava@gmail.com
If you exercise any of your rights under this part of the Privacy Notice or under applicable legal regulations, we will inform you of the measure taken in accordance with your request, and we will likewise inform every Recipient to whom personal data have been disclosed under this Privacy Notice, provided that such notification is possible and/or does not require disproportionate effort. In order to process your request, we may require you to provide certain identifying information that you have previously provided to us. We will always request such information only to the extent strictly necessary to verify that the relevant request was in fact sent by you. We will handle your request without undue delay, and in any event no later than within one month of receiving it, and we reserve the right to extend this period by a further two months in more complex cases.
This Privacy Notice becomes effective on 1 January 2025.
The Controller may amend or update this Privacy Notice from time to time, in accordance with applicable legislation and with changes in the scope and manner of processing the personal data of Data Subjects. The current version of this Information is always available in electronic form on the Controller’s Website: https://www.izy-stay.com/
As Data Subjects, you may contact us at any time with a request for more detailed information regarding the processing of your personal data, at the email address: izybratislava@gmail.com
Your comfortable and affordable accommodation in the heart of Bratislava. Enjoy modern rooms, free Wi-Fi, and a convenient location just minutes away from the city’s main attractions. Whether you’re traveling solo, with friends, or family, you’ll find the perfect place to relax and explore Bratislava with us. Book your stay today and enjoy the comfort you deserve.