Privacy Policy
Last updated: 20 May 2026
1. Data Controller
REVYSTA s.r.o.
Brutovce 71, 053 73 Brutovce
Company ID: 55 929 087
E-mail: office@revysta.sk
No Data Protection Officer has been appointed, as the processing does not trigger the obligation under Article 37 GDPR.
2. Data We Collect
a) Contact form
When you submit the contact form, we collect:
- Hotel name (required)
- Email address (required)
- Location (optional)
- Number of rooms (optional)
- Phone number (optional)
- Message text (optional)
- Hashed IP address (automatic, for abuse protection and rate limiting)
b) Analytics and marketing data
With the visitor's consent, we collect data about traffic and interaction with the site through the following services:
- Google Analytics 4 - anonymised traffic data: pages visited, time spent on page, device and browser type, and geographic region (country/city).
- Meta Pixel (Facebook/Instagram) - measuring ad effectiveness and remarketing: pages viewed, actions taken (e.g. form submission, phone click) and the technical identifiers needed to attribute the visit to an ad campaign. Data is sent to Meta Platforms Ireland Limited.
These services activate only after your explicit consent in the cookie banner. Until consent is given, no analytics or marketing data is sent (Google Consent Mode v2, default state "denied").
c) Functional cookies
We use the revysta_lang cookie to remember your language preference. This cookie is necessary for the site to work correctly and does not require consent.
3. Purpose of Processing
| Data | Purpose | Legal basis |
|---|---|---|
| Contact form | Processing the inquiry, replying, and preparing recommendations for the hotel | Legitimate interest (Art. 6(1)(f) GDPR) |
| Google Analytics | Evaluating traffic and improving the website | Consent (Art. 6(1)(a) GDPR) |
| Meta Pixel | Measuring ad effectiveness and remarketing | Consent (Art. 6(1)(a) GDPR) |
| Language cookie | Remembering language preference | Legitimate interest (Art. 6(1)(f) GDPR) |
4. Recipients
Your data may be shared with the following third parties solely for the purposes stated above:
- Google LLC - analytics data via Google Analytics 4 (only with the visitor's consent)
- Meta Platforms Ireland Limited - marketing and measurement data via Meta Pixel (only with the visitor's consent)
- WebSupport s.r.o. - website hosting and email infrastructure (SMTP)
We do not share your hotel or business data for marketing purposes and do not sell it to third parties.
5. International Data Transfers
Some recipients also process data outside the European Union (in the USA). Transfers take place under the EU-US Data Privacy Framework, whose certified participants are:
- Google LLC - Google Analytics 4
- Meta Platforms, Inc. - Meta Pixel
These transfers occur only for data collected with the visitor's consent (analytics and marketing).
6. Retention
- Contact form data: 2 years from the last communication, then deleted
- Contract and invoicing documents: 10 years, as required by Slovak accounting and tax law
- Analytics data (Google Analytics): 14 months (GA4 default retention)
- Cookie revysta_lang: 365 days
- Cookie revysta_analytics: 365 days (stores your consent choice)
7. Your Rights
As a data subject you have the right to:
- Access - request a copy of the data we process about you
- Rectification - request correction of inaccurate data
- Erasure - request deletion of your data
- Restriction of processing - request that processing be suspended
- Data portability - receive your data in a structured format
- Object - object to processing based on legitimate interest
- Withdraw consent - withdraw consent for analytics cookies at any time (by deleting cookies in your browser or clicking "Decline" in the cookie banner)
If you believe your rights have been violated, you have the right to lodge a complaint with:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava
Web: dataprotection.gov.sk
8. Cookies
| Cookie | Type | Purpose | Expiry |
|---|---|---|---|
revysta_lang |
Functional | Stores the selected language | 365 days |
revysta_analytics |
Functional | Stores the cookie choice (accept/decline) | 365 days |
_ga |
Analytical | Google Analytics - distinguishing visitors | 2 years |
_ga_* |
Analytical | Google Analytics - session state | 2 years |
_fbp |
Marketing | Meta Pixel - distinguishing a visitor for advertising and remarketing | 3 months |
_fbc |
Marketing | Meta Pixel - attributing the visit to an ad campaign (if you arrived from a Meta ad) | 3 months |
Analytical and marketing cookies (_ga, _ga_*, _fbp, _fbc) are loaded only after your explicit consent in the cookie banner. If you decline, they are not stored.
9. Automated Decision-Making
REVYSTA uses analytical algorithms to evaluate market and hotel signals and generate recommendations for the daily brief. These recommendations are purely advisory. The final decision always rests with the hotel operator. This does not constitute automated decision-making within the meaning of Article 22 GDPR.
10. Security Measures
When processing personal data, we apply appropriate technical and organisational measures in accordance with Article 32 GDPR:
- Encrypted transmission: Communication between the browser and the server runs exclusively over HTTPS (TLS 1.2+).
- EU hosting: The website and email infrastructure are operated by WebSupport s.r.o. on servers located in the European Union.
- Limited access: Personal data from the contact form is accessible only to people authorised to handle inquiries.
- Anonymised analytics data: IP addresses for Google Analytics are anonymised before being sent to Google. Analytics cookies activate only after the visitor's explicit consent.
- Hashed IP addresses: IP addresses of contact form senders are stored exclusively as a one-way hash (SHA-256), used solely for abuse protection.
11. Security Incident Procedure
In the event of a personal data breach, we act in accordance with Articles 33 and 34 GDPR:
- Notifying the supervisory authority: A security incident that poses a risk to the rights and freedoms of individuals is reported to the Slovak Office for Personal Data Protection within 72 hours of discovery.
- Notifying data subjects: Where an incident poses a high risk, we also inform the affected individuals without undue delay, in clear language.
- Internal documentation: All incidents, including those with no notification obligation, are recorded internally, along with a description, impact, and the remediation measures taken.
Report security incidents or suspicions of them to: office@revysta.sk
12. Response Time for Requests
Requests from data subjects (access, rectification, erasure, portability, restriction, objection) are handled in accordance with Article 12 GDPR:
- Standard deadline: Within 30 days of receiving the request.
- Extension: For complex or repeated requests, we may extend the deadline by a further 2 months. We will notify you of the extension within 30 days of receiving the request, including the reason.
- Form of response: We provide the response electronically, unless you request otherwise.
- Free of charge: Handling a request is free of charge. For manifestly unfounded or repetitive requests, we reserve the right to charge a reasonable fee or to refuse to act.
Send requests to: office@revysta.sk with the subject line "Request - Personal Data Protection".
13. Contact
For questions about the processing of personal data, please contact:
REVYSTA s.r.o.
E-mail: office@revysta.sk
Address: Brutovce 71, 053 73 Brutovce