1. Data Controller

Melius Hotel is the entity responsible for processing your personal data. Processing is carried out in strict compliance with data protection legislation, including the GDPR (General Data Protection Regulation).

For privacy questions or to exercise your rights, contact geral@hotelmelius.com. This is the hotel's general contact and is not presented as the formal contact of a DPO.

2. Collected Data and Purposes

Booking and service request forms may collect name, email, telephone, dates, number of guests, requested category/room or service, and notes supplied by the customer. For the newsletter we collect email, optional name, language, form source and the dates on which consent was requested, confirmed or withdrawn. The optional post-stay form collects a score, text, language, optional public name and the explicit publication choice. The website does not collect or process online payments.

Manage accommodation and hotel service requests and bookings.
Contact the customer to confirm, change or clarify a request.
Prepare the stay, on-site invoicing and comply with applicable legal obligations.
Protect the service against abuse and prevent duplicate bookings.
Record and evidence a double-confirmed subscription; the system does not send campaigns automatically.
Request feedback after a confirmed stay and place internal testimonials in a moderation queue; nothing is published automatically.

3. Browser Preferences and Optional Metric

The website stores non-sensitive technical preferences locally, such as theme, privacy choice and a cache of public configuration. The admin panel uses session storage for the authenticated session and local storage for operational state without customer contact data.

Only after consent, the browser may send our own service a page-view count containing only the normalized page path and counts of technical booking steps. The latter use a closed event allowlist, path and an optional technical category. The day is determined by the server. No cookies, identifiers, query strings, IP in the payload, user-agent, dates, contact details, notes, booking ID, room number or other personal data are sent; the server stores only aggregate daily counts for approximately 400 days.

4. Data Retention

Booking and request data is kept only for as long as necessary for operations, invoicing, dispute resolution and legal obligations, after which it is deleted or anonymized. An unconfirmed subscription expires after 7 days; after withdrawal, its technical record expires after 30 days; a confirmed subscription remains until withdrawal. Review invitations expire after 120 days; pending reviews after 365 days and rejected reviews after 30 days. Approved testimonials reach the website only through explicit review and publication. Aggregate page counts have a technical TTL of approximately 400 days.

5. Data Subject Rights

You may exercise applicable rights of access, rectification, erasure, restriction, portability or objection by contacting geral@hotelmelius.com. Every manual message to subscribers must include the individual unsubscribe link exported by the admin panel; you may also ask the hotel to withdraw consent. Withdrawing metrics consent stops future beacons, but an anonymous count already aggregated cannot be linked back to an individual for deletion.

6. Recipients and External Services

Data may be processed by technical providers necessary for operations, including the current transactional email delivery service (Resend), and by legally competent authorities, subject to applicable safeguards. The homepage directly loads an embedded Google Maps frame, which may receive technical request data such as the IP address under Google's policy; a separate external link also opens the map. Links to external services such as Playtomic, Booking.com or TripAdvisor open platforms with their own policies; Melius Hotel does not send form content to those platforms through this website. The choice between direct loading and click-to-load remains pending the owner's legal review.

Privacy Policy