Privacy Policy

The controller is KANIK Advisory, s.r.o., registered office Panská 27, 811 01 Bratislava, Slovakia, company ID (IČO): 57 852 863, tax ID (DIČ): 2123315623, not registered for VAT, registered in the Commercial Register of the Bratislava III City Court, section Sro, file no. 203859/B. For data protection matters contact info@kanikadvisory.sk or our registered office. We have not appointed a data protection officer as the law does not require it.

Enquiries via the contact form or e-mail — name, e-mail, phone, property name and details, message. Purpose: handling the enquiry and preparing an offer. Legal basis: pre-contractual steps and our legitimate interest in responding (Art. 6(1)(b) and (f) GDPR). Kept for 2 years after the last communication unless a contract follows.

Approaching accommodation businesses — when preparing a preview (pre-filled profile) we use publicly available data about the property and its business contact details (e.g. the property's website, business register, booking portals and maps). Purpose: B2B offer of the Service. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Kept for up to 2 years or until you object.

Clients and their contacts — identification and contact data, Portal credentials (passwords stored only as a cryptographic hash), login and activity records. Purpose: performing the contract, account management, security. Legal basis: contract and legitimate interest in security (Art. 6(1)(b) and (f) GDPR). Kept for the contract term and 3 years after (limitation period); security logs for up to 12 months.

Billing and payments — business name, address, company ID, tax ID, VAT ID, billing e-mail, payment records (without card numbers). Purpose: invoicing and tax and accounting obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR). Accounting records are kept for 10 years.

Service communication — account e-mails, password resets, weekly reports and action-plan notices. Legal basis: contract. You can unsubscribe from non-operational e-mails via the link in each e-mail.

Website analytics — if analytics is enabled (Google Analytics, Microsoft Clarity), behavioural data are processed only with your consent (Art. 6(1)(a) GDPR; § 109(8) of Slovak Act No. 452/2021). You may withdraw consent at any time. Details are on the Cookies page.

Personal data of hotel guests contained in clients' data (reservation exports, PMS data) are not processed by us as controller but as processor on the client's behalf, governed by the Data Processing Agreement.

We share personal data only as necessary with:

• Vercel Inc. (USA) — website and application hosting; the application runs in a data centre in Ireland.
• Supabase Inc. (USA) — database and file storage; data stored in Ireland (AWS eu-west-1).
• Stripe Payments Europe, Ltd. (Ireland) — payment processing and billing; also an independent controller for payments.
• Resend Inc. (USA) — e-mail delivery from the EU region (Ireland).
• Anthropic PBC (USA) — a language model that helps draft the action plan; it receives aggregated property data, not guest personal data.
• Google Ireland Ltd. — public data about accommodation businesses (Google Places); Google Analytics if analytics is enabled.
• Microsoft Ireland Operations Ltd. — Microsoft Clarity, only with analytics consent.
• Namecheap, Inc. (USA) — forwarding of e-mails sent to our domain.
• An external accountant and tax adviser, and public authorities where required by law.

Transfers to the USA rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) for certified recipients, otherwise on Standard Contractual Clauses approved by the Commission.

• access to your personal data and a copy,
• rectification of inaccurate data,
• erasure where data are no longer needed or are processed unlawfully,
• restriction of processing,
• portability of data provided under a contract or consent,
• objection to processing based on legitimate interest, including direct marketing,
• withdrawal of consent at any time without affecting prior processing.

Exercise your rights by e-mail to info@kanikadvisory.sk. We reply without undue delay and within one month at the latest. You may also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

We protect data with encrypted transfer (HTTPS), database-level access control, separation of the client and internal parts of the application, account lockout after repeated failed logins, and regular backups.

Price recommendations are computed automatically but concern the accommodation property, not individuals. We do not carry out automated decision-making with legal effects on individuals.

We update this policy when processing changes. The current version is always on this page; clients are informed of material changes by e-mail.