Privacy Policy

This Privacy Policy explains how MS Sparrow Hostel ("we", "us", "our") collects, uses, and protects your personal data when you visit mssparrowstay.com or contact us directly, and how we use video surveillance at the hostel (section 10). This policy is in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

1. Who Is Responsible for Your Data?

Data Controller:

MS SPARROW GROUP d.o.o.
Dunajska cesta 103, 1000 Ljubljana
Ljubljana, Slovenia
Email: info@mssparrowstay.com

2. What Data We Collect

When you use our contact enquiry form, we collect:

• First and last name
• Email address
• Phone number (optional)
• Check-in and check-out dates
• Number of guests
• Room preference
• Group or organisation name and airport-transfer request (group enquiry form, optional)
• Any message or special requests you provide

When you visit our website, we may also collect:

• IP address (anonymised)
• Browser type and version
• Pages visited and time spent (via cookies, only with your consent)

3. Why We Collect Your Data (Legal Basis)

We process your personal data on the following legal bases under GDPR Article 6:

• Legitimate interests — to respond to your enquiry and help arrange your stay
• Legitimate interests — to improve our services and communicate with you about your visit
• Consent — for cookies and any optional marketing communications

4. How We Use Your Data

We use your data exclusively to:

• Respond to your enquiry sent to info@mssparrowstay.com
• Follow up about your planned visit and provide relevant information (check-in times, directions, etc.)
• Send you relevant information about your stay (check-in times, directions, etc.)
• Comply with legal obligations (e.g. tourism registration requirements)

We do NOT sell, rent, or share your data with third parties for marketing purposes.

5. Who We Share Your Data With

Your data may be shared only with:

• Netlify, Inc. — hosts this website and receives the enquiry form (including spam filtering) before forwarding it to our inbox
• Google — our email provider (for delivering your enquiry to our inbox)
• Slovenian authorities if required by law (e.g. tourist registration — Slovenian law requires hostels to report guest data to the police register)
• Booking platforms (Booking.com, Hostelworld, Google) only if you book through them directly — their own privacy policies apply. This website does not process direct bookings.

6. How Long We Keep Your Data

We retain your personal data for the following periods:

• Booking enquiry data: up to 2 years from your stay or last contact
• Financial/invoicing records: 10 years as required by Slovenian tax law
• Cookie data: as specified in our Cookie Policy

After these periods, your data is securely deleted.

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure ("right to be forgotten") — request deletion of your data
• Right to restriction — request we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent for cookies or marketing at any time

To exercise any of these rights, contact us at: info@mssparrowstay.com

We will respond within 30 days. You also have the right to lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec): www.ip-rs.si

8. Data Security

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. Our website uses HTTPS encryption (SSL/TLS certificate via Let's Encrypt).

9. Transfers Outside the EU

Our website host (Netlify, Inc.) and our email provider (Google) are based in the United States and may process your data outside the European Union or EEA. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses or the EU–U.S. Data Privacy Framework. We do not transfer your data anywhere else outside the EU/EEA.

10. Video Surveillance at the Hostel

The sign at the hostel entrance points to this section. Under GDPR Article 13 and Article 76 of the Slovenian Personal Data Protection Act (ZVOP-2), this is the full information about our video surveillance.

• Controller: MS SPARROW GROUP d.o.o., Dunajska cesta 103, 1000 Ljubljana. Contact: info@mssparrowstay.com, +386 70 777 086
• Where: 3 cameras, only in common areas: one at the top of the stairs, facing down the stairs to the entrance; two at the reception, one from each side, one of them also covering part of the hallway. There are no cameras in bedrooms, bathrooms or toilets.
• What: picture only, no sound.
• Why: the safety of guests (including school groups) and of the people who work at the hostel, the protection of guests' and our property against theft and damage, and control of who enters, as the reception is not staffed 24 hours a day.
• Legal basis: our legitimate interest (GDPR Article 6(1)(f)) and Article 76 of ZVOP-2. We weighed this interest against our guests' privacy, with particular care for children staying with school groups: the cameras cover only the stairs, the reception and part of the hallway, record no sound, and the recordings are never published.
• Storage and live view: recordings are stored only on our own recorder (with its own disk) at the hostel. The hostel manager can also watch the cameras live through the recorder's phone app, to check that the hostel is secure. Recordings are played back only when there is a reason, such as an incident.
• Who can see the recordings: only the hostel manager and the company director. We give recordings to the police or another authority only on a lawful request. They are never used for marketing.
• How long we keep them: at most one year (ZVOP-2 Article 76(9)). The recorder overwrites older recordings automatically, currently after about 5 months.
• Every viewing, use or handover of recordings is written in a log (who, when, which recordings, why), kept for two years.
• Your rights: you can ask for access to recordings of you, their erasure or restriction, or object, by writing to info@mssparrowstay.com. You can also complain to the Slovenian Information Commissioner: www.ip-rs.si

Videonadzor v hostlu (slovensko): upravljavec je MS SPARROW GROUP d.o.o., Dunajska cesta 103, 1000 Ljubljana (info@mssparrowstay.com, +386 70 777 086). 3 kamere snemajo samo sliko, brez zvoka, in samo v skupnih prostorih (stopnišče z vhodom, recepcija z obeh strani, del hodnika); v sobah, kopalnicah in straniščih kamer ni. Namen: varnost gostov in oseb, ki delajo v hostlu, zaščita premoženja in nadzor vstopa. Pravna podlaga: zakoniti interes (točka (f) prvega odstavka 6. člena Splošne uredbe) in 76. člen ZVOP-2. Posnetki se hranijo samo na lastnem snemalniku v hostlu; upravnik lahko kamere prek mobilne aplikacije snemalnika občasno spremlja v živo, da preveri varnost hostla; posnetke pregleda samo, kadar je za to razlog (npr. incident). Posnetke vidita samo upravnik hostla in direktorica; policiji ali drugemu organu jih posredujemo le na zakonito zahtevo. Hranimo jih največ eno leto (trenutno se samodejno prepišejo po približno 5 mesecih); vsak vpogled se zabeleži v dnevnik, ki se hrani dve leti. Pravice (dostop, izbris, omejitev, ugovor) uveljavljate na info@mssparrowstay.com; pritožba: Informacijski pooblaščenec, www.ip-rs.si.