Legal information
Privacy policy
What data we collect on the hotelspot website, why, who we share it with and what rights you have.
This is a translation provided for convenience. The Polish version is the binding one.
Data controller
The controller of your personal data is Spotstay Sp. z o.o., registered office: ul. Cystersów 13/6, 31-553 Kraków, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under no. 0001096818, NIP (tax ID): 6762665735, REGON: 528200240 ("we"). For data protection matters, write to kontakt@hotelspot.pl or to our registered office.
This policy covers the hotelspot.pl website (PL, EN and DE versions) and the services on it: forms, the calculator, the free audit and full audit orders. Data processing in the hotelspot application for hotels and their guests is described in separate documents (the Application terms and agreements with hotels).
What data we process
- Contact, demo and partner forms: name, email, phone, company or hotel name, position, message and any other details you enter.
- Calculator: the calculation inputs and the email address we send the result to.
- Free audit: website address, property name, location, property type, email for the report, your consents and the audit result.
- Full audit: orderer details (name, email, phone), invoice details (company, tax ID, address), property details and page list, the chosen option, payment method and status.
- Google property search: the phrase you type and the ID of the selected place.
- Technical data: IP address, browser and device type, time and address of the page visited (server logs and abuse protection).
- Cookies and similar technologies: described in the Cookie policy.
The audit analyses publicly available information about the property: its website, search results and AI assistant answers. We send search and AI providers the property details (name, location, website), not your contact details.
Purposes and legal bases
Providing data is voluntary, but without the required fields we cannot reply, send the report or accept an order. We do not make decisions about you based solely on automated processing that produce legal effects.
Who we share data with
We use providers who process data on our behalf under data processing agreements or as independent controllers for their own services:
Data may also be shared with our accounting office, legal advisers and public authorities where required by law.
Transfers outside the EEA
Some providers are based in or use servers in the United States. Transfers rely on the European Commission decision on the EU-US Data Privacy Framework (for certified companies) or on standard contractual clauses. You can request a copy of the safeguards by writing to us.
How long we keep data
- Messages and form submissions: until the conversation ends, then up to 3 years from the last contact.
- Audit results and reports: up to 24 months after the audit.
- Orders and invoices: 5 years from the end of the year in which the tax obligation arose.
- Newsletter and consent-based contact: until you withdraw consent.
- Data needed to defend against claims: until the limitation period expires.
- Technical data for abuse protection: a few days; server logs according to the hosting provider's rules.
Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on our legitimate interest. You can withdraw consent at any time without affecting the lawfulness of prior processing: via the link in a message, by email or via "Manage cookies" in the website footer.
You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa), or with the supervisory authority in your country.
Security
The website uses an encrypted connection (HTTPS). Only authorised people have access to the data. Card data is handled directly by Stripe; we do not receive it.
Changes to this policy
We update this policy when our services or providers change. The current version is always available at this address.
Last updated: 30 September 2026
