Privacy Policy

This Privacy Policy explains how the hotel processes the personal data you leave on marketsquarelviv.com. It covers the forms on the website — offer requests and the callback form — and does not cover the data you provide directly at the front desk on check-in.

The data controller is “USPISHNYI HOTEL” LLC, 4 Shevska Street, Lviv — the hotel Best Western Plus Market Square Lviv (the Hotel). Please send any questions about data processing to privacy@marketsquarelviv.com.

1. Who processes your personal data

• Data controller: “USPISHNYI HOTEL” LLC (limited liability company).
• Registered location: 4 Shevska Street, Lviv.
• Hotel where the data is processed: Best Western Plus Market Square Lviv, 4 Shevska Street, Lviv.
• Company registration number (EDRPOU): __ — this detail will be added once confirmed.
• Contact for data protection matters: privacy@marketsquarelviv.com.

Only the staff who handle requests — the reservations department and the front desk — have access, and only to the data they need to do their work.

2. What data we collect

Data you provide yourself when filling in a form on the website:

• your name;
• your phone number;
• your email address, if you provided it;
• arrival and departure dates, the number of rooms and guests;
• date of birth, preferences or comments, if the form contains such a field and you filled it in;
• company name, for business enquiries.

Technical data the website collects together with the request automatically:

• the address of the page the request was sent from, and the time it was sent — this appears in the email to the Hotel so that the manager can see where the enquiry came from;
• a hash of your IP address — stored on the server for 15 minutes and used only to limit automated submissions.

The web server keeps technical request logs (IP address, time, page address). They are used for security and diagnostics and are not matched with request data.

We do not collect health, religious or political data through the website, we do not ask for copies of documents, and we do not knowingly collect data of persons under 18. If you have accidentally included such data in a comment, please tell us and we will delete it.

3. Why we process the data

Data submitted through the forms is used only to:

• process your request and contact you by phone or email;
• clarify the details of your booking, confirm the terms and, where needed, prepare an offer;
• provide accommodation and other hotel services if you use them;
• protect the forms from spam and automated submissions.

We do not use form data for advertising, we do not send newsletters and we do not build profiles. If you ever wish to receive hotel news, that will require separate consent.

4. On what basis we process the data

The main basis is your consent. You give it by ticking the checkbox in the form before submitting; without it the form is not sent. You may withdraw your consent at any time by writing to privacy@marketsquarelviv.com.

For guests from European Union countries: processing is based on your consent (Art. 6(1)(a) GDPR) and, for the steps required to make a booking, on taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

For Ukraine: processing is carried out with the consent of the data subject under the Law of Ukraine “On Personal Data Protection”.

5. Who receives your data

We do not sell personal data and do not pass it to third parties for advertising. Request data is seen only by those who handle the enquiry directly:

• the Hotel’s reservations department and front desk — the staff who answer the request;
• the email service — it delivers the request to the Hotel’s work mailbox;
• a secured Telegram work chat — the request is duplicated there so that a manager sees it immediately; only Hotel staff have access to the chat;
• the web server owner (hosting provider) — stores the website files and database on the Hotel’s behalf.

Online booking is separate. The “Check availability” button opens the Best Western booking system. It is an external service that does not belong to the Hotel: it collects and processes booking data under its own rules, which we do not control. Before booking, please read the Best Western privacy policy.

The email service and Telegram may process technical data outside Ukraine. The transfer is limited to what is needed to deliver the request.

6. How long we keep the data

• Form requests — until the enquiry is completed and for a further __ months after our last contact with you, so that a previous conversation is visible if you get in touch again.
• The IP address hash used to limit submission rates — 15 minutes.
• Web server technical logs — the retention period is set by the hosting provider; they are needed for security and diagnostics.

Once the period ends we delete or anonymise the data. If you ask us to delete a request earlier, we will do so — except where the law requires us to keep it.

7. Your rights

• to know what data of yours we process and to receive a copy of it;
• to have inaccurate data corrected;
• to have data deleted when it is no longer needed for the request;
• to withdraw your consent — processing will stop, although this does not affect the lawfulness of processing before withdrawal;
• to object to processing or to have it restricted.

Guests from EU countries also have the rights set out in Articles 15–22 GDPR, including data portability, and may lodge a complaint with the supervisory authority of their country. In Ukraine a complaint may be submitted to the Ukrainian Parliament Commissioner for Human Rights.

To exercise any of these rights, write to privacy@marketsquarelviv.com. We reply within __ days.

8. Cookies and analytics

The website sets one cookie — pll_language. It remembers the language you selected (Ukrainian or English) and is kept for about a year. This is an essential technical cookie: without it the language switcher would not remember your choice. We do not ask for consent for it because it is not used for tracking.

There is no analytics on the website: we do not use Google Analytics, advertising pixels or third-party embeds. The map on the contact page is our own drawing made for the site; the fonts are hosted on our own server rather than someone else’s. Cookies for signing in to the admin area are set only for Hotel staff.

You can delete or block cookies in your browser settings at any time. The website will keep working, but the language choice will reset each time.

9. How we protect the data

Only staff who need the data for their work have access to requests. The website does not show requests to visitors: they arrive in the work mailbox and in a closed work chat.

We review access rights periodically and remove what is no longer needed. If you believe your data may have reached someone unauthorised, write to us and we will investigate.

10. Changes to this Policy

We may update this Policy: the current version is always published on this page. Date of the last update: __.

If the changes are significant — for example, a new data processing service is added — we will state this separately on this page.

Note: this text requires review by a lawyer

This Policy has been prepared as a working draft for the Hotel’s website. It describes how the website actually works, but it must be reviewed by a lawyer — in particular:

• data retention periods and the time allowed for replying to a guest’s request (marked as __);
• the legal bases for processing for guests from EU countries and the full list of GDPR rights;
• the transfer of data outside Ukraine (email service, Telegram) and the required safeguards;
• the full details of the data controller (company registration number) and registration of the personal data database;
• the procedure for responding to guests’ requests regarding their rights.

Until the final version is approved, this text is not a legal document.