Privacy policy

Data we process

When you send a general message or table enquiry, we process the information you enter. Accommodation bookings take place in a separate external booking portal and are not submitted through a form on this website.

• full name,
• email address and telephone number,
• subject and message or special requests,
• for table enquiries, requested date and number of guests,
• submission time, language and a technical enquiry identifier.

Purposes and legal bases

We use form data to reply, prepare an offer and take steps at your request before entering a possible contract (Article 6(1)(b) GDPR).

When the root address is visited, the IP address is compared with a locally stored country-level database to display the appropriate language version. We do not determine a precise location, store the result or send data to an external service for this lookup. The basis is our legitimate interest in a user-friendly language adaptation (Article 6(1)(f) GDPR); a manual language choice always takes priority.

To protect the service from excessive requests, the IP address is processed in server memory for no more than 10 minutes on the basis of our legitimate security interest (Article 6(1)(f) GDPR). If a booking or business relationship is formed, legal retention duties may apply (Article 6(1)(c) GDPR).

• Enquiry data is not used for direct marketing without a separate legal basis.
• We do not carry out automated decision-making or profiling.

Recipients and processors

Data is available only to authorised Gostilna Hrast personnel and technical providers where required for hosting, maintenance or delivery of an enquiry notification.

When email notifications are enabled, enquiry data is sent to Resend solely to deliver that message. The accommodation portal is an external service; information entered there is processed by its operator under its own privacy notice.

Country detection uses locally stored GeoLite2 data created by MaxMind, available from https://www.maxmind.com/.

Retention

Enquiries are kept for as long as needed to reply, reach an agreement and evidence the communication, and afterwards only for applicable legal periods or to establish, exercise or defend legal claims. The operator must confirm the final internal deletion period before publication.

The server-memory record used for form rate limiting is removed after 10 minutes. Cookie durations are listed in the cookie policy.

Your rights

Where the law provides, you may request access, correction, erasure, restriction and portability, or object to processing. Consent-based processing may be withdrawn at any time for the future.

Send requests to the contact below. You may also complain to the Slovenian Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.

Security and changes

We use reasonable technical and organisational safeguards, although no transmission or storage system is entirely risk-free.

We update this notice when forms, providers, purposes or legal bases change. The latest revision date appears above.