Copyright © Art Hotel Tartini
Menu
Art Hotel Tartini d.o.o.
Valid from: 21 October 2026
Previous version: July 2025
This policy explains which personal data we collect when you visit our website, book a stay, stay with us, contact us, follow us on social media or sign up for our newsletter, why we need it, who we share it with, how long we keep it and what your rights are.
The controller of your personal data is:
Art Hotel Tartini d.o.o.
Tartinijev trg 15, 6330 Piran, Slovenia
VAT ID: SI78722381
Email: welcome@qorxalnuviz.shop
Phone: +386 5 671 10 00
For any question about your personal data, write to welcome@qorxalnuviz.shop.
We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
Your right to object: where we process your data on the basis of our legitimate interests, you can object at any time for reasons relating to your situation. You can object to direct marketing at any time, without giving a reason. See section 9.
When you book through the booking engine on our website, we collect:
Why: to make and manage your booking and to contact you about your stay.
Legal basis: performance of a contract and steps before a contract (Art. 6(1)(b) GDPR).
Card details are entered directly into the secure systems of our booking engine and payment provider and are used only to guarantee or charge your booking.
If you book through an online travel agency, a booking platform or a travel agent, they send us your name, contact details (often a masked email address), phone number, stay details, special requests and, where applicable, payment or virtual card details.
Why and legal basis: the same as in 2.1. The travel agency or platform is a separate controller for the data you give them, under its own privacy policy.
If you book for other people, for example family members, children or colleagues, you give us their names and, where needed, other details. Please make sure they know about this policy. Data of children are given to us by their parents or guardians.
At check-in we collect the data the law requires for guest registration: your first and last name, sex, date of birth, citizenship, and the type and number of your identity document, together with the dates of your stay.
To speed up check-in, we scan your identity document with a scanner connected to our hotel management system, which reads these details from the document. The image of your document is not stored; only the details listed above are saved.
We use this data only for guest registration and the tourist tax, and report it to the authorities through AJPES eTurizem.
Why: Slovenian law requires us to register every guest with the authorities and to report the tourist tax.
Legal basis: legal obligation (Art. 6(1)(c) GDPR), under the Residence Registration Act (ZPPreb-1) and the Act on the Promotion of Tourism Development (ZSRT-1).
During your stay we record the services you use (for example breakfast, parking, extras) for billing. Legal basis: contract (Art. 6(1)(b)).
If you tell us about food allergies, dietary needs, a disability or another health-related need, for example for breakfast, a room or an event, we use this information only to provide our service to you.
Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which you give by sharing the information with us. You can withdraw it at any time. We delete this information together with your booking data (see section 7).
For payments we process the payment amount, payment method, the last digits of the card and the transaction reference. We issue invoices with your name and, for companies, the company details.
Legal basis: contract (Art. 6(1)(b)) and our legal obligations in accounting and tax law (Art. 6(1)(c)).
For group bookings we may send a secure payment link (Pay by Link) by email. We never ask for card details or payments by WhatsApp, Viber, SMS or a link in a chat. If you receive such a request in our name, do not respond and let us know at welcome@qorxalnuviz.shop.
When you write to us or call us, we process your name, contact details and the content of the conversation, so that we can answer and help you with your stay.
We also communicate with guests through WhatsApp on our official business number +386 51 412 249. WhatsApp is provided in the EU by WhatsApp Ireland Limited. If you prefer, you can always reach us by email or phone instead.
Legal basis: contract (Art. 6(1)(b)) for questions about a booking or stay; our legitimate interest in answering enquiries (Art. 6(1)(f)) for other questions.
Before your arrival we send you an email with practical information about your stay. After your departure we send you a thank-you email with an invitation to review your stay (for example on Google or Tripadvisor).
Legal basis: contract (Art. 6(1)(b)) for the email before arrival; our legitimate interest in learning how you liked your stay (Art. 6(1)(f)) for the email after departure. You can opt out of emails after your stay at any time by replying to the email or writing to welcome@qorxalnuviz.shop.
If you sign up for our newsletter, we process your email address, first name (if given), language and the date of your consent. We use it to send you news and offers of Art Hotel Tartini, including a welcome email.
Legal basis: your consent (Art. 6(1)(a) GDPR). We send newsletters only to people who signed up. You can unsubscribe at any time through the link in every email or by writing to welcome@qorxalnuviz.shop. Withdrawing consent does not affect messages sent before.
We use Brevo (Sendinblue SAS, France) to send newsletters. Brevo records whether an email was delivered and opened and which links were clicked, so that we can improve our newsletters. After you unsubscribe, we keep only your email address on a list of unsubscribed contacts, so that we do not write to you again.
If you contact us about a group, event, wedding or corporate stay, or if you work for a travel agency or company we work with, we process your name, company, job title, business contact details and our correspondence. For groups and events this can include a rooming list and dietary needs of participants (see 2.5).
Why: to prepare offers, manage the booking and maintain the business relationship.
Legal basis: steps before a contract and the contract (Art. 6(1)(b)), and our legitimate interest in business communication (Art. 6(1)(f)).
We offer our group and event services to companies. For this we may use the business contact details of company representatives (name, job title, company, business email or phone, LinkedIn profile) that we find on company websites, in business directories or on LinkedIn, and contact them by email or on LinkedIn.
Legal basis: our legitimate interest in offering our services to businesses (Art. 6(1)(f)). You can object at any time by replying to our message or writing to welcome@qorxalnuviz.shop, and we will not contact you again.
We have pages on Facebook (facebook.com/arthoteltartinipiran) and Instagram (instagram.com/hoteltartini). If you follow us, comment or send us a message there, we see your public profile and what you write to us.
For the statistics Meta provides about visits to our pages (Page Insights), we and Meta Platforms Ireland Limited are joint controllers. Meta is responsible for providing you with information about this processing and for your rights in relation to it; details are in Meta's Page Insights Controller Addendum. Meta's own processing is described in its privacy policy.
Legal basis: our legitimate interest in presenting our hotel and communicating with you on social media (Art. 6(1)(f)).
Our website uses cookies that are needed for it to work. We use analytics and advertising cookies (Google Analytics, Google Ads) only if you allow them in the cookie banner. More information is in our Cookie Policy.
Legal basis: your consent (Art. 6(1)(a) GDPR and the Electronic Communications Act, ZEKom-2) for non-essential cookies.
We use video surveillance at the entrances and exits of the building at Tartinijev trg 15, at reception, in the restaurant, on the rooftop terrace and at the staff entrance to the kitchen to protect the safety of people and property and to control access. Notices are placed at the monitored areas.
Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), in line with Articles 76 onwards of ZVOP-2.
Recordings are kept for up to 30 days, unless they are needed as evidence in criminal or other official proceedings. In that case they are kept until the proceedings end and are given to the authorities only on the basis of a lawful request.
We also use personal data, based on our legitimate interests (Art. 6(1)(f)), to:
If you apply for a job with us, we process the data in your application (CV, contact details, work history) to choose a candidate.
Legal basis: steps before an employment contract (Art. 6(1)(b)). We keep applications only until the selection process ends.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Our room prices depend on occupancy and market prices, not on your personal data. We use AI tools to help sort incoming emails and draft replies; our staff review every reply before it is sent.
We share personal data only when it is needed for the purposes above. Our service providers (processors) process data only on our instructions and under a data processing agreement.
| Recipient | What for |
|---|---|
| Lighthouse | booking engine and channel manager (online bookings, connection to travel agencies) |
| Hotelinco | hotel management system (reservations, guest registration, invoicing) |
| Worldline | card payments and payment links |
| Google (Google Workspace) | email, documents and calendars |
| Brevo | newsletters (only if you signed up) |
| messages with guests on WhatsApp | |
| Google (Analytics, Ads, Tag Manager) | website analytics and advertising (only with your cookie consent) |
| IT and automation providers | internal workflows, records of group, event and business enquiries |
| AI service providers | help with sorting incoming emails and drafting replies |
| Sales tools | contacting business representatives by email and on LinkedIn (section 2.11) |
| Accounting and IT service providers | bookkeeping and IT support |
We also share data with:
We do not sell your personal data.
Some providers (Google, Meta, and some of our IT and AI providers) may process data in the United States or other countries outside the European Economic Area. We transfer data only where the European Commission has decided the country provides adequate protection (for example certified companies under the EU-US Data Privacy Framework), or on the basis of the European Commission's standard contractual clauses. You can ask us for a copy of these safeguards.
Our hotel management system provider stores data on servers in the EU and in Switzerland. The European Commission has recognised that Switzerland provides adequate protection.
| Data | How long |
|---|---|
| Booking and stay data, including special requests | 3 years after departure, then anonymised |
| Guest registration data (identity document, date of birth, sex) | until the end of the calendar year after your stay, then deleted (Residence Registration Act, ZPPreb-1) |
| Invoices and accounting records | 10 years after the end of the year they relate to (ZDDV-1) |
| Card details | only as long as needed to guarantee or charge the booking, then deleted or masked |
| Emails and WhatsApp messages with guests | 2 years after the last contact |
| Newsletter | until you unsubscribe; after that only your email address on the unsubscribe list |
| Group and business partner correspondence | 3 years after the last contact |
| Business contacts we approached who did not reply | 1 year after our last message |
| Video recordings | up to 30 days |
| Job applications | until the end of the selection process |
| Cookies | as set out in the Cookie Policy |
After that we delete or anonymise the data.
We protect personal data with technical and organisational measures appropriate to the risk. Access is limited to staff who need it for their work, and we regularly review access rights and how long we keep data. If a personal data breach is likely to put your rights at risk, we report it to the Information Commissioner and, where the law requires, inform you without undue delay.
You have the right to:
To use your rights, write to welcome@qorxalnuviz.shop or to Art Hotel Tartini d.o.o., Tartinijev trg 15, 6330 Piran. We may ask you to confirm your identity. We reply within one month. If a request is complex, we may extend this by two more months and will tell you why.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where you believe the infringement took place. In Slovenia this is:
Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec)
Dunajska cesta 22, 1000 Ljubljana
gp.ip@ip-rs.si · www.ip-rs.si
We update this policy when our processing changes. The current version is always published on this page, with its date at the top.
