1.1. This Personal Data Processing Policy (the “Policy”) defines the procedure for processing and protecting personal data of users of the website geleonhotel.ru, guests, potential guests and other persons contacting Individual Entrepreneur Denis Alekseevich Vinogradov through the website, the online booking module, e-mail, telephone and messengers.
1.2. The Policy has been prepared in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”, Federal Law No. 149-FZ dated 27 July 2006 “On Information, Information Technologies and Information Protection”, and other applicable regulatory legal acts of the Russian Federation.
1.3. By using the website, sending a request through the feedback form, making a booking, paying for services or contacting the Operator in any other way, the user confirms that he or she has read this Policy and understands how his or her personal data are processed.
1.4. This Policy is made freely available on the website and applies to all personal data received by the Operator in connection with use of the website, processing of requests, booking and provision of hotel services.
1.5. This English version is provided for convenience. The Russian version of this Policy is the original and legally prevailing version. In case of any discrepancy between the Russian and translated versions, the Russian text shall prevail.

2.1. Individual Entrepreneur Denis Alekseevich Vinogradov is responsible for organizing personal data processing, unless otherwise established by a separate internal administrative document of the Operator.
2.2. Requests from personal data subjects, applications for withdrawal of consent, and requests for clarification, blocking or deletion of personal data shall be sent to: geleon_spb@mail.ru.ru.

Personal data — any information relating directly or indirectly to an identified or identifiable individual.
Operator — a person who independently or jointly with other persons organizes and/or carries out personal data processing and determines the purposes of processing, the scope of data and the actions performed with them.
Personal data subject — a website user, guest, potential guest, guest representative or any other individual whose personal data are processed by the Operator.
Personal data processing — any action or set of actions performed with personal data, including collection, recording, systematization, accumulation, storage, updating, use, transfer, depersonalization, blocking, deletion and destruction.
Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to a foreign person, foreign authority or foreign organization.
Website — the website located at geleonhotel.ru.

4.1. The Operator may process personal data of the following categories of personal data subjects:

• website users;
• guests and potential guests of the accommodation facility;
• persons sending requests through the “Contact Us” form on the Contacts page;
• persons making online bookings through the Bnovo module;
• persons making online payments;
• persons contacting the Operator by e-mail, telephone, Telegram or WhatsApp;
• representatives of contractors and other organizations interacting with the Operator.

5.1. Through the feedback form on the Contacts / “Contact Us” page, the Operator may process the following data:

• name;
• e-mail address;
• telephone number;
• text of the user’s message;
• technical data related to sending the form, including date and time of the request, IP address, browser and device information, if such data are recorded by the website platform.

5.2. When an online booking is made through the Bnovo module, the Operator may process the following data:

• guest’s first name and surname;
• telephone number;
• e-mail address;
• booking details: check-in and check-out dates, number of guests, selected room category, rate, price, booking notes;
• information about payment, payment status and booking confirmation;
• other information independently provided by the user when booking or during subsequent communication.

5.3. Upon check-in and provision of hotel services, the Operator may process information necessary to comply with the laws of the Russian Federation, register accommodation and keep guest records, including identity documents, registration information and other data required by the applicable rules for provision of hotel services.
5.4. When contacting the Operator via Telegram, WhatsApp, e-mail or other communication channels, the Operator processes the information that the personal data subject independently provides in correspondence or conversation.
5.5. When using the website, technical data may be processed: IP address, browser and device information, cookie files, date and time of visit, referral source and user actions on the website, if such information is recorded by connected services.
5.6. The Operator does not request or process special categories of personal data or biometric personal data through the website, unless otherwise expressly provided for by the laws of the Russian Federation or by a separate written consent of the subject.

6.1. The Operator processes personal data for the following purposes:

• processing user requests submitted through the “Contact Us” form;
• communicating with guests and potential guests;
• providing information about the address, check-in procedure, accommodation terms and available services;
• making, confirming, changing and administering bookings;
• sending notifications related to booking and accommodation;
• arranging and confirming online payment through the YooKassa payment service;
• performance of the hotel services agreement;
• compliance with the laws of the Russian Federation;
• ensuring proper operation of the website, forms, booking module, map services and communication services;
• ensuring website security and preventing technical failures or unlawful use of the website;
• reviewing requests from personal data subjects and exercising their rights.

6.2. The Operator does not use personal data for advertising mailings without a separate legal basis and/or a separate consent of the personal data subject, where such consent is required by applicable law.

7.1. The legal grounds for personal data processing are:

• data subject;
• performance of an agreement to which the personal data subject is a party, or taking steps at the subject’s request prior to entering into an agreement;
• fulfilment of obligations imposed on the Operator by the laws of the Russian Federation;
• exercise of the Operator’s rights and legitimate interests, provided that the rights and freedoms of the personal data subject are respected;
• this Policy and other local documents of the Operator, to the extent not contrary to the laws of the Russian Federation.

8.1. The Operator may perform the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification, updating, modification, extraction, use, transfer, provision, access, depersonalization, blocking, deletion and destruction.
8.2. Personal data are processed by a mixed method: using automation tools and without using automation tools.
8.3. The Operator does not make decisions that produce legal consequences for the personal data subject or otherwise affect his or her rights and legitimate interests solely on the basis of automated processing of personal data.

9.1. Personal data may be stored in the website administration panel on the Tilda platform, in the Bnovo online booking service, in the Operator’s e-mail account, and in other systems used by the Operator to process requests, bookings, payments and provide hotel services.
9.2. Requests from the website may be stored in the website request database and/or the Tilda platform and may also be sent to the Operator’s e-mail and to Bnovo.
9.3. Booking data submitted through Bnovo may be stored in the Bnovo service and duplicated to the Operator’s e-mail.
9.4. According to the information available to the Operator, the website and the main databases used for processing personal data of website users and guests are located in the Russian Federation, unless otherwise follows from the terms of use of separate external services.

10.1. For operation of the website, processing of requests, booking and payment, the Operator may use the following services and technical partners:

• Tilda platform — website hosting, operation of forms, storage of requests and technical website infrastructure;
• Bnovo online booking service — making, confirming and administering bookings;
• Mail.ru e-mail — receiving and storing notifications, requests and correspondence;
• YooKassa — processing online payments and receiving payment statuses;
• Yandex Maps — displaying the location of the accommodation facility;
• Telegram and WhatsApp — communication channels used by the user at his or her own initiative by clicking the relevant links;
• external fonts and technical resources, including Google Fonts, if they are actually connected to the website and have not been replaced by local font files.

10.2. Personal data may be transferred to Bnovo for making, confirming and administering bookings. Data from Bnovo may be duplicated to the Operator’s e-mail.
10.3. When making an online payment, data required for payment processing are processed by the YooKassa payment service in accordance with its rules and documents. The Operator does not store full bank card details of users.
10.4. When following links to Telegram or WhatsApp, the user independently moves to third-party services and provides information to them at his or her own initiative. The Operator processes only the information that the user sends to the Operator in correspondence.
10.5. The Operator transfers personal data to third parties only to the extent necessary to achieve the purposes of processing, perform an agreement, provide services, process payments, comply with legal requirements or protect the rights and legitimate interests of the Operator.

11.1. The Operator does not intentionally carry out cross-border transfer of personal data of website users and guests, except where such transfer is caused by the personal data subject’s use of foreign communication services or by the actual connection of external technical resources located outside the Russian Federation.
11.2. When the user independently moves to Telegram, WhatsApp or another third-party service, the user interacts with the relevant service under the terms of such service. The Operator processes the information that the user sends to the Operator in correspondence.
11.3. If cross-border transfer of personal data is required to achieve the purposes of processing, the Operator carries it out in compliance with the laws of the Russian Federation, including performance of the necessary notification and organizational procedures before such transfer begins, where applicable.

12.1. The website may use cookies and similar technologies to ensure proper operation of the website, forms, booking module, map services and other technical functions.
12.2. Cookies may contain technical information about the browser, device, user actions on the website, selected settings and the user session.
12.3. Detailed information on the use of cookies is provided in the Cookie Policy published on the website.

13.1. Personal data are processed until the purposes of processing are achieved or until the personal data subject withdraws consent, unless otherwise provided by the laws of the Russian Federation, an agreement or the need to protect the rights and legitimate interests of the Operator.
13.2. Request data may be stored in e-mail, the website administration panel, Bnovo and other working systems of the Operator for the period necessary to process the request, confirm the booking, perform the agreement, resolve possible claims and fulfil legal obligations.
13.3. After the purposes of processing are achieved or upon occurrence of other legal grounds, personal data shall be deleted, destroyed or depersonalized unless further storage is required by law.

14.1. The Operator takes necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution and other unlawful actions.
14.2. Such measures may include restricting access to requests and bookings, use of accounts and passwords, granting access only to persons who need it for their work duties, controlling access to e-mail and services, as well as organizational data protection measures.
14.3. Persons who gain access to personal data must maintain confidentiality and use the data only for purposes related to processing requests, booking, payment and provision of services.

15.1. The personal data subject has the right to:

• receive information about the processing of his or her personal data;
• request clarification, blocking or destruction of personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw consent to personal data processing;
• receive information about persons to whom personal data are or may be transferred;
• appeal against actions or omissions of the Operator to the authorized body for protection of the rights of personal data subjects or to a court;
• exercise other rights provided by the laws of the Russian Federation.

15.2. To exercise his or her rights, the subject may send a request to: geleon_spb@mail.ru. The request should preferably specify full name, contact details, the substance of the request and information enabling the Operator to identify the request.

16.1. The personal data subject may withdraw consent to personal data processing by sending the relevant application to: geleon_spb@mail.ru.
16.2. After receiving the withdrawal, the Operator stops processing personal data and destroys the data within the period established by the laws of the Russian Federation, except where the Operator is entitled to continue processing without the subject’s consent on other legal grounds.

17.1. For the convenience of users, this Policy may be published on the website in Russian and foreign languages.
17.2. The translation of the Policy is provided solely for the convenience of users. In the event of contradictions, discrepancies or differences in interpretation between the Russian and foreign versions, the Russian version shall prevail.

18.1. The Operator may amend this Policy. The new version of the Policy takes effect upon its publication on the website, unless another effective date is specified in the new version.
18.2. Users are advised to periodically review the current version of the Policy on the website.

For questions regarding personal data processing and exercise of the rights of personal data subjects, please contact: geleon_spb@mail.ru.