PRIVACY POLICY
1. GENERAL PROVISIONS
1.1. This privacy policy explains how UAB „MICHAELSON boutique HOTEL“ processes the personal data of hotel guests, visitors of the website www.hotelmichaelson.com, customers, suppliers and job applicants.
1.2. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania and the Law on Electronic Communications of the Republic of Lithuania.
1.3. The data controller is UAB „MICHAELSON boutique HOTEL“, company code 111805372, address: Žvejų St. 18A, LT-91241 Klaipėda, Lithuania, e-mail reception@hotelmichaelson.com, tel. +370 640 63378 (the Hotel).
1.4. Key principles: we collect data only for clear and lawful purposes, process it fairly, keep it secure and no longer than necessary; access is limited to employees and authorised processors who need it for their work.
2. DEFINITIONS
2.1. Personal data – any information relating to an identified or identifiable natural person.
2.2. Data subject – a natural person whose data is processed by the Hotel.
2.3. Cookie – a small text file stored on the visitor's device when visiting a website.
2.4. Booking system – the online room booking system book.hotelmichaelson.com.
3. WHERE WE GET DATA FROM
3.1. From you – when you book a room, check in at the Hotel, contact us by e-mail, phone or via the website, buy a gift voucher or send your CV.
3.2. From booking platforms and partners – when you book via Booking.com, Expedia, HRS or a travel agency (name, contact details, booking details).
3.3. From your device – when you visit the website and the booking system (cookies, see Section 7).
4. WHAT DATA WE PROCESS, FOR WHAT PURPOSES AND ON WHAT LEGAL BASIS
– Providing accommodation services and fulfilling bookings. Data: name, surname, contact details, arrival and departure dates, number of guests, requests, payment and invoice data, car registration number (if provided). Legal basis: performance of a contract (GDPR Art. 6(1)(b)). Retention period: 1 year after departure.
– Guest registration as required by law. Data: name, surname, date of birth, identity document number, citizenship, issuing country, address. Legal basis: legal obligation (GDPR Art. 6(1)(c)). Retention period: 1 year after departure.
– Accounting. Data: invoice and payment data. Legal basis: legal obligation. Retention period: 10 years.
– Performance of contracts with suppliers. Data: supplier's (natural person's) name, surname, contact details, business certificate or self-employment data, bank account. Legal basis: performance of a contract, legal obligation. Retention period: term of the contract and 10 years for accounting documents.
– Recruitment. Data: CV and cover letter data, references. Legal basis: consent (GDPR Art. 6(1)(a)). Retention period: deleted immediately after the selection ends.
– Handling enquiries, feedback and complaints. Data: name, surname, contact details, message content. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). Retention period: 1 year after the reply.
– Sale of gift vouchers. Data: buyer's name, surname, contact details, voucher details, recipient's name. Legal basis: performance of a contract. Retention period: voucher validity period and 1 year.
– Direct marketing. Data: name, surname, e-mail, phone. Legal basis: consent. Retention period: until consent is withdrawn.
– Safety of persons and property (video surveillance). Data: video recording. Legal basis: legitimate interest. Retention period: 30 days.
– Operation and security of the website and booking system. Data: IP address, browser, device, pages visited. Legal basis: legitimate interest. Retention period: according to the lifetime of essential cookies.
– Visitor statistics and measuring advertising results. Data: analytics and advertising cookie data. Legal basis: consent given in the cookie banner. Retention period: as set out in Section 7.
4.1. The video surveillance system does not use facial recognition; signs inform about surveillance before entering the monitored area; cameras do not cover premises where privacy is expected.
4.2. Payment card data is processed by payment service providers; the Hotel does not store full card details.
4.3. You may separately consent to receiving news and offers by e-mail, for example when checking in at the Hotel. Consent is optional and not linked to the provision of accommodation services. You can withdraw it at any time by clicking „Unsubscribe“ at the bottom of the e-mail or by writing to reception@hotelmichaelson.com.
5. DATA RECIPIENTS AND PROCESSORS
5.1. The following service providers process data on behalf of the Hotel:
– UAB „Cona Baltic“ – hotel management system (protel), online booking system and booking channel management;
– Wix.com Ltd. – website platform;
– Google Ireland Limited – Google Analytics (only with consent, see Section 7);
– Meta Platforms Ireland Limited – Meta (Facebook, Instagram) pixel and Conversions API (only with consent, see Section 7);
– payment service providers – payment processing;
– accounting service providers.
5.2. When you book via Booking.com, Expedia, HRS or another platform, that platform is a separate data controller and applies its own privacy policy.
5.3. Data may be disclosed to public authorities where required by law.
5.4. Some providers (Wix, Google, Meta) may transfer data to countries outside the European Economic Area, including the USA. In such cases the safeguards provided by the GDPR apply – the EU-U.S. Data Privacy Framework and/or the standard contractual clauses approved by the European Commission.
5.5. We do not sell or rent personal data.
6. DATA OF MINORS
6.1. Persons under 14 may not submit personal data via the website. Data of children staying with their parents or guardians is provided by the parents or guardians.
7. COOKIES AND TRACKING TECHNOLOGIES
7.1. Essential cookies ensure the operation and security of the website and the booking system. They are always set and do not require consent.
7.2. Analytics and advertising cookies are used only if the visitor consents in the cookie banner („Accept“ or by selecting categories in „Settings“). They are not set before consent:
– Google Analytics 4 (Google Ireland Limited) – visitor and booking statistics on the website and in the booking system; main cookies _ga, _ga_* – up to 2 years;
– Meta pixel and Conversions API (Meta Platforms Ireland Limited) – measuring the results (bookings and enquiries) of Facebook and Instagram advertising; main cookie _fbp – up to 3 months.
7.3. If a visitor consents to analytics and advertising cookies and books a room, the fact of the booking, its amount and currency are sent to Google and Meta to show which channel generated the booking.
7.3a. If a visitor consents to advertising cookies and submits an enquiry or performs another action on the website, Meta may receive encrypted (hashed) e-mail address, phone number, name, city and country to link the action to an advertisement. This data may also be sent directly from the Wix server (Conversions API).
7.4. You can change or withdraw your consent at any time by clicking „Cookie settings“ or by deleting cookies in your browser. Withdrawal does not affect the lawfulness of processing carried out before it.
7.5. How the providers process data: Google – policies.google.com/privacy; Meta – www.facebook.com/privacy/policy.
8. YOUR RIGHTS
8.1. You have the right to:
– obtain information about the processing and access your data;
– request correction of inaccurate data;
– request erasure of your data („right to be forgotten“) when it is no longer needed; this right does not apply where we must keep the data by law;
– request restriction of processing;
– data portability;
– object to processing based on legitimate interest and to object to direct marketing at any time;
– not be subject to a decision based solely on automated processing;
– withdraw your consent at any time.
8.2. You can submit requests by e-mail reception@hotelmichaelson.com, by phone +370 640 63378 or in writing to Žvejų St. 18A, LT-91241 Klaipėda, Lithuania. Please provide information allowing us to verify your identity.
8.3. We reply within 1 month; for complex requests this period may be extended by 2 more months, in which case we will inform you.
8.4. You have the right to lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos St. 17, LT-10312 Vilnius, www.vdai.lrv.lt).
9. CHANGES TO THE POLICY
9.1. The Hotel may update this policy. The new version applies from its publication on the website. In case of any discrepancy, the Lithuanian version prevails.
Last updated: 31 October 2026.