Last updated: 3 October 2026.
1. Who is responsible for your data?
The controller of personal data processed in BELVOYA is K&K Global Solutions sp. z o.o., ul. Józefa Sowińskiego 59/46, 01-105 Warszawa, Polska, NIP 5842854900, KRS 0001117071. For privacy questions and requests, email kontakt@kkglobal.pl.
2. What we process and why
Search and hotel information
You can search without creating an account. We process your destination or hotel, dates, occupancy, currency, filters and the nationality used for a rate request. These criteria are sent to Nuitée / LiteAPI to retrieve accommodation information and rates. The current search uses Polish guest nationality. Browser and server requests also contain technical information such as IP address, time and browser details.
Where these data relate to you, we use them to provide the service you request (Article 6(1)(b) GDPR). Limited technical information is also used for security and service reliability, based on our legitimate interest (Article 6(1)(f) GDPR).
Account and saved offers
We process your email address, account identifier, sign-in and account information, and the hotel, stay criteria and target price you save. If you choose Google sign-in, Google provides the information associated with that sign-in, which can include your email, name and profile picture. We use these data to create and maintain your account, authenticate you and make your saved offers available (Article 6(1)(b) GDPR). Providing the information required for an account is voluntary, but necessary to use its features.
Service messages and correspondence
We use your email to send messages necessary for sign-in and account security. We process the information you include when contacting us to answer your request, provide support or handle a complaint. Depending on the matter, the basis is performing the service (Article 6(1)(b)), complying with a legal obligation (Article 6(1)(c)) or our legitimate interest in responding to correspondence and protecting rights (Article 6(1)(f) GDPR).
An internal notification of a new registration is sent to the operator’s authorised administrator. This supports account administration and service supervision, based on our legitimate interest. It is not a newsletter subscription. We do not currently send automatic price-alert emails or use account registration as consent to advertising.
3. Who receives information?
Authorised personnel and the following service providers receive information to the extent needed for their role:
- Vercel — website hosting, delivery and technical operation;
- Supabase — account authentication, database and backend functions;
- Resend — delivery of transactional emails and internal registration notifications;
- Google — Google Analytics 4 usage statistics and optional Google sign-in, if you choose it;
- Nuitée / LiteAPI — hotel information, rate searches and availability verification;
- Hotel-image providers — when your browser loads an external photograph, its host receives the technical data needed to deliver it, including your IP address.
Providers may use their own approved subprocessors. Information may also be disclosed to professional advisers or competent authorities where necessary and supported by a legal basis. Optional Google sign-in is also subject to Google’s own privacy information.
Some providers operate internationally, so processing or access may occur outside the European Economic Area. Applicable safeguards depend on the provider and service, and can include an adequacy decision or the European Commission’s standard contractual clauses. You can request information about the safeguards relevant to your data and how to obtain a copy by contacting us. We do not represent that every service processes data exclusively in the EU.
4. How long do we keep data?
We keep account data and saved offers for the duration of the account service. You can remove saved offers yourself and request account closure by email. After a deletion request, we assess which data can be removed and whether a limited subset must be retained to comply with an applicable legal obligation or to establish, exercise or defend specific legal claims. We do not retain all account information indefinitely on that basis.
Correspondence is retained while the matter is handled and, where justified, for the period needed to meet applicable obligations or resolve related claims. Technical logs are retained according to their security and operational purpose and the provider settings. Deleted information may remain in protected backups until those backups expire under the relevant provider’s configured retention cycle; backups are not used as an active account database.
5. Cookies, browser storage and analytics
We use cookies and similar browser storage for sign-in, session security and preserving actions you request, such as returning to your search after sign-in. Session-storage entries for a search or a pending saved offer normally remain until that browser tab is closed. Authentication tokens have limited lifetimes and may be refreshed during use.
We use Google Analytics 4 to understand which parts of BELVOYA are visited, whether hotel searches return results and which offers visitors view or select. Analytics starts automatically when the website opens. It uses a pseudonymous browser identifier and technical information such as device, browser, approximate location and activity time. This statistical measurement is separate from optional Google sign-in. We do not send your name, email, account identifier, payment details, authentication tokens or the text you type into search fields as analytics event parameters.
Our analytics events use a limited set of parameters, such as the currency, party size, stay length, result count, a recognised destination category and the supplier hotel identifier. Page URLs are sent without search parameters or fragments. Advertising storage, advertising personalisation and Google Signals are disabled. We do not record a visitor consent click or treat account registration as one. Details about analytics cookies and browser controls are available in our cookies information.
6. Your choices and rights
Depending on the legal basis and circumstances, you may request access to your data, a copy, correction, deletion, restriction of processing or data portability. You may object to processing based on legitimate interests. If we use consent as a basis in the future, you will be able to withdraw it without affecting the lawfulness of earlier processing.
Send requests to kontakt@kkglobal.pl. We may ask for information necessary to verify your identity, without requesting more than needed. We respond without undue delay and normally within one month. If a lawful extension is needed because of complexity or the number of requests, we will explain it within that first month.
You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), or another competent supervisory authority. uodo.gov.pl.
7. Automated decisions, bookings and changes
We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Filtering and sorting hotel results help you browse offers. Online purchases and payments are not currently available; this notice does not imply that we are already collecting payment-card details or completing hotel reservations.
When the service or its data processing changes, we update this notice and its date. If a change materially affects how we use your personal data, we will provide appropriate information before the new processing begins. New purposes requiring consent will not be authorised merely by changing this page.