Personal data processing principles and privacy policy
Effective from 05.11.2026
1. DATA PROCESSING PRINCIPLES
Park Hotell Jõhvi (hereinafter the hotel) values the privacy and security of its guests. We process personal data responsibly, transparently and in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter the GDPR), the Estonian Personal Data Protection Act and other legislation in force in Estonia.
The controller of personal data is Pargi 28 hotell OÜ (registry code 16981282, address Pargi tn 28, Jõhvi, Jõhvi Parish, Ida-Viru County, Estonia), which operates Park Hotell Jõhvi. For questions regarding personal data, please contact the hotel by e-mail at info@parkhotelljohvi.ee or by phone at +372 5460 6000.
These principles apply to the hotel’s guests, persons making bookings, gift card purchasers, website visitors and other persons whose data the hotel processes in providing its services. The processing of hotel employees’ data is governed by a separate procedure.
The purpose of processing personal data is to provide guests with high-quality accommodation services, to manage bookings, to fulfil contractual and statutory obligations and to ensure the safety of the hotel, its guests and employees.
Collection of personal data
1.1. Personal data means any information relating to an identified or identifiable natural person. Such data may include, for example, name, date of birth, contact details, booking details and information related to the use of the website.
1.2. We collect personal data when you:
- book accommodation on the hotel’s website, by e-mail or by phone;
- make a booking through a booking portal (e.g. Booking.com) or a tour operator – in this case we receive your data from that intermediary;
- check in at the hotel and fill in the guest registration card;
- submit an enquiry on the website or request further information about accommodation;
- purchase or use a hotel gift card;
- subscribe to the newsletter or consent to receiving offers;
- communicate with the hotel or submit feedback or a complaint;
- use the hotel’s services and electronic access systems;
- are in an area covered by video surveillance;
- visit the hotel’s website, which uses cookies.
1.3. Depending on the service and the purpose of processing, we may process the following data:
- personal details: name, date of birth, citizenship and residential address; name, date of birth and citizenship of an accompanying spouse and minors (data required on the guest registration card under § 24 of the Tourism Act); for third-country nationals also the type and number of the travel document and the issuing country;
- contact details: e-mail address, phone number and address;
- booking and accommodation data: booking number, dates of stay and room details;
- billing data: invoices, payment method, payment status and information required for accounting;
- company data: company name, registry code and data required for invoicing;
- website usage data: IP address, device and browser data and information collected through cookies;
- access data: time and location of key card or code use;
- video surveillance recordings: images captured in the hotel’s monitored areas;
- communication data: enquiries, correspondence and feedback necessary for providing the service;
- preferences and special requests: requests you have made regarding the room, breakfast or other services.
The hotel processes only the personal data necessary to achieve the specific purpose.
The hotel does not intentionally collect special categories of personal data (e.g. health data). If you inform us, for example, of a food allergy or reduced mobility, we use this information only to fulfil your request and with your explicit consent.
We generally process the data of minors in connection with the accommodation of an accompanying parent or guardian. Where processing is based on consent and concerns an online service (e.g. a newsletter), the consent of a parent or guardian is required for children under 13 (§ 8 of the Personal Data Protection Act).
Use of personal data and legal bases
1.4. We process personal data for the following purposes and on the following legal bases. The table also shows the data retention periods:
| Purpose | Legal basis (GDPR Art. 6(1)) | Retention period |
| Managing bookings and providing accommodation services | conclusion and performance of a contract (point b) | 3 years after the service is provided (§ 146(1) of the Law of Obligations Act) |
| Registration of guests by guest registration card | legal obligation (point c), § 24 of the Tourism Act | 2 years from the date the guest registration card is completed (§ 24(6) of the Tourism Act) |
| Billing and accounting | legal obligation (point c), Accounting Act | 7 years (§ 12 of the Accounting Act) |
| Responding to enquiries and customer service | pre-contractual measures (point b), legitimate interest (point f) | up to 1 year after the enquiry is resolved |
| Handling feedback, complaints and claims | legitimate interest (point f) | 3 years after resolution |
| Sale and use of gift cards | performance of a contract (point b) | 3 years after the gift card expires |
| Security of hotel property, guests and employees (video surveillance) | legitimate interest (point f) | up to 30 days; in the event of an incident, until it is resolved or proceedings are concluded |
| Access system management (key cards and codes) | performance of a contract (point b), legitimate interest (point f) | up to 30 days; in the event of an incident, until it is resolved or proceedings are concluded |
| Returning lost and found items | legitimate interest (point f) | until the item is returned or the storage period ends |
| Direct marketing (newsletter, offers) | consent (point a); for existing customers, legitimate interest (point f), § 103¹ of the Electronic Communications Act | until consent is withdrawn or you unsubscribe, but no longer than 3 years from the last contact |
| Website operation and security (necessary cookies) | legitimate interest (point f) | as stated in the cookie table (section 2.3) |
| Website traffic analysis and marketing cookies | consent (point a) | as stated in the cookie table (section 2.3) |
| Establishment, exercise and defence of legal claims | legitimate interest (point f) | until the claim expires or proceedings are concluded |
1.5. The legal basis for processing personal data is the conclusion or performance of a contract, compliance with a legal obligation of the hotel, the hotel’s legitimate interest or your consent.
Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Providing the data required on the guest registration card is a statutory obligation, and booking data is necessary to conclude the contract. Without this data, the hotel cannot provide accommodation services. Providing data for marketing purposes is voluntary.
We send direct marketing e-mails only with your prior consent or, if you are a hotel customer, about similar services of the hotel (§ 103¹ of the Electronic Communications Act). Every message includes an option to unsubscribe free of charge.
Retention and transfer of personal data
1.6. We retain personal data only for as long as necessary to achieve the purpose for which it was collected, to comply with legal obligations or to resolve legal claims. Retention periods are set out in section 1.4. After the retention period ends, the data is deleted or anonymised.
1.7. We may transfer personal data to service providers to the extent necessary to provide the service or to comply with the hotel’s legal obligations: the property management and booking system provider (Confemar OÜ), the payment service provider (Montonio Finance OÜ), the accounting system provider (Directo OÜ), the IT service provider (Ithooldus Eesti OÜ), the security service provider (Forus Security AS) and website and e-mail service providers. Contracts have been concluded with processors that process data on behalf of the hotel.
We disclose data to competent public authorities (e.g. the Police and Border Guard Board, the Tax and Customs Board) and law enforcement authorities only on the grounds and to the extent provided by law.
Personal data is generally processed within the European Economic Area (EEA). If a service provider (e.g. a web analytics or e-mail service provider) transfers data outside the EEA, this takes place only subject to the safeguards set out in Chapter V of the GDPR – on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses approved by the Commission.
1.8. The hotel does not disclose or sell guests’ personal data. Only employees and authorised service providers with a justified need have access to the data.
1.9. You have the right to:
- receive information about the processing of your personal data and access your data;
- request the rectification of inaccurate or incomplete data;
- request the erasure of data where there are grounds for it and retention is not required by law;
- request the restriction of processing;
- object to processing based on legitimate interest and opt out of direct marketing at any time;
- receive the data you have provided in a machine-readable format and transmit it to another controller, where processing is based on consent or a contract;
- withdraw your consent at any time;
- lodge a complaint with the Estonian Data Protection Inspectorate or apply to a court.
We will respond to your request without undue delay and no later than within one month. Where necessary, we may extend this period by two months, in which case we will inform you. Before disclosing data, we may ask you to verify your identity.
1.10. For questions or requests regarding personal data, please contact us by e-mail at info@parkhotelljohvi.ee or at the hotel reception.
Video surveillance
1.11. Park Hotell Jõhvi uses video surveillance to ensure the security of the hotel entrances, common areas and car park, to protect people and property, and to establish the circumstances of possible security incidents.
Video surveillance is carried out on the basis of the hotel’s legitimate interest.
1.12. Areas under video surveillance are marked with information signs stating the name and contact details of the controller and a reference to these principles. Real-time video surveillance is carried out by the hotel and by Forus Security AS as the hotel’s processor.
1.13. Video recordings are retained for up to 30 days, after which they are deleted automatically. In the event of a security incident, the relevant recording may be retained until the incident is resolved or proceedings are concluded.
Only persons authorised by the hotel have access to the recordings. Where necessary and where there is a legal basis, recordings may be disclosed to competent authorities.
Key cards and lost and found items
1.14. Electronic key cards and door codes are used to provide access to the rooms assigned to guests and to permitted areas. The access system records the use of cards and codes. This data is used only for access management and, in justified cases, for investigating security incidents.
Please keep your key card and room access details safe and report the loss of a card to the hotel reception immediately.
1.15. Items found on the hotel premises are generally kept for one month. To return an item, we may process the owner’s name, contact details and other information necessary for the return. The data is used solely for handling and returning the item.
Data security and changes to the policy
1.16. We apply appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss and destruction. Hotel employees are required to keep personal data confidential. We notify the Estonian Data Protection Inspectorate and, where necessary, the data subjects of any personal data breach.
1.17. The hotel has the right to update these terms if legislation, services or data processing principles change. The current version is published on the hotel’s website. We will announce significant changes on the website.
Reading this privacy policy does not in itself constitute consent to all of the processing operations described in it. Consent is requested separately where processing is based on consent.
2. COOKIE POLICY
Use of cookies
2.1. To provide a better service to its users, the Park Hotell Jõhvi website www.parkhotelljohvi.ee uses cookies. The website is operated by Pargi 28 hotell OÜ.
2.2. The website may contain third-party elements (e.g. web analytics, the booking engine or social media) that store cookies on behalf of those third parties. If a provider is located outside the European Economic Area, the safeguards described in section 1.7 apply.
What is a cookie?
2.3. A cookie is a small text file that a website you visit stores on your device (computer, phone or tablet) through your browser. When you visit the website again, your browser reads the cookie and sends the information in it back to the website or element that stored it.
2.4. Cookies make the website work, remember your choices and help us track website usage statistics. We use the information from cookies to improve the website’s functionality, user experience and content.
Types of cookies used on the website
2.5.Necessary cookies are essential for navigating the website, keeping it secure and making a booking. Without them, the website cannot work properly. Consent is not required for necessary cookies.
2.6.Preference cookies remember your previous choices, such as your language, so the website can offer a more convenient and personalised experience.
2.7.Analytics cookies collect data on how visitors use the website. We use this information to make the website easier to use.
2.8.Marketing cookies are used to show you more relevant advertising and to measure how well advertising campaigns perform.
2.9. By duration, cookies are either session cookies, which are deleted when you close your browser, or persistent cookies, which remain on your device until they expire or you delete them.
2.10. A list of the cookies used on the website, with their purposes, duration and providers, is available in the website’s cookie settings.
Consent and refusing cookies
2.11. We store preference, analytics and marketing cookies only with your prior consent. Consent is requested in the cookie banner on your first visit to the website. Giving consent is voluntary, and refusing cookies is as easy as accepting them.
2.12. You can change or withdraw your consent at any time in the website’s cookie settings. You can also delete or block cookies in your browser settings. Each browser does this in its own way. More information is available on the Estonian Data Protection Inspectorate’s website: https://www.aki.ee/kupsised.
2.13. If you block cookies, some website features, including booking, may no longer be available.
3. CONTACT DETAILS
Park Hotell Jõhvi
Address: Pargi tn 28, Jõhvi, Jõhvi Parish, Ida-Viru County, Estonia
Phone: +372 5460 6000
E-mail: info@parkhotelljohvi.ee
Website: https://www.parkhotelljohvi.ee/
Legal name: Pargi 28 hotell OÜ
Registry code: 16981282
If you believe that your personal data has been processed unlawfully, you may contact the Estonian Data Protection Inspectorate via its website https://www.aki.ee (Tatari 39, 10134 Tallinn, e-mail info@aki.ee) or apply to a court.
The hotel reviews these principles at least once a year and whenever significant changes occur.