Privacy Policy
Effective from 21 October 2026
This policy explains how Hotel Vilmāja processes your personal data when you book a room, stay at the hotel or use our website, how long the data is kept and what rights you have.
1. Controller and contact details
The controller of your personal data is IL12, SIA (registration No. 50203621381), registered address: Zemgaļu iela 23A – 11, Riga, LV-1006, Latvia, which operates Hotel Vilmāja at Ilmājas iela 12, Riga, LV-1004.
For questions about personal data, write to reservation@vilmaja.lv or call +371 20628874.
2. Applicable law
We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), the Latvian Personal Data Processing Law, the Tourism Law, the Accounting Law, the Law on Information Society Services and other Latvian legislation.
3. What data we process, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling a booking request (website form, e-mail, phone) | Name, e-mail, phone, requested dates, room type, number of rooms and guests, your notes | Steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)) | If the booking is not confirmed: up to 3 months after the request is handled. If confirmed: see the next row. |
| Performing the booking and providing your stay | Name, company name (if booked by a company), contact details, stay dates, room, number of guests, country, payment method, notes about the stay | Performance of a contract (Art. 6(1)(b)) | Up to 2 years after the stay ends (for possible claims and disputes), unless the law requires longer. |
| Invoicing, payments and accounting | Name or company name, registration and VAT number, address, e-mail, invoice amount and payment information | Legal obligation (Art. 6(1)(c); Accounting Law) | For the periods set by law for keeping accounting documents. |
| Guest registration and notification of foreign guests | Identity document details, nationality, arrival and departure dates (only where required by law) | Legal obligation (Art. 6(1)(c); Tourism Law and related regulations) | For the period set by law. |
| Communication, handling questions and complaints, legal defence | Correspondence with the hotel, content of calls and e-mails, related booking data | Our legitimate interests (Art. 6(1)(f)) | Up to 2 years, or until a dispute is resolved. |
| Security and protection of property (video surveillance) | Video images, place and time of recording | Our legitimate interests — ensuring the safety of guests, staff and property, preventing and investigating incidents (Art. 6(1)(f)) | No longer than 30 days; if a recording is needed to investigate an incident or to comply with an authority’s request — until the matter is resolved. |
| Operating and securing the website | IP address, device and browser technical data in server logs | Legitimate interest in operating and securing the website (Art. 6(1)(f)) | As set by the hosting provider, usually no longer than several weeks. |
Video surveillance. For the safety of people and property, video surveillance is carried out in the hotel’s common areas and grounds. We do not carry out video surveillance in guest rooms or bathrooms. We inform about video surveillance with warning signs. Access to recordings is restricted to authorised persons, and we disclose recordings only to law enforcement or other competent authorities where the law requires.
We do not store payment card data in our systems. We do not use your data for direct marketing without your separate consent. When retention periods end, data is deleted or anonymised.
4. Where we get the data
- Directly from you (website form, e-mail, phone, during your stay).
- From booking platforms (for example Booking.com) if you booked there — they pass us the data needed for the booking.
- From a company or person booking on your behalf (for example your employer or a travel agency).
- From the hotel’s video surveillance cameras, if you are in the hotel’s common areas or grounds.
5. Who we share data with
We share personal data only where necessary for the purposes above or where required by law:
- Technology service providers (processors): Google (Firebase) for cloud storage and website hosting; Render for the auxiliary service that forwards booking requests to the hotel’s e-mail; an e-mail service provider.
- Accounting and financial service providers, banks and payment service providers — for invoicing and payments.
- Booking platforms (for example Booking.com) — if the booking was made through them.
- State and municipal authorities, law enforcement and courts — where required by law.
We choose processors carefully, and they may use the data only on our instructions.
6. Transfers outside the EU/EEA
Some of our service providers (for example Google and Render) are connected with companies outside the EU/EEA. In such cases we rely on GDPR transfer safeguards, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework. Our booking data is stored in a data centre in the European Union.
7. Data security
We use encrypted connections (HTTPS), access to booking data only after sign-in and with role-based permissions (staff see only what they need for their work). These measures reduce, but cannot entirely eliminate, the risk of data being lost or reaching unauthorised persons.
8. Cookies and third-party content
The website does not use advertising or tracking cookies. Only your chosen language is stored in your browser. The site embeds a Google Maps map and Google Fonts; when they load, Google may receive your IP address and use its own cookies under its own terms. If you do not want this, you can avoid the map section or block third-party content in your browser settings.
9. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects for you.
10. Your rights
You have the right to:
- obtain confirmation whether we process your data and access it;
- have inaccurate or incomplete data corrected;
- request erasure where there is no lawful ground to keep the data;
- restrict processing and object to processing based on our legitimate interests;
- receive your data in a structured format (data portability) where processing is based on a contract;
- withdraw consent at any time (this does not affect the lawfulness of earlier processing).
To exercise your rights, write to reservation@vilmaja.lv. We may ask you to confirm your identity before replying. We reply without undue delay and within one month at the latest.
11. Complaints
If you believe the processing of your data breaches the law, you can contact us or lodge a complaint with the Data State Inspectorate of Latvia (www.dvi.gov.lv).
12. Changes to this policy
We may update this policy. The current version is always published on the website, and its effective date is shown at the top of the page.