Privacy Policy

1. Data controller and contact

The controller of personal data processed in connection with this website is the business identified below. StayBadge is the product and website brand.

2. What this policy covers

This policy covers the public website and business correspondence. It does not replace the separate information provided by a hotel about processing guest data, wristband use or optional location services within a hotel deployment.

3. What data we process

Contact information: your name, work email address, hotel or company name, optional country, message and any information you choose to include in correspondence. Please do not send guest records, health information, identity documents or other unnecessary personal data.

Technical data: the server receives the IP address and information needed to deliver a page. Access logs record the IP address, request method, requested path, response status and response size. Other information needed to diagnose a server error may appear in error logs.

Preferences: the website can save your chosen theme and language in your browser. It also reads your browser language preferences to select a supported language when you enter the home page without a saved choice. We do not use these preferences to identify or track you.

4. Purposes and legal grounds

Responding to enquiries and discussing hotel cooperation is based on our legitimate interest in handling business correspondence (Article 6(1)(f) GDPR). If you personally ask us to take steps towards a contract to which you would be a party, Article 6(1)(b) GDPR may apply.

Serving the website, maintaining availability, diagnosing errors and preventing abuse are based on our legitimate interest in operating and protecting the service (Article 6(1)(f) GDPR). Records necessary to meet a legal obligation are processed under Article 6(1)(c) GDPR.

5. Contact and voluntary information

Providing contact details is voluntary. We need a reply address and information about your enquiry to respond meaningfully. A cooperation enquiry does not subscribe you to a newsletter or advertising campaign.

The contact form reports whether delivery was confirmed. If the sending service is unavailable or not connected, the message is not delivered; entered details remain in the page until it is refreshed or closed. You can also contact us directly at the email address above.

When enabled, Cloudflare Turnstile checks contact submissions for abuse. It processes technical signals such as IP address and browser/device information and a short-lived verification token. This serves our legitimate interest in protecting the service (Article 6(1)(f) GDPR). Cloudflare may process these signals outside the EEA under its applicable data protection safeguards. The message contents are not sent to Turnstile. Our gateway keeps IP-based rate counters in memory for up to one minute; it does not store message contents. A delivery provider receives contact details and message contents only after verification. See Cloudflare’s privacy policy for details.

6. Cookies, local storage and analytics

The website does not use analytics or advertising cookies, Google Analytics or personalised advertising. Fonts and images are served with the website. If anti-spam verification is enabled, its external script loads only when you interact with the contact form.

The key staybadge-theme in browser local storage keeps your appearance choice on that device until you clear site data. Without a saved choice, the website follows the system theme. The key staybadge-language stores a manually selected language until you clear site data. Without a saved language, the generic home page uses the first supported browser language, with English as the fallback. Direct links to localized pages retain their language. Clearing these preferences does not prevent you from using the website.

7. Recipients, hosting and international transfers

We have selected OVHcloud hosting in the Poland region, within the European Economic Area. Data may be accessible to hosting and email providers and authorised technical providers only as needed to operate the service or handle correspondence, and to authorities where disclosure is required by law.

We do not sell personal data or share it for third-party advertising. If a service requires a transfer outside the EEA, we will identify the transfer and apply the safeguards required by GDPR, such as an adequacy decision or standard contractual clauses, before using it for that processing.

8. How long we keep data

Business correspondence is retained for the time needed to answer the enquiry and conclude the discussion. If correspondence leads to cooperation, relevant records follow the contract and applicable legal retention requirements. Records needed for legal claims may be kept until the applicable limitation period expires.

Server logs are automatically rotated when the configured size limit is reached; their retention therefore depends on traffic volume. Theme and language preferences stay on your device until you remove them. Unsent form content is not stored by the website beyond the current page session.

9. Your rights

Subject to the conditions of GDPR, you may request access to your data, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests. If processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing.

To exercise a right, use the contact email shown above. We may ask for proportionate information to verify the request and protect against unauthorised disclosure. We respond within the time limits required by GDPR.

You may lodge a complaint with a supervisory authority, in particular in the EEA country where you live or work, or where the alleged infringement occurred. In Poland, this is the President of the Personal Data Protection Office (UODO).

10. Security and automated decisions

We minimise the information requested and use technical safeguards appropriate to the website, including restrictions on scripts and external resources. We require HTTPS encryption for public access to the website. This website does not make decisions with legal or similarly significant effects through automated processing and does not profile visitors for advertising.

11. Business audience

The website is directed at hotel professionals and business partners, not at children. Please contact us if you believe a child’s personal data has been sent to us so that we can assess and address the situation.

12. Changes to this policy

We update this policy when the website or our processing changes. The date above identifies the current version. Changes involving new purposes or services will be reflected in the information provided before that processing begins.