Legal
Privacy policy
Your privacy matters to us. This policy explains what personal data the Lazy Haven website collects, why, on what legal basis, who it is shared with, and what rights you have under the EU General Data Protection Regulation (GDPR). In practice we collect only what you send us through the contact form.
Last updated: 2026-07-21
1. Data controller
The controller responsible for your personal data is Lazy Haven (host: Boštjan), Ob igrišču 14, 9226 Moravske Toplice, Slovenia. We have not appointed a Data Protection Officer, as we are not required to. For any privacy question you can reach us directly at bostjan.jelsevar@gmail.com.
2. What personal data we collect
We only collect personal data that you actively provide or that is strictly necessary to operate the site securely:
- Contact form data: your name, your email address, the message you write, and the language version of the site you used.
- Technical data: your IP address and the time of submission, recorded together with your enquiry to protect the form against spam and abuse. We do not use analytics, advertising, or tracking cookies.
3. Purposes of processing
We use this information solely to read, answer, and follow up on your enquiry about staying at Lazy Haven, and to keep the contact form secure. We do not use your data for marketing, we do not build profiles, and we never sell it.
4. Legal basis (Art. 6 GDPR)
We process your contact-form data on the basis of your consent, which you give by submitting the form (Art. 6(1)(a) GDPR), and, where you contact us about a possible booking, in order to take steps at your request prior to entering into a contract (Art. 6(1)(b)). Storing your IP address for spam and abuse prevention rests on our legitimate interest in keeping the site secure (Art. 6(1)(f)).
5. Recipients and processors
We do not share your data with third parties for their own purposes. To operate the site we rely on the following service providers, who act only as processors on our documented instructions:
- Google (Gmail SMTP) — delivers the enquiry email from the contact form to us.
- Cloudflare (Turnstile) — provides the CAPTCHA that distinguishes real visitors from bots and protects the form from spam.
6. International data transfers
Our processors named above are operated by companies based in the United States and may process data outside the European Economic Area. Where that happens, the transfer is safeguarded by the European Commission’s Standard Contractual Clauses and equivalent measures, so that your data continues to enjoy an adequate level of protection.
7. How long we keep your data
We keep enquiries only for as long as needed to handle your request and any resulting booking correspondence, and no longer than 24 months afterwards, after which they are deleted. You may ask us to delete yours sooner at any time.
8. Security
We apply appropriate technical and organisational measures to protect your data, including encrypted transport (HTTPS), access limited to the site owner, and encryption of stored credentials. No transmission over the internet can be guaranteed to be completely secure, but we take reasonable steps to protect your information.
9. Automated decision-making
We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects concerning you.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data erased (“right to be forgotten”);
- restrict how we process your data;
- receive your data in a portable, machine-readable format;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting processing already carried out.
To exercise any of these rights, simply email us at bostjan.jelsevar@gmail.com. We will respond within one month, free of charge.
11. Right to lodge a complaint
If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana — www.ip-rs.si.
12. Changes to this policy
We may update this policy from time to time to reflect changes in the site or in the law. The current version, with its date, is always the one published on this page.
13. Contact
Questions about this policy or your data? Write to bostjan.jelsevar@gmail.com and we will be glad to help.