POLICY

on the processing of personal data of users of pinskhotel.by

Controller: Grand Pinsk Limited Liability Company (Grand Pinsk LLC), taxpayer identification number 291837786

Version dated 19 August 2026

1. General provisions

1.1. This Policy on the processing of personal data of users of pinskhotel.by (the Policy) sets out how Grand Pinsk Limited Liability Company (the Controller) processes and protects personal data obtained when individuals use the website https://pinskhotel.by/, its pages, forms, embedded modules and services (the Website).

1.2. The Controller's address is 27 Lenina Street, Pinsk, Brest Region, Republic of Belarus. Contact details: +375 29 155-77-00, +375 29 587-78-77, grandpinskhotel@gmail.com.

1.3. This Policy has been prepared in accordance with Law No. 99-Z of the Republic of Belarus of 7 May 2021 on Personal Data Protection (the Law) and other legislation of the Republic of Belarus. The current text of the Law is available in the National Legal Information Database.

1.4. The Policy applies to the processing of personal data of Website users, visitors, individuals submitting enquiries and requests, individuals requesting a call back, and guests and customers using the online booking module.

1.5. The Policy does not govern the processing of data of employees, job applicants, business partners or hotel visitors outside the Website, including CCTV and in-person accommodation registration, where such processing is unrelated to use of the Website.

1.6. The Policy is made publicly available before personal data processing begins at https://pinskhotel.by/kontakty/politika-konfidentsialnosti/.

1.7. Reading this Policy does not constitute consent to all processing of personal data. Where the Law requires consent, the Controller obtains it separately through an affirmative action by the user, such as ticking a box in a form or cookie-settings panel. Users may refuse consent without adverse consequences, except that a function or service objectively requiring the data may then be unavailable.

2. Key terms

2.1. Personal data means any information relating to an identified or identifiable individual.

2.2. A personal data subject (user) is an individual whose personal data is processed.

2.3. Processing of personal data means any operation or set of operations involving personal data, including collection, organisation, storage, alteration, use, anonymisation, restriction, dissemination, disclosure and deletion.

2.4. Disclosure of personal data means actions intended to make personal data available to a specified person or group of persons.

2.5. Dissemination of personal data means actions intended to make personal data available to an unspecified group of persons.

2.6. An authorised person is a person who processes personal data on behalf of, or in the interests of, the Controller under a contract or another legal basis.

2.7. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state.

2.8. Cookies are small pieces of data stored on the user's device by the Website or a connected service and retrieved on subsequent visits.

2.9. Other terms have the meanings assigned to them by the Law.

3. Processing principles and methods

3.1. The Controller processes personal data lawfully, fairly and transparently, solely for purposes stated in advance and only to the extent necessary to achieve them.

3.2. The Controller does not combine personal datasets processed for incompatible purposes, takes steps to keep data up to date, and does not retain identifying data longer than required by the processing purposes, contract or law.

3.3. Processing may be automated or manual and includes collection, recording, organisation, accumulation, storage, updating, retrieval, use, disclosure, restriction and deletion. Dissemination is permitted only where there is a separate legal basis.

3.4. Sources of personal data include:

the user, who enters data in forms, the booking module or messages, or provides it by other means;
the user's devices and software when accessing the Website;
booking, analytics, mapping and communication services connected to the Website;
other lawful sources where obtaining data is necessary to perform a contract or is provided for by law.

4. Purposes, data categories and legal bases for processing

4.1. Website visits, operation and security

4.1.1. During a Website visit, the following may be processed automatically: IP address; date and time of access; requested page and referring page; browser, operating system, device type and characteristics; language; network connection; technical errors; session and other identifiers; and cookie data.

4.1.2. Data is processed to display the Website, retain user preferences, ensure operation and information security, prevent abuse, diagnose errors and compile visit statistics.

4.1.3. Analytical and other optional cookies are processed on the basis of consent expressed in the cookie-settings panel. Technical data and essential cookies are processed to the extent necessary to provide the requested Website function, maintain security and fulfil the Controller's statutory obligations.

4.2. Website search

4.2.1. Using search involves processing the search-query text and the technical data listed in paragraph 4.1.1.

4.2.2. The purposes are to provide search results, improve navigation and identify technical errors. Users should not include unnecessary personal data in search queries.

4.3. Call-back requests

4.3.1. The call-back form processes the name, if provided, telephone number, submission and its time, consent information and necessary technical data.

4.3.2. The purposes are to contact the user, answer questions, provide service information and, where necessary, take steps towards entering into a contract at the user's request.

4.3.3. Processing is based on the user's consent. Once steps are taken to enter into or perform a contract, the Law's grounds for processing without consent for contractual purposes also apply.

4.3.4. If no contract is concluded, data is retained until communication and the matter are resolved, but no longer than one year after the last interaction, or until consent is withdrawn, unless another lawful basis for processing exists.

4.4. Enquiries and file attachments

4.4.1. The enquiry form processes the name, telephone number, message, attached file's name, format, size and contents, submission and its time, consent information and necessary technical data.

4.4.2. The purposes are to assess the enquiry, contact the user, prepare a response or proposal and, at the user's request, take steps to enter into or perform a contract.

4.4.3. The legal basis and retention period follow paragraphs 4.3.3 and 4.3.4 of the Policy.

4.4.4. The Controller does not request special-category personal data, passwords, full bank-card details or identity-document copies through this form. Users should not include such information in a message or attachment unless necessary and specifically requested by the Controller.

4.5. Online booking

4.5.1. The page https://pinskhotel.by/booking/ uses the embedded TravelLine: Booking Engine module. Depending on the booking stage and selected services, the following may be processed:

arrival and departure dates, number of rooms and guests, age categories and children's ages;
selected room, rate plan, additional services, promotional code, requests and comments;
surname, first name, patronymic, nationality, telephone number, email address and other contact details;
customer and guest details where a booking is made on behalf of others;
booking number and status, price, currency, payment method and status, and payment identifier;
technical data and session and user identifiers of the booking module.

4.5.2. The purposes are to search availability, calculate prices, create, change or cancel bookings, enter into and perform accommodation and related service agreements, send confirmations and service messages, accept payment, handle enquiries and fulfil statutory obligations.

4.5.3. Processing is based on the need to take steps at the user's request to enter into and perform a contract to which the data subject is a party, and, where required by the Law, on consent or another lawful basis.

4.5.4. A user providing other guests' data confirms that they have a lawful basis for disclosing it to the Controller, have informed those guests about the processing and act within their authority.

4.5.5. Booking data is retained for the period necessary to perform the contract and resolve possible claims, and then for periods required by accounting, tax, archiving, hotel-service, migration-registration and other applicable legislation.

4.5.6. Bank-card details are entered into the relevant payment provider's secure form and processed under that provider's rules. The Controller may receive the payment amount, method, identifier and status as necessary to fulfil the booking and maintain records.

4.6. Reviews and material for publication

4.6.1. If a user submits a review or other material for publication, the Controller may process their name or pseudonym, review text, publication date, stay information, image and other voluntarily supplied data.

4.6.2. Publishing personal data on the Website constitutes dissemination to an unspecified audience and requires separate consent to dissemination or another legal basis. Users may contact the Controller to request that publication cease.

4.7. Communication through third-party services

4.7.1. The Website includes links to Telegram, WhatsApp, maps, social networks and other external services. Following a link or sending a message may allow the service to receive user data under its own rules.

4.7.2. When a user contacts the Controller through such a service, the Controller may receive the profile name or pseudonym, telephone number, account identifier, message contents and metadata. The purpose and retention period depend on the enquiry and paragraphs 4.3–4.5 of the Policy.

4.7.3. Contact details obtained to respond to enquiries, requests or bookings are not used for advertising mailings without separate consent.

5. Cookies and analytics services

5.1. The Website may use:

essential cookies required for pages and forms to work, prevent abuse, retain sessions and preserve selected settings;
analytical cookies to assess traffic and users' interactions with the Website;
cookies and other identifiers used by the embedded booking module, maps, rating widget and other external components.

5.2. The Website uses Yandex Metrica, which may receive page and event information, IP addresses, browser and operating-system details, cookies and anonymised identifiers. Click maps, link tracking and accurate bounce-rate measurement are enabled. A description of the service is available on the page “How Metrica works”, and Yandex's policy is available at https://yandex.ru/legal/confidential/.

5.3. Optional analytics technologies are used on the basis of consent. Consent may be changed or withdrawn in the cookie-settings panel, where available, or by deleting or blocking cookies in browser settings. Blocking essential cookies may prevent some functions from working correctly.

5.4. Cookie retention depends on its purpose and the relevant service's settings. Session cookies are deleted when the browser closes; persistent cookies expire at the end of their set period or when deleted by the user. The Controller must not retain analytics identifiers longer than necessary for the stated purpose.

6. Authorised persons, recipients and third-party services

6.1. The Controller may entrust processing to persons supporting the Website and services, provided a contract defines the purposes and processing activities, confidentiality obligations and data-protection measures.

6.2. The following may participate in processing Website users' data:

TRAVEL LINE SYSTEMS LLC, provider of TravelLine: Booking Engine for online bookings; legal documents are available at https://www.travelline.ru/support/privacy/;
YANDEX LLC and its affiliates, providing Yandex Metrica, maps and the rating widget; their policy is available at https://yandex.ru/legal/confidential/;
1C-Bitrix LLC and technical contractors, providing the software platform and related technical components; privacy terms are available at https://www.1c-bitrix.ru/legal/privacy/;
the hosting provider, Website administrator, email provider and other contractors responsible for infrastructure, support, backups and information security;
banks, payment organisations and payment-service providers when payments are made;
public authorities and other persons in the circumstances and manner prescribed by law.

6.3. A third-party service may independently determine the purposes and methods of processing when users interact with it directly. It then acts as an independent controller for its own processing, and users should read its rules.

6.4. At a data subject's request, the Controller provides the information required by the Law about persons to whom their personal data has been disclosed.

7. Cross-border transfers

7.1. Use of TravelLine, Yandex, 1C-Bitrix and other external services may involve transferring technical, analytical, contact and booking data to the Russian Federation and other countries where the relevant recipients or infrastructure are located.

7.2. Cross-border transfers comply with Article 9 of the Law. Transfers to a country that does not ensure an adequate level of protection for data subjects' rights are permitted only on a basis provided by the Law, including informed consent to the resulting risks, necessity to perform a contract with the data subject, or authorisation from the competent authority.

7.3. As a member of the Eurasian Economic Union, the Russian Federation is included in the list of countries ensuring an adequate level of protection for personal data subjects' rights, established by the National Personal Data Protection Centre of the Republic of Belarus.

8. Retention, cessation of processing and deletion

8.1. Specific retention periods are determined by the purpose and legal basis of processing, contractual terms, limitation periods and statutory requirements.

8.2. Once the purpose is achieved, consent expires or is withdrawn, the Controller ceases processing and deletes the data unless another statutory basis permits continued processing.

8.3. If immediate deletion from a backup is technically impossible, the Controller blocks further use and deletes the data within the established backup-refresh cycle.

8.4. Anonymised statistical data that cannot identify a user may be retained after the original personal data is deleted.

9. Security measures

9.1. The Controller takes legal, organisational and technical measures to protect personal data against unauthorised or accidental access, alteration, restriction, copying, dissemination, disclosure, deletion and other unlawful acts.

9.2. In particular, the Controller restricts access for staff and contractors, uses secure connections, accounts and authentication, maintains backups, updates software, monitors data operations, enters into the necessary agreements with authorised persons and trains those permitted to process data.

9.3. Users should also take reasonable precautions: do not share verification codes, check the Website address, and do not send unnecessary documents or special-category personal data through general forms.

10. Data subjects' rights

10.1. A data subject has the right to:

withdraw consent to processing at any time without giving reasons;
obtain information about the processing of their personal data;
request correction of incomplete, outdated or inaccurate personal data;
obtain information free of charge once per calendar year about disclosure of their personal data to third parties, unless the law provides otherwise;
request, free of charge, cessation of processing and deletion where no lawful basis for processing exists;
challenge the Controller's actions, inaction and decisions before the National Personal Data Protection Centre of the Republic of Belarus and subsequently before a court;
exercise other rights provided by law.

10.2. Consent may be withdrawn by submitting a request under Article 14 of the Law or in the same form in which it was given, where this allows withdrawal to be established.

10.3. To exercise rights under Articles 10–13 of the Law, the data subject submits a written request or an electronic document. It must include their surname, first name, patronymic if any, residential or temporary address, date of birth, identification number or identity-document number where required by the Law, the request itself and a handwritten or digital signature.

10.4. Written requests should be sent to Grand Pinsk LLC, 27 Lenina Street, Pinsk, Brest Region, Republic of Belarus. An electronic document bearing a digital signature may be sent to grandpinskhotel@gmail.com. For clarification, the Controller may also be contacted using the details in paragraph 1.2.

10.5. The Controller considers requests and notifies the data subject within the statutory time limits. As a general rule, withdrawal of consent, correction of data, provision of information on disclosure to third parties, cessation of processing and deletion are carried out within fifteen days of receiving a duly completed request, unless the law provides otherwise.

11. Minors' data

11.1. The Website and hotel services may involve bookings for stays with children. A child's data must be supplied by their legal representative or another person lawfully entitled to act in the child's interests.

11.2. Until a data subject reaches 16, consent to processing is given by a legal representative, unless legislation specifies another age or an exception.

11.3. If the Controller establishes that a minor's data was supplied without the necessary legal basis, it will cease processing and delete or restrict the data, unless the law requires otherwise.

12. External websites

12.1. The Controller does not control the contents or data-processing rules of third-party websites and applications reached through external links. Users should read the relevant privacy policy before providing data.

12.2. An external link does not make the Controller responsible for all actions of that third party. This does not limit the Controller's responsibility for its own processing or for an authorised person processing data on its behalf.

13. Policy changes and contact details

13.1. The Controller may amend the Policy following changes to legislation, services, processing purposes or methods. A new version takes effect when published on the Website, unless it states otherwise.

13.2. If a change requires fresh consent, the Controller obtains it before processing under the revised terms. Continued use of the Website does not itself replace consent where the Law requires it.

13.3. The current Policy is available at https://pinskhotel.by/kontakty/politika-konfidentsialnosti/.

13.4. For questions about personal data processing and protection, contact:

Postal address: Grand Pinsk LLC, 27 Lenina Street, Pinsk, Brest Region, Republic of Belarus;
Email: grandpinskhotel@gmail.com;
Telephone: +375 29 155-77-00, +375 29 587-78-77.