Privacy Policy
This Privacy Policy explains how Kenova ("we", "us", or "Kenova") collects, uses, stores, and protects personal data in connection with the Kenova guest-guide platform (the "Service").
Dubrovnik-Neretva County, Croatia
Contact: hello@kenovastay.com
We are based in the Republic of Croatia, a member state of the European Union. This policy is written to comply with the General Data Protection Regulation (EU) 2016/679 (GDPR) and its Croatian implementation under the Zakon o zaštiti osobnih podataka (ZZOP).
1. What data we collect and why
We collect two categories of personal data depending on your relationship with Kenova.
1.1 Host data (property owners and managers who subscribe to Kenova)
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, email address, WhatsApp/phone number | To contact you, deliver the Service, provide support | Art. 6(1)(b) — performance of a contract |
| Property name, address, check-in details, house rules, local recommendations | To generate your property's welcome guide | Art. 6(1)(b) — performance of a contract |
| WiFi network name and password | Displayed in your welcome guide to arriving guests | Art. 6(1)(b) — performance of a contract |
| Billing and payment data | To process subscription payments | Art. 6(1)(b) — performance of a contract; Art. 6(1)(c) — legal obligation (VAT) |
1.2 Guest data (travellers who scan a Kenova guide QR code)
Welcome guides are served as static web pages with no user accounts, no login, and no tracking cookies. We do not intentionally collect any personal data from guests. If you view a guide, your IP address may be logged transiently by our hosting provider (Netlify) in standard server access logs for security and infrastructure purposes. We do not use, process, or analyse these logs beyond routine security monitoring.
2. How we collect data
- Host intake form (Google Forms) — submitted voluntarily when a host onboards
- Direct email or WhatsApp contact between host and Kenova
- Netlify server logs (automatic, infrastructure-level)
3. Processors and third parties
We use a small number of sub-processors to operate the Service. Each is contractually bound to process your data only on our behalf and in accordance with GDPR.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google LLC (Forms, Sheets, Gmail, Drive, Apps Script) | Host intake, email delivery, data processing | USA (EU SCCs / Google Workspace DPA) |
| Netlify, Inc. | Hosting and delivery of welcome guides | USA (EU SCCs / Netlify DPA) |
We do not sell, rent, or share your personal data with any third party for marketing purposes. We do not use your data to train AI models.
4. International transfers
Our sub-processors (Google, Netlify) are headquartered in the United States. Transfers to these processors are covered by the EU Standard Contractual Clauses (SCCs) and each processor's applicable Data Processing Agreement. By using the Service you acknowledge that your data may be processed in the United States under these safeguards.
5. Retention
| Data category | Retention period |
|---|---|
| Host account and property data | Duration of active subscription, plus 12 months after termination (to resolve disputes and comply with accounting obligations) |
| Billing records | 7 years (Croatian accounting law / Zakon o računovodstvu) |
| Netlify access logs | 30 days (Netlify default), then automatically deleted |
| Support correspondence | 3 years from last contact |
6. Your rights under GDPR
As a data subject in the EU, you have the following rights. To exercise any of them, contact us at hello@kenovastay.com. We will respond within 30 days.
- Right of access (Art. 15) — obtain a copy of the personal data we hold about you.
- Right to rectification (Art. 16) — correct inaccurate or incomplete data.
- Right to erasure (Art. 17) — request deletion of your data where there is no legitimate reason for us to continue processing it.
- Right to restriction (Art. 18) — ask us to suspend processing of your data in certain circumstances.
- Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
- Right to object (Art. 21) — object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
7. Right to lodge a complaint
You have the right to lodge a complaint with the Croatian supervisory authority:
Selska cesta 136, 10 000 Zagreb, Croatia
Tel: +385 1 4609 000
Web: azop.hr
Email: azop@azop.hr
You may also lodge a complaint with the supervisory authority of the EU member state in which you reside or work.
8. Cookies and tracking
The welcome guide pages currently use no analytics cookies, tracking pixels, or third-party scripts other than fonts. If we add analytics in the future, we will update this policy and request your consent where required by law.
9. Children
The Service is directed at property hosts and managers and is not intended for persons under 18. We do not knowingly collect personal data from minors.
10. Security
We apply technical and organisational measures appropriate to the risk, including HTTPS-only delivery, restricted access to host data, and security headers on all web properties. Welcome guides are served as static files with no database connectivity.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Material changes will be communicated to active hosts by email at least 14 days before they take effect.
12. Contact
Questions about this policy or your personal data: hello@kenovastay.com