PRIVACY POLICY AND SCOPE
This Privacy Policy explains how UAB Mazon Home (the Company, “we”) processes personal data relating to Bōheme House accommodation and restaurant customers, guests, restaurant visitors, persons making enquiries and website visitors. It applies to services provided by the Company, bookings made directly or through intermediaries, and related communications. Where a particular service at another location is provided by a different legal entity, that provider must separately identify itself and provide the relevant privacy information.
This Policy operates alongside the Bōheme House Terms & Conditions. The Terms govern the service and payment arrangements; this Policy explains personal data processing. This Policy is not a blanket consent form: each processing purpose is based on an appropriate legal basis.
Personal data of job applicants, employees and former employees are further covered by the Company’s separate employee privacy notice and internal GDPR documents provided to staff.
DATA CONTROLLERS AND CONTACT DETAILS
Controller for accommodation and restaurant operations: UAB Mazon Home, company registration No. 305888757, Muitinės g. 9-2, Kaunas, Lithuania, email [email protected], telephone +370 668 21771. The Company’s director coordinates data protection matters; enquiries may be sent to the email address above.
Separate controller for video surveillance: UAB Mazon Holding, company registration No. 304286915, G. D. Kuverto g. 15G-16, Neringa, Lithuania, email [email protected].
PERSONAL DATA WE PROCESS AND ITS SOURCES
Depending on the service, we process: name and contact details; booking reference, dates, number of guests, apartment or table details, arrival and departure dates; orders, invoice particulars, payment and security-deposit transaction information; correspondence, special requests, complaints and incident records; where required, guest-registration and identity-verification information prescribed by law; and technical website-use data actually collected by enabled tools.
Data are obtained from you, an authorised person making a booking for you, booking platforms, payment service providers or communications with us. Where information about you is supplied by another person, we provide the information required under GDPR Article 14 where applicable.
Please avoid submitting excessive information. We do not ask for account passwords or security question answers. Payment card transactions are handled by the relevant payment provider; the data involved depend on the actual system and its role.
PROCESSING PURPOSES AND LEGAL BASES
Booking, accommodation, restaurant orders, service communications and payment administration: GDPR Article 6(1)(b) (contract or pre-contractual steps).
Mandatory guest registration, accounting, taxes, legally required records and disclosures to competent authorities: GDPR Article 6(1)(c) (legal obligation).
Handling enquiries and complaints, prevention of fraud and incidents, bringing or defending legitimate claims and proportionate IT security: GDPR Article 6(1)(f) (legitimate interests in resolving matters, maintaining service and system security and protecting rights), where these interests are not overridden by individual rights.
Optional direct marketing, publication of images or reviews where required: GDPR Article 6(1)(a) (consent) or another lawful basis specifically applicable to the activity. Lithuanian electronic communications rules also apply to marketing.
Allergy information or dietary restrictions revealing health data are processed only where voluntarily supplied for a specific service and with explicit consent under GDPR Article 9(2)(a), together with an appropriate Article 6 basis.
GUEST REGISTRATION AND IDENTITY CHECKS
Bōheme House operates a remote self check-in service without a permanently staffed reception. Under the Lithuanian Law on Tourism and the requirements of the National Tourism Information System (NTIS), E. turistas, we verify the identity of guests and submit the legally required guest-registration details electronically to NTIS no later than 24 hours from the date of accommodation, subject to statutory exceptions.
Our remote check-in form requests the details required by applicable rules, including name, surname, date of birth, issuing country and number of the identity document, nationality, residence and stay details, insofar as required under the current guest-registration rules. Information relating to accompanying minors is handled within the scope prescribed by law.
Because identification cannot be performed at a physical reception desk, we ask guests to provide a photograph or copy of a valid passport or identity card through a designated secure channel. We request the image to verify identity and the accuracy of registration details. NTIS does not require accommodation providers to collect copies of identity documents, and the document image is not submitted to NTIS as a mandatory registration record. Submission of prescribed registration details to NTIS relies on GDPR Article 6(1)(c) (legal obligation); the necessity of processing a document image for remote identification is assessed separately under GDPR Article 6(1)(f) (legitimate interest in reliable identity verification) and the principles of proportionality and data minimisation.
The image is used solely to verify identity and registration details, not for marketing or unrelated purposes. Following verification it is erased without undue delay, unless there is a separate documented lawful basis for retention in a specific case. Only authorised personnel may access it. If remote verification cannot be completed, an appropriate alternative method of identity verification may be offered.
If legally mandatory information is not provided, accommodation may not be possible. Retention of identity document images is separate from the processing of registration data in NTIS. Further details of processing in NTIS are available in its personal data processing rules.
PAYMENTS, CARDS, DEPOSITS AND CLAIMS
To administer payments, security-deposit holds and releases, we process transaction-related data such as amount, date, booking reference, payment status and limited payment-method identifiers supplied by the payment system. We do not process complete card data beyond what is necessary and lawfully permitted.
Where there is alleged damage, additional services or a disputed payment, we may process relevant evidence, correspondence and payment information solely to assess or defend a legitimate claim. Whether charges are valid is governed by the specific booking conditions and Terms & Conditions; this Privacy Policy does not itself authorise extra card charges.
ALLERGIES AND OTHER SPECIAL CATEGORY DATA
If you voluntarily disclose allergies, intolerances or dietary restrictions revealing health information, we use them solely to prepare or serve your particular order safely. Access is limited to service and kitchen staff who need the information; it is not discussed publicly or placed in a general customer marketing database.
These data are deleted when the specific service is completed unless a limited portion must be retained for a particular dispute or claim. You may withdraw explicit consent at any time without affecting processing carried out lawfully before withdrawal.
If you do not provide this information, we may be unable to take your individual dietary needs into account. Providing it is not a general requirement for making a booking.
VIDEO SURVEILLANCE (CCTV)
The data controller responsible for video surveillance in Bōheme House premises and areas is UAB Mazon Holding, company registration No. 304286915, G. D. Kuverto g. 15G-16, Neringa, Lithuania, email [email protected]. UAB Mazon Holding determines the surveillance arrangements, purposes, scope, access conditions and recording retention periods. Requests relating to personal data processed by the CCTV system may be sent to the email address above.
DIRECT MARKETING, IMAGES AND REVIEWS
Where we send newsletters or other direct marketing messages, we do so only on a lawful basis and in compliance with applicable electronic communications requirements. You may unsubscribe at any time using the unsubscribe link or by emailing [email protected].
We use identifiable images, testimonials or videos in promotional communications only on an appropriate legal basis and, where required, with separate consent. Refusal to consent does not affect accommodation or restaurant services.
According to the internal documents available, the Company does not carry out automated individual decision-making with effects covered by GDPR Article 22 or related profiling. This Policy does not describe nationality-based marketing profiling as an ongoing practice.
WEBSITE, COOKIES AND ANALYTICS
The website may use strictly necessary technical cookies and, only with prior consent where required, analytics or marketing cookies and similar technologies. Rejecting non-essential cookies must be as easy as accepting them, and consent can be changed or withdrawn through the website cookie settings.
This general Privacy Policy does not replace a functioning consent-management interface and technical audit. The presence of Google Tag Manager or another tag manager does not by itself establish which cookies are actually set.
DATA RECIPIENTS AND PROCESSORS
Where necessary, data may be disclosed to booking and property-management platforms, restaurant POS providers, payment providers, banks, accountants, IT maintenance, email and cloud service providers; authorised legal advisers and insurers; public authorities, courts and law enforcement where legally justified.
Where a partner acts as our processor, GDPR Article 28 contractual requirements apply; where it acts as an independent controller, its separate privacy notice may apply. UAB Mazon Holding is a separate CCTV controller, not a general recipient of all guest booking data.
The Company does not sell customer personal data. Data are not supplied to third parties for their independent marketing without a separate lawful basis.
TRANSFERS OUTSIDE THE EEA
International booking, email, cloud or other services may involve processing outside the European Economic Area (EEA). In that case we assess the specific transfer and apply GDPR Chapter V safeguards, such as an adequacy decision, Standard Contractual Clauses and additional measures where required.
You may contact [email protected] for information about safeguards and how to obtain a copy.
DATA RETENTION PERIODS
Accommodation booking data: normally 2 years after the service is provided, unless a longer period is necessary for accounting, disputes or legal obligations.
Restaurant booking data: up to 12 months or less if no longer needed.
Customer communications: 12 months from the last communication, unless needed longer for a contract or dispute.
Invoices, payments and accounting records: normally 10 years where that statutory period applies to the document category; any different applicable statutory period prevails.
Allergy and health-related dietary data: until completion of the specific service and then deleted, unless necessary for a documented dispute.
Complaints, incidents and claims: until resolution and expiry of the applicable limitation period or another lawful retention period.
Marketing consent and preferences: while consent or another marketing basis remains effective; opt-out evidence may be retained as necessary to demonstrate compliance.
CCTV footage: retained for the period determined by UAB Mazon Holding.
DATA SECURITY AND STAFF CONFIDENTIALITY
We apply risk-appropriate technical and organisational measures: role-based individual access, password and authentication protections, access reviews, safeguards in our systems, staff training and confidentiality commitments. Staff must not use guest information for personal purposes or photograph, disclose or discuss it with unauthorised persons.
Data security incidents are recorded and assessed. Where required under GDPR Articles 33 and 34, the supervisory authority and/or affected individuals are notified.
YOUR RIGHTS AND REQUESTS
Under the GDPR you have rights to information, access, rectification, erasure, restriction, portability in certain cases, objection to processing based on legitimate interests, and withdrawal of consent at any time where consent is relied upon. Rights may be restricted only where the law allows.
Send requests about data processed by UAB Mazon Home to [email protected] and CCTV requests to [email protected]. We respond without undue delay, normally within one month; the GDPR permits an extension for complex cases, with notice. We request additional identification only where there are reasonable doubts about identity.
If you believe your data are processed unlawfully, you may complain to the Lithuanian State Data Protection Inspectorate (www.vdai.lrv.lt) or seek judicial remedies.
UPDATES AND CONTACT DETAILS
We review this Policy when processing practices or laws change. Updated versions are published on our website; where required by law, significant changes are communicated appropriately.
For Company data processing: UAB Mazon Home, [email protected]. For video surveillance: UAB Mazon Holding, [email protected].
Policy version: October 2026.