PRIVACY POLICY
Date of adoption: 16.10.2026.
Version: 2.0
Last updated: 16.10.2026.
Introduction
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we may disclose it to, and what rights you have in relation to your data.
Personal data is data relating to an identified or identifiable natural person. This may include, for example, a name, contact details, identification document details, booking information, or an IP address.
We take your privacy seriously. We process personal data in accordance with the Personal Data Protection Act of the Republic of Serbia and other regulations applicable to our business.
Where the General Data Protection Regulation (GDPR) of the European Union applies to a particular processing, we also comply with its requirements.
Who processes your data
The controller of your personal data is:BNV BRISTOL DOO BEOGRAD
Karađorđeva 50
11000 Belgrade, Republic of Serbia
E-mail: [email protected]
Data Protection Officer: Sandra Pribić PR GDPR Partner
What data we collect
Depending on how you use our services, we may collect:
1. name and surname;
2. date and place of birth;
3. address and other details of residence;
4. nationality;
5. gender;
6. details from an identity card, passport or other identification document;
7. email address and telephone number;
8. reservation and stay details;
9. information about the services you use;
10. information about your requests and preferences regarding your stay;
11. data required for payment and invoicing;
12. vehicle registration number, when you use the car park;
13. information you provide when you contact us;
14. data required for loyalty programme membership, if you enrol;
15. photographs and other visual recordings, where there is a relevant legal basis;
16. CCTV footage;
17. data about your use of our website, including your IP address and data collected via cookies and similar technologies.
We do not collect more data than is necessary for a specific purpose.
We process special categories of personal data only when permitted by law and when there is an appropriate legal basis for such processing.
How we obtain your data
We most often obtain data directly from you, when:
1. you book a room or another service;
2. you stay at the Hotel;
3. you contact the Hotel;
4. use our website;
5. sign up for our loyalty programme;
6. sign up to receive our promotional messages.
If you made your booking through a booking platform, a travel agency or another intermediary, we may receive certain data from that intermediary.
We may also receive your data from other business partners or systems when it is necessary to provide a service or to fulfil legal obligations.
Why we process your data
We use your data only for specific and lawful purposes.
Guest registration and other legal obligations
We must collect and use certain data because we are required to do so by law. This includes, among other things, data required for guest registration and records, including data submitted through the Central Information System – eTurista, as well as data necessary to fulfil tax, accounting, and other legal obligations. The data we collect for these purposes is used to the extent necessary to fulfil a specific legal obligation.
Booking and provision of services
We use the data so that we can:
1. process and confirm your booking;
2. prepare for your stay;
3. provide the services you have booked;
4. respond to your requests and enquiries;
5. arrange additional services you have requested;
6. process payment and issue an invoice;
7. communicate with you regarding your stay.
We process this data because it is necessary to perform the contract with you or to take steps prior to entering into a contract.
Payment and Accounting
We process the data required for payment and invoicing to perform our contract with you and to comply with our legal and accounting obligations. When payment is made via a payment service provider, that provider may process the data in accordance with their own policies and applicable regulations.
Security
For the protection of our guests, employees, visitors and the Hotel's property, we may use CCTV and other security measures. Areas under video surveillance are marked with an appropriate notice. CCTV recordings are retained for a maximum of 30 days, unless a specific recording needs to be kept for longer in connection with a particular incident, legal proceedings, or for the establishment or protection of rights and interests, in accordance with the law.
Promotional messages and offers
If you have subscribed to our promotional messages, we may use your contact details to send you information about the Hotel's offers, events, services and news. When your prior consent is required to send a certain type of promotional messages, we will request it before we start sending them. You can unsubscribe from promotional messages at any time, by following the instructions provided in the message itself or by sending
request to [email protected]. Unsubscribing from promotional messages does not affect the processing of data required for your reservation, stay, or to fulfil our legal obligations.
Loyalty Programme
If you join our loyalty programme, we use your data to manage your membership, provide benefits and communicate with you about it. Data used for sending promotional messages is processed in accordance with the rules that apply to direct marketing.
Photographs and Event Promotion
During events and other activities at the Hotel, photographs may be taken in which guests and visitors are present. When we use a guest's photograph for the promotion of the Hotel, we will, where necessary, obtain their consent beforehand for such processing. If the processing is based on consent, you may withdraw your consent at any time. Withdrawing your consent does not affect the lawfulness of processing that was carried out before its withdrawal. If you have any questions or wish to exercise your rights in relation to a photograph, you can contact us at [email protected].
Legal basis for processing
We only process data when there is a corresponding legal basis for doing so.
Depending on the purpose, this may be:
1. performance of a contract or taking steps at your request prior to entering into a contract;
2. compliance with a legal obligation;
3. your consent, where it is required for a specific processing;
4. our legitimate interest, when such processing is permitted by law.
For each specific processing activity, we apply the appropriate legal basis. When we base the processing on our legitimate interest, this interest may, depending on the specific processing, include the protection of guests, employees and property, the prevention of fraud and misuse, the protection of information systems, the establishment and defence of legal claims, as well as other legitimate interests related to the safe and efficient operation of the Hotel. When applying the legitimate interest basis, we assess whether our interests override the interests or fundamental rights and freedoms of the data subject, in accordance with applicable regulations.
Are you required to provide us with data
Providing certain personal data may be a legal requirement or a necessary condition for entering into and performing a contract, or for providing certain hotel services. In such cases, if you do not provide the data necessary for a specific purpose, we may not be able to process your booking, provide a particular service, check in the guest, or fulfil a relevant legal obligation.
Data that is not necessary for the stated purposes may be optional, and failure to provide it will not affect the provision of the basic hotel service.
Who we may disclose your data to
We do not sell your data.
We may make your data available to other parties when it is necessary to provide a service, fulfil a legal obligation, protect safety, or establish and protect legal rights.
These may include:
1. relevant government authorities, when we are required to do so by law;
2. providers of hotel and reservation system services;
3. providers of IT, cloud, hosting and other technical services;
4. payment service providers;
5. providers of e-mail and SMS messaging services;
6. marketing and communication service providers;
7. accounting, legal and other professional advisers;
8. business partners who provide the service you have requested;
9. other parties when there is an appropriate legal basis for doing so.
When someone processes your data on our behalf, we take appropriate measures to ensure that the data is processed in accordance with the law and is protected.
Transfer of data outside the Republic of Serbia
In the course of using certain hotel, reservation, IT, cloud and other systems, your data may be transferred or made available to service providers located outside the Republic of Serbia, including countries outside the European Economic Area. When data is transferred to a country for which an adequate level of protection has not been determined, The Hotel ensures appropriate safeguards in accordance with applicable regulations, including, where the relevant conditions are met, adequacy decisions, standard contractual clauses or other legally permitted safeguards.
You can obtain more information about specific international transfers and categories of service providers by contacting the Hotel at [email protected].
Analytics and cookies
Our website uses cookies and other similar technologies. Some cookies are necessary for the website to function, while others are used for analytics, marketing and other functionalities. We use non-essential cookies in accordance with your choice and applicable regulations.
A detailed overview of the cookies we use can be found in the table below.
1. Strictly necessary cookies
| Name | Provider | Purpose | Category | Duration |
| bid-consent-cookie | The Bristol (the-bristol.com) | Saves the user's choice regarding cookies (accepting with settings or declining). | Necessary | 1 year (if cookies are accepted); 7 days (if rejected) |
| bid-country | The Bristol (the-bristol.com) | Saves the visitor's country, determined from their IP address, to automatically populate the country code in forms. | Necessary | Session |
| initial_referrer | The Bristol (the-bristol.com) | Saves which external website the user came from, or whether the access was direct, in order to determine the booking source. | Required | Session |
| referrer_synced | The Bristol (the-bristol.com) | Indicates that the source of the visit has already been recorded and prevents it from being re-recorded. | Essential | Session |
| bid-checkin-checkout | The Bristol (the-bristol.com) | Saves the selected arrival and departure dates during the booking process. | Required | Session |
| amadeus-access-token | The Bristol (the-bristol.com) | Enables access to the Amadeus reservation system to check availability and prices. Used exclusively on the server-side (HttpOnly). | Required | Up to 1 hour |
| bid-member-cookie | The Bristol (the-bristol.com) | Maintains the session of a logged-in Club 1912 loyalty programme member. The cookie is available exclusively on the server-side (HttpOnly). | Required | 15 minutes |
| bid-member-info-cookie | The Bristol (the-bristol.com) | Stores basic member information, such as name and membership level, for display in the user interface and to apply the member price. | Necessary | 1 day (after login); session (for an anonymous discount within the loyalty programme) |
| NEXT_LOCALE | The Bristol (the-bristol.com) | Saves the selected website language. | Necessary | Session |
| __cf_bm | Cloudflare (*.hubspot.com, *.hsforms.com, *.hs-scripts.com, *.hs-analytics.net, *.hs-banner.com) | This is used to protect against automated access and bots on the HubSpot servers that the website loads. | Necessary | 30 minutes |
2. Analytics cookies
| Name | Provider | Purpose | Category | Duration |
| _ga | Google Analytics (.the-bristol.com) | Assigns a unique identifier to a visitor to distinguish users and analyse visits to the website. | Analytics | 2 years |
| _ga_W841LRVTFX | Google Analytics (.the-bristol.com) | Stores session state information for the website's Google Analytics 4 (GA4) property. | Analytics | 2 years |
| _cs_id | Contentsquare (listed as Google Analytics in the original table; verify) | Identifies the visitor to analyse website behaviour and record sessions. | Analytics | 13 months |
| _cs_s | Contentsquare (listed as Google Analytics in the source table; verify) | Records the number of page views during a session and the session recording status. | Analytics | 30 minutes |
| _cs_c | Contentsquare (listed as Google Analytics in the source table; verify) | Saves the user's choice regarding consent to tracking by the Contentsquare tool. | Analytics | 13 months |
| hubspotutk | HubSpot (.the-bristol.com) | Identifies the visitor and allows data from submitted forms (contact, events and Club 1912) to be linked to a contact in the CRM system. | Analytics | 6 months |
| __hstc | HubSpot (.the-bristol.com) | A basic session tracking cookie, which stores data about the domain, visitor identifier, time of the first and last visit, and the number of sessions. | Analytics | 6 months |
| __hssc | HubSpot (.the-bristol.com) | Tracks the session and the number of page views within the session. | Analytics | 30 minutes |
| __hssrc | HubSpot (.the-bristol.com) | Indicates that the user has restarted their browser, i.e. that a new session has started. | Analytics | Session |
3. Marketing cookies
| Name | Provider | Purpose | Category | Duration |
| _gcl_au | Google Ads (.the-bristol.com) | Measures conversions associated with Google Ads campaigns via the Conversion Linker feature. | Marketing | 3 months |
| IDE | Google (DoubleClick) (.doubleclick.net) | Enables the display and measurement of ads based on user visits and activity, including remarketing. | Marketing | 13 months |
| _fbp | Meta (Facebook Pixel) (.the-bristol.com) | Tracks visits for advertising and conversion measurement on Facebook and Instagram platforms. | Marketing | 3 months |
Data retention period
We only retain your data for as long as is necessary for the purpose for which it was collected, unless we are required by law to keep it for longer or when longer retention is needed to establish or protect legal claims.
The retention period depends on the type of data and the purpose for which the data is processed. When determining the retention period, we take into account the nature of the data, the purpose of the processing, legal retention periods, the need to maintain business and accounting records, as well as the need to establish or defend legal claims.
When the retention period expires, we delete, destroy or anonymise the data, unless there is a legal or other permitted basis for its continued retention.
Data security
We take appropriate technical and organisational measures to protect your data from unauthorised access, loss, destruction, or other unlawful processing.
Only individuals who need the data to perform their jobs have access to it.
We regularly review and improve our security measures in line with the risks and the nature of the processing we carry out.
Personal data breach
In the event of a personal data breach, we will take appropriate measures in accordance with applicable regulations, including an assessment of the risk to the rights and freedoms of the data subject. When the legal requirements are met, we will notify the Supervisory Authority and/or the data subject of the personal data breach, in accordance with the law.
Automated decision-making
The Hotel does not currently make decisions that produce legal consequences or similarly significantly affect a guest solely on the basis of the automated processing of their data.
The Hotel also does not currently carry out any profiling of guests that produces such effects. Should we introduce such processing in the future, we will provide information about it in accordance with applicable regulations and, where necessary, ensure appropriate rights and safeguards to protect the interests of the data subject.
Your rights
In relation to your data, you have the right to:
1. request confirmation as to whether we are processing your data;
2. request access to your data;
3. request the rectification of inaccurate data or the completion of incomplete data;
4. request the erasure of your data, where the legal conditions are met;
5. request the restriction of processing, where the legal conditions are met;
6. in certain cases, request the portability of your data;
7. object to processing based on legitimate interest;
8. object to processing for direct marketing purposes;
9. withdraw consent where processing is based on consent;
10. not be subject to a decision based solely on automated processing, where the legal conditions are met;
11. lodge a complaint with the Commissioner for Access to Public Information and Data Protection.
Some of these rights may be restricted where there are legal grounds for doing so.
How to exercise your rights
If you wish to exercise any of your rights or have a question regarding the processing of your data, you can contact us:
BNV BRISTOL DOO BEOGRAD
Karađorđeva 50
11000 Belgrade, Republic of Serbia
E-mail: [email protected]
If we cannot reliably establish your identity based on the information we already hold, we may request additional information necessary to confirm your identity.
We will respond to the request without delay, and in any case within 30 days of its receipt. In complex cases, the deadline may be extended in accordance with the law, of which we will inform you.
Complaint to the Commissioner
If you believe that the processing of your data has been carried out in breach of the regulations, you have the right to lodge a complaint with the Commissioner for Public Information and Personal Data Protection.
Commissioner for Public Information and Personal Data Protection
15 King Alexander Boulevard
11000 Belgrade
Republic of Serbia
Telephone: +381 11 3408 900
Fax: +381 11 3343 379
Email: [email protected]
If the GDPR applies to the specific processing, you also have the right to contact the competent supervisory authority in the European Union, when the conditions for this are met.
Application of the GDPR
The Hotel provides services to guests from various countries, including member states of the European Union.
When the GDPR applies to specific processing, the Hotel complies with its requirements, including the rules on transparency, data subjects' rights, and international data transfers. To find the data protection supervisory authority in your European Union member state, you can use the official list of supervisory authorities published by the EU Data Protection Board: EU Supervisory Authorities.
Changes to the Privacy Policy
We may amend this Privacy Policy from time to time to align it with changes in legislation, business practices, or the way we process data.
A new version of the Policy will be posted on this website.
If the change introduces a new purpose of processing for which your consent is required, we will request it before commencing such processing.