Privacy policy

1. Who the controller is

The controller of the tobogana.sk, tobogana.cz, tobogana.pl, tobogana.hu and tobogana.com websites ("Tobogana") is MEDIBEARS s. r. o., registered office at J. Bendíka 738/6, 971 01 Prievidza, Slovakia, company ID (IČO) 56 818 301, tax ID (DIČ) 2122462584, VAT ID (IČ DPH) SK2122462584, entered in the Commercial Register of the District Court of Trenčín, section Sro, file no. 55562/R. For anything about personal data, write to us at data@tobogana.com.

2. Visitors who are not signed in

Your children's ages, saved hotels and comparisons are remembered only in your browser. We do not send them to our server.
Site statistics: we record the type of event (search, hotel page view, click on a hotel's website or phone number, error report), the kind of visit source (search engine, AI assistant, social network, other website, campaign, direct visit) and a few search parameters, such as the number of children or filters. We do not store an IP address, a visitor identifier or a cookie.
Google Analytics: we measure traffic with Google Analytics. It sets analytics cookies only after you consent in the cookie banner, and you can change your choice at any time. Without consent, Google receives only anonymous signals with no cookies and no advertising data. Legal basis: consent.
Advertising cookies: we do not use them.
Reporting an error in the details: we store the text of the report and your e-mail address if you enter it. Cloudflare Turnstile protects the form against bots.
Reporting a review: we store the reason, the text and your e-mail address if you enter it. We use the e-mail address only to tell you the decision.
Hotel photos from Google: on a hotel profile, photos load directly from Google services. Your browser communicates with Google, which receives technical data such as your IP address. We store neither the photos nor this data.
Google rating on a hotel profile: the rating card is loaded by Google Maps Platform. When it loads, Google receives technical data such as your IP address.
Photos of regions, attractions and tips from Wikimedia Commons are served from our own server with the author's name and licence. Your browser does not communicate with Wikimedia for them.
The hotel map loads from OpenFreeMap (map data from OpenStreetMap), which receives technical data such as your IP address.
Links to Booking.com: the "Check prices and dates" link to Booking.com on hotels without a paid listing is an affiliate link. If you book a stay through it, Booking.com pays us a commission. The price does not change for you, and the commission does not change the score or the order of hotels. After the click, the intermediary CJ (Commission Junction) and Booking.com process data about the visit under their own policies: CJ privacy policy, Booking.com privacy policy.
Links to hotel and partner websites: we add to the address only a tag showing that the visit came from Tobogana.
Legal basis: legitimate interest in running, securing and improving the website.

3. Parents with an account

You create an account by signing in with Google. You do not set a password with us.

Data from your Google account: name and e-mail address.
Details you add about hotels: your answers, the month and year of your stay and the review status. Next to a published detail we show "according to parent {first name} · stay {month/year}". You can hide your first name in your account.
Reviews: stars, text, month and year of your stay, your children's ages and the review status. With a published review we show your first name (unless you hide it), the month of your stay and your children's ages, never your e-mail address or surname.
Discounts: when you reveal a discount code, we save it to your account together with the terms that applied at that moment. The partner receives only totals (views, clicks, codes revealed), never your name or e-mail address.
Consent to e-mail tips: we store what you consented to, the version of the text, where and when, and when you withdrew it. Consent is voluntary and you can withdraw it at any time in "My account".
Protection against misuse: daily limits on the number of hotels for which you can add details or write a review. An editor can see whether a parent's e-mail address is on the domain of the hotel's website, but we do not show the editor the e-mail address itself.
Legal basis: performance of a contract (the account and its features), consent (e-mail tips) and legitimate interest (protection against misuse, accurate hotel details).
Exporting and deleting your account: in "My account" you can download all your data and delete your account. After deletion we erase your name, e-mail address, consents, discount codes, reviews, pending and rejected answers and your sign-in account. Approved facts about a hotel remain, with no link to you. The steps are on the Delete account page.

4. Hotels, attractions and their staff

Public contact e-mail addresses from hotel and attraction websites: we use them to send a questionnaire about facilities for children. Every e-mail contains a one-click unsubscribe, and we do not contact unsubscribed addresses again.
Questionnaire: the name and job title of the person who filled in the questionnaire, and their answers.
Orders for paid placements: billing and contact details of the company and the contact person.
Legal basis: legitimate interest (contacting them and accurate details about the property), performance of a contract and legal obligation (orders and accounting).

Data is processed only by suppliers we need to run the website:

Supabase: database and sign-in, data centre in Frankfurt (EU).
Vercel: website hosting, servers in Frankfurt (EU); website content is also delivered through a server network outside the EU.
Brevo: sending e-mails from the website.
Google: sign-in with Google if you choose it, photos and the rating card (Google Maps Platform) on hotel profiles, and traffic measurement with Google Analytics.
Cookienovo: the cookie banner and a record of your choice.
Cloudflare Turnstile: protecting forms against bots.
OpenFreeMap: map data.
CJ (Commission Junction) and Booking.com: only after you click an affiliate link, under their own policies.
Accounting and invoicing services: for orders of paid placements.

Where a supplier processes data outside the EU, this is based on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

We calculate driving times to attractions in advance on our server with OpenRouteService. We do not send visitors' data to this service.

6. How long we keep data

Parent account: until it is deleted.
Parents' answers awaiting review or rejected: until the account is deleted.
Discount codes: no more than 90 days after the discount ends, and immediately when the account is deleted.
Record of consent: until consent is withdrawn and then 3 years as proof that we had consent.
Technical logs against misuse: no more than 90 days.
Contacting hotels: records of sending and unsubscribing for 3 years.
Orders and invoices: as required by the Slovak Accounting Act (10 years).
Reviews: until they are deleted or the account is deleted.
Review reports and decisions on them: 3 years.
Error reports: until they are resolved and then no more than 1 year.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object to processing and to withdraw consent at any time. Write to us at data@tobogana.com and we reply within one month.

You can lodge a complaint with the Slovak supervisory authority, the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk), or in Czechia with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz).

8. Changes

This policy is effective from 5 November 2026, version 1.4. We announce significant changes on this page, and also by e-mail to parents with an account.