Privacy Policy
1. Controller and contacts
TravoBerg OÜ (registry code 16889116), Mäehaldja tee 10, Metsakasti küla, 74019 Viimsi vald, Harju maakond, Estonia. Email: aleksandr@berg.travel · Phone: +372 5346 0010 · Telegram: @BergTravel_bot. Support hours: 09:00–21:00 Tallinn time. For data protection matters write to aleksandr@berg.travel.
2. Data we collect
- Guest details: first and last name, email, phone number, special requests to the hotel.
- Booking details: hotel, dates, room, rate, amount, confirmation numbers, status.
- Company details — if you request an invoice for a company.
- Account data: your Telegram chat id and interface language, or a web session identifier, and the invite code used.
- Technical data: IP address, request timestamps, server logs.
We do not receive or store card details — they are handled by our payment partner.
3. Purposes and legal bases
- Performance of a contract (Art. 6(1)(b) GDPR): making the booking, issuing the voucher, confirmations, cancellations and refunds, customer support.
- Legal obligation (Art. 6(1)(c)): accounting and tax — records are kept for 7 years under the Estonian Accounting Act.
- Legitimate interest (Art. 6(1)(f)): preventing abuse and code guessing, rate limiting, service security, handling complaints.
- Consent (Art. 6(1)(a)): optional analytics and any marketing messages — only if you agree, and you may withdraw consent at any time.
4. Who receives your data
- The hotel you book — guest name, dates, requests and phone number for arrival contact.
- Nuitée Travel (LiteAPI) — our accommodation supplier and payment partner (merchant of record).
- Telegram — if you use our bot or Mini App.
- Hosting and email: our hosting provider (EU servers) and the mail delivery service.
- Accountants and public authorities — to the extent required by law.
We never sell your data and do not share it for third-party marketing.
5. Transfers outside the EEA
If the hotel you book is outside the European Economic Area, your booking data is transferred to that country because it is necessary to perform the contract (Art. 49(1)(b) GDPR). For service providers outside the EEA we rely on the European Commission's standard contractual clauses.
6. Retention
Booking and accounting records: 7 years from the end of the relevant financial year. Support correspondence: up to 1 year. Server logs: up to 90 days. Profile data: while your access to the service is active; after access is withdrawn it is deleted within 30 days, except what we must keep by law.
7. Your rights
You may request a copy of your data, its correction or erasure, restriction of processing, object to processing based on legitimate interest, and receive your data in a portable format. Write to us and we will answer within 30 days. If you are not satisfied, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, aki.ee.
8. Cookies and browser storage
We use strictly necessary cookies only:
bt— session token (sign-in by personal link or invite code), 30 days, HttpOnly;bt_ok— a flag telling the app that a session exists, 30 days.
The app also stores your chosen language in the browser (localStorage). The service cannot work without these, so no consent is required; you can block them in your browser settings, but you will not stay signed in.
The app sets no analytics or advertising cookies; if we ever add any, it will be with your consent only. See the Cookies page.
9. Security
Traffic is protected by TLS, database access is restricted and administrative actions are limited to a verified account. We do not store card data. If a breach is likely to put you at risk, we will inform you and the Data Protection Inspectorate as required by the GDPR.
10. Children
The service is intended for people aged 18 and over. Children's data is processed only as guest details supplied by the adult making the booking.
11. Changes
We may update this policy. Material changes are announced in the app or by email. The last update date is shown at the bottom of this page.