Privacy policy

1.1. For the operation of uastay.com, the personal account, STAY's marketing, antifraud, support, analytics and compliance with legal obligations, STAY is the personal-data owner/controller.

1.2. For check-in, the stay, guest records, fulfilling special requests, security and its own service, the respective Hotel is a separate owner/controller. The Hotel's details are provided on the offer page, at checkout and in the Voucher.

1.3. When the STAY module is used on a Hotel's website, the allocation of roles depends on the purpose: booking data may be processed by two separate controllers; STAY may act as the Hotel's processor for certain technical operations.

1.4. Banks, Acquirers, payment systems and fiscal services process data under their own legal obligations and policies. STAY does not control the full card details on the hosted payment page.

• identification: full name, date of birth/child's age, citizenship or a document — only where necessary;
• contact: phone, e-mail, messenger, address;
• booking data: hotel, dates, room, guests, meals, wishes, promo code, loyalty;
• payment: amount, currency, masked number/token, bank, status, transaction ID, 3DS, refund/chargeback; the full card data is received by the Acquirer;
• technical: IP, device/browser, cookies, session ID, logs, source/UTM, language, approximate location;
• communications: requests, calls where recording is announced, correspondence, reviews;
• corporate data: company, registration code, position, details for invoicing/business trips;
• security data: risk indicators, failed payments, fraud signals, sanctions/KYC data — to the extent required by law or the Acquirer.

• the selected Hotel and its PMS/channel manager;
• banks, Acquirers, payment systems, antifraud and fiscal providers;
• hosting, cloud, CRM, call center, email/SMS/messenger, analytics and technical support;
• partners through whom the User received the offer, to the minimum extent needed for attribution and remuneration;
• state authorities, courts and regulators upon a lawful request.

4.1. STAY does not sell personal data as a standalone product. Transfers are made for defined purposes, on the basis of an agreement, the law, consent or another proper basis.

5.1. Certain cloud, payment, communication or analytics providers may be located outside Ukraine. STAY applies contractual, organizational and technical safeguards and, for persons covered by the GDPR, the mechanisms provided by the GDPR, including standard contractual clauses where necessary.

• to know the sources, location, purpose, scope and recipients of the data;
• to obtain access and a copy, to correct inaccuracies;
• to withdraw consent where processing is based on consent;
• to request deletion/restriction where this does not conflict with mandatory retention;
• to object to marketing and, where applicable, to processing based on legitimate interest;
• to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or a competent EEA authority where the GDPR applies.

7.1. Requests are submitted to privacy@uastay.com. STAY may verify the identity of the requester. A request concerning the Hotel's data may be forwarded to the respective Hotel.

8.1. The User can change their choices in the "Cookie settings". Refusing non-essential cookies does not block basic booking but may reduce personalization.

• TLS encryption, access control, MFA for administrative accounts;
• pseudonymization/tokenization of payment identifiers;
• segregation of roles, logging, backups and vulnerability management;
• PCI DSS scope minimization: hosted payment page and a ban on storing CVV/full card details;
• contractual requirements for contractors and incident response.

9.1. No system guarantees absolute security. In case of an incident STAY takes measures to contain it, assess the risk and notify partners, individuals and authorities in the cases provided by law.

10.1. A booking is made by an adult with legal capacity. Children's data is processed only for accommodation, pricing and meeting the Hotel's requirements. Medical or other sensitive data should not be shared unless necessary for a special request and a proper basis is provided.

11.1. STAY and the Hotel must not automatically exchange marketing consents. Each controller proves the lawfulness of its own communications on its own. You can opt out via the link in a message or by contacting us.

12.1. The Policy may be updated. Material changes are announced on the website and, where possible, directly. The revision date is stated at the beginning.