Privacy Policy

Two roles: this website, and the EZ2Stay platform

This policy covers two different things, because they have different legal roles under data protection law.

First, ez2stay.com the marketing website: when you browse it, EZ2Stay SRL is the controller of the data described below (analytics, consent choice, locale, server logs).

Second, the EZ2Stay platform that hostels run their front desk on: when a guest completes online check-in, EZ2Stay SRL acts as processor on behalf of the hostel (the controller), which sets the retention and access rules for its own guests' data. A Data Processing Agreement governs this relationship; the DPA page ships separately.

What the website collects

Analytics (Google Analytics 4) — only after you consent. Before consent, at most a cookieless ping may be sent so we can measure aggregate traffic without identifying you.

A consent-choice cookie, so we remember what you decided and don't ask again every visit.

A locale cookie, so the site remembers your language preference. (Theme preference is stored in your browser's local storage, not a cookie.)

Server logs (IP address, request path, timestamp, user agent) generated automatically by the hosting infrastructure for security and abuse prevention.

Legal bases (GDPR Art. 6)

Analytics: your consent, which you can withdraw at any time via "Cookie settings" in the footer.

Consent-choice and locale cookies, and server logs for security: our legitimate interest in operating a working, abuse-resistant website, balanced against your rights.

What the platform processes (guest data)

EZ2Stay is receptionless, self-check-in software: guests complete identity verification and check-in themselves online, without a front-desk staff member handling their documents or payment in person.

Depending on how a hostel configures its account, this can include check-in details, ID document images used for verification, and payment status. EZ2Stay processes this data solely on the hostel's documented instructions, as its processor — the hostel is the controller and the right place to direct a guest data-subject request in the first instance.

International transfers

Some processors we use, including Google LLC (Google Analytics), are based in the United States. Where personal data leaves the EU/EEA, we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the processor.

DRAFT — the specific list of sub-processors and transfer mechanisms will be completed and kept current as part of legal review.

Retention

Consent-choice cookie: 12 months, then it expires and we ask again.

Analytics data: retained per the retention period configured in our Google Analytics 4 property admin settings.

Guest data on the platform: retained per the platform's documented retention rules, which the hostel (as controller) configures within the limits EZ2Stay sets by design.

Your rights under the GDPR

If you are in the EU/EEA or UK, you have the right to access, rectify, erase, or restrict the processing of your personal data, to receive it in a portable format, and to object to processing based on legitimate interest.

You can lodge a complaint with a supervisory authority. In Romania, that is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

California and other US visitors (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of your personal information.

We honor "Do Not Sell or Share" requests, including the Global Privacy Control (GPC) signal, automatically when your browser sends it — you don't need to submit a separate request for that to take effect.

Brazil (LGPD)

If you are in Brazil, the Lei Geral de Proteção de Dados gives you rights of confirmation, access, correction, anonymization, portability, and deletion, among others.

Where LGPD requires opt-in consent (for example, for analytics), we apply the same consent mechanism described above before any non-essential processing begins.

Contact

Questions about this policy, or to exercise any of the rights above: contact@ez2stay.com.