Privacy Policy
Operatort of VILLA SANDY Resort,
company City Park Center a.s., settled 10, 040 01 Košice, IČO: 36 213 624, As the operator of the information system, you publish compliance with the principle of fairness and transparency towards the data subjects concerned in this statement on the protection of personal data under the name.:
INFORMATION OBLIGATION OF THE OPERATOR
in accordance with Articles 13, 14 and the relevant Recitals of the Regulation of the European Parliament and the Council (EU) 2016/679 on the protection of natural persons in the processing of personal data and on the free movement of such data (hereinafter referred to as the “Regulation”) and the Act of the National Council of Slovak Republic no. 18/2018 Coll. on the protection of personal data and on amendments to specific laws (hereinafter referred to as the “Act on Personal Data Protection”).
The purposes of personal data processing are the reasons for which the personal data of data subjects (clients, guests, customers, applicants) are processed in our information systems on precisely determined legal bases. The purposes are specifically determined, explicitly stated and authorised. When processing the personal data of the data subjects, we comply with the principle of legality according to Articles 6 and 9 of the Regulation (individual purposes and legal bases are listed in the appendix of this Information Obligation).
Data subjects whose personal data are processed in our information systems for specifically defined purposes may exercise the following rights in writing or electronically:
a) Right to access the personal data – it is the right to obtain confirmation of whether your data is being processed, as well as the right to get access to this data within the scope of the purposes and duration of the processing, the category of personal data concerned, the range of recipients, the procedure in each automatic processing, or the consequences of such processing. As an operator, we have the right to use all reasonable measures to verify the data subject’s identity requesting access to the data, particularly in relation to online services and identifiers (Article 15, Recital 63, 64 of the Regulation). If the operator processes this data, it will issue a copy of this personal data to the data subject upon request. Issuance of the first copy is free of charge. For any additional copies requested by the person, the operator will charge a fee corresponding to the administrative costs incurred by issuing the copy. Suppose a person asks for information in the form of electronic means. In that case, it will be provided to him in a commonly used electronic format, e-mail, unless he requests another method.
b) Right to rectify the incorrect personal data and supplement incomplete personal data (Article 16, Recital 65 of the Regulation). The operator will correct or supplement personal data without undue delay after the data subject has requested it.
c) Right to erasure – „to be forgotten“ of those personal data that are no longer necessary for the purposes for which they were obtained and processed; in case of withdrawal of consent on the basis of which the processing is carried out; in case of illegal processing; if personal data were obtained in connection with the offer of an information company (persons under 16 years of age), subject to the fulfilment of the conditions specified in Article 17, Recital 65,66 of the Regulation. The data subject will not have the right to delete personal data, provided that their processing is necessary for:
- to exercise the right to freedom of expression and information;
- to fulfil an obligation according to the law, a particular regulation or an international treaty to which the Slovak Republic is bound, or to fulfil a task carried out in the public interest or the exercise of public authority entrusted to the operator,
- for reasons of public interest in the field of public health,
- for the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes, if it is likely that the right to erasure will make it impossible or seriously difficult to achieve the goals of such processing, or
- to demonstrate, exercise or defend legal claims
d) Right to restriction of processing is possible to apply as a data subject
-
- challenges the correctness of personal data and other details in accordance with Article 18, Recital 67 of the Regulation, in the form of the temporary transfer of selected personal data to another processing system, prevention of user access to selected personal data or temporary removal of processing
- the processing is illegal, and the data subject requests the restriction of their use instead of deletion of personal data
- the operator no longer needs personal data for the purposes of the processing, but the data subject requires them to prove, exercise or defend legal claims
- the data subject objected to the processing of personal data on the basis of the legitimate claim of the operator until it is verified whether the legitimate reasons on the part of the operator prevail over the legitimate reasons of the data
Suppose the data subject requires the restriction of the processing of his data. In that case, the operator will not carry out any processing operations with the data concerned, except storage, without the data subject’s consent.
e) Right to the accuracy of personal data is the right to transfer the personal data provided by you to our information systems on the basis of consent or performance of the contract to another operator in a structured, commonly used, and machine-readable format, as long as it is technically possible also under the conditions of Article 20, Recital 68 of the Regulation in case the processing is carried out by automated means. The exercise of this right does not affect Article 17 of the Regulation. The right to data portability does not apply to processing necessary to fulfil a task carried out in the public interest or the exercise of public authority entrusted to us as the operator.
f) Without prejudice to any other administrative or judicial means of redress, you as a data subject have the right to file a complaint with the Personal Data Protection Authority of the Slovak Republic in accordance with Article 77 of the Regulation if you believe that the processing of personal data concerning you is in violation with the Regulation or the Personal Data Protection
As a data subject, you also have the right to object to the processing of your personal data at any time for reasons related to a specific situation, also if the processing is necessary for the purposes of legitimate interests pursued by us as an operator or a third party (except for processing carried out by public authorities in the performance of their tasks), with the exception of cases where such interests are overridden by your interests or fundamental rights and freedoms as a data subject that require the protection of personal data (in particular if the data subject is a child).
City Park Center a.s., so sídlom Bencúrova 10, 040 01 Košice, IČO: 36 213 624 adopted as the operator of the information system all appropriate personnel, organisational and technical measures for the purpose of maximum protection of your personal data to reduce the risk of their misuse, leakage and so forth, to the greatest extent possible. In accordance with our obligation arising from Article 34 of the Regulation, we inform you as data subjects that if a situation arises that we, as the operator, violate the protection of your personal data in a way that is likely to lead to a high risk for the rights and freedoms of natural persons, we will notify you of this fact without undue delay.
WARNING: to comply with the principle of minimisation, all personal data provided by you is a necessary legal or contractual requirement to fulfil the purpose of their processing. Failure to provide mandatory data essential for concluding a contract may result in failure to complete a contractual relationship.
In case of any questions related to the protection of your personal data, including the exercise of your rights in accordance with the Regulation and the Act on the Protection of Personal Data, please get in touch with us e-mail adresse: [email protected]
If you are not satisfied with our answer, or if you believe that we process your personal data unfairly or illegally, you can file a complaint with the supervisory authority, which is the Personal Data Protection Office of the Slovak Republic, https://dataprotection.gov.sk, Hraničná 12 , 820 07 Bratislava 27; tel. number: +421 /2/ 3231 3214; E-mail: [email protected].
The operator processes personal data for these purposes:
1. RECORD OF ACCOMMODATED GUESTS IN THE ACCOMMODATION FACILITY
| The purpose of personal data processing |
Maintaining a database of guests staying in the accommodation facility with the aim of checking them when moving around the accommodation facility, during their check-in, check-out, payment of local taxes and fees, reporting to the relevant authorities. |
| Legal basis |
The legal basis for the processing of personal data in the subject IS is represented by Act no. 404/2011 Coll. on the residence of foreigners and on the amendment and supplementation of certain laws, Law no. 253/1998 Coll. on reporting the residence of citizens of the Slovak Republic and the register of residents of the Slovak Republic, Act no. 513/1991 Coll. Commercial Code Act no. 40/1964 Coll. Civil Code as amended |
| Categories of beneficiaries |
Bodies of state administration, public power and public administration according to relevant legal regulations |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data | 10 years from the date of accommodation |
|
Information about the existence of automated decision-making, including profiling |
It’s not happening |
| Categories of affected persons | Accomodated guests |
| Category of personal data |
Name, surname, identity card or travel document number, address of permanent residence, length of stay, nationality and date of birth for foreigners |
| The source from which the personal data originates |
Personal data concerning the person concerned can be obtained from the following source: booking through online travel agencies (e.g. booking.com, airbnb.com, etc.) |
2. RESERVATIONS OF TABLES IN RESTAURANT PREMISES:
| The purpose of personal data processing |
Provision of restaurant and hospitality services based on table reservation through online reservation on the website or by telephone. |
| Legal basis |
The legal basis for the processing of personal data in the subject IS is represented by Act no. 513/1991 Coll. Commercial Code, Act no. 40/1964 Coll. Civil Code, Act no. 455/1991 Coll. on trade, Constitution of the Slovak Republic. |
| Categories of beneficiaries | Public authorities according to relevant legal regulations (court, OCTK and offense authority) |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data | 1 day from the fulfillment of the processing purpose |
| Information about the existence of automated decision-making, including profiling |
It’s not happening |
| Categories of affected persons | Natural persons – customers, guests |
| Categories of personal data | Name, surname, phone number |
3. CAMERA SYSTEM MONITORING SPACES ACCESSIBLE TO THE PUBLIC
| The purpose of personal data processing |
Monitoring of spaces accessible to the public for the purpose of property protection, health and crime detection. |
| Legal basis |
Legitimate interest in the sense of Article 6 par. 1 letter f) Regulations. The main legitimate interest is the protection of the property and safety of the operator and the affected persons and the detection of crime |
| Categories of beneficiaries |
Public authorities according to relevant legal regulations (court, OCTK and offense authority) |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data |
3 days from the day following the day on which the record was made |
| Information about the existence of automated decision-making, including profiling |
It’s not happening |
| Categories of affected persons |
Natural persons who entered the monitored area |
| Categories of personal data |
Likeness of a natural person, expressions of a personal nature, data that can be used to identify a natural person, vehicle type and license plate number |
4. HANDLING OF CLAIMS
| The purpose of personal data processing |
Processing of claims for services and goods provided. |
| Legal basis |
The legal basis for the processing of personal data in the subject IS is represented by Act no. 250/2007 Coll. on consumer protection |
| Categories of beneficiaries | They are not |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data |
6 months from the day the claim was processed |
| Information about the existence of automated decision-making, including profiling | It’s not happening |
| Categories of affected persons |
Accomodated guests, visitors to the establishment, customers of restaurants |
| Category of personal data |
Name, surname, identity card or travel document number, address of permanent residence, length of stay, nationality and date of birth for foreigners. |
5. EXERCISE OF THE RIGHTS OF THE PERSONS CONCERNED
| The purpose of personal data processing |
The purpose of processing personal data Processing requests from natural persons aimed at exercising their rights as data subjects in accordance with Regulation (EU) 2016/679 of the European Parliament and Council on the protection of natural persons in the processing of personal data and on the free movement of such data. Legal basis Art. 6 par. 1 letter c), in accordance with Art. 15 to 22 and 34 of the Regulation of the European Parliament and the Council (EU) 2016/679 on the protection of natural persons in the processing of personal data and on the free movement of such data. |
| Legal basis |
Art. 6 par. 1 letter c), in accordance with Art. 15 to 22 and 34 of the Regulation of the European Parliament and the Council (EU) 2016/679 on the protection of natural persons in the processing of personal data and on the free movement of such data. |
| Categories of beneficiaries |
Bodies of state administration, public power and public administration according to relevant legal regulations |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data | 1 year from the date of processing the application |
| Information about the existence of automated decision-making, including profiling | It’s not happening |
| Categories of affected persons |
A natural person who, as a data subject, within the scope of the purposes defined by the operator, turns to the operator with a request to exercise his rights |
| Category of personal data |
Personal data related to the processing of applications by which the affected persons have exercised their rights, in particular the title, first name, last name, address, signature and other personal data to which the applied right of the affected person applies. |
6. CONTRACTUAL RELATIONS
| The purpose of personal data processing |
Within the subject information system, personal data of a natural person as one of the contracting parties is processed. Contractual relations are prepared and concluded in IS Contractual relations for the provision of accommodation and related services. |
| Legal basis |
The Constitution of the Slovak Republic, SNR Act No. 513/1991 Coll. Commercial Code, SNR Act No. 40/1964 Coll. Civil Code |
| Categories of beneficiaries | They are not |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data |
5 years from the completion of the contract |
|
Information about the existence of automated decision-making, including profiling |
It’s not happening |
| Categories of affected persons | Contracting party – natural person |
| Category of personal data |
Personal data to the extent necessary, especially title, first name, last name, date of birth, permanent residence / temporary residence, phone number. no., e-mail, account number, signature, address |
7. PROMOTION OF THE OPERATOR
| The purpose of personal data processing |
Promotion of the operator, publication of information about the activities of the operator (e.g. about organized events, etc.) with the intention of building its good name. Promotion takes place on the website of the operator, on the intranet and also in the internal premises of the operator. |
| Legal basis |
The consent of the person concerned pursuant to Article 6, paragraph 1 letter a) Regulations and the Act on the Protection of Personal Data, while the person concerned has the right to withdraw his consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. |
| Categories of beneficiaries | They are not |
| Cross-border transfer of personal data | It’s not happening |
| Deadlines for deleting os. data | 30 days from withdrawal of consent |
|
Information about the existence of automated decision-making, including profiling |
It’s not happening |
| Categories of affected persons |
Employees of the operator, accommodated guests, restaurant customers, participating persons |
| Category of personal data |
Personal data to the extent necessary, especially title, first name, last name, function / job title, photo, video and other personal data in order to achieve the purpose of processing |
8. MARKETING
| The purpose of personal data processing |
The purpose of processing personal data is to send marketing offers via e-mail/newsletter (e.g. about promotional stays, etc.) |
| Legal basis | Legitimate interest in the sense of Article 6 par. 1 letter f) Regulations. The consent of the person concerned pursuant to Article 6, paragraph 1 letter a) Regulations and the Act on the Protection of Personal Data, while the person concerned has the right to withdraw his consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. |
| Categories of beneficiaries |
Intermediaries – mainly marketing and advertising agencies, software/IT service providers |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data | 30 days from withdrawal of consent |
|
Information about the existence of automated decision-making, including profiling |
It’s not happening |
| Categories of affected persons | Natural persons – accommodated guests, potential guests, customers |
| Category of personal data | Name, surname, email address |
9. ECONOMICS, ACCOUNTING DOCUMENTS
| The purpose of personal data processing |
Economic agenda and processing of accounting documents, in particular – contracts, orders, processing of incoming invoices and invoicing to customers (guests). |
| Legal basis |
The legal basis for the processing of personal data in the subject IS is represented by Act no. 460/1992 Coll. The Constitution of the Slovak Republic, as amended, Act No. 513/1991 Coll. Commercial Code as amended, Act NR SR no. 431/2002 Coll. on accounting, as amended, Act no. 222/2004 Coll. on value added tax as amended, the Personal Data Protection Act and related legal regulations as amended, Act No. 145/1995 Coll. on administrative fees, as amended, by Act NR SR no. 595/2003 Coll. on income tax, as amended, by Act NR SR no. 461/2003 Coll. on social insurance, as amended, by Act of the NR SR no. 563/2009 Coll. on tax administration (tax code), as amended, Act no. 40/1964 Coll. Civil Code as amended, Act No. 311/2001 Coll. Labor Code as amended |
| Categories of beneficiaries |
Bodies of state administration, public power and public administration according to relevant legal regulations. Intermediary – contractual partner who ensures the accounting agenda for the operator |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data | 10 years |
|
Information about the existence of automated decision-making, including profiling |
It’s not happening |
| Categories of affected persons | – natural persons – interested in accommodation, accommodated guests
– employees of suppliers and customers, – representatives of suppliers and customers – intermediary – contractual partner of the operator who ensures the accounting agenda – restaurant customers |
| Category of personal data |
Personal data related to the management of accounting documents, in particular title, first name, last name, address of permanent residence, address of temporary residence, telephone number, e-mail address, date of birth, social security number, type and number of identity document, signature, account number |
10. LEGAL RELATIONSHIPS AND CLAIM ENFORCEMENT
| The purpose of personal data processing |
Ensuring management of the legal agenda (e.g. first-instance proceedings, settlement of remedies, settlement of court disputes, representation in legal matters, application of decisions on compensation for damages, recovery of compensation for damages, application of contractual obligations, design of measures with organizational-legal impact, etc.). |
| Legal basis |
The legal basis for personal data processing is Act No. 460/1992 Coll. The Constitution of the Slovak Republic, as amended, Act No. 40/1964 Coll. Civil Code, as amended, Act No. 99/1963 Coll. Civil Code of Court, Act of the Slovak Republic No. 300/2005 Coll. Criminal Code, Act NR SR no. 301/2005 Coll. Criminal Code, SNR Act No. 71/1967 Administrative Procedure, Act No. 233/1995 Coll. on court bailiffs and enforcement activities (Executive Regulations) and on amendments and additions to certain laws as amended, Act of the National Assembly of the Slovak Republic No. 7/2005 Coll. on bankruptcy and restructuring and on the amendment and supplementation of certain laws as amended, Act of the National Assembly of the Slovak Republic no. 153/2001 Coll. on the Prosecutor’s Office, as amended, Act of the National Assembly of the Slovak Republic No. 372/1990 Coll. on offenses as amended, Act no. 586/2003 Coll. on Advocacy and on Amendments to Act No. 455/1991 Coll. on trade (Trade Act) as amended, the Personal Data Protection Act and related legal regulations as amended. Act of the NR SR no. 311/2001 Coll. Labor Code as amended. |
| Categories of beneficiaries | – the courts
– enforcement authorities, – bodies of state administration, public authority and public administration according to relevant legal regulations |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data | 10 years |
|
Information about the existence of automated decision-making, including profiling |
It’s not happening |
| Categories of affected persons | – accommodated guests – debtors,
– restaurant customers – debtors, – counterparties in disputes, – other natural persons in the position of participants in the proceedings |
| Categories of personal data |
Personal data related to the handling of disputes, in particular name, surname, address of permanent residence or residence, date of birth or other identification data, telephone number, e-mail address |
11. COMPLAINTS
| The purpose of personal data processing |
Dealing with complaints, i.e. carrying out procedures for their submission, registration, reception, investigation and written notification of the result of investigation of complaints or review of complaints. |
| Legal basis | Law no. 9/2010 Z. z. on complaints as amended |
| Categories of beneficiaries | The complainant and other natural persons to whom the complaint relates |
| Cross-border transfer of persons. data | It’s not happening |
| Deadlines for deleting os. data | 6 months from the date of handling the complaint |
| Information about the existence of automated decision-making, including profiling | It’s not happening |
| Categories of affected persons | – natural persons – complainant,
– the person to whom the complaint concerns, – other natural persons whose personal data are necessary for handling complaints |
| Category of personal data |
Personal data related to the handling and investigation of complaints, in particular the name, surname, address of permanent or temporary residence of the complainant, address of the complainant for delivery in electronic form, other personal data found or submitted during the handling of the complaint and which are necessary to achieve the purpose of processing Special categories of personal data according to Art. 9 par. 1 of Regulation No. 2016/679 (GDPR) or § 16 par. 1 of Act no. 18/2018 Coll. on the protection of personal data may be the subject of processing if they are the subject of a complaint or discovered during the processing of a complaint Personal data related to recognition of guilt for criminal acts, misdemeanors according to Art. 10 of Regulation no. 2016/679 (GDPR) or § 17 of Act no. 18/2018 Coll. on the protection of personal data may be subject to processing if they are the subject of a complaint or discovered during the handling of a complaint |
12. ADMINISTRATION OF THE REGISTRY
| Purpose of processing | Management of incoming and outgoing mail (registry management) |
| Legal basis |
Law no. 395/2002 Coll. on archives and registries and on the addition of certain laws as amended, Act No. 305/2013 Coll. on the electronic form of the exercise of the powers of public authorities and on the amendment and supplementation of certain laws (the e-Government Act), as amended |
| Categories of beneficiaries |
Bodies of state administration, public power and public administration according to relevant legal regulations. |
| Cross-border transfer | It’s not happening |
| Deadlines for deleting os. data | 3 years |
| Information about the existence of automated decision-making, including profiling | It’s not happening |
| Categories of affected persons | Senders and recipients of correspondence (natural persons) |
| Category of personal data |
Personal data related to registry management, including delivery to an electronic mailbox, in particular title, name, surname, address, telephone number, e-mail address, subject of correspondence / registry entry and other personal data necessary to achieve the purpose |