Personal data processing
On the basis of the EU Regulation 2016/679 (hereinafter referred to as GDPR), we provide you with information about the processing of guests' personal data that occurs in connection with their stay.
Contact details:
The data controller is Hotel Křížový Vrch, Za Pilou 6, Jeseník 79001.
The contact details of the person responsible for the protection of personal data are:
restaurace@krizovyvrch.cz
tel. +420 604 729 730
Personal data processing table
|
Name of personal data processing |
Purpose of processing |
Categories of personal data |
Legal title |
Specification of the legal title - Act |
Source - from whom acquired |
Storage period or time limit for deletion |
Categories of data recipients |
|
Accommodation booking - receiving information from internet booking portals |
Booking a stay |
Identification and contact details, duration of stay |
Conclusion or performance of a contract |
|
booking portal |
Storage for the duration of the stay and the complaint period. |
none |
|
Reservation of accommodation - at the reception in person and by phone |
Booking a stay |
Identification and contact details, duration of stay |
Conclusion or performance of a contract |
|
data subject |
Storage for the duration of the stay and the complaint period. |
none |
|
Recording of data on guests in the Guest Book. |
Arranging your stay |
Identification and contact details, duration of stay, services provided |
Conclusion or performance of a contract |
|
data subject |
Storage for the duration of the stay and the complaint period. |
none |
|
Transfer of data to the Foreign Police |
Fulfillment of legal obligation - par 102 of the Act on Accommodation of Foreigners 326/1999 Coll. |
Identification details and duration of stay |
Legal obligation |
|
data subject |
6 years from the end of the stay |
Foreign Police |
|
Guest records in the Client Database |
Speeding up the booking of returning guests |
Identification and contact details |
Legitimate interest |
|
data subject |
Until such time as an objection is lodged. |
none |
|
Passing guest data to the ID-access system |
providing access to the premises |
Basic identification and room number |
Conclusion or performance of a contract |
|
data subject |
For the duration of the stay |
none |
|
Receipts and Invoices - documents for VAT |
Issuing sales receipts |
Information required for issuing VAT documents |
Legal obligation |
No. 235/2004 Coll., on VAT Section 35 and 35a |
data subject |
10 years |
Tax Office |
|
Processing of identification data for the provision of services during the stay |
Guest identification to facilitate service delivery |
Identification data |
Legitimate interest |
|
data subject |
Until such time as an objection is lodged |
none |
|
Customer system (vouchers) for restaurant and hotel guests |
Provision of discounts for recurring services |
Contact details |
Legitimate interest |
|
data subject |
during the voucher validity period |
none |
Explanation of the table and processing:
Legal titles - are the lawful justifications for processing and are defined in the GDPR, Articles 6 and 9.
Storage period - means how long we are entitled or obliged to process and store your data.
Other recipients - here we indicate to which other recipients we transfer data. If it says "None", it means that we do not pass it on to anyone.
Source of data - here we indicate from whom we obtained the personal data. If it says "Data Subject" then this means that we have obtained it directly from the person it relates to.
We do not intend to transfer your personal data outside the EU or to any international organization.
In cases where the processing is based on the legal title "Conclusion or performance of a contract", we need your personal data for the conclusion of the contract and its subsequent performance, without which the contract cannot be concluded.
In cases where the processing is based on the legal title "Legal Obligation", we need to process your personal data on the basis of legal requirements until the time specified by the law in question and we may not restrict or delete this processing during this period.
We will only process your personal data for the purposes set out in the table.
We obtain personal data directly from data subjects, except for the processing of "Accommodation booking - receiving information from internet booking portals", where we obtain some personal data from companies operating internet booking portals. The contact details of these data controllers can be found on their websites where you have made your booking. Due to their larger number and the data transfer between them, we do not list them here.
Description of the rights of data subjects
As a data subject (the natural person about whom the data is processed), you have the following rights in relation to your personal data:
|
The Law |
Specification |
|
Request a statement |
This is a listing of the data we hold about you, the so-called right of access. We will extract in the format according to our possibilities. You do not have the right to request a statement in the format you specify. The only exceptions where we may not make an extract are in cases involving documents the disclosure of which would endanger the rights and freedoms of others. This includes personal data of other persons, protection of trade secrets, intellectual property, etc. |
|
Request a correction |
If you find that we have inaccurate, outdated or incomplete information about you, please ask us to correct or complete it. |
|
Request deletion |
We have to erase where we would have stored personal data after the specified storage period or where we do not have a valid legal title. We must not lawfully erase where the processing is carried out by virtue of the performance of a contract or Legal Obligation. |
|
Request restrictions on processing |
This applies to processing on the grounds of legitimate interest. The restriction of processing will occur in the event of an objection and the restriction will last for the period of consideration of the objection. |
|
Object to processing |
An objection may be lodged in cases where processing is carried out on the basis of a legitimate interest. An objection to the sending of commercial communications will always be recognised. In cases where your name or other contact details are provided for the purpose of providing services, the possibility of misuse is almost eliminated and is necessary for these activities. We therefore consider this legitimate interest to be overridden and do not accept any objections. |
|
Withdraw consent to processing |
This is possible in cases where processing is carried out on the basis of consent. If you have given your consent to the processing and withdraw it, the processing will be terminated. |
|
Request a statement in a portable format |
You can only request an extract in a portable format in cases of processing based on legal titles - performance of a contract and consent. You may only request a list of the data you have provided to us that we hold in electronic form and you do not have the right to request a format. We will provide them to you in XLS format with named columns. |
|
Object to automated decision-making |
We do not carry out any processing based on automated decision-making. |
|
File a complaint with the supervisory authority |
If we do not respond to your request within 1 month, you can file a complaint with the Office for Personal Data Protection. |
Method of exercising rights
If you wish to exercise any of these rights, you can apply in the following way:
Your identity will be verified at the hotel reception using your ID card or passport, and you will be contacted with your application and given a date for processing. The application cannot be accepted without identity verification.
On the date of processing, you will be given a written Notification of the outcome of the application and related materials after re-verification of your identity.
We are entitled to charge a fee equivalent to the administrative costs for requesting more than one copy.
Actions related to the exercise of data subjects' rights are performed free of charge.
However, if the requests are found to be manifestly unfounded or unreasonable, in particular because they are repetitive, then we may:
-
impose a reasonable fee taking into account the administrative costs
-
refuse to grant the request