With effect from 25 May 2018 the processing of your personal data will be subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), known as GDPR. With regard to this we provide you with the following information about the processing and protection of your personal data.
I. Personal data controller
The controller of your personal data is the company Zlatnická, spol. s.r.o., registered address: Zlatnická 1126/3, 110 00 Praha 1, reg. no. 27172546, registered in the commercial register maintained by Prague City Court, section C, file no. 101820 (hereinafter referred to as the Controller), which is the operator of the Cosmopolitan Hotel Prague at the address Zlatnická 1126/3, 110 00 Prague 1 (hereinafter referred to as the Hotel).
II. Which personal data do we process?
The personal data that we process about you and the extent of which differs depending on the type and extent of the services provided include your:
We obtain personal data directly from you or from the agent that has arranged your accommodation when concluding the accommodation reservation agreement or the accommodation agreement and also during our contractual relationship. Your personal data is provided automatically. If you choose not to provide us with your personal data, we will not be able to conclude an accommodation reservation agreement or accommodation agreement.
No automated decision-making occurs during the processing of your personal data.
In order to ensure the security and confidentiality of your personal data, which is extremely important to us, we use technical and organisational measures to protect against unauthorised access to the personal data and its misuse, including the security of our IT systems. We regularly evaluate and update all our measures.
III. Purpose of processing and legal basis for the processing of personal data
We process your personal data for the following purposes:
providing services on the basis of a concluded accommodation reservation agreement or accommodation agreement in the Hotel, i.e. in particular, for the purposes of concluding a contract and managing our contractual relationship and communicating with you.
In this case the legal basis enabling us to process your personal data is that the processing of your personal data is necessary in order to conclude or fulfil an agreement with you.
fulfilling our legal obligations, i.e. in particular, for the purposes of keeping a house book and notifying the accommodation of foreign citizens according to legislation governing the residence of foreign citizens in the Czech Republic.
In this case the legal basis enabling us to process your personal data is that the processing of your personal data is necessary in order to fulfil the legal obligation that applies to us as a controller of personal data.
protecting our legitimate interests, i.e. in particular, for the purposes of assessing, exercising and enforcing our legal claims, protecting the rights, property or security of us, our clients or other persons.
In this case the legal basis enabling us to process your personal data is that the processing of your personal data is necessary for the purposes of our legitimate interests as a controller of personal data.
marketing and sending marketing messages and business offers which we believe might interest you in order to improve our services, if you have provided your consent to direct marketing.
In this case the legal basis enabling us to process your personal data is that you have at some time granted us revocable consent to the processing of your personal data for this purpose.
IV. Recipients to whom we might provide your personal data
In order to ensure the proper running of the Hotel, when providing services and fulfilling our contractual obligations, we use professional and specialized services of other subjects, such as gastronomic service providers, IT services, accountants, auditors and other subjects that provide us with their services. If these subjects process your personal data provided to them by the Controller, they are in the position of personal data processors and process them only according to our instructions and cannot use them otherwise. We select each such subject carefully and with each of them we enter into a personal data processing contract, in which such subject as a processor has to fulfil strict obligations to protect and safeguard personal data.
V. Period for which we will process your personal data
We store your personal data only for as long as any of the aforementioned processing purposes lasts, i.e. in particular for the duration of the agreement and for the duration of your consent to the processing of personal data. Following the termination of your agreement or the withdrawal of your consent we will then store your personal data only for the duration and under the conditions required by law in accordance with general limitation, archiving and shredding periods.
VI. Your rights relating to the processing of your personal data
Regarding the processing of your personal data you have:
the right to brief, clear, transparent and comprehensible information about how we handle your personal data and what your rights are regarding the processing of your personal data (this document also serves this purpose)
the right of access to personal data including the right to obtain confirmation of whether or not we are processing your personal data and the right to request information about how we are processing your personal data
the right to rectification of inaccurate or incomplete personal data
the right to erasure of your personal data (“the right to be forgotten”), if:
- your personal data is no longer required for the purposes for which it was collected or processed;
- you have withdrawn your consent to the processing of your personal data;
- you have objected to the processing of your personal data and our legitimate interest in the further processing of your personal data does not have priority in that particular case or you have objected to the processing of your personal data for direct marketing purposes;- your personal data has been processed unlawfully;
- your personal data has to be erased according to legal regulations.
the right to the restriction of processing of your personal data if:
- you dispute the accuracy of your personal data, until we verify their accuracy;
- the processing of your personal data is unlawful and instead of erasing your personal data you only ask for its use to be restricted;
- we no longer need your personal data but you request it in order to exercise your legal rights;
- you have objected to the processing of your personal data, until we verify whether our legitimate interests outweigh your interests.
the right to the portability of data including your right to obtain your personal data and your right to decide to have it transferred to another service provider (to another personal data controller)
the right to object to the processing of your personal data if we process it in order to protect our legitimate interests or for direct marketing purposes
the right to make a complaint to the supervisory authority which is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7; www.uoou.cz
If you have any questions or comments on the processing of your personal data or want to exercise your rights referred to in section VI., you can do so in writing to the Controller’s address, i.e. Zlatnická, spol. s.r.o., Zlatnická 1126/3, 110 00 Praha 1, or by e-mail to: gdpr@hotel-cosmopolitan.cz.