INFORMATION ON THE PROCESSING OF PERSONAL DATA
Dear Guests, Visitors, and Clients,
as part of the services provided to you by our company H & HOTELS, headquartered at: Václavské náměstí 839/7, 110 00 Praha 1 – Nové Město, Company ID No.: 458 09 534, registered in the Commercial Register kept by the Municipal Court in Prague under File No. C12375 (hereinafter the "company"), your personal data is being processed.
We would hereby like to provide you with information about the processing of personal data by our company in connection with the new Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the general regulation on the protection of personal data for which the designation GDPR has already been established (hereinafter the "GDPR").
With this document, our company is providing you with basic information that we, as a personal data administrator, are obliged to provide you with. For more information, please visit: www.hhotels.cz.
1. Personal data administrator:
The administrator of the personal data that you have provided us with is our company (see above). The administrator can be contacted in the manner described in point 12 below.
Your personal data is processed in the following activities:
a) booking accommodation in one of our hotels; and/or
b) making a reservation in one of our restaurants,
by reserving services through the reservation form on the website http://www.hhotels.cz or one of the individual websites of our centres, or when entering your contact email address at the same address in order to receive news about our services and special offers.
Purpose of processing:
We process your personal data for the following purposes:
a. concluding a contract, administration and the execution of a contract or negotiations on a contract, and/or
b. sending a business offer or other business message requested by you, including information about products, services, events, competitions, news subscriptions and sending holiday wishes
The provision of personal data to an administrator is generally a statutory or contractual requirement. As regards the provision of personal data for marketing purposes, which does not represent the fulfilment of a contractual and statutory obligation of an administrator, your consent is required. If you do not grant your consent to the processing of your personal data for marketing purposes to the administrator, it does not mean that the administrator would refuse to provide a service under a contract as a result.
2. Description of the purpose of processing:
We use your personal data for sending a business offer or other business message requested by you. In addition, if you are a guest staying in one of our hotels, your personal data is processed by the company on the basis of Act no. 565/1990 Coll., on local fees, as amended, and Act no. 326/1999 Coll., on the residence of foreign nationals in the Czech Republic, as amended, Act no. 235/2004 Coll., on value added tax, Act no. 235/2004, on certain information society services, Act no. 480/2004 Coll., all while fulfilling the legal obligations of the company.
3. Authorization to process:
The lawfulness of processing is governed by Art. 6 (1) of the GDPR, according to which the processing is lawful if it is necessary for the fulfilment of a contract, for the fulfilment of a data administrator's legal obligation, or for protecting legitimate interests.
Therefore, we must carry out the processing so that it is possible to conclude a contract with you, execute a contract that you have concluded with us or so that we can send an offer or other business message requested by you. The provision of your personal data for the purpose of concluding and executing a contract is a standard contractual requirement. If you do not provide your personal data for this purpose, a contract may not be concluded with you as a result or it may not be possible to execute a contract that has already been concluded.
4. Categories of personal data that we process:
In order to ensure your satisfaction with the proper fulfilment of an obligation, to ensure the fulfilment of a legal obligation or provide service offers or send other business messages, the company processes the following personal data categories as an administrator:
a) basic identification data and contact details - name, surname, e-mail, and delivery address;
b) information about the use of the administrator's services - it is information about what services of the administrator you have used;
c) information for subsequent communication and newsletters with special sales, discounts, etc.
5. Processing and archiving period:
The personal data will be processed and stored at least for the duration of the contract and then for 5 years after the provision of services. Some personal data needed, for example, for tax and billing obligations will be stored for a longer period of time, generally 5 years starting from the year following the occurrence of the event stored.
Personal data may be archived in the public interest and used for scientific, historical or statistical research purposes. In justified cases, personal data may be subject to processing for the purpose of resolving legal issues, including the performance of obligations towards public administration bodies and the monitoring and ongoing evaluation of legal risks (legitimate interest of the controller).
6. Categories of processors or recipients to whom we may provide personal data:
Your personal data will be provided to our business partner ensuring the operation of our booking system and to the administrator of our website. On request, personal data may also be provided to public authorities, in particular courts, the Police of the Czech Republic and other law enforcement authorities, in the necessary scope and within the statutory limits.
The company will disclose your personal data only if it is necessary for the fulfilment of obligations arising for the company out of the applicable legislation or if it is necessary for the fulfilment of obligations under concluded contracts, orders, bookings, etc. Your personal data may also be processed by external employees of the company. The entities that cooperate with us are carefully selected on the basis of guarantees they provide in order to ensure the technical and organizational protection of the personal data handed over. Personal data may be processed for the company only by data processors and solely on the basis of a personal data processing contract concluded between them and the company.
7. Personal data source:
8. Transfer of personal data to third countries or multinational companies:
As part of mentioned processing, your personal data will not be transferred to countries outside the European Union or the European Economic Area, nor to any international organization or other multinational companies.
9. Automated decision-making based on personal data:
The processing of your personal data does not involve automated decision-making or profiling.
Personal data may be archived in the public interest and used for scientific, historical or statistical research purposes. In justified cases, personal data may be subject to processing for the purpose of resolving legal issues, including the performance of obligations towards public administration bodies and the monitoring and ongoing evaluation of legal risks.
10. What other rights do you have related to the processing of your personal data?
The company makes every effort to ensure that your personal data is processed properly and securely. The rights described in this article below are guaranteed to you, and you can exercise them towards the administrator. They are the following rights:
a) The right to information about the processing of your personal data,
b) The right to access personal data being processed,
c) The right to withdraw your consent to the processing of your personal data,
d) The right to correct inaccurate or incorrect data, or to complete incomplete data,
e) The right to restrict or block personal data,
f) Right to delete personal data (the right to be forgotten) in the event of unauthorized processing or in the event that the purpose of processing has expired,
g) The right to be provided with a listing of the personal data in a structured and machine-readable format for you or another administrator (right to data portability),
h) The right to object to the processing of personal data if you believe that the processing is not legitimate, and
i) The right to express your wishes not to be subject to automated decision-making (in the event that automated decision-making is taking place).
11. How can you exercise these rights?
To communicate with the company in the matter of protecting your personal data, you can use the following contacts:
Electronically at the email address: dpo,hhotels,cz
Over the phone on the phone number: +420 222 244 713
In writing at the mailing address:
H & HOTELS s r. o.
Václavské náměstí 839/7
110 00 Praha 1 – Nové Město
In connection with the exercise of your rights, the company may require a reasonable reimbursement not exceeding the costs necessary for handling a request if such request is evidently unjustified or unreasonable.
12. In the case of questions or uncertainties
If you have any questions regarding the personal data protection, you can contact the person responsible for this issue at: dpo,hhotels,cz
13. Filing complaints
If you disagree with the way in which we are processing your personal data, you can file a complaint with the Supervisory Authority in order to protect your rights.
Office for Personal Data Protection
Pplk. Sochora 27
170 00 Praha 7
+420 234 665 111