Data Protection

INFORMATION ON

PROCESSING PERSONAL DATA

Due to the new rules on personal data of individuals, effective from 25 May 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals regarding the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1), hereinafter GDPR), we wish to inform you how we use the data we collect, what it is used for and what rights you have regarding its processing.

Personal data controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o., based in Wrocław (53-234), ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, owner of Hotel Vega, Hotel Bacero and Hotel Grand City.

You may contact the personal data controller directly at: daneosobowe@hotelbacero.com.pl

Data purposes/legal bases

We may process your personal data only under applicable law. The GDPR provides several bases for processing individuals' personal data.

By using our Hotel's services, your personal data will be processed for several purposes:

- entering into and performing the agreement with you for hotel or similar services provided by the Hotel at the Guest's request (e.g. booking a private event at our restaurant—wedding, christening, formal dinner, etc.). Legal basis: Art. 6(1)(b) GDPR,

As well as:

- possible establishment, pursuit or defence of claims,

- archiving information where required to prove facts under applicable law,

- financial purposes, including accounting settlement of your stay and issuing accounting documents,

- statistical purposes, satisfaction surveys, analytics to tailor services to customer needs, and handling complaints and enquiries,

- direct marketing of our own products and services,

- the Guest's personal data may also be processed by video surveillance on Hotel premises, solely in publicly accessible areas (corridors, stairwells, reception, restaurant, etc.). Video surveillance is used to ensure the safety of our Guests and others on the premises and to protect property.

which is our legitimate interest as personal data controller (legal basis: Art. 6(1)(f) GDPR)

Scope of processed data.

We process the following data: your name, email address, telephone number, place of residence, PESEL number, ID card or passport number, date of birth, and potentially financial identification data (credit/debit card details).

Data processing period.

We will process personal data for:

- the entire term of the hotel services agreement or other agreement made at the Guest's request, then until claims expire—up to 10 years,

- data recorded in accounting documents and needed to issue an invoice—for 5 years from the end of the accounting period,

- data processed on the basis of our legitimate interest as controller—for as long as that interest exists,

- data processed for direct marketing of our products and services—until you object,

- data processed by video surveillance—for 30 days, unless further processing is necessary due to an incident for proceedings under statutory provisions.

Entities to which we may disclose personal data.

We disclose personal data only to subcontractors with whom we have separate data processing agreements:

-IT companies providing Hotel support and infrastructure (provider of Integrated IT Systems Not7.pl, based in Chyby, ul. Pomarańczowa 5, Spółka z o.o.; Profitroom Sp. z o.o., based in Poznań, ul. Roosevelta 9/3, 60-829),

Data may also be disclosed to: law firms, courier and postal operators, insurers, entities authorised by law (including courts and prosecutors' offices), and tax offices.

Transfers of data to third countries or international organisations.

We do not transfer your personal data to third countries or international organisations.

Your rights.

The GDPR protects the processing of your personal data. You have the right to:

access it and receive a copy.
correct your data.
erase it if you believe we have no grounds to process it.
restrict processing, e.g. to storage only or other purposes you specify, and when you object to processing.
object to marketing. You may always object to processing for direct marketing; we will then stop processing it for that purpose.
object to processing based on legitimate interest due to your particular situation. You must state the reason (particular situation) requiring us to stop processing. We will stop processing your data for these purposes unless we demonstrate overriding grounds or need it to establish, pursue or defend claims.
data portability, by receiving, on request, your personal data in an easily readable format (e.g. CSV) or asking us to transfer it to another controller (service provider),
lodge a complaint with the President of the Personal Data Protection Office. Its contact details and how to exercise this right are available online at the Office's official website.

To exercise your rights, please contact us at: daneosobowe@hotelbacero.com.pl

After confirming your identity, we will handle your requests, rights and questions.

May you withdraw your consent if previously given for certain data processing purposes?

You may withdraw such consent at any time by sending a brief message to daneosobowe@hotelbacero.com.pl stating that you withdraw your consent to our processing of your personal data.

Please note that if we process your data for other purposes and on legal bases other than consent, we may continue processing it for purposes supported by those other bases. We identify these situations with the purposes for which we process personal data.

Requirement/voluntary provision of data.

To use our services and enter into an agreement with us, you must provide your personal data, as it is required to conclude the agreement. Providing data may also be required by law (e.g. for VAT invoice sales records). If you do not provide it, we may refuse to conclude the agreement.

Entities that provided us with your personal data.

If you did not provide the data personally, we may have received it from the travel agency or booking portal used to make your reservation.

We work with these online accommodation booking intermediaries: booking.com, HRS.com, CiH, eHoliday.pl, Expedia.com, Netmedia, PTQV.

Personal data received from other entities includes, in particular, your name, email address, phone number, date of birth and PESEL number.

Details of the entity that provided your data are available at hotel reception or at www.grandcityhotel.pl

INFORMATION ON

PROCESSING YOUR PERSONAL DATA

(CONTACT FORM)

Due to new rules on personal data of individuals, effective from 25 May 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on protecting individuals regarding personal data processing and the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1), hereinafter GDPR), we wish to inform you how we use the data we collect, what it is used for and your rights regarding its processing.

Personal data controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o., based in Wrocław (postal code 53-234), at 251 Grabiszyńska Street, NIP: 8943228086, REGON: 527526375, owner of Hotel Vega, Hotel Bacero and Hotel Grand City.

You may contact the data controller directly at: daneosobowe@hotelbacero.com.pl

Data processing purpose/legal bases.

We may process your personal data only under applicable law. The GDPR provides several bases for processing individuals’ personal data.

After you complete the hotel website contact form, we will process your data to contact you and answer questions in your message. The legal basis is your consent (Article 6(1)(a) GDPR).

We may also process your data for direct marketing of our products and services based on the content of your message, which is our legitimate interest as data controller (Article 6(1)(f) GDPR).

Scope of processed data.

We process your name, email address and phone number.

Data processing period.

We process personal data for:

-the time needed to handle your message, but no longer than 12 months,

-direct marketing of our products and services until you object.

Entities to which we may disclose personal data.

This data may be disclosed to IT companies providing Hotel IT support and infrastructure, with which the controller has separate data processing agreements (provider of Integrated IT Systems Not7.pl, based in Chyby, 5 Pomarańczowa Street, and Profitroom Sp. z o.o., based in Poznań, 9/3 Roosevelta Street, 60-829),

Transfers to third countries or international organisations.

We do not transfer your personal data to third countries or international organisations.

Your rights.

The GDPR protects the processing of your personal data. You have the right to:

access it and receive a copy.
correct your data.
erase it if you believe we have no grounds to process it.
restrict processing, e.g. to storage only or other purposes you specify, including when you object to processing.
object to marketing. You may always object to processing for direct marketing; we will then stop processing it for that purpose.
object to processing based on legitimate interest due to your particular situation. You must provide the reason. We will stop processing your data for these purposes unless we show that our grounds override your rights or are needed to establish, pursue or defend claims.
data portability: receive your personal data from us in a readable format (e.g. CSV) or ask us to transfer it to another data controller (service provider),
lodge a complaint with the President of the Personal Data Protection Office; contact details and instructions are available on its official website.

To exercise your rights, contact us at: daneosobowe@hotelbacero.com.pl

After confirming your identity, we will handle your requests, rights and questions.

May you withdraw consent previously given for certain data processing purposes?

You may withdraw consent at any time by emailing daneosobowe@hotelbacero.com.pl a brief statement that you withdraw consent to our processing of your personal data.

If we process your data for other purposes and on other legal bases than consent, we may continue processing it for those purposes. We identify these situations alongside the processing purposes.

Requirement/voluntary nature of providing data.

Providing data in the contact form is voluntary; however, failure to provide it may prevent us from contacting you and answering your message.

INFORMATION

FOR EMPLOYEES, ASSOCIATES, TRAINEES AND JOB APPLICANTS

ON PERSONAL DATA PROCESSING

Personal data controller.

You may contact the data controller directly at: daneosobowe@grandcity.pl.

Purposes and legal grounds for processing.

We process your personal data to:

- conclude and perform our employment or other civil-law contract (contract for specific work, mandate contract, etc.), i.e. maintain employee files, settle payroll, pay remuneration, settle sick leave and benefits, prepare employment contracts, annexes, terminations and employment certificates, and settle and send PIT forms (legal basis: Art. 6(1)(b) GDPR). Providing this data is required by law and a condition of concluding the contract.

- recruit candidates for work under various arrangements (employment contract, mandate contract, contract for specific work, internships), with your consent (legal basis: Art. 6(1)(a) GDPR). Providing this data is legally required and a condition of concluding the contract.

- comply with the legal obligation imposed on the personal data controller as employer under applicable law, i.e. archive employee files and employment-related documents, HR and accounting records, provide additional benefits for employees and their families, insurance protection, and occupational health and safety, arising in particular from the Labour Code of 26 June 1974, the Act of 13 October 1988 on the social insurance system, and the Act of 26 July 1991 on personal income tax (legal basis: Art. 6(1)(c) GDPR). Providing this data is a condition of concluding the contract and a contractual and statutory requirement.

- furthermore, personal data may be processed by video surveillance at the workplace—the Hotel. Video surveillance ensures the safety of employees and other persons on the premises and protects property. Processing for this purpose is our legitimate interest as personal data controller (legal basis: Art. 6(1)(f) GDPR).

Where required by the legal obligation of the personal data controller as employer, we may also process your special-category personal data under Art. 9(2)(h) GDPR. This obligation may arise, among others, from Art. 57 of the Act on cash benefits from health insurance in the event of sickness and maternity, and Art. 185 of the Labour Code concerning information about an employee’s pregnancy.

Special-category data include, in particular, health and biometric data.

Scope of processed data.

We process only personal data required by applicable law. Under Art. 22¹of the Labour Code, we process your: first and last name, parents’ names, date of birth, place of residence (correspondence address), education, employment history, PESEL number and other employee data where necessary to exercise special employment rights.

Data processing period.

Personal data related to:

- employment (in employee files) will be processed for up to 50 years after employment ends. This retention period follows, among others, from Art. 125a(4) of the Act on pensions from the Social Insurance Fund,

- civil-law contracts, concerning contract performance and collaborators’ data, will be processed for the period specified in separate applicable laws—up to 10 years,

- issuing invoices and accounting documents will be processed for 5 years from the end of the tax period,

- recruitment purposes—2 years from applying for the position,

- video surveillance data will be stored for 30 days, unless, due to an incident, further processing is necessary for proceedings conducted under the law.

Entities to which we may disclose data.

We disclose personal data only to subcontractors with whom we have separate data-processing agreements: Bon-Net Spółka z o.o., provider of Integrated IT Systems, based in Poznań, ul. Polna 13 a/5, and Profitroom Sp. z o.o., based in Poznań, ul. Roosevelta 9/3, 60-829.

And to these recipient categories: ZUS, tax offices, entities cooperating to provide ZFŚS benefits, entities cooperating on insurance protection, and entities authorized by law (including courts and prosecutors’ offices).

Transfers of data to third countries and international organizations.

We do not transfer your personal data to third countries or international organizations.

Your rights.

The GDPR protects personal data processing. You have the right to:

access your data and receive a copy.
correct your data.
erase your data if you believe we have no grounds to process it.
restrict processing, e.g. to storage only or other purposes you specify, and where you object to processing.
object to processing based on legitimate interest due to your particular situation. You must state the reason (particular situation) why, in your view, we must stop processing. We will stop processing for these purposes unless we demonstrate that our grounds override your rights or the data is needed to establish, pursue or defend claims.
withdraw consent to processing where this is the legal basis, by sending a statement to: daneosobowe@grandcity.pl, stating that you withdraw consent to personal data processing.
data portability, by receiving from us, on request, data in easily readable formats (e.g. CSV or others) or asking us to transfer it to another controller you identify.
lodge a complaint with the President of the Personal Data Protection Office. Its contact details and how to exercise this right are available on the Office’s official website.

Your personal data will not be subject to automated processing, including profiling.

Providing data is voluntary, but refusal may result in refusal to conclude the contract.

INFORMATION OBLIGATION

FOR HOTEL GUESTS AND PERSONS RECORDED BY VIDEO SURVEILLANCE

Due to the new rules on personal data of individuals, effective from 25 May 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on protecting individuals regarding personal data processing and the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1)—the GDPR), we wish to inform you what we do with the data we collect, why we use it and what rights you have regarding its processing.

Personal data controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o., based in Wrocław (postal code 53-234), ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, owner of Hotel Vega, Hotel Bacero and Hotel Grand City.

You may contact the personal data controller directly at: daneosobowe@hotelbacero.com.pl

Processing purpose/legal grounds

We may process your personal data only under applicable law. The GDPR provides several grounds for processing individuals’ personal data.

When entering our hotel premises, we may process your personal data for the purpose:

- ensuring safety for people, property and information,

- responding to requests, inquiries and applications.

Processing may be based on the hotel’s legal obligation, arising, among others, from the Labour Code Act of 26 June 1974, the Civil Code Act of 23 April 1964, the Personal Data Protection Act of 10 May 2018 and the Telecommunications Law Act of 16 July 2004.

Processing may also be based on the controller’s legitimate interest (Art. 6(1)(f) GDPR).

Scope of processed data.

For the purposes above, we may process such personal data as: first and last name, PESEL, identity document and your image.

Data processing period.

The retention period for your data may, in specific cases, depend on legal provisions requiring data to be stored for a specified period. Where the data controller has a legitimate interest, data may be stored for as long as that interest exists.

- data processed through video monitoring will be stored for 30 days, unless, due to an incident, further processing is necessary for proceedings conducted under the law.

Entities to which we may disclose personal data.

We will disclose personal data only to our subcontractors with whom we have separate data processing agreements:

-entities with which we may cooperate to ensure the safety of persons, property and information,

-IT companies providing Hotel IT support and infrastructure (provider of Integrated IT Systems Not7.pl, Chyby, ul. Pomarańczowa 5, Spółka z o.o.; Profitroom Sp. z o.o., Poznań, ul. Roosevelta 9/3, 60-829),

This data may also be disclosed to: law firms, courier and postal operators, insurers, entities authorised under applicable law (including courts, prosecutors and bailiffs), and tax offices.

Transfers of data to third countries or international organisations.

We do not transfer your personal data to third countries or international organisations.

Your rights.

The GDPR protects the processing of your personal data. You have the right to:

access it and receive a copy.
correct your data.
have it erased if you believe we have no grounds to process it.
restrict processing, e.g. solely to storage or other purposes you specify, including where you object to processing.
object to marketing. You may always object to processing your personal data for direct marketing; in that case, we will no longer process it for this purpose.
object to processing based on a legitimate interest due to your particular situation. You must give us the reason (your particular situation) requiring us to stop processing. We will stop processing your data for these purposes unless we demonstrate that our grounds override your rights, or that the data is needed to establish, pursue or defend claims.
data portability, by requesting your personal data from us in an easily readable format (e.g. CSV or another readily accessible format), or asking us to transfer it to another data controller (service provider),
lodge a complaint with the President of the Personal Data Protection Office. Its contact details and information on exercising this right can be easily found online on the Office's official website.

To exercise your rights, please contact us by email: daneosobowe@hotelbacero.com.pl

After verifying your identity, we will handle your requests, rights and questions.

May you withdraw your consent if you previously gave it for certain data processing purposes?

You may withdraw this consent at any time by sending a brief message to our email address: daneosobowe@hotelbacero.com.pl stating that you withdraw your consent to our processing of your personal data.

Please note that if we process your data for other purposes and on other legal bases than your consent, we may continue processing it for purposes supported by those other legal bases. We identify these situations alongside the purposes for which we process personal data.

Data provision mandatory or voluntary

Processing data for the purposes indicated above may be required by law or contract.

If you do not provide your data for these purposes, you may be unable to enter the hotel, may be asked to leave, or we may be unable to fulfil your request or application.