Data Protection

INFORMATION REGARDING

THE PROCESSING OF YOUR PERSONAL DATA

Due to the new rules concerning the personal data of natural persons, effective from May 25, 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p.1) - hereinafter GDPR), we would like to inform you about what we do with the data we collect, what data are used for, and what rights you have regarding their processing.

Data Controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o. with its registered office in Wrocław (postal code 53-234), at ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, which operates Hotel Vega, Hotel Bacero, and Hotel Grand City.

You can contact the Data Controller directly at the following email address: daneosobowe@hotelbacero.com.pl

Purpose and legal basis for data processing.

Your personal data may be processed solely in accordance with applicable law; GDPR provides several legal bases for processing personal data of natural persons.

When using our Hotel's services, your personal data will be processed for several purposes:

- concluding and performing a contract with you regarding hotel or similar services provided upon the Guest's request (e.g., reservation of a special event in our restaurant - weddings, christenings, formal dinners, etc.). Legal basis: Art. 6 (1)(b) GDPR,

As well as:

- potential establishment, pursuit, or defense of claims,

- archiving information when required to demonstrate facts arising from applicable laws,

- financial purposes related to settling costs of your stay in the Hotel by our accounting department, including issuing accounting documents,

- statistical, customer satisfaction surveys, analytical purposes aimed at tailoring our services to customer needs, handling complaints and requests,

- direct marketing of our own products and services,

- moreover, guest personal data may be processed by video surveillance within the Hotel premises, only in publicly accessible areas (corridors, staircases, reception, restaurant, etc.). The use of video surveillance aims to ensure the safety of our Guests and others present on the premises, as well as protect property.

This constitutes the legitimate interest of the data controller (legal basis: Art. 6 (1)(f) GDPR).

Scope of processed data.

We process the following data concerning you - first and last name, email address, phone number, place of residence data, PESEL number, ID card or passport number, date of birth, and we may also collect financial identification data (credit/debit card data).

Data processing period.

Personal data will be processed by us for:

- the entire duration of the hotel service contract or any other contract concluded at the Guest's request, and thereafter until limitation periods for claims expire - a maximum of 10 years,

- data recorded in accounting documents necessary for issuing invoices - for 5 years from the end of the accounting period,

- data processed on the basis of our legitimate interest as a data controller will be processed for the entire duration of this interest,

- data processed for the direct marketing of our own products and services - until objection is raised,

- data processed by video surveillance will be stored for 30 days, unless further processing is necessary due to an event for legal proceedings based on statutory provisions.

Recipients of personal data.

Personal data will be disclosed exclusively to our subcontractors with whom we have concluded separate data processing agreements:

- IT companies and providers of IT support and infrastructure for the Hotel (supplier of the Integrated IT Systems Not7.pl located in Chyby, ul. Pomarańczowa 5 Spółka z o.o., Profitroom Sp. z o.o. based in Poznań, ul. Roosevelta 9/3, 60-829),

The data may also be disclosed to the following recipient categories: law firms, courier and postal operators, insurance companies, entities authorized under applicable law (courts, prosecutors), tax offices.

Transfer of data to third countries or international organizations.

We do not transfer your personal data to third countries or international organizations.

Your rights.

The GDPR protects the processing of your personal data. You have the right to:

1. access your data and obtain copies,
2. rectify your data,
3. erase your data if you believe we have no legal basis for processing it,
4. restrict processing of data, e.g. only to storage or other specific purposes you indicate, and also if you have objected to the processing,
5. object to marketing. You may always object to processing for direct marketing purposes (in which case we will no longer process data for that purpose),
6. object to processing based on legitimate interest due to your particular situation. To do so, you must provide a reason (a particular situation) requiring us to cease processing. We will stop processing your data for those purposes unless we demonstrate overriding legitimate grounds or require data for establishing, pursuing, or defending claims,
7. data portability, which can be realized by obtaining data from us in easily readable formats (e.g., csv or other accessible formats) or by requesting that we transfer your data to another controller (another service provider),
8. file a complaint with the President of the Personal Data Protection Office, whose contact details and procedures are easily found online on the official website of the Personal Data Protection Office.

To exercise your rights, please contact us by email at: daneosobowe@hotelbacero.com.pl

After confirming your identity, we will process your requests, rights, and questions.

Do you have the right to withdraw your consent if previously given for some processing purposes?

You can withdraw your consent at any time by sending a short message to our email address: daneosobowe@hotelbacero.com.pl indicating that you withdraw your consent to the processing of your personal data by us.

Please note that if we process your data for other purposes and on other legal bases than your consent, we will continue to process data for those purposes on other legal grounds. We have indicated these situations in the section about purposes for which data are processed.

Information on requirement/voluntariness of data provision.

In order to use our services and conclude an agreement with us, you must provide your personal data because it is a condition for the agreement. The requirement to provide data is also a legal obligation (e.g., for invoicing VAT). If you do not want to provide data, we may refuse to conclude the agreement.

Entities that have provided us with your personal data.

If data were not provided to us personally by you, we might have received them from a travel agency or booking portal through which you made the reservation.

We cooperate with the following online accommodation booking intermediaries: booking.com, HRS.com, CiH, eHoliday.pl, Expedia.com, Netmedia, PTQV.

Personal data we have received from other entities typically include first and last name, email address, phone number, date of birth, PESEL.

Detailed information about a specific entity that provided us your data can be obtained at the hotel reception or at – www.hotelbacero.com.pl

INFORMATION REGARDING

THE PROCESSING OF YOUR PERSONAL DATA

(CONTACT FORM)

Due to the new rules concerning the personal data of natural persons, effective from May 25, 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p.1) - hereinafter GDPR), we would like to inform you about what we do with the data we collect, what data are used for, and what rights you have regarding their processing.

Data Controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o. with its registered office in Wrocław (postal code 53-234), at ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, which operates Hotel Vega, Hotel Bacero, and Hotel Grand City.

You can contact the Data Controller directly at the following email address: daneosobowe@hotelbacero.com.pl

Purpose and legal basis for data processing.

Your personal data may be processed solely in accordance with applicable law; GDPR provides several legal bases for processing personal data of natural persons.

After completing the contact form on the hotel's website, we will process your data to establish contact with you and respond to questions sent in the message. In this case, the legal basis for processing your data is your consent (Art. 6 (1)(a) GDPR).

Additionally, due to the content of your message sent via the contact form, we may process your data for direct marketing purposes of our own products and services, which constitutes the legitimate interest of the data controller (legal basis Art. 6(1)(f) GDPR)

Scope of processed data.

We process the following data concerning you - first and last name, email address, and phone number.

Data processing period.

Personal data will be processed by us for:

- the time necessary to process the content of the message you sent to us, but not longer than 12 months,

- for the direct marketing of our own products and services until an objection is raised.

Recipients of personal data.

The data may be shared with IT companies and providers of IT support and infrastructure for the Hotel, with whom the controller has concluded separate data processing agreements (supplier of the Integrated IT Systems Not7.pl located in Chyby, ul. Pomarańczowa 5 Spółka z o.o., Profitroom Sp. z o.o. based in Poznań, ul. Roosevelta 9/3, 60-829),

Transfer of data to third countries or international organizations.

We do not transfer your personal data to third countries or international organizations.

Your rights.

The GDPR protects the processing of your personal data. You have the right to:

1. access your data and obtain copies,
2. rectify your data,
3. erase your data if you believe we have no legal basis for processing it,
4. restrict processing of data, e.g. only to storage or other specific purposes you indicate, and also if you have objected to the processing,
5. object to marketing. You may always object to processing for direct marketing purposes (in which case we will no longer process data for that purpose),
6. object to processing based on legitimate interest due to your particular situation. To do so, you must provide a reason (a particular situation) requiring us to cease processing. We will stop processing your data for those purposes unless we demonstrate overriding legitimate grounds or require data for establishing, pursuing, or defending claims,
7. data portability, which can be realized by obtaining data from us in easily readable formats (e.g., csv or other accessible formats) or by requesting that we transfer your data to another controller (another service provider),
8. file a complaint with the President of the Personal Data Protection Office, whose contact details and procedures are easily found online on the official website of the Personal Data Protection Office.

To exercise your rights, please contact us by email at: daneosobowe@hotelbacero.com.pl

After confirming your identity, we will process your requests, rights, and questions.

Do you have the right to withdraw your consent if previously given for some processing purposes?

You can withdraw your consent at any time by sending a short message to our email address: daneosobowe@hotelbacero.com.pl indicating that you withdraw your consent to the processing of your personal data by us.

Please note that if we process your data for other purposes and on other legal bases than your consent, we will continue to process data for those purposes on other legal grounds. We have indicated these situations in the section about purposes for which data are processed.

Information on requirement/voluntariness of data provision.

Providing data in the contact form is completely voluntary; however, failure to provide data may prevent us from contacting you and responding to your message.

INFORMATION

FOR EMPLOYEES, COLLABORATORS, TRAINEES, AND JOB APPLICANTS

REGARDING THE PROCESSING OF PERSONAL DATA

Due to the new rules concerning the personal data of natural persons, effective from May 25, 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p.1) - hereinafter GDPR), we would like to inform you about what we do with the data we collect, what data are used for, and what rights you have regarding their processing.

Data Controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o. with its registered office in Wrocław (postal code 53-234), at ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, which operates Hotel Vega, Hotel Bacero, and Hotel Grand City.

You can contact the Data Controller directly at the following email address: daneosobowe@hotelbacero.com.pl.

Purpose and legal basis for processing personal data.

We process your personal data for the purposes of:

- concluding and performing an employment contract or other civil law contract (contract for specific work, mandate contract, etc.), i.e., maintaining employee files, payroll processing, payment of remuneration, managing sick leaves and benefits, preparing employment contracts, annexes, terminations, work certificates, PIT submissions (legal basis Art. 6 (1)(b) GDPR). Providing such data is a legal requirement and a condition for concluding the contract.

- recruitment of candidates for employment (under various employment conditions: employment contract, mandate, contract for specific work, internship) based on your consent (legal basis Art. 6 (1)(a) GDPR). Providing such data is a legal requirement and a condition for concluding the contract.

- related to the legal obligation of the data controller as employer under applicable laws, i.e., archiving employee files and employment-related documents, HR and accounting, benefits provision for employees and their families, insurance protection, occupational health and safety - based on the Labor Code of June 26, 1974, Social Insurance System Act of October 13, 1988, Personal Income Tax Act of July 26, 1991 (legal basis Art. 6 (1)(c) GDPR). Providing data for this purpose is a contract condition, contractual obligation, and statutory requirement.

- additionally, personal data may be processed via video surveillance on company premises – Hotel. The use of video monitoring aims to ensure the safety of employees and others present as well as protect property. Processing data for this purpose is the legitimate interest of the data controller (legal basis Art. 6 (1)(f) GDPR).

If required by the legal obligations of the data controller as an employer, we may also process your special category data based on Art. 9 (2)(h) GDPR. This legal obligation may arise, among others, from the Act on Cash Benefits from Health Insurance in case of Illness and Maternity, Art. 185 of the Labor Code regarding information about an employee's pregnancy, and others.

Special category data include especially health data or biometric data.

Scope of processed data.

We only process personal data as required by law. Pursuant to Art. 22¹ of the Labor Code, we process: your first and last name, parents' first names, birth date, place of residence (correspondence address), education, employment history, PESEL, and other personal data if necessary for the use of employee rights under labor law.

Duration of data processing.

Personal data processed in relation to:

- employment relationship (in employee files) will be processed for up to 50 years after termination of employment. This retention period results from Art. 125a (4) of the Act on Pensions and Disability Pensions from the Social Insurance Fund,

- employment under civil law contracts, for contract execution and collaborators' data will be processed as specified in separate laws - up to 10 years,

- necessary data for issuing invoices and accounting documents will be processed for 5 years from the end of the tax period,

- recruitment purposes - 2 years from the application date,

- data from video surveillance will be stored for 30 days unless further processing is necessary due to an event for legal proceedings based on statutory provisions.

Recipients of data.

Personal data will be disclosed only to our subcontractors with whom we have concluded separate data processing agreements - suppliers of the Integrated IT Systems Bon-Net Spółka z o.o., located in Poznań, ul. Polna 13 a/5, Profitroom Sp. z o.o. based in Poznań, ul. Roosevelta 9/3, 60-829.

Also, to the following recipients: Social Insurance Institution (ZUS), tax offices, entities cooperating to provide social benefits (ZFŚS), entities cooperating with insurance protection, and entities authorized under applicable law (courts, prosecutors).

Transfer of data to third countries and international organizations.

We do not transfer your personal data to third countries nor international organizations.

Your rights.

GDPR protects the processing of personal data. You have the right to:

1. access your data and obtain copies,
2. rectify your data,
3. erase your data if you believe we have no legal basis for processing them,
4. restrict processing, e.g., only to storage or other purposes you indicate, and also if you have objected to processing,
5. object to processing based on legitimate interest due to your particular situation. You must provide a reason (a particular situation) requiring cessation of processing. We will stop processing data for these purposes unless we demonstrate overriding grounds or if processing is necessary to establish, pursue or defend claims,
6. withdraw consent to data processing if processed based on consent, by sending a statement to: daneosobowe@hotelbacero.com.pl, indicating that you withdraw consent,
7. data portability, by receiving data from us in readable format (e.g., csv) or request transfer to another data controller,
8. file a complaint with the President of the Personal Data Protection Office, whose contact details and procedures are available on the official website.

Your personal data will not be subject to automated decision making, including profiling.

Providing data is voluntary, but refusal may result in refusal to conclude the contract.

INFORMATION OBLIGATION

FOR HOTEL GUESTS AND PERSONS RECORDED BY VIDEO SURVEILLANCE

Due to the new personal data rules effective May 25, 2018 (Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to personal data processing and free data movement, repealing Directive 95/46/EC (GDPR)), we want to inform you about what we do with the data we collect, their purpose, and your rights related to their processing.

Data Controller.

The data controller is BACERO HOTELE Sp. z o.o., Wrocław (53-234), ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, operator of Hotel Vega, Hotel Bacero, and Hotel Grand City.

You can contact the Data Controller directly at: daneosobowe@hotelbacero.com.pl

Purpose and legal basis for processing.

Your personal data are processed strictly under applicable laws; GDPR provides several bases for processing personal data.

Upon entering our hotel, we may process your data to:

- ensure the safety of persons, property, and information,

- respond to requests, demands, and applications.

The legal basis for this processing may be fulfilling legal obligations binding the hotel, arising, among others, from laws such as the Labor Code, Civil Code, Personal Data Protection Act, Telecommunications Law.

It may also be the legitimate interest of the data controller (Art. 6 (1)(f) GDPR).

Scope of processed data.

In these purposes, we may process data such as your name, PESEL number, identity document, and your image.

Data processing period.

The data retention period may depend on specific legal regulations specifying timeframes for data storage. If based on legitimate interest, processing may last for the entire duration of that interest.

- data from video surveillance will be stored for 30 days unless further processing is necessary due to occurrence of an event for legal proceedings.

Recipients of personal data.

We will share data only with subcontractors with whom we have agreements on data processing:

- entities cooperating on security of persons, property, and information,

- IT companies and IT support providers (supplier of Integrated IT Systems Not7.pl in Chyby, ul. Pomarańczowa 5 Spółka z o.o., Profitroom Sp. z o.o., Poznań, ul. Roosevelta 9/3),

Additionally, data may be disclosed to: law firms, courier and postal operators, insurance companies, authorized entities under applicable law (courts, prosecutors, bailiffs), tax offices.

Transfer of data to third countries or international organizations.

We do not transfer your personal data to third countries or international organizations.

Your rights.

GDPR protects your personal data. You have the right to:

1. access and obtain copies of your data,
2. rectify your data,
3. erase your data if no legal basis exists for processing,
4. restrict processing to storage or other indicated needs, including when you object to processing,
5. object to marketing; you can always object to direct marketing (and we will cease processing for that purpose),
6. object to processing based on legitimate interest for your particular situation. You must give a reason requiring discontinuation. We will stop unless we demonstrate overriding grounds or necessity for claims,
7. data portability, by getting data in readable formats or having them transferred to another controller,
8. complain to the President of the Personal Data Protection Office, with contact details on official website.

To exercise your rights, contact us via email: daneosobowe@hotelbacero.com.pl

After confirming your identity, we will process your requests.

Do you have the right to withdraw consent for some data processing if previously given?

You can withdraw consent anytime by sending a short message to our email address: daneosobowe@hotelbacero.com.pl stating that you withdraw consent for processing of your personal data.

Note that if data are processed on other legal bases than consent, processing may continue for purposes supported by those bases.

Information on requirement/voluntariness of data provision.

Processing of data for the above purposes may be statutory or contractual obligations. Failure to provide data may preclude entry to the hotel premises, result in request to leave the hotel, or inability to fulfill your requests or applications.