Informative Text about Processing Personal Data for CPI Hotels, a.s. clients
CPI Hotels is represented on the market by the brands: Budha-Bar Hotel Prague, Clarion Hotels, Quality Hotels, Comfort Hotels, Mamaison Hotels & Residences, Spa & Kur Hotels, Holiday-Inn, Fortuna Hotels, Private Label Hotels, Ubytovny.cz and Benada Restaurant.
1. What data do we process?
A) Client data
Based on your reservation (or stay without a reservation) we process personal data of clients in the following scope:
- identification and contact data (name and surname, permanent residential address, ID card number or similar document and possibly also e-mail address and telephone number);
- in the case of natural persons engaged in business activities: also the designation of the natural person engaged in business activities, registered office, ID number, VAT number, data on VAT payer;
- in the case of business trips by non-entrepreneurs: also data on the organisation that ordered or paid for the stay);
- data about the purpose of the stay or information that the client is a person who is not subject to a fee for a spa or recreational stay;
- information about your membership in the loyalty program;
- information about your stay and services used and the amount and method of payment for services provided (in case of non-cash payment, bank account number, or payment card details);
- in the case of foreign nationals (in addition to the above data): also the date of birth, nationality, travel document number, visa number, permanent residential address abroad;
- in the case of guests using parking at our hotel: also their car license plate number.
In addition to accommodation, we also provide you with spa treatments in our Spa & Kur Hotels. If used, we also process the following data in addition to the above:
- diagnosis data obtained directly from you by our doctor during the initial medical examination;
- data on health care provided to you in our facilities and the course of treatment (medical examination, possible health complications during your stay, etc.)
B) Photo documentation from events
We take a reasonable amount of photo documentation (situational shots from events) at the events we organise for the purpose of subsequent publication of selected photos on our website for the promotional purposes of CPI Hotels. This means that the visitors to a specific event are not primarily displayed, but rather the overall atmosphere of the event; the shots are not published in detailed resolution and we do not include captions describing specific event visitors. In the professional opinion of the Office for Personal Data Protection, these cases are not primarily a question of personal data protection, but of privacy protection according to the Civil Code; consent to the processing of personal data for "illustrative" images is therefore not required.
2. On what basis and for what purpose do we process your personal data?
A) Processing necessary for the fulfilment of legal obligations
The provision and processing of all the above personal data, with the exception of e-mail address and telephone number and information about your membership in the loyalty program, is necessary for the purposes of fulfilling our legal obligations, especially obligations arising from the Act on Local Fees and the Act on the Stay of Foreigners in the Czech Republic and also from accounting and tax regulations.
B) Processing necessary to fulfil the contractual relationship
Processing your identification data and data about your stay and provided services and the amount and method for their payment is necessary for the purposes of fulfilling the contractual relationship related to your stay, i.e., fulfilling orders and reservations, concluding and fulfilling contracts related to accommodation and dining and related services offered and provided by us.
In the case of spa care, we process data provided on the registration card, information about your treatment stays and the health care services provided to you in our facilities, as well as information on the payment for the stay. We process this data on the basis of a legal relationship between you and CPI Hotels, the subject of which is the provision of spa therapeutic rehabilitation treatment and related services (accommodation, dining, etc.). The purpose of this processing is to provide the above services.
C) The consequence of not providing data
We cannot provide you with our accommodation services if you do not provide us with the above data. We do not need any of your personal data to provide dining and other services and therefore we do not acquire or process it for this purpose.
D) Processing necessary for the purposes of legitimate interests
We process your personal data in the scope of your name, surname, e-mail address and information about your stay, on the basis of our legitimate interests for the purposes of direct marketing, the purpose of processing is exclusively the option to send you marketing and business messages, i.e., information about interesting news, discounts, etc.
We also process personal data in the same extent for sending satisfaction questionnaires after your stay in our hotels, for the purpose of verifying your satisfaction with our services and to constantly improve the quality of our services for you.
In our hotels there are no cases in which guests question the services we provide or spa care services. Should such a case arise, we would be forced to process data on the services provided to the extent necessary to conduct such a dispute, solely for the purpose of protecting our rights in said dispute. Similarly, we would be forced to process the necessary data in the case of non-payment for our services or in the case of damages incurred by us.
E) Processing on the basis of consent
Based on your consent or permission settings in the applications used in your internet browser, we process technical information obtained when visiting our website – see in detail the separate informative text available at www.cpihotels.com/cs/cookies.
We offer our clients Wi-Fi network services, and you have the option of choosing a paid connection alternative or a connection alternative provided free of charge. In the case of a free connection, you are informed in advance that CPI Hotels will use the data on your e-mail address exclusively for the purpose of sending marketing communication informing you about interesting news, discounts, etc. You subsequently have the opportunity to express your disagreement with marketing communication being sent to you in the future, at any time.
You can withdraw your consent at any time by sending a notice to our address (CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10), our e-mail address firstname.lastname@example.org, by using the contact form at www.cpihotels.com, or by changing the settings in your internet browser. Withdrawal of consent will come into force upon its delivery to CPI Hotels. According to the GDPR, the withdrawal of consent does not affect the lawfulness of processing based on the consent given before its revocation.
F) Automated processing of your data
In no case do we carry out automated decision-making or other automated processing of your personal data that would have any legal consequences for you or would significantly affect you in a similar way.
3. Source of personal data
We obtain all the above data directly from you, in connection with negotiation of a contract and provision of accommodation and dining services.
If reservation of our services was arranged by another person (typically the employer in the case of business trips), we obtain your basic identification and contact information (in the scope of name and surname, telephone number, or e-mail address) directly from this person.
For reservations entered through reservation portals, your basic identification and contact information (in the scope of name and surname, telephone number, or e-mail address) is provided to us by the reservation portal.
4. How long do we process your personal data for?
We process your personal data for the duration of your stay in our hotel. After the end of your stay, we process only:
- Data for which the obligation to process it arises from the relevant legal regulations, and only for the time necessary according to said legal regulations. (For example, the accounting and tax documents that we issue to you also contain some of your personal data (name and surname, type of service provided, date of issue of the document). We keep these documents only for the purpose of fulfilling the obligations set out in the relevant accounting and tax legislation, for the period imposed by these regulations.)
- Your name, surname, e-mail address and information about your stay for the purposes of direct marketing by CPI Hotels (sending information about interesting news or discounts of our services, etc.) and for sending satisfaction questionnaires. We process data for sending satisfaction questionnaires only until evaluation of the questionnaires (maximum 1 month after your stay). For the purposes of direct marketing, we process your data listed above until you withdraw your consent to further processing.
- Data necessary for the purpose of existing or imminent disputes. We process this data only until the legally effective ruling concerning the dispute and fulfilment of obligations arising from the ruling, or until such time disputes over the provided services may arise under applicable law.
After expiration of these periods, we regularly dispose of your personal data, both in paper and electronic form.
5. To whom do we make your personal data available or pass it on?
A) Transfer to third parties
We do not transfer or disclose your personal data to any third parties, with the exception of public authorities, where the obligation to transfer data arises from valid and effective legislation (this is typically the case with data that we process under the Local Fees Act or the Act on Residence of Foreigners in the Czech Republic).
In the case of spa care services, we do not disclose your personal data to anyone; our doctors and other medical staff are employees of CPI Hotels.
For the purposes of providing some support services (e.g., sending marketing messages, improving communication and the segmentation of offers, ensuring online hotel reservations, cookie processing) we use the services of processors. This always involves processing carried out exclusively for our company and on the basis of our instructions. We always select the processors with regard to the trustworthiness and quality of their services, including the security of the processed personal data. Processing is only possible on the basis of a contract concluded between CPI Hotels and the processor, binding the processor to the same degree of personal data protection as that provided by CPI Hotels itself. We will inform you about the processors we currently work with upon request.
C) Transfer of data abroad
In principle, our processors have their registered office and place of processing of personal data in the Czech Republic or in another EU country. Only in the case of sending and evaluating satisfaction questionnaires and in the case of some reservation systems do we use processors in the USA; these are always renowned companies within international hotel, reservation and similar networks, who provide services for hotels worldwide.
By Commission Implementing Decision 2016/1250 dated 12 July 2016, pursuant to European Parliament and Council Directive 95/46/EC on the adequacy of protection provided by the EU-US Privacy Shield, the European Commission, together with US government authorities, defined the 'Privacy Shield' system ( "Privacy Shield") as a special tool to ensure an adequate level of protection of personal data even after it has been transferred to a recipient in the United States. Pursuant to this decision, Companies established in the United States of America that have committed to the principles of the Privacy Shield program ensure an adequate level of protection of personal data. The US-based processors mentioned above are among the companies that have committed themselves to the Privacy Shield program. More information can be found on the official website of the program at https://www.privacyshield.gov. The Privacy Shield program remains valid even after the GDPR came into effect.
In cases other than those listed above, we do not transfer personal data outside the EU.
6. How CPI Hotels ensures the protection of personal data
All people in our organisation who come into contact with personal data are obliged to maintain confidentiality regarding the processed personal data, including the safety measures aimed at protecting it. This obligation also remains in place if said individual’s employment with CPI Hotels or the processor ends.
7. Your rights under the applicable law
According to the valid legal regulation of personal data protection, you have the following rights:
- the right to access your personal data that we process; this includes the right to obtain the following information from CPI Hotels:
- confirmation of whether CPI Hotels processes your personal data
- access to this personal data,
- information on the purposes of processing,
- on the categories of personal data concerned,
- information on recipients or categories of recipients to whom personal data will be made available,
- on planned storage time, or the criteria for determining this,
- on the existence of the right to request the correction or deletion of personal data, or the restriction of its processing, or the right to object to such processing,
- on the right to lodge a complaint with the supervisory authority,
- on all available information on the source of personal data if not obtained from the data subject - from you,
- whether there is automated decision-making, including profiling,
- on appropriate safeguards for the transfer of personal data outside the EU,
- provided that the rights and freedoms of others are not adversely affected, as well as a copy of the personal data.
- the right to correct your personal data if it is incorrect, inaccurate, or incomplete; the corrections will be carried out by CPI Hotels without undue delay with regard to technical feasibility,
-the right to request the deletion of personal data in cases specified by the GDPR, e.g., in the case of revocation of consent to processing, or if you raise an objection to processing, in the case of illegal processing of personal data, in the case that personal data is no longer needed for the purposes for which it was processed, etc. You can therefore request the deletion of your personal data, but this option does not apply where processing is necessary to fulfil a legal obligation and in some other cases stipulated by the GDPR.
- the right to request restriction of the processing of personal data in cases provided for by the GDPR, such as when you deny the accuracy of personal data, raise an objection to its processing, etc.
- - the right to the transferability of the data you have provided us and which is processed in automated form, based on your consent, or on the basis of the necessity of its processing for the fulfilment of the contract with you, or for the implementation of measures taken before the conclusion of the contract at your request. In such cases, we will allow you to obtain your personal data in a structured, commonly-used and machine-readable format, or, if technically feasible, will pass it directly to another administrator designated by you;
- the right to object to the processing of your personal data based on the need for processing, for the purpose of legitimate interest, including processing for direct marketing purposes. If we are unable to provide serious and legitimate reasons for processing, which outweigh your interests or rights and freedoms, or for the determination, enforcement or defence against any legal claims, we will not continue to process your personal data in such cases.
- the right to withdraw consent to the processing of your personal data at any time by sending a communication to our address (CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10), to our e-mail address email@example.com, via the online contact form at www.cpihotels.com, or by changing the settings of your internet browser. The withdrawal of consent will come into force upon its delivery to CPI Hotels. According to GDPR, the withdrawal of consent does not affect the lawfulness of processing based on the consent given before its revocation.
- the right not to be the subject of any decision based solely on automated processing, including profiling, which has legal consequences for you or similarly significantly affects you, except as expressly provided in the GDPR,
- in addition to the above, if you believe that the processing of your personal data is violates the GDPR, the right to file a complaint with the supervisory authority, i.e., the Office for Personal Data Protection with registered office at Pplk. Sochora 27, 170 00 Prague 7.
8. Information text about the camera system on the premises of CPI Hotels, a.s.
• the purpose of processing is to protect property and increase the safety of persons
• the scope of processing includes only video recording by the camera system, without sound recording
• administrator identification: CPI Hotels, a.s., Company ID No.: 47116757, Bečvářova 2081/14, Prague 10, 100 00
• the recording from the camera system is stored on an HDD device/hard drive operated by CPI Hotels, a.s; no other processor is used for this camera system
• the site of processing is the registered office of CPI Hotels, a.s. and its premises at Vladislavova 1390/17, Nové Město, 110 00 Prague, as well as individually listed hotels, including the number of cameras:
|Hotel Imperial Ostrava||Tyršova 1250/6, 702 00 Moravská Ostrava||35|
|Clarion Hotel Prague Old Town||Hradební 768/9, 110 00 Prague, Staré Město||8|
|Comfort Hotel Olomouc||Wolkerova 1197/29, 779 00 Olomouc||12|
|Buddha-Bar Hotel Prague||Jakubská 649/8, 110 00 Prague, Staré Město||33|
|Spa Kur Hotel Harvey||Dlouhá 222/2, 351 01 Františkovy Lázně||37|
|Grand Hotel Zlatý Lev||Gutenbergova 126/3, 460 05 Liberec||8|
|Clarion Hotel Špindlerův Mlýn||Labská 111, 543 51 Špindlerův Mlýn||13|
|Spa Kur Hotel Praha||Ruská 27/12, 351 01 Františkovy Lázně||18|
|Clarion Hotel České Budějovice||Pražská tř. 2306/14, 370 04 České Budějovice||63|
|Clarion Hotel Prague City||Tylovo náměstí 15/3, 120 00 Prague, Vinohrady||12|
|Mamaison Residence Belgická||Belgická 318/12, 120 00 Prague, Vinohrady||2|
|Clarion Congress Hotel Ostrava||Zkrácená 2703/84, 700 30 Ostrava, Zábřeh||30|
|Hotel Černigov Hradec Králové||Riegrovo náměstí 1494/4, 500 02 Hradec Králové||12|
|Mamaison Hotel Riverside||Janáčkovo nábřeží 1115/15, 150 00 Praha||8|
|Comfort Hotel Prague City East||Bečvářova 2081/14, 100 00 Prague 10||68|
|Quality Hotel Ostrava City||Hornopolní 3313/42, 702 00 Moravská Ostrava, Ostrava||26|
|Mamaison Residence Downtown Prague||Na Rybníčku 1329/5, 120 00 Nové Město, Prague||48|
|Quality Hotel Brno Exhibition Centre||Křížkovského 30, 603 00 Brno||49|
• only law enforcement or administrative authorities may be the recipient of data from the camera system, for the purposes of misdemeanour proceedings
• the cameras cover:
- individual hotel entrances and reception areas, corridors and underground garages, parking spaces in front of the hotel, entrances/exits, staff entrances, supply and handling areas, terraces, entrances to fitness/wellness facilities(in the case of Clarion in Špindlerův Mlýn and Ostrava ), halls/foyers, access to conference rooms, ramp, yard/courtyard.
• the retention period of records is a maximum of 7 days, after which the data is automatically deleted by being recording over, as the camera system is based on a loop mode
• camera operation regime: continuous (or based on automatic motion sensor)
• contact details for receiving requests for information: registered address of CPI Hotels, a.s., or e-mail address firstname.lastname@example.org
According to the valid legal personal data protection regulations , you generally have the following rights:
- the right to access your personal data, which we process,
- the right to correct your personal data in the event that it is incorrect, inaccurate or incomplete,
- the right to request the deletion of personal data, or restriction of its processing,
- the right to object to the processing of your personal data,
- in addition to the above, you also have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection with its registered office at Pplk. Sochora 27, 170 00 Prague 7.
If anything is unclear or you have any questions regarding the processing of your personal data, you can contact us at any time by sending a letter to the registered address of CPI Hotels, a.s. or an e-mail to email@example.com.
9. Our contact information
If anything is unclear or you have any questions regarding the processing of your personal data, please contact us at any time by sending us a letter to the registered address of CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10, or to the e-mail address of our data protection officer firstname.lastname@example.org, or using the contact form at www.cpihotels.com.