Privacy

Acting pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – hereinafter referred to as "GDPR"), I inform you that:

1) the controller of your personal data is Hotel Klimek SPA Limited Partnership KRS 0000918370, NIP 7343266037 operating the hotel under the name Hotel Klimek **** SPA, headquartered in Muszyna, Złockie 107, phone 18 477 82 22, email rodo@hotel-klimek.pl, hereinafter referred to as the Controller;

2) your personal data may be processed for the purpose of:

• a) fulfilling obligations arising from the contract concluded with the hotel/business entity,
• b) fulfilling obligations arising from legal regulations, 
• c) conducting marketing activities,
• d) customer satisfaction surveys,
• e) ensuring the safety of the hotel’s property and employees (including video monitoring),
• f) communication with customers and contractors,
• g) providing SPA services,
• h) adapting hotel services to the guest's specific requirements,
• i) establishing, pursuing, or defending claims,
• j) documenting the provision of qualified first aid by a rescuer, especially during active leisure activities,
• k) providing aesthetic medicine services,
• l) providing catering services.

3) in case we receive your data from a third party, we inform you that we will process the following categories of your personal data: first name, last name, address, contact phone number, email; we inform you that your personal data comes from an entity with which you have concluded a contract, the subject of which is the service provided by us;

4) the legal basis for data processing is

• a) conclusion and performance of a contract with the Controller (Article 6(1)(b) GDPR),
• b) fulfilling obligations arising from legal regulations (Article 6(1)(c) GDPR),
• c) consent, for data not necessary for concluding and performing the contract with the Controller, especially for marketing activities and communication with customers and contractors (Article 6(1)(a) GDPR),
• d) explicit consent in the case of processing data concerning the health of the hotel guest (Article 9(2)(a) GDPR),
• e) legitimate interest of the hotel in customer satisfaction surveys, ensuring the safety of the hotel’s property and employees (Article 6(1)(f) GDPR),
• f) establishing, pursuing, or defending claims (Article 6(1)(f) and Article 9(2)(f) GDPR),
• g) medical diagnosis and treatment (Article 9(2)(h) GDPR).

5) the recipients of your personal data may be:

• a) entities to whom the Controller commissions services related to personal data processing, e.g., IT service providers, accounting offices, and companies, bodies, and institutions to which the Controller will direct correspondence or inquiries on your behalf, e.g., transport companies,
• b) bodies authorized by law, including courts and other public administration bodies;

6) your personal data will be stored for the period required by law or until the termination of the contract with the Controller and/or the expiration of claims, and in the case of data processed based on consent until the withdrawal of such consent; data processed within the hotel’s monitoring system will be stored for up to 3 months, while in the case of customer satisfaction surveys until the customer raises an objection;

7) if the processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;

8) you have the right to access your data and the right to rectify, delete, restrict processing, the right to data portability, and the right to object – solely under the terms set out in the GDPR;

9) you have the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your personal data violates the provisions of the GDPR;

10) providing your personal data is voluntary, but to the extent that data processing is necessary for the conclusion and performance of the contract with the Controller, the consequence of not providing such data will be the inability to conclude a contract with the Controller.