GDPR Compliance

Who is the Administrator of your personal data and how to contact them?

1. The Administrator of your personal data is TMS SPARTACO Sp. z o.o., with its registered office at Aleja Stanów Zjednoczonych 61, 04-028 Warsaw, registered in the National Court Register by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division KRS 0000721146, NIP 1132964907, REGON 3695908660 (hereinafter "Company").

2. Requests, statements, and all correspondence concerning personal data should be sent in writing to the above address of the Company's registered office or by email to: rodo@tmsspartaco.pl.

Purposes and legal bases for processing personal data

3. We process your personal data for the purposes of:

a) accepting reservations, including using the online booking system (System), and concluding and performing a hotel service contract concluded with the Administrator and making necessary settlements in connection with its conclusion – for the time necessary to perform the contract, and after its termination, personal data will be processed for the period necessary to demonstrate the proper fulfillment of the resulting obligations until the expiration of periods indicated in archival regulations (Art. 6(1)(b) GDPR);

b) fulfilling statutory obligations of the Administrator, in particular tax-related, related to submitted complaints and reporting – for the period necessary to fulfill the statutory obligations of the Administrator, especially until the expiry of limitation periods for tax and complaint liabilities (Art. 6(1)(c) GDPR);

c) realizing the legitimate interest of the Administrator described below – for the period necessary to realize the legitimate interests of the Administrator involving replying to inquiries sent via the contact form, ensuring necessary settlements related to the concluded contract, pursuing possible claims by the Company related to damage caused by the guest or defending against claims by the guest against the Company, direct marketing, conducting quality analysis of provided services, and building relationships and image, but not longer than until the objection is deemed justified by your particular situation, and in cases where direct marketing is the legitimate interest – until you object (Art. 6(1)(f) GDPR);

d) ensuring the safety of hotel guests and other persons present on the Hotel premises and securing property, which constitutes a legitimate interest pursued by the Administrator (Art. 6(1)(f) GDPR), consisting in providing safety within the indicated scope. Video surveillance recordings containing your personal data will be stored for a period not exceeding 21 days from the date of recording unless they constitute evidence in proceedings conducted under the law or the Administrator becomes aware that they may constitute evidence – then the storage period is extended until the final conclusion of the proceedings.

e) in the case of voluntary and optional consents data will also be processed for marketing purposes consisting of providing you with information about the Company's products and services, promotions, price lists, and other information, as well as promotional events, training, and other activities of the Administrator, also on the basis of separate consents via messages sent to your email address or phone number and during telephone conversations with you – until consent is withdrawn (Art. 6(1)(a) GDPR).

Information on whether providing data is a statutory / contractual requirement / condition for concluding a contract / obligation to provide data:

4. Providing your personal data is a condition for concluding a hotel service contract. Data is provided voluntarily, and you are not obliged to provide it. However, the inability of the Company to process your data results in the impossibility of concluding the above contract.

To whom will personal data be disclosed?

5. The Company discloses personal data to the following categories of entities:

a) authorized employees of TMS SPARTACO Sp. z o.o.,

b) banks,

c) entities providing services to the Administrator, such as accounting and tax services, auditing, postal operators and couriers, IT system and service providers, insurers, entities providing technical, organizational, and advisory support, entities providing legal services,

d) entities providing archiving services, entities providing protection services for persons and property, entities authorized under legal regulations, within the meaning of the Act of February 16, 2007, on competition and consumer protection, which includes the Company, and recipients authorized under legal regulations,

e) entities with whom TMS SPARTACO Sp. z o.o. has concluded cooperation agreements.

What rights do you have with regard to personal data?

6. You have the right to: access data, correct it, delete data, restrict its processing, and data portability (if the processing is based on consent or contract in an automated manner).

7. You have the right to object to the processing of data for purposes based on the Company's legitimate interest due to reasons related to your particular situation. We will stop processing your data for these purposes unless we can demonstrate that there are important legitimate grounds overriding your interests, rights, and freedoms, or your data will be necessary to establish, pursue, or defend claims.

8. You have the right to withdraw previously given consent for data processing at any time when consent is the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. The above requests and statements should be submitted as indicated in point 2 above.

Will the Company make automated decisions concerning you or conduct automatic profiling?

10. Your data will not be processed in an automated manner, nor will it be profiled.

Will we transfer your personal data to a third country (outside the EEA) or an international organization?

11. Your personal data will not be transferred to a third country or international organization.

Where can you file a complaint regarding personal data processing?

12. If you consider that the processing of your personal data violates the GDPR regulations, you may file a complaint with the supervisory authority responsible for data protection. In the Republic of Poland, the supervisory authority is the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warsaw).