Privacy Policy
Version effective from 15.07.2024
I. GENERAL PROVISIONS
1. This Privacy Policy (hereinafter referred to as the Privacy Policy) sets out the rules for processing by TMS SPARTACO Sp. z o.o., registered office address: Aleja Stanów Zjednoczonych 61, 04-028 Warsaw, entered in the National Court Register by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register KRS 0000721146, NIP 1132964907, REGON 3695908660 (hereinafter the Administrator) of personal data: users of the website operated by the Administrator at www.hotelbelvedere.pl (hereinafter the Website) and clients making reservations, including via the online reservation system (System) and in accordance with the reservation regulations of Hotel Belvedere available at /en/contact/additional-information
2. In order to ensure the security of entrusted personal data, the Administrator operates on the basis of internal procedures and recommendations, compliant with the relevant legal acts concerning personal data protection, in particular the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter GDPR).
3. The Administrator exercises particular due diligence to protect the interests of the persons whose data is processed, and in particular ensures that personal data is:
a) processed lawfully;
b) collected for specified, lawful purposes and not further processed in a way incompatible with those purposes;
c) accurate and adequate in relation to the purposes for which it is processed;
d) kept in a form that allows identification of the persons to whom it relates no longer than is necessary to achieve the purpose of processing.
4. Terms used in the Privacy Policy with capital letters have the meaning defined in the reservation regulations at Hotel Belvedere.
II. RULES FOR PROCESSING PERSONAL DATA BY THE ADMINISTRATOR OF WEBSITE OR SYSTEM USERS
1. The Administrator obtains your personal data in the following ways:
a) Website Users - browsing the Website only
The Administrator analyses your behavior on the Website, including monitoring and collecting information about activity on the Website (e.g., frequency, viewed tabs), to use it for evaluation and conducting own marketing activities. This information is collected to ensure the proper functioning of the Website, especially for security purposes and to use it for the Administrator's own marketing activities. More information about obtaining and processing personal data via "cookies" is available in the Cookies Settings on the Website;
b) Website Users - filling in and submitting the contact form
The Website includes a contact form through which the User may send the Administrator the following personal data: first name, last name, phone number, email address. The decision to fill in the contact form and provide personal data is voluntary and belongs to the User. The personal data provided by the User in the contact form will be used by the Administrator to respond to the User's inquiry;
c) Clients
Clients who have entered into a contract with the Administrator for the provision of hotel services;
d) Website Users - subscribing to the Newsletter
The Website contains a form through which the User can subscribe to receive the Newsletter by providing the Administrator with an email address. The decision to provide the address is voluntary and belongs to the User.
III. INFORMATION OBLIGATION
Who is the Administrator of your personal data and how to contact them?
1. The Administrator of your personal data is TMS SPARTACO Sp. z o.o., registered office address: Aleja Stanów Zjednoczonych 61, 04-028 Warsaw, entered in the National Court Register by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register KRS 0000721146, NIP 1132964907, REGON 3695908660.
2. Requests, statements, and any correspondence regarding personal data should be sent in writing to the aforementioned registered office address or by email to: rodo@tmsspartaco.pl
Purposes and legal bases of personal data processing
3. We process your personal data for the purposes of:
a) accepting reservations, including via the online reservation system (System), concluding and performing the contract for hotel services concluded with the Administrator and making necessary settlements related to its conclusion – for the period necessary to perform the contract, and after its termination, personal data will be processed for the time necessary to demonstrate proper performance of the resulting obligations until the expiration of periods indicated in archival regulations (Art. 6(1)(b) GDPR);
b) fulfilling statutory obligations of the Administrator, particularly tax-related, connected with complaints and reporting – for the time necessary to comply with statutory obligations of the Administrator, particularly until expiration of statutory limitation periods for tax and complaint liabilities (Art. 6(1)(c) GDPR);
c) realizing the legitimate interest of the Administrator described below – for the time necessary to realize the legitimate interest of the Administrator consisting in responding to inquiries sent via the contact form, ensuring necessary settlements related to the concluded contract, pursuing any claims by the Company for damages caused by the guest or defending against guest claims against the Company, direct marketing, conducting quality analysis of provided services and building relationships and image, but not longer than until your objection justified by a particular situation is recognized as valid; in case the legitimate interest is direct marketing – until you object (Art. 6(1)(f) GDPR);
d) ensuring the safety of hotel guests and other persons present on the Hotel premises and securing property, which constitutes a legitimate interest pursued by the Administrator (Art. 6(1)(f) GDPR), consisting in ensuring security in the specified scope. Recordings from video monitoring containing your personal data will be kept for no longer than 21 days from the date of recording, unless they constitute evidence in proceedings conducted based on law or the Administrator has been notified that they may constitute evidence in proceedings – then the retention period is extended until the final conclusion of the proceedings.
e) if voluntary and optional consents are given, data will also be processed for marketing purposes consisting in providing you with information about the Company's products and services, promotions, price lists, and other information, as well as promotional events, trainings, and other activities of the Administrator, also based on separate consents via messages sent to your email address or phone number and during telephone conversations with you – until consent is withdrawn (Art. 6(1)(a) GDPR).
In the case of Website Users’ data, the legal basis for data processing is the necessity to process it to realize the legitimate interest of the Administrator consisting in ensuring the proper functioning of the Website (Art. 6(1)(f) GDPR), and for profiling the legal basis is the User’s consent expressed through available settings from the cookie banner or via the User's browser settings allowing saving “cookies” files (Art. 6(1)(a) GDPR).
The User can refuse or withdraw the given consent especially by changing the settings of their internet browser/changing settings from the cookie banner or restrict its scope. Withdrawal of consent does not affect the lawfulness of the data processing done based on the consent before its withdrawal.
Information on whether providing data is a statutory/contractual requirement / condition for concluding the contract / obligation to provide data:
4. The obligation to provide personal data by you is a condition for concluding the contract for hotel services. Data is provided voluntarily and you are not obligated to provide it. However, the lack of possibility for the Company to process your data results in the inability to conclude the aforementioned contract.
Providing personal data in the contact form is not a statutory or contractual requirement or a condition for concluding a contract. Failure to provide data will result in the Administrator's inability to process your data for the purpose of responding to your inquiry.
To whom personal data will be disclosed?
5. Your personal data may be disclosed to the following categories of recipients:
a) authorized employees of TMS SPARTACO Sp. z o.o.,
b) banks,
c) entities providing services to the Administrator, such as accounting and tax services, auditing, postal operators and couriers, IT system and service providers, insurers, entities providing technical, organizational, and advisory support,
d) entities providing legal services, entities providing archiving services, entities providing personal and property protection services, entities authorized pursuant to law, within the meaning of the Act of 16 February 2007 on competition and consumer protection, of which the Company is part and recipients authorized under the law,
e) entities with which TMS SPARTACO Sp. z o.o. has concluded cooperation agreements.
What rights do you have in relation to personal data?
6. You have the right to: access your data, rectify it, delete data, restrict its processing, and to data portability (if processing is based on consent or contract in an automated manner).
7. You have the right to object to data processing for purposes carried out on the basis of the Company's legitimate interest due to reasons related to your particular situation. We will cease processing your data for these purposes unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms or your data is necessary for the establishment, exercise, or defense of legal claims.
8. You have the right to withdraw the previously given consent to data processing at any time to the extent consent is the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
9. The aforementioned requests and statements should be submitted as indicated in point 2 above.
Will the Company take automated decisions or conduct automated profiling concerning you?
10. Your data will not be processed in an automated manner nor profiled.
Will we transfer your personal data to a third country (outside the EEA) or an international organization?
11. Your personal data will not be transferred to a third country/international organization.
Where can a complaint regarding the processing of personal data be filed?
12. If you believe that the processing of your personal data violates the GDPR, you may file a complaint with the supervisory authority responsible for personal data protection. In Poland, the supervisory authority is the President of the Office for Personal Data Protection (address: ul. Stawki 2, 00-193 Warsaw).
IV. FINAL PROVISIONS
1. The Administrator reserves the right to amend the provisions of the Privacy Policy.
2. The Administrator will notify Users of any changes to the Privacy Policy 5 days before these changes come into effect by publishing the unified text of the Privacy Policy on the Website.
3. Continued use of the Website after changes to the Privacy Policy constitutes a declaration of the User's will to accept the changes to the Privacy Policy.