Data Protection

INFORMATION REGARDING

PROCESSING OF YOUR PERSONAL DATA

Due to the new regulations regarding personal data of natural persons, which have been in force since May 25, 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p.1) - hereinafter GDPR), we would like to inform you what we do with the data we collect, what the data are used for, and what rights you have in connection with their processing.

Data Controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o. with its registered office in Wrocław (postal code 53-234), at ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, which operates Hotel Vega, Hotel Bacero, and Hotel Grand City.

You can contact the Data Controller directly at the email address: daneosobowe@hotelbacero.com.pl

Purpose and legal basis for data processing.

Your personal data can only be processed based on applicable laws; GDPR provides several legal bases for processing the personal data of natural persons.

By using the services of our Hotel, your personal data will be processed for several purposes:

- conclusion and performance of the contract concluded with you for the provision of hotel or similar services, which at the guest's request are provided by the Hotel (e.g., reservation of special events in our restaurant - weddings, christenings, formal dinners, etc.) . Legal basis: art. 6(1)(b) GDPR,

As well as:

- possible establishment, pursuit, or defense of claims,

- archiving information in case of the necessity to demonstrate facts resulting from applicable laws,

- financial purposes involving the necessity to settle the costs of your stay by our accounting department, including issuing accounting documents,

- statistical purposes, customer satisfaction surveys, analytical purposes aimed at adjusting our services to customer needs, handling complaints and requests,

- for direct marketing of our own products and services,

- additionally, the guest's personal data may be processed by video surveillance located within the Hotel premises, exclusively in publicly accessible areas (corridors, staircases, reception, restaurant, etc.). The use of video surveillance aims to ensure the safety of our guests and other persons present on the premises, as well as protection of property.

This is our legitimate interest as the data controller (legal basis: art. 6(1)(f) GDPR)

Scope of processed data.

We process the following data concerning you - first and last name, email address, phone number, place of residence data, PESEL number, ID card or passport number, date of birth, we may also collect financial identifying data (credit/debit card details).

Data processing period.

Your personal data will be processed by us for the period of:

- the entire duration of the hotel service contract or any other contract concluded at the Guest's request, and thereafter until the limitation period for claims arising from it expires - maximally for 10 years,

- data recorded in accounting documents necessary to issue invoices - for 5 years from the end of the tax settlement period,

- processed by us on the basis of our legitimate interest as data controller, will be processed for as long as this interest exists,

- processed for direct marketing purposes of our own products and services - until an objection is raised,

- data processed by video surveillance will be kept for 30 days, unless, due to an incident, further processing is necessary for proceedings conducted under applicable laws.

Entities to which we may disclose personal data.

Personal data will only be disclosed to our subcontractors with whom we have concluded separate agreements on entrusting data processing:

- IT companies and those providing IT support and infrastructure to the Hotel (supplier of Integrated IT Systems Not7.pl based in Chyby, ul. Pomarańczowa 5 Spółka z o.o., Profitroom Sp. z o.o. based in Poznań, ul. Roosevelta 9/3, 60-829),

These data may also be disclosed to the following categories of recipients: law firms, courier companies and postal operators, insurance companies, entities authorized under applicable laws (e.g., courts, prosecutors), tax offices.

Transfer of data to third countries or international organizations.

We do not transfer your personal data to third countries or international organizations.

Rights.

The GDPR protects the processing of your personal data. You have the right to:

1. access your data and receive copies of them.
2. correct (rectify) your data.
3. the right to have your data deleted if you believe we have no basis for processing them.
4. restrict the processing of data, e.g., only for storage or other purposes indicated by you, as well as in situations where an objection to data processing has been raised.
5. object to marketing. You can always object to the processing of your personal data for the purposes of direct marketing (in which case we will not process them for this purpose).
6. object to processing based on the legitimate interest due to your particular situation. To do this, you must inform us of the reason (particular situation) requiring us to stop the processing of data. We will stop processing your data for those purposes unless we demonstrate that our processing bases override your rights, or if the data are necessary for establishing, pursuing, or defending claims.
7. data portability, which can be realized by receiving from us, upon your request, your personal data in formats that are easily readable (e.g., csv or other commonly used formats), or you may ask us to transfer the data to another data controller (service provider).
8. file a complaint to the President of the Personal Data Protection Office, whose contact details and the procedure to exercise this right you can easily find on the official website of the Personal Data Protection Office.

To exercise your rights, please contact us at the email address: daneosobowe@hotelbacero.com.pl

After confirming your identity, we will process your requests, rights, and questions.

Do you have the right to withdraw your consent if previously given for certain data processing purposes?

Such consent can be withdrawn at any time by sending a short message to our email address: daneosobowe@hotelbacero.com.pl indicating that you withdraw your consent to the processing of your personal data by us.

Please remember that if we process your data for other purposes and on other legal grounds than the given consent, we will still be able to process the data for the purposes based on other legal grounds. We have indicated these situations in the purposes for which we process personal data.

Information on the requirement/voluntariness of providing data.

To use our services and conclude a contract with us, you must provide your personal data, as this is a condition for concluding the contract. Providing data is also a legal requirement (e.g., for documentation of sales made by VAT invoice). If you do not want to provide them, we may refuse to conclude the contract.

Entities that provided us with your personal data.

If the data were not provided to us personally by you, we may have obtained them from a travel agency or a booking portal through which you made the reservation.

We cooperate with the following online accommodation booking intermediaries: booking.com, HRS.com, CiH, eHoliday.pl, Expedia.com, Netmedia, PTQV.

The personal data we received from other entities primarily includes first and last name, email address, phone number, date of birth, PESEL.

Detailed information about the specific entity that provided us with your data can be obtained at the hotel reception or at the address – www.hotelvega.pl

INFORMATION REGARDING

PROCESSING OF YOUR PERSONAL DATA

(CONTACT FORM)

Due to the new regulations regarding personal data of natural persons in force since May 25, 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p.1) - hereinafter GDPR), we want to inform you what we do with the data we collect, what the data are used for, and what rights you have in connection with their processing.

Data Controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o. with its registered office in Wrocław (postal code 53-234), at ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, which operates Hotel Vega, Hotel Bacero, and Hotel Grand City.

You can contact the Data Controller directly at the email address: daneosobowe@hotelbacero.com.pl

Purpose and legal basis for data processing.

Your personal data can only be processed on the basis of applicable laws; GDPR provides several legal bases for processing personal data of natural persons.

After filling out the contact form on the hotel’s website, we will process your data in order to contact you and respond to the questions sent in the message. In this case, the legal basis for processing your data is your consent (art. 6(1)(a) GDPR).

Moreover, due to the content of your message sent via the contact form, we may process your data for direct marketing of our own products and services, which is our legitimate interest as data controller (legal basis art. 6(1)(f) GDPR).

Scope of processed data.

We process the following data concerning you - first and last name, email address, and phone number.

Data processing period.

Your personal data will be processed by us for the period of:

- necessary to handle the content of the message sent to us, but no longer than 12 months,

- processed for direct marketing purposes of our own products and services until an objection is raised.

Entities to which we may disclose personal data.

These data may be disclosed to IT companies and those providing IT support and infrastructure to the Hotel, with whom the administrator has concluded separate agreements on entrusting data processing (supplier of Integrated IT Systems Not7.pl based in Chyby, ul. Pomarańczowa 5 Spółka z o.o., Profitroom Sp. z o.o. based in Poznań, ul. Roosevelta 9/3, 60-829),

Transfer of data to third countries or international organizations.

We do not transfer your personal data to third countries or international organizations.

Rights.

The GDPR protects the processing of your personal data. You have the right to:

1. access your data and receive copies of them.
2. correct (rectify) your data.
3. the right to have your data deleted if you believe we have no basis for processing them.
4. restrict the processing of data, e.g., only for storage or other purposes indicated by you, as well as in situations where an objection to data processing has been raised.
5. object to marketing. You can always object to the processing of your personal data for the purposes of direct marketing (in which case we will not process them for this purpose).
6. object to processing based on the legitimate interest due to your particular situation. To do this, you must inform us of the reason (particular situation) requiring us to stop the processing of data. We will stop processing your data for those purposes unless we demonstrate that our processing bases override your rights, or if the data are necessary for establishing, pursuing, or defending claims.
7. data portability, which can be realized by receiving from us, upon your request, your personal data in formats that are easily readable (e.g., csv or other commonly used formats), or you may ask us to transfer the data to another data controller (service provider).
8. file a complaint to the President of the Personal Data Protection Office, whose contact details and the procedure to exercise this right you can easily find on the official website of the Personal Data Protection Office.

To exercise your rights, please contact us at the email address: daneosobowe@hotelbacero.com.pl

After confirming your identity, we will process your requests, rights, and questions.

Do you have the right to withdraw your consent if previously given for certain data processing purposes?

Such consent can be withdrawn at any time by sending a short message to our email address: daneosobowe@hotelbacero.com.pl indicating that you withdraw your consent to the processing of your personal data by us.

Please remember that if we process your data for other purposes and on other legal grounds than the given consent, we will still be able to process the data for the purposes based on other legal grounds. We have indicated these situations in the purposes for which we process personal data.

Information on the requirement/voluntariness of providing data.

Providing data in the contact form is entirely voluntary, but failure to provide it may prevent us from contacting you and responding to your message.

INFORMATION

FOR EMPLOYEES, CO-WORKERS, INTERNS, JOB APPLICANTS

REGARDING THE PROCESSING OF PERSONAL DATA

Due to the new regulations regarding personal data of natural persons effective from May 25, 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p.1) - hereinafter GDPR), we would like to inform you what we do with the data we collect, what the data are used for, and what rights you have regarding their processing.

Data Controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o., with its registered office in Wrocław (postal code 53-234), at ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, which operates Hotel Vega, Hotel Bacero, and Hotel Grand.

You can contact the Data Controller directly at the email address: daneosobowe@hotelbacero.com.pl.

Purposes and legal bases for processing personal data.

Your personal data is processed for the purpose of:

- concluding and performing an employment contract or other civil law contract (contract for specific work, mandate contract, etc.), i.e., maintaining employee records, payroll accounting, salary payments, handling sick leaves and benefits, preparing employment contracts, annexes, contract terminations, employment certificates, tax settlements and sending PIT forms (legal basis: art. 6(1)(b) GDPR). Providing these data for this purpose is a statutory requirement and a condition for concluding the contract.

- recruiting candidates for employment (on various employment bases: employment contract, mandate, contract for specific work, internships) based on your consent (legal basis: art. 6(1)(a) GDPR). Providing data for this purpose is a statutory requirement and a condition for concluding the contract.

- in connection with the legal obligation on the data controller as an employer arising from applicable legal provisions, i.e., archiving employee files and documents related to employment, HR and accounting records, implementation of additional benefits for employees and their families, insurance protection, occupational health and safety - resulting in particular from the Labor Code of June 26, 1974, the Act of October 13, 1988, on the social insurance system, and the Act of July 26, 1991, on personal income tax (legal basis: art. 6(1)(c) GDPR). Providing data for this purpose is a contractual condition, statutory obligation, and legal requirement.

- additionally, personal data may be processed through video surveillance located on the work premises - the Hotel. The use of video surveillance aims to ensure the safety of employees and others present, as well as the protection of property. Data processing for this purpose is our legitimate interest as the data controller (legal basis: art. 6(1)(f) GDPR).

If there is a legal obligation upon the data controller as employer, we may also process special categories of your personal data based on art. 9(2)(h) GDPR. Such a legal obligation may arise, for example, from art. 57 of the Act on cash benefits from health insurance in case of sickness and maternity, art. 185 of the Labor Code regarding information about employee pregnancy, and others.

Special categories of data include, among others, health data or biometric data.

Scope of processed data.

We process only personal data within the scope prescribed by legal provisions. Pursuant to art. 22¹ of the Labor Code, we process your: first and last name, parents' names, date of birth, place of residence (correspondence address), education, employment history, PESEL number, and other employee personal data if the provision of such data is necessary due to the employee exercising special entitlements under labor law.

Period of data processing.

Personal data processed in connection with:

- employment relationship (in employee files) will be processed for up to 50 years from the end of employment. The obligation to store data for this period results, among others, from art. 125a(4) of the Act on pensions and disability pensions from the Social Insurance Fund,

- employment based on civil law contracts related to contract execution and collaborators' data will be processed in accordance with other applicable laws, for up to 10 years,

- necessary for issuing invoices and accounting documents, data will be processed for 5 years from the end of the tax period,

- recruitment purposes – 2 years from the application date,

- data processed by video surveillance will be stored for 30 days unless further processing is necessary for proceedings conducted under applicable laws.

Entities to which we may disclose data.

Personal data will be disclosed only to our subcontractors with whom we have concluded separate agreements on entrusted data processing - supplier of Integrated IT Systems Bon-Net Spółka z o.o., with registered office in Poznań, ul. Polna 13 a/5, Profitroom Sp. z o.o. with registered office in Poznań, ul. Roosevelta 9/3, 60-829.

Also to the following categories of recipients: Social Insurance Institution (ZUS), tax offices, entities cooperating to provide benefits from the Company Social Benefits Fund (ZFŚS), entities cooperating regarding insurance protection, and entities authorized under applicable laws (e.g., courts, prosecutors).

Transfer of data to third countries and international organizations.

We do not transfer your personal data to third countries or international organizations.

Rights.

The GDPR protects the processing of personal data. You have the right to:

1. access your data and receive copies of them.
2. correct (rectify) your data.
3. the right to have your data deleted if you believe we have no basis for processing them.
4. restrict the processing of data, e.g., only for storage or other purposes indicated by you, as well as in situations where an objection to data processing has been raised.
5. object to processing based on legitimate interest due to your particular situation. To do this, you must inform us of the reason (particular situation) requiring us to stop processing. We will stop processing data for those purposes unless we can demonstrate that our processing bases override your rights or if data are necessary for establishing, pursuing, or defending claims.
6. withdraw consent to data processing if processed on this legal basis, by sending a statement to: daneosobowe@hotelbacero.com.pl, simply indicating consent withdrawal.
7. data portability, which can be realized by receiving from us, upon your request, your data in readable formats (e.g., csv or other), or ask us to transfer the data to another data controller designated by you.
8. file a complaint to the President of the Personal Data Protection Office, whose contact details and procedure to exercise this right are easily found on the official website of the Personal Data Protection Office.

Your personal data will not be subject to automated processing, including profiling.

Providing data is voluntary, but refusal may result in refusal to conclude the contract.

INFORMATION OBLIGATION

FOR HOTEL GUESTS AND PERSONS RECORDED AND RECORDED BY VIDEO SURVEILLANCE

Due to the new regulations regarding personal data of natural persons, in force since May 25, 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p.1) - hereinafter GDPR), we wish to inform you what we do with the data we collect, what the data are used for, and what rights you have regarding their processing.

Data Controller.

The controller of your personal data is BACERO HOTELE Sp. z o.o. with its registered office in Wrocław (postal code 53-234), at ul. Grabiszyńska 251, NIP: 8943228086, REGON: 527526375, operating Hotel Vega, Hotel Bacero, and Hotel Grand City.

You can contact the Data Controller directly at the email address: daneosobowe@hotelbacero.com.pl

Purpose and legal basis for data processing.

Your personal data may only be processed based on applicable laws; GDPR provides several legal bases for processing personal data of natural persons.

If you enter our hotel premises, we may process your personal data for the purpose of:

- ensuring the safety of persons, property, and information,

- responding to demands, requests, and applications.

The legal basis for processing data for these purposes may be the need to fulfill a legal obligation imposed on the hotel, which may arise, among others, from provisions of the Labor Code of June 26, 1974, the Civil Code of April 23, 1964, the Act of May 10, 2018 on personal data protection, and the Telecommunications Law of July 16, 2004.

The legal basis for processing this data may also be the legitimate interest of the data controller (art. 6(1)(f) GDPR).

Scope of processed data.

For the above purposes, we may process personal data such as: first and last name, PESEL, identity document, and your image.

Data processing period.

The period of storing your data may in specific cases depend on legal provisions which set the required storage time. The storage of data, where there is a legitimate interest of the data controller, may last for as long as this interest exists.

- data processed by video surveillance will be stored for 30 days unless due to an incident, further processing is necessary for proceedings conducted under legal provisions.

Entities to which we may disclose personal data.

We will disclose personal data only to our subcontractors with whom we have concluded separate agreements on entrusting data processing:

- entities with whom we cooperate to ensure the safety of persons, property, and information,

- IT companies and those providing IT support and infrastructure to the Hotel (supplier of Integrated IT Systems Not7.pl based in Chyby, ul. Pomarańczowa 5 Spółka z o.o., Profitroom Sp. z o.o. based in Poznań, ul. Roosevelta 9/3, 60-829),

Such data may also be disclosed to the following recipient categories: law firms, courier and postal operators, insurance companies, entities authorized under applicable law (including courts, prosecutors, bailiffs), tax offices.

Transfer of data to third countries or international organizations.

We do not transfer your personal data to third countries or international organizations.

Rights.

The GDPR protects the processing of your personal data. You have the right to:

1. access your data and receive copies of them.
2. correct (rectify) your data.
3. the right to have your data deleted if you believe we have no basis for processing them.
4. restrict the processing of data, e.g., only for storage or other purposes indicated by you, as well as in situations where an objection to data processing has been raised.
5. object to marketing. You may always object to the processing of your personal data for the purposes of direct marketing (in which case we will not process them for this purpose).
6. object to processing based on the legitimate interest due to your particular situation. To do this, you must inform us of the reason (particular situation) requiring us to stop processing data. We will stop processing your data for those purposes unless we demonstrate that our processing bases override your rights, or if data are necessary for establishing, pursuing, or defending claims.
7. data portability, which can be realized by receiving from us, upon your request, your personal data in formats that are easily readable (e.g., csv or other commonly used formats), or you may request we transfer the data to another data controller (service provider).
8. file a complaint to the President of the Personal Data Protection Office, whose contact details and the procedure to exercise this right you can easily find on the official website of the Personal Data Protection Office.

To exercise your rights, please contact us at the email address: daneosobowe@hotelbacero.com.pl

After confirming your identity, we will process your requests, rights, and questions.

Do you have the right to withdraw your consent if previously given for certain data processing purposes?

Such consent can be withdrawn at any time by sending a short message to our email address: daneosobowe@hotelbacero.com.pl indicating that you withdraw your consent to the processing of your personal data by us.

Please remember that if we process your data for other purposes and on other legal grounds than the given consent, we will still be able to process the data for the purposes based on other legal grounds. We have indicated these situations in the purposes for which we process personal data.

Information on the requirement/voluntariness of providing data.

Processing data for the above purposes may be a statutory or contractual requirement.

If you do not provide your data for these purposes, it may result in the inability to enter the hotel premises, a request to leave the hotel, or inability to fulfill your demands, requests, or applications.