Personal data protection policy

PERSONAL DATA PROTECTION POLICY

Dear guests,

Unirea Hotel & SPA makes every effort to offer extraordinary products, services and experiences to all of our clients. We are glad that you are our guest and we value your loyalty. We are aware that confidentiality is an important aspect nowadays and it is for this reason that we have developed this Policy. In this way, we explain our practices regarding the personal data we collect from you through this site, through written or verbal communications with us, when you benefit from the products and services of Unirea Hotel & SPA.

We are concerned to guarantee to you the protection of your personal data, in accordance with the rules and principles of Regulation (EU) No 679 of 27th April, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

Personal data means any information about an identified or identifiable individual; an identifiable individual is a person who can be identified, directly or indirectly, in particular by reference to an identification element, such as a name, identification number, location data, an online identifier, or to one or more specific elements, particular to his/her physical, physiological, genetic, psychological, economic, cultural or social identity.

This "Policy" refers to the personal data of our customers, business partners, of other persons who come into contact with us or who visit our locations, employees or persons in the process of being hired, collaborators, etc. and applies to personal data collected through: e-mail, directly at the reception, various forms, CVs, video recordings, web-site, social media. In order to carry out the activity, S.C. Complex Hotelier Unirea S.A. may collect, process and store certain personal data, that are legally required, for the conclusion of a contract or for a legitimate interest. This data may be, but is not limited to: surname, forename, nationality, country and locality of residence,phone number, e-mail address, video images, photos, etc.

The personal data protection policy describes:

The purposes for which we collect and the way we use your personal data;
The way we collect personal data;
The basis of processing for the above mentioned purposes;
The categories of personal data we collect and process;
Storage period for processing;
Your rights and how you can exercise them;
To whom we can transmit this data.

We would also like to bring to your knowledge the measures that we take to ensure the protection of your personal data, as well as how you can contact us in matters related to the protection of your personal data.

The identity and contact details of S.C. Complex Hotelier Unirea S.A., as a personal data operator

S.C. COMPLEX HOTELIER UNIREA S.A.

Headquarters: Piața Unirii, nr. 5, Iași, România, postal code 700056

Registration number at the Trade Register : J/22/89/1998

Unique Registration Code : C.U.I. RO10164493

Subscribed share capital: 2.650.000,00 RON paid

T: 0232 – 20 50 00 | F: 0232 – 20 50 26

E: rezervari@hotelunirea.ro | W: www.hotelunirea.ro

Certificate of Classification: nr. 2617/162

Registered with the National Supervisory Authority for the Processing of Personal Data: no. 17875 and no. 17876

Contact details of the data protection officer: dataprotection@hotelunirea.ro.

The personal data we collect:

Forename, surname, e-mail address, telephone number, ID / passport number and series, country and place of residence;
Credit card details (card type, credit card number, name of the card holder, expiration date and security code);
Information about the client's stay, including the date of arrival and departure, special requests (allergens, specific diets, children), comments on the preferences of your services (including the preference for the type of room, facilities or any other services used);
The information you provide regarding your marketing preferences or during participation in surveys, contests or promotional offers;
Health information when using the massage or access services in the SPA area.

When you visit our websites, even if you do not make a reservation or order a product / service, we may collect certain personal data, such as the IP address, the browser you use and the operating system information, the version of the application, language settings, and pages you've been shown. If you are using a mobile device, we may also collect data that identifies your mobile device, device-specific settings and features, and latitude and longitude details. When you make a reservation, our system records by what means and from which websites you made the reservation. If this data can identify you as an individual, the this data is considered personal data that is subject of this Policy on the protection of personal data. You can choose at any time what personal data (if any) you wish to provide.

THE PURPOSE FOR WHICH WE COLLECT AND HOW WE USE YOUR PERSONAL DATA

S.C. Complex Hotelier Unirea S.A. collects data in the following cases:

1. If you are a customer or potential customer of the Hotel:

We have the obligation to manage safely and only for the specified purposes the personal data you provide us about you.

1.1. In order to be able to offer you our services

We request data:

so we can book rooms for you, get confirmation of booking and other services in our hotel;
so we can book meals in the restaurant or appointments at the SPA, to get confirmation of the reservation and other services in our hotel;
it is possible that we have to answer and solve the requests that you have sent;

For the aforementioned purposes we ask for your consent / agreement and we ask for your phone number and e-mail address, expressly; we have as a basis for processing our legitimate interest.

We request data:

so we can accommodate you in our hotel; in this case, the processing of personal data is done on the basis of a legal obligation;
so you can become a subscriber of the Unirea SPA Center, having as the basis for the processing the legitimate interest of the hotel, as well as the execution of a contract;
to reserve a location, in order to organize an event, based on processing the legitimate interest of the hotel, as well as the execution of a contract.

1.2. To communicate with you before, during and after your stay

It is important for us to be able to communicate with you for a variety of purposes, such as finding out what do you think about our services, resolving your various claims or being able to provide you with personalized, timely services , in electronic format or by phone.

1.3. Compliance with legal obligations

In certain situations we may ask you for some personal data under a legal obligation imposed by the legislation in force.

1.4. Sending information (newsletter)

We request data to send you commercial information / newsletters, in electronic format. For this we ask for your consent / agreement and we ask for your e-mail address, expressly; we have as a basis for processing our legitimate interest.

You can withdraw your consent at any time, thus expressing your option not to receive our newsletter in the future by clicking "unsubscribe" when you receive the respective email.

The categories of data processed in the context of our relationship with you are your surname and forename, telephone number, address / residence, e-mail address, as well as other personal data that you can provide us directly.

1.5 Analysis, improvement and research

We use personal data to conduct market surveys and analyzes in order to improve our services. It is possible to involve a third party to do this on our behalf. We may disclose the results of such research, including to third parties, in the agreed anonymous form. We use your data for analytical purposes, to improve our services, to improve the user experience and to improve the functionality and quality of our online services.

For this we ask your consent and ask for your phone number and e-mail address, expressly; we have as a basis for processing our legitimate interest.

1.6 Security, detection and prevention of fraud

We use information, which may include personal data, to prevent fraud and other illegal activities or activities that infringe the rights of individuals. We also use this information to investigate and detect fraud. We may use personal data for risk assessment and security purposes, including user authentication. For this purpose, personal data may be communicated to third parties, such as public authorities, in accordance with the applicable regulations in force.

1.7 Legal grounds

For this purpose we must use the information provided, which may include personal data, to resolve legal disputes or complaints, for the investigate and comply with regulations, to implement an agreement or to confirm requests from law enforcement bodies, in the extent to which this is provided by law.

2. If you are an employee or another type of collaborator

2.1. To enter into contractual relations with us (Individual Labor Contract, daily activity, etc.)

We request the data required by law in order to conclude employment contracts with us, under a legal obligation: surname, forename, residence, date and place of birth, identity card details, documents of study, criminal record, fiscal record, CVs , medical certificate, etc.

2.2. To communicate with you

In order to be able to communicate with you in a timely manner, we can ask for your phone number and e-mail address.

3. If you want to be the employee of S.C. Complex Hotelier Unirea S.A.

We use the personal data contained in the CVs we receive to evaluate the applicants' qualifications for a position within S.C. Complex Hotelier Unirea S.A., including our internship programs. We base our processing on the interest of potential conclusion and development of an employment contract.

The categories of data processed in the context of our relationship with you are the name, e-mail address, telephone number, address, personal data included in the CV, photography, details on education and training, professional qualifications, as well as other personal data that you can supply directly.

4. If you are a business partner / supplier

4.1. In order to keep in touch with you

We use your personal data to maintain direct contact and to sustain a contractual relationship with you. We collect this data based on the conclusion of commercial contracts.

4.2. In order to communicate with you

We use your contact details to facilitate real-time communication of the relevant details regarding our contractual relationship.

4.3. Legal obligation

In certain situations we may ask you for some personal data under a legal obligation imposed by the legislation in force.

5. If you are a visitor of the spaces of S.C. Complex Hotelier Unirea S.A.

We use your personal data to ensure the safety of our customers, of the goods and of our staff. In this case, we base our data processing on the legitimate interest of S.C. Complex Hotelier Unirea S.A.

The categories of data processed in this context are your name, as well as other personal data that you can provide us directly, upon our request, as well as your images recorded using the video surveillance system.

6. If you are a user of our websites:
www.hotelunirea.ro

www.unirea-shop.ro

www.restaurant-panoramic.ro

www.unireaspa.ro

www.nuntalaunirea.ro

We use the personal data we collect from you when you visit our websites in order to monitor traffic and improve their content. We rely on this data processing activity on our legitimate interest. The categories of data processed in this context are the time and date of accessing a website and the IP address from which the site was accessed.

The grounds for processing personal data may be: a legal obligation (if S.C. Complex Hotelier Unirea S.A. is legally obliged to disclose certain personal data to public authorities), the execution of a contract concluded by S.C. Complex Hotelier Unirea S.A. in the context of a certain transaction or the legitimate interest of S.C. Complex Hotelier Unirea S.A. to carry out a transaction in the most efficient way.

The online booking service is provided through our own website; when you access this service, the terms and conditions that apply are those mentioned on that website. We advise you to consult them!

7. Provision of personal data

When your personal data is requested directly from you, S.C. Complex Hotelier Unirea S.A. asks you to provide all the categories of data that we request for the purposes mentioned above, because otherwise we will not be able to perform our specific activity.

If you provide Complex Hotelier Unirea S.A. personal data of other individuals, please communicate to them, before such a provision of data, the way in which S.C. Complex Hotelier Unirea S.A. intends to process their personal data, as described in this confidentiality policy.

8. Transmission of personal data to third parties

Although, as a general rule, we do not disclose your personal data to third parties, there is the possibility:

to disclose contact details to our marketing service providers (only with your consent);
to disclose the contact details to our providers of banking services, software maintenance, accounting, lawyers, of satisfaction analysis and management contracts (only with your consent);
if there is a legal obligation to transmit the relevant personal data to the public authorities, in the context of the provision, by us, of the services requested by you.

9. Duration of processing

Your personal data will be stored until the time of termination of the relationship with the client, unless we have the legal obligation to continue to store your data in order to present it to the public authorities.

10. Security procedures implemented to secure your personal data

In accordance with the regulation for the protection of personal data, S.C. Complex Hotelier Unirea S.A has applied technical and organizational measures to ensure the security of personal data and their inappropriate use.
We use appropriate systems and procedures to protect and secure the personal data you provide to us.
We also use security procedures and technical and physical restrictions for accessing and using personal data on our servers.
Only authorized personnel are allowed access to personal data during its activity.

11. Your rights

These rights are as follows:

The right to receive information regarding data processing and a copy of the processed data, allows you to obtain confirmation that your personal data are processed by us and, if so, what are the relevant details of these processing activities.
The right to request the correction of inaccurate data or the completion of incomplete data, allows you to rectify your personal data if they are incorrect
The right to request the deletion of your personal data and, if your personal data has been made public, the transmission of information regarding the request for deletion to other operators, allows you to obtain the deletion of your personal data in certain cases, such as :
1. if the data is no longer needed in relation to the purposes for which its was collected;
2. if the processing was based on your consent and if you withdrew your consent, or it has expired or if there is no legal basis for processing your personal data;
3. a court or regulatory authority has decided that your personal data should be deleted;
4. if it proves that your personal data have been processed illegally.

In our turn, we have the right to refuse your request for deletion of personal data if it is necessary to process them:

for the exercise of the right to free expression and information;
to comply with a legal obligation to process, to fulfill a task performed in the public interest or in the exercise of an official authority with which we are invested;
for reasons of public interest in the field of public health;
for finding, exercising or defending a right in court.

The right to request restriction of data processing allows you to obtain the restriction on the processing of your personal data in certain cases, for example, when you dispute the accuracy of your personal data, for a period that allows us to verify this accuracy.
The right to data portability allows you to receive the personal data you have provided to us, in a structured, commonly used and legible format, or to transmit this data to another data operator.
The right to oppose data processing with the intention of ceasing processing allows you to object to the further processing of your personal data, under the conditions and within the limits established by law.
The right to withdraw at any time a given consent to stop a processing of the data based on your consent. Withdrawal will not affect the legality of the processing based on the consent granted before the withdrawal.
The right not to be the subject of a decision based solely on automatic processing (including on the creation of profiles). At the time we present this information note, we do not automatically process your data.
The right to file a complaint with a supervisory authority if you consider that data processing is a violation of the GDPR. In particular, you can lodge a complaint with the supervisory authority in the Member State of the European Union: (i) where you have your habitual residence; or (ii) where your place of employment is; or (iii) where the alleged violation of your data protection rights has occurred. In Romania, the supervisory authority for the processing of personal data is the National Supervisory Authority for the Processing of Personal Data (ANSPDCP).

The contact details of National Supervisory Authority for the Processing of Personal Data are the following:

Address: Bulevardul General Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, Romania, postal code 010336
Phone number (central line): 031 805 92 11
Fax: 031 805 96 02
E-mail address: anspdcp@dataprotection.ro
Website: http://www.dataprotection.ro/

We are happy to ensure that you exercise these rights, unless this proves impossible or involves a disproportionate effort.

As a data subject, you can contact our data protection officer at any time and free of charge, with a notification, using the following contact information: e-mail: dataprotection@hotelunirea.ro in order to exercise your rights in accordance with the GDPR.

You also have the right to file a complaint with the National Supervisory Authority for the Processing of Personal Data, as an autonomous central public authority with general competence in the field of personal data protection.

We are committed to always handling your requests with the utmost attention and you can ask us any questions, to get an answer as soon as possible.

Date of the update:11.12.2019