RESERVE
RESERVE

Personal Data Policy

Privacy Statement of Family Hotel Oasis

At Family Hotel Oasis, we strive to offer exceptional products, services, and experiences. We value our business, but we value your loyalty even more. We know that privacy is important to you, and we have prepared this statement to explain our practices regarding the personal information we collect from or about you on this website, through verbal or written communication with us, when you visit Family Hotel Oasis, or through other sources, such as tour operators. or through other sources, such as tour operators.

This statement describes the practices adopted by Family Hotel Oasis, which are fully compliant with the requirements of REGULATION (EU) 679/2016 on the protection of personal data.

What personal data do we collect?

During any event involving our guests or in preparation for such an event, it may be necessary to collect personal data such as names, telephone numbers, email addresses, addresses, etc. In such cases, data is always collected only for the specific purpose and is limited to the minimum amount necessary to achieve that purpose.

Lotteries or marketing surveys to gather feedback from our guests and customers about the quality of the products and services we offer are part of the list of such events aimed at offering only the most suitable high-quality products and services for you.

The personal data collected during guest registration is required by law and regulated. When registering at the hotel, you will be given the opportunity to familiarize yourself with the information provided by the reception administrators regarding the protection of personal data.

Other information collected at the hotel

  1. The car rental request requires additional personal data required by law related to this activity, such as driver’s license number and other data related to the rental and insurance services offered.
  2. Collection of information at the premises of Family Hotel Oasis. The Tourism Act requires us to collect the minimum personal data required by this law when registering guests at the hotel. In order to ensure your safety, we may make video recordings of guests and visitors in public areas of the complex, under the conditions regulated by the Private Security Activity Act
  3. Organization of events. Technical details for events organized by you may include data such as date and time, number of guests, information about guest rooms, and the minimum personal data required for them. For corporate events, company details and additional information may be required. When you visit us as part of a group, we will have the personal data provided to us by the group so that we can send you offers for events organized for the group, depending on your personal preferences. If you are an event organizer, you may agree to share information about your event with third parties—service providers who provide services for your event.
  4. Social networks. If you participate in social networks, you should know that we encourage you to share information about your stay with us with your contacts through text and/or photos, as well as to participate in photo contests, for example with photos taken during your stay with us. If other people are present in the photo material, their consent is required in this case.
  5. Business partnership or career opportunities. . Please contact us for further information that would allow us to assess your suitability for a partnership or career development with us. In such cases, we may need to compare the information you provide with other publicly available information.

Personal data received from third parties

It is common practice in your relationship with us for third parties to be involved, such as the tour operator through whom you booked and paid for your stay and additional services, or event organizers. They have contracts with us for the processing of personal data as joint controllers or as a controller and processor, so that the protection of your personal data in these cases is also in accordance with REGULATION (EU) 679/2016 as legal obligation of both parties towards you..

Sharing of personal data

In our efforts to offer you the best experience and the highest quality products and services at Family Hotel Oasis, we may need to share information with service providers and our business partners for overlapping purposes or with your explicit consent. with whom we have an agreement in accordance with Regulation (EU) 679/2016 on the protection of personal data. For example, when planning a group event or meeting, information is collected that may be shared with the organizers and/or our business partners whose products or services would improve your experience at our complex.

The sharing of information with our complex, catering services, or other cases such as “concierge” or external service providers is also only for overlapping purposes or with your consent and is in accordance with the principles of Regulation (EU) 679/2016.

In all other cases, information is only shared as required by law and with the relevant officials, such as those required by the Tourism Act.

Family Hotel Oasis does not transfer personal data outside the country.

Protection of personal data

Definitions

According to Article 4 of Regulation 679/2016:

1) “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific as to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

2) “processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organizing, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

3) “restriction of processing” means marking stored personal data with the aim of limiting their processing in the future;

4) “profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to the evaluation of aspects concerning the performance of a natural person’s professional duties, or to the evaluation of aspects concerning the natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

5) “pseudonymization” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without using additional information, provided that the personal data are not stored in a way that allows the personal data to be linked to another data subject without using additional information, and that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not linked to an identified or identifiable natural person;

6) “personal data file” means any structured set of personal data accessible according to specific criteria, whether centralized, decentralized, or distributed according to a functional or geographical principle;

7) “controller” means a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its determination may be laid down by Union law or the law of a Member State;

8) “personal data processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller;

9) “recipient” means a natural or legal person, public authority, agency, or other body, to which personal data are disclosed, whether a third party or not. At the same time, public authorities that may receive personal data in the course of a specific investigation in accordance with Union or Member State law shall not be considered “recipients”; the processing of such data by those public authorities shall be subject to the applicable data protection rules in accordance with the purposes of the processing;

10) “third party” means a natural or legal person, public authority, agency, or other body, other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or the processor, are authorized to process personal data;

11) “consent of the data subject” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

12) “personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed;

13) “genetic data” means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physical or health characteristics or about the natural characteristics of that natural person, and which are obtained, in particular, from an analysis of a biological sample from the natural person concerned;

14) ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of a natural person, such as facial images or fingerprints;

15) “health data” means personal data related to the physical or mental health of a natural person, including the provision of health services, which reveal information about his or her health status;

Principles

According to Article 5 of Regulation 679/2016, the principles are complied with when:

Paragraph 1.

Personal data is:

  1. a) processed lawfully, fairly, and in a transparent manner in relation to the data subject (“LAWFULNESS, FAIRNESS, AND TRANSPARENCY”);

b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, for scientific or historical research purposes or statistical purposes shall not be considered incompatible with the initial purposes pursuant to Article 89(1) (“PURPOSE LIMITATION”);PURPOSE LIMITATION

c) appropriate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“DATA MINIMIZATION”);

d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that inaccurate personal data are erased or rectified in a timely manner, taking into account the purposes for which they are processed (“ACCURACY”)

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, for scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the appropriate technical and organizational measures to safeguard the rights and freedoms of the data subject (“STORAGE LIMITATION”);

e) processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (“INTEGRITY AND CONFIDENTIALITY”).

Paragraph 2.

The administrator is responsible for and is able to demonstrate compliance with paragraph 1 (“ACCOUNTABILITY”).

Rights of data subjects

  1. Data subjects have the following rights with regard to the processing of data and the data recorded about them:

To request confirmation as to whether personal data relating to them is being processed and, if so, to obtain access to the data and information about the recipients of the data.

To request a copy of their personal data from the ADMINISTRATOR;

To request the ADMINISTRATOR to correct personal data when it is inaccurate or no longer up to date;

To request the ADMINISTRATOR to delete PERSONAL DATA COLLECTED ON THE BASIS OF CONSENT (the “right to be forgotten”);

To request the ADMINISTRATOR to restrict the processing of personal data when there are legitimate grounds for doing so, in which case the data will only be stored but not processed;

To lodge a reasoned objection to the processing of their personal data;

To lodge a complaint with the supervisory authority (the Personal Data Protection Commission) if they believe that any of the provisions of Regulation (EU) 679/2016 have been violated;

To request and receive their personal data in a structured, commonly used, and machine-readable format, where the means and formats for doing so are regulated in our internal regulations;

When personal data is processed on the basis of consent, to withdraw consent to the processing of personal data at any time by means of a separate request addressed to the controller;

Not to be subject to automated decisions that significantly affect him/her, without the possibility of human intervention;

To object to automated profiling that takes place without his or her consent.

  1. The ADMINISTRATOR shall provide conditions to ensure that the data subject can exercise these rights:

Data subjects may make requests for access to data, and the ADMINISTRATOR shall ensure that the response to the data subject’s request complies with the requirements of the General Regulation.

Data subjects have the right to lodge complaints with the ADMINISTRATOR regarding the processing of their personal data.

Responsibility

According to Article 24 of Regulation 679/2016

Responsibility of the controller “Family Hotel Oasis”

Paragraph 1.

Taking into account the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organizational measures to ensure and be able to demonstrate that processing is performed in accordance with this Regulation. These measures shall be reviewed and, if necessary, updated. Paragraph 2

Paragraph 2.

Where proportionate to the processing activities referred to in paragraph 1, the measures referred to in paragraph 1 shall include the implementation by the controller of appropriate data protection policies.

Paragraph 3

Adherence to approved codes of conduct or approved certification mechanisms may be used as an element of proof of compliance with the obligations of the controller.

This paragraph will be implemented by “Family Hotel Oasis” as soon as sectoral policies and/or certification in the hotel and restaurant industry are approved!

Joint processing

To ensure maximum security and comfort for our guests, when working with tour operators and/or other partners involved in the provision of information and/or services by them, “Family Hotel Oasis” always concludes contracts/agreements for the processing of personal data in accordance with Regulation 679/2016