Information about personal data processing terms according to Article 13 of the EU Parliament and EU Council Regulation (EU) 2016/679 on Protection of Physical Individuals during Personal Data Processing and Free Data Movement (hereinafter the „Regulation“) in compliance with § 19 of Act No. 18/2018 Coll. on Personal Data Protection (hereinafter the „Act“).

Operator: 

Hotel Château Belá, s.r.o., registered office at Belá 1 943 53 Belá, company ID: 43999174, incorporated in the Company Register kept at the District Court Nitra, Section: Sro, File No. 21917/N.

Operator´s contact data: tel. no. +421 36 7577 600, email: reception@chateau-bela.com.

Contact data of a person responsible for personal data processing surveillance: admin@chateau-bela.com

You are a person affected within the processing of your personal data, i.e. a person to whom the personal data processed by us relate. 

Affected persons´ rights:

Right for access to personal data 

i.e. right to obtain confirmation from a competent person, whether personal data of a person affected that has exercised his/ her right are processed, as well as the right to access the personal data. As a person affected, you are entitled to access your information about: the purpose of data processing, the category of affected personal data, the circle of data recipients, the time of processing and storage, method of every single automatic data processing, etc. also the effects of such personal data processing, etc. (Article 15 of the Regulation). As the Operator, we have the right to adopt all reasonable measures to verify the identity of the affected person that has applied for access to personal data, especially with online services and identifiers. Based on the affected person´s request, the Operator shall issue a confirmation on whether personal data of the affected person that relate to him/ her are processed. If the Operator processes such data, he shall issue a copy of the affected person´s personal data upon request. Issuance of the first copy is free of charge. The Operator shall charge every subsequent copy of the data requested by the person with the amount corresponding to the administrative cost incurred to the Operator with such copy-making. If a person affected requested the information via email, the information shall be provided to her/him in a commonly used electronic form – email, unless he/she

requested another form of information. 

Right for restricted data processing  

can be exercised if you, as a person affected, have contested the correctness of the personal data and other requirements according to Article 18, recital 67 of the Regulation, in the form of the temporary transfer of selected personal data to another processing system, restricted access of the users to the selected personal data, or temporary cancellation of such data processing.

Right for correction

if the Operator keeps incorrect personal data of the person affected. As well, the person affected has the right to completion of incomplete personal data. The Operator shall provide for correction or completion of personal data without unnecessary delay upon the affected person´s request. 

Right for deleting

or „forgetting“ personal data associated with the affected person. Taking into account its nature and significance, this right of the affected person is limited by the specification of further preconditions, i.e. as soon as the right was exercised by the affected person, the Operator shall delete the personal data, provided that at least one of the following preconditions was met: a) personal data are not necessary anymore for the purposes they have been obtained or otherwise processed; b) the person affected has withdrawn the consent that gave the basis to personal data processing; c) the person affected raised objection against personal data processing; d) personal data have been processed illegally; e) fulfillment of a legal duty, special regulation or international agreement that the Slovak Republic is bound by, or is a reason of personal data deleting, or f) personal data have been obtained in relation with the information company service offer to a person younger than 16 years of age. 

The person affected shall not have the right for deleting personal data if the data processing is required for: a) exercising the right for freedom of expression and information; b) fulfillment of an obligation according to the law, special regulation, or international agreement that the Slovak Republic is bound by, or fulfillment of task performed in the public interest or during the execution of public power entrusted to the Operator; c) for purposes of public interest in the area of public health; d) for purposes of archiving in the public interest,for purposes of scientific or historical research or statistical purposes, if the right for deleting will likely disable or seriously complicate reaching of the goals of such processing or e) for purposes of confirmation, enforcement, or defense of legal claims. 

The Operator shall delete the personal data of the persons affected upon their request without necessary delay as soon as he considers the affected person´s request as reasonable. 

Right for proposal of the initiation of the proceedings

The affected person has the right to propose the initiation of the proceedings at the Office of Personal Data Protection of the Slovak Republic if he/ she supposes that his/her rights in the area of personal data protection were impaired.

Right for raising objection

The affected person has the right to raise objections against personal data processing at any time for reasons related to a particular situation. The affected person has the right to object to personal data processing based on a) legal title for the fulfillment of tasks in the public interest or during the execution of public power, or legal title of the Operator´s legitimate interest; b) personal data processing for purposes of direct marketing; c) personal data processing for purposes of scientific or historical research or statistical purposes. The submitted objection shall be reviewed within a reasonable period. In this case, we shall not continue in further personal data processing if we haven´t proved the necessary legitimate interest in personal data processing that would prevail the rights or interests of the person affected or the reasons for exercising the legal claim.

Right for personal data transferability 

As a person affected, you have the right to request from your Operator to transfer the personal data provided to him to another operator in a commonly used and machine-readable format, provided that your data were obtained based on consent conferred by the person affected, or based on contract, and such personal data are processed via automated means.

The purpose of personal data processing refers to the reason why the Operator processes personal data of persons affected in the information systems, based on applicable law. Every single personal data processing is based on particular legal regulations and for a particularly specified, authorized, and expressly stipulated purpose. 

- as an Operator, we adopted adequate personal, organizational, and technical measures to ensure maximum personal data protection. We aim to avoid or reduce the risk of leakage, misuse, publishing, or other use of your data to the maximum possible extent. If a situation occurred that would likely result in high risk for the rights and freedoms of physical individuals, you will be immediately contacted as a person affected (Article 34 of the Regulation).

- In the sake of maintaining the principles of personal data processing stipulated in the Regulation, as well as the Act, especially the principles of personal data minimizing, you as a person affected are required to provide us only with personal data within the necessarily required legal or contract extent to fulfill the the purpose of personal data processing. We want to make you aware that failed provision of such required personal data extent for purpose of contract conclusion could result in the failed conclusion of the contract.

Purposes of personal data processing, legal basis, categories of data recipients, period of personal data storage, and categories of persons affected classified in particular information systems: 

Client's registration

Purpose of personal data processing: Personal data of physical individuals – clients as registered clients are processed in the stated information system with the ordering of services or the goods provided by the Operator, for the purpose of keeping the clients´ records and the lists of the Operator´s contacts. 

Legal basis: Consent conferred by a person affected according to Article 6, clause 1, item a) of the Regulation, and to the Personal Data Protection Act provided that the affected person has the right to withdraw the consent conferred at any time. Withdrawal of consent shall not affect the legal nature of personal data processing resulting from the consent before its withdrawal.  

Categories of recipients: the state administration, public power, and public administration bodies in compliance with applicable legal regulations, authorized employees, an attorney in law.

Personal data deleting deadline: 5 years

Categories of persons affected: physical individuals – clients.  

Contract relations – clients as physical entities

Purpose of personal data processing: Personal data of physical entities – clients as registered clients are processed in the stated information system with the ordering of services or the goods provided by the Operator based on the order placed by phone, email, or via an order form on the website.

Legal basis: Contract relation established between the Operator and customer through confirmed order or concluded contract within the Operator´s business activity subject, permitted by the Constitution of the Slovak Republic, Civil Code, Commercial Code (Act No. 455/1991 Coll.), Trade Act, and related legal regulations /Article 6 clause 1 item b) /. Processing of personal data of a physical entity – the customer is necessary for the purpose of fulfillment of the contract subject that the affected person – the customer is a contracting party of.

Categories of recipients: the state administration, public power, and public administration bodies in compliance with applicable legal regulations, authorized employees, an attorney in law.

Personal data deleting deadline: 5 – 10 years

Categories of persons affected: physical entities – clients. 

Marketing

Purpose of personal data processing: Conducting of marketing survey and provision of information to a person affected by the Operator. It is a provision of information associated with the offer of the goods and services of the Operator or his business partners, including distribution of information on various discounts, products, and activities, as well as distribution of business notices via electronic means – post/e-mail/phone contact to the contact data stated by the person affected. 

Legal basis: Consent conferred by a person affected according to Article 6, clause 1, item a) of the Regulation, and to the Personal Data Protection Act provided that the affected person has the right to withdraw the consent conferred at any time. Withdrawal of consent shall not affect the legal nature of personal data processing resulting from the consent before its withdrawal. 

Categories of recipients: authorized employees, an attorney in law.

Personal data deleting deadline: 5 years

Categories of persons affected: physical individual – a person interested that has expressed the interest in the marketing information.

Operator´s promotion – documentation from promotion events

Purpose of personal data processing: The purpose of personal data processing refers to the promotion of the Operator and his activities. Photos and sometimes also a video – record is made from the event that a person affected is a participant of the other participants, interesting moments and activities. The photos or video – records can be published on the official Operator´s website or his social networks´ profiles – so-called fun pages.

Legal basis: Legitimate interest according to Article 6, clause 1, item f) of GDPR. The primary interest is to promote the Operators to increase awareness of their activities and non-earning activities performed on own cost. Publishing of photos does not impair the serious nature, dignity, and safety of persons affected; the persons affected have the right to express their interest/ lack of interest in publishing the photos directly at the event venue or via email.

Categories of recipients: authorized employees, an attorney in law, a visitor of the official Operator´s website, and a marketing agency.

Personal data deleting deadline: 5 years

Categories of persons affected: employee, the public attending the organized event

Camera system monitoring public–accessible premises  

Purpose of personal data processing: The purpose of personal data processing within the agenda in question refers to the monitoring of public–accessible premises aimed at protecting health and property.

Legal basis: Legitimate interest according to Article 6, clause 1, item f) of the Regulation. Primary legitimate interest refers to the protection of property and safety of the Operator and persons affected.

Categories of recipients: public power bodies according to applicable legal regulations, insurance companies, the Police Corps, authorized employees, attorneys in law.

Personal data deleting deadline: 15 days after the video – record preparation. 

Categories of persons affected: physical individuals who entered the Operator´s premises that are accessible by the public, and the public itself. 

Verification of the client's age

Purpose of personal data processing: The purpose of personal data processing within the agenda in question refers to the fulfillment of the duties of the person obliged as they result from Act No. 219/1996 Coll. on Protection against Alcoholic Beverages Misuse and Establishment and Operation of Anti-Alcoholic Drunk- Tanks as amended, from Act No. 377/2004 Coll. on Protection of Non-Smokers as amended, and from Act No. 30/2019 Coll. on Gambling as amended. To fulfill these duties, the Operator has the right to require from the physical individual – client to present his/ her citizen ID card or submit further documents according to the above-cited Acts.

Legal basis: Act No. 219/1996 Coll. on Protection against Alcoholic Beverages Misuse and Establishment and Operation of Anti-Alcoholic Drunk- Tanks as amended, from Act No. 377/2004 Coll. on Protection of Non-Smokers as amended, and from Act No. 30/2019 Coll. on Gambling as amended; related laws (e.g. in the form of reference below the line). 

Categories of recipients: authorized employees, an attorney in law.

Personal data deleting deadline: Immediately after reaching the purpose or conclusion of related proceedings (e.g. resulting from the Slovak Police Corps intervention, inspection by affected authorities, etc.).

Categories of persons affected: the Operator´s clients – physical individuals.

Registration of accommodated guests

Purpose of personal data processing: The purpose of personal data processing within the agenda in question refers to service provision in the area of accommodation, including pre-contract relations with persons accommodated. Following the accommodation contract conclusion, the main purpose refers to the registration of accommodated guests (keeping the guestbook) according to applicable legal regulations.

Legal basis: Act No. 253/1998 Coll. on Reporting of Stay of Slovak Citizens and Register of Slovak Citizens as amended; Act No. 582/2004 on Local Taxes and Local Charges for Municipal Waste and Small Building Waste as amended; generally binding legal regulation of the affected municipality/ village; fulfillment of the contract according to Article No. 6, clause 1, item b) of GDPR.

Categories of recipients: public administration, public power, and the state administration bodies according to applicable legal regulations, authorized employees, an attorney in law.

Personal data deleting deadline: according to Registration Order – 5 years 

Categories of persons affected: accommodated guests, persons interested in accommodation.

Registration of foreign nationals

Purpose of personal data processing: The purpose of personal data processing within the agenda in question refers to the fulfillment of the Operator's duties according to § 111 Act No. 404/2011 Coll. on the Stay of Foreign Nationals as amended, with the fact that the Operator provides for accommodation also of guests – foreign nationals. For this purpose, personal data of foreign nationals within the due extent shall be entered in the guestbook.

Legal basis: Act No. 404/2011 Coll. on the Stay of Foreign Nationals as amended, with the fact that the Operator provides for accommodation also of guests – foreign nationals. For this purpose, personal data of foreign nationals within the due extent shall be entered in the guestbook.

Categories of recipients: public administration, public power, and the state administration bodies according to applicable legal regulations, authorized employees, an attorney in law.

Personal data deleting deadline: according to Registration Order – 5 years 

Categories of persons affected: accommodated guests – foreign nationals.

Registration of declared cost

Purpose of personal data processing: The purpose of personal data processing within the agenda in question refers to the declaration of the cost incurred to the Operator during accommodation provision.

Legal basis:  Legitimate interest according to Article 6, clause 1, item f) of the Regulation. Primary legitimate interest refers to the protection of property and financial interest of the Operator.

Categories of recipients: authorized employees, an attorney in law.

Personal data deleting deadline: according to Registration Order – 5 years 

Categories of persons affected: accommodated guests – physical individuals.

Registration of customers´ suggestions/ complaints 

Purpose of personal data processing: The purpose of personal data processing within the agenda in question refers to the Operator´s interest in the increase of quality of the offered services and solution of any customer complaints. For this purpose, the customer has the right to make a suggestion or file a complaint in the way that he/she was notified.

Legal basis: Personal data processing is necessary for the solution of a suggestion/ complaint. Legal basis refers to the fulfillment of duties resulting from the contract.

Categories of recipients: authorized employees, an attorney in law.

Personal data deleting deadline: according to the Registration Order.

Categories of persons affected: Customers who made a suggestion or filed a complaint.

Personal data transfer to a non- EU country/ international organization 

Personal data shall not be transferred to a non- EU country/ international organizations.

Profiling

The Operator does not process personal data through profiling or a similar method based on automated individual decision–making. 

In case of any questions related to the processing of your personal data, please contact us via our responsible person for these issues.