Privacy Policy

1. GENERAL PROVISIONS

​

1. 1. This Privacy Policy is for information purposes only, which means that it does not create any obligations for the Service Recipients, Guests, Trading Partners, or Visitors. The Privacy Policy primarily contains rules concerning the processing of personal data by the Controller, including the bases, purposes and scope of personal data processing and the rights of the data subjects.

1.2. The Controller of personal data collected via: https://hik.krakow.pl, Social Media and directly from Guests visiting our Hotel is: GEMO Sp. z o.o. with its registered office in Krakow, Wielopole 4, 31-072 Krakow, hereinafter referred to as the Hotel.​

 

Hereinafter referred to as the “Controller” or ”HOTEL”

• postal address: ul. Wielopole 4, 31-072 Krakow,

• phone (+48.6190000)

​

1.3. We have appointed a Data Protection Officer, Dorota Gross, who can be contacted regarding the protection of your data and the handling of related matters by email: dpo[at]hik.krakow.pl, in writing to the address of our registered office as indicated in clause 1.2.

1.4. The use of the Controller's Websites is voluntary. The same applies to the provision of data necessary for the conclusion of Contracts, including contracts for the supply of services within the scope of the Controller's business. The provision of personal data in this case is a contractual requirement and if the data subject wishes to conclude a given contract with the Controller, he/she is obliged to provide the required data. Generally applicable laws impose an obligation on the Controller to process personal data (e.g. to process data for the purpose of maintaining tax or accounting records), and failure to provide such data will prevent the Controller from fulfilling those obligations.

1.5. The Controller takes special care to protect the interests of the persons whose personal data it processes, and in particular is responsible for ensuring, and ensures, that the data it collects are: (1) processed lawfully; (2) collected for specified, legitimate purposes and are not further processed in a way that is incompatible with those purposes; (3) accurate and relevant to the purposes for which they are processed; (4) kept in a form that permits identification of the data subjects and for no longer than is necessary to achieve the purpose of the processing; and (5) processed in a manner that ensures adequate security of personal data, including protection against unauthorised or unlawful processing and

accidental loss, destruction or damage, by appropriate technical or organisational means.

1.6. Having regard to the nature, scope, context and purposes of the processing and the risk of interference with the rights or freedoms of natural persons of varying probability and seriousness, the Controller implements appropriate technical and organisational measures to ensure that the processing is carried out in accordance with the Regulation and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Controller applies technical measures to prevent the acquisition and modification by unauthorised persons of personal data transmitted electronically.

​

​

2. THE PURPOSE, BASIS AND DURATION OF PROCESSING

​

2. 1. Activities relating to personal data processing:

• registration and service of guests,

• management of systems and services,

• data verification,

• pursuance of claims in respect of the Controller’s business activities,

• preservation of information in case of legal necessity to prove the facts,

• fulfilment of tax obligations, including the bookkeeping obligation,

• provision of marketing services,

• ensuring the highest quality of the provided services, conducting video surveillance.

​

2.2. In each case, the purpose, basis, duration and scope of processing and the recipients of the personal data processed by the HOTEL result from the actions taken by you in relation to the services or activities listed below.

​

Purpose of data processing:

GUEST REGISTRATION

Basis of processing and data retention period: 

Art. 6(1)(b) OF THE GDPR - CONTRACT/ACCEPTANCE OF HOTEL RULES AND REGULATIONS on the basis of the Civil Code.
Data are stored for a period of 6 years. 

Activities aiming to identify and register the Guest in order to provide the service.

Maximum scope of data processing: 

HOTEL REGISTRATION CARD:

Forename, surname, residential address, telephone number, email address.

 

Purpose of data processing:

PROVISION OF SERVICES

Basis of processing and data retention period: 

Art. 6(1)(b) OF THE GDPR - CONTRACT on the basis of the Civil Code.
Data are stored for a period of 6 years.

Activities aiming to ensure the performance of the contract or taking of actions prior to the conclusion of the contract.

Maximum scope of data processing:  

CONTRACT/PURCHASE ORDER:

Forename and surname or name of the Trading Partner, address, contact details.

​

Purpose of data processing:

BILLING FOR SERVICES

Basis of processing and data retention period: 

Art. 6(1)(c) OF THE GDPR -  LEGAL OBLIGATION on the basis of the Accounting Act.

Data are stored for a period of 6 years.

Activities relating to billing for the provided services.

Maximum scope of data processing: 

INVOICES AND BILLS:

Forename and surname, address, company name/registered office, Tax Identification Number (NIP), value and date of service.

​

Purpose of data processing:

MARKETING

Basis of processing and data retention period: 

Art. 6(1)(f) - LEGITIMATE INTEREST
Data are stored for up to 6 years or as long as the Controller's legitimate interest exists in connection with marketing activities.

Maximum scope of data processing: 

MAIL: IP address, forename and surname, telephone number, email address.

​

Purpose of data processing:

PURSUANCE OF RIGHTS

Basis of processing and data retention period: 

Art. 6(1)(f) OF THE GDPR - LEGITIMATE INTEREST
Data are stored until the rights or claims relating to the performance of the services expire.

Maximum scope of data processing: 

DOCUMENTATION: Data necessary for the proceedings

​

Purpose of data processing:

OPINIONS OF THE GUESTS

Basis of processing and data retention period: 

Art. 6(1)(f) OF THE GDPR - LEGITIMATE INTEREST

Data are stored for up to 30 days or until an objection is made to the processing of those data.

The satisfaction survey is conducted on the basis of the consent given, on the hotel registration card, where the Provision of Services by Electronic Means Act of 18 July 2002 serves as the legal basis, in connection with the tasks carried out and the legitimate interests of the Hotel.

Maximum scope of data processing: 

SURVEY: Forename and surname, telephone number, email address

​

Purpose of data processing:

VIDEO SURVEILLANCE

Basis of processing and data retention period: 

Art. 6(1)(f) OF THE GDPR - LEGITIMATE INTEREST
Video surveillance data are stored for a maximum of 10 days.

The video surveillance covers the hotel premises in order to protect the persons and property therein.

Maximum scope of data processing: 

IMAGE RECORDING: Data from video surveillance on the premises of the HOTEL.

​

Purpose of data processing:

CORRESPONDENCE

Basis of processing and data retention period:  

Art. 6(1)(f) OF THE GDPR - LEGITIMATE INTEREST

Maximum scope of data processing: 

MAIL, LIST:

Identification data, forename and surname, postal address, email address, IP address, data from correspondence.

​

• The data are permanently deleted or anonymised after the end of the aforementioned periods.

​

2.3 Legislation:

​

Personal data are processed by the Controller in accordance with the applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) - hereinafter referred to as the “GDPR” or “GDPR Regulation”. The official text of the GDPR Regulation: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679

 

• The Hotel Services and Services of Tour Managers and Tourist Guides Act of 29 August 1997;

• The Provision of Services by Electronic Means Act of 18 July 2002;

• The Accounting Act of 29 September 1994;

• The Civil Code Act of 23 April 1964;

• The Goods and Services Tax Act of 11 March 2004;

• The Telecommunications Law Act of 16 July 2004;

• The Consumer Rights Act of 30 May 2014;

• The Personal Data Protection Act of 10 May 2018;

• Hotel and car park rules and regulations; 

• Regulation (EU)2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data and repealing Directive 95/46/EC (GDPR).

​

​