We hereby advise that we process your personal data. The details of how we do it can be found below.
I. The Controller of personal data.
Jerzy Donimirski, conducting a business activity under the name: Donimirski Pałac Pugetów Business Center (“DPPBC”) with headquarters in Kraków, ul. Starowiślna 13, entered into the Business Activity Central Register and Information Record (CEIDG), Tax Identification (NIP) No. 6760050538, is the Controller of your personal data.
II. Objectives and basis of data processing.
In order to conclude a contract of purchase/sale based your interest in the offer of DPPBC, (legal basis: Art. 6.1.a of GDPR). In order to carry out and under the contract concluded between you and DPPBC (legal basis: Art. 6.1.b of GDPR). In order to meet a justified interest of DPPBC, which includes:
- the protection of rights, enforcement of contracts and obtaining due remuneration under said contracts, pursuing claims related to the implementation of hotel services and defence of claims of the other party against DPPBC, drawing up and archiving documentation of the implementation of the contract,
- documentation of the implementation of the service for tax purposes, providing the highest quality of service for hotel guests,
- in the case when you have expressed your consent for the processing of personal data for marketing purposes, DPPBC processes personal data for this purpose, i.e. in order to provide the guest with marketing information and offers about its products and services, establishing and reinforcing business relationships (legal basis: Art. 6.1.f of GDPR).
In the case in which you have expressed your consent to receive the newsletter, your email address will be used to receive newsletters. The newsletter will be sent to you with a frequency selected by the marketing department, so as to ensure that you have access to up-to-date information about the offer and activity of DPPBC and other information about the areas of activity of DPPBC (legal basis: Art. 6.1.a of GDPR).
If you fill the contact form or submit your inquiry in another form (e.g. e-mail, telephone, social network), you agree to be contacted in association with the implementation of your request or query (legal basis: Art. 6.1.a of GDPR).
Personal data of guests are collected by the hotel monitoring system (video surveillance) in order to ensure the correct implementation of the services, among others, by ensuring the safety of hotel guests and other individuals on DPPBC premises, protecting the vital interests of guests and protecting the vital interests of other individuals, as well as the justified purpose of the controller. (legal basis: Art. 6.1.f of GDPR).
In the case in which we carry out a contract or order or other service for your benefit, we will also process personal data contained in the invoices, accounting books or other documentation confirming the conclusion and performance of the contract, in order to prepare and store documents in accordance with applicable laws. e above applies to a situation in which you are a party to the contract or order, and to a situation in which your employer or entity with which you cooperate is a party to the contract or order, or when any service (e.g. a hotel reservation) has been made in your benefit. (legal basis: Art. 6.1.c of GDPR).
III. Categories of your data which we process.
DPPBC will process the following categories of your data:
* Basic identification data: Electronic identification data, financial identification data, data relative to your place of residence.
IV. Recipients of the data.
DPPBC can disclose your personal data to the following categories of entities:
Contractors, or entities which DPPBC uses in data processing, i.e. accounting firms, law firms, companies providing IT support services to DPPBC and the hotel, and providing IT soware, transportation and taxi companies in the situation in which the guest orders transportation or a courier shipment,
V. Disclosing data to third countries or international organisations.
DPPBC does not disclose your data outside the EU, Norway, Liechtenstein, and Iceland.
VI. Data retention period
Your data obtained with the purpose of concluding a contract shall be kept by DPPBC throughout the period of contract negotiation, and until the end of the period of the limitation of potential claims from the contract.
Your basic contact details are kept by DPPBC for the purpose of direct marketing of its products and services, until you raise an objection with respect to their processing in order to do this, until you withdraw your consent, if DPPBC has been processing data based on the so-called marketing consent, or until DPPBC alone determines that the data have become obsolete.
Your data obtained in connection with video surveillance will be processed for 30 days from the date of recording, and subsequently it will be permanently deleted.
VII. Your rights.
You are entitled to:
- the right of access to your data and obtain copies thereof,
- the right to rectify (amend) your data,
- the right to erase data – if in your opinion there is no reason for DPPBC to process your data, you can ask that DPBC erase them,
- the right to restrict data processing – you can request that DPPBC restrict the processing of your personal data to solely their storage or performing actions agreed upon with you; if you believe think that DPPBC has invalid data regarding you or processes them unduly, or if you do not want DPPBC to erase them, because they are needed to determine, pursue or defence claims, or for the time of objecting to data processing filed by you,
- the right to object to data processing:
a. “Marketing” objection. You have the right to object to the processing of your data for the purposes of direct marketing. If you do exercise this right – we will stop processing the data for this purpose.
b. Objection due to a particular situation. You also have the right to object to the processing of your data based on a legitimate interest for purposes other than direct marketing, and also, where the processing is necessary for us for the performance of a task carried out in the interest of the public or to exercise a public authority entrusted to us. In such case, you should indicate to DPPBC the specific situation that you believe justifies ceasing data processing by DPPBC under your objection. DPPBC will no longer process your data for these purposes, unless DPPBC demonstrates that the basis of our processing of your data takes precedence to your rights, or that your data are necessary for DPPBC to determine, pursue or defend claims. - the right to transfer data – you have the right to receive from us personal data concerning you which you have provided us with under a contract or your permission, in a structured, widely-used machine-readable format.
You can also request that we send said data directly to another entity, - the right to lodge a complaint with a supervisory authority – if you believe that we process your data in violation of the law, can you make a complaint about it to the President of the Office for Personal Data Protection or other competent supervisory authority,
- the right to withdraw the consent to the processing of personal data – you have the right to withdraw at any time the consent for the processing of these personal data which DPPBC processes based on your consent. Withdrawal of consent will not affect the lawfulness of the processing which was made based on your consent prior to its withdrawal.
In order to execute your rights, you send your request to the email address: daneosobowe@donimirski.com or call the phone number + 48 122613838, address: Parkowa 11, Kraków. Before the execution of your rights, DPPBC will have to identify you accordingly.
VIII. Information about the required/voluntary providing of data information.
You providing data is a condition of concluding the contract.
If you do not provide your data, DPPBC shall refuse to enter into the contract.
In the case of data collected in the field of purchasing, sales or marketing activities – providing of data is completely voluntary and the consequence of not providing them may be that there will be no way to contact you in the future.
In the case of online forms – providing of data is voluntary, however, failing to provide the data indicated as mandatory (required) results in the inability to submit the form and, as a consequence, depending on the type of form, in the inability to download the file, participate in an event or subscribe to the newsletter.
IX. Information about the data source – only in the case where the data comes from another person.
Your data can be obtained from sources which are available to the public, i.e., among others, from the Register of Entrepreneurs of the National Court Register (KRS), the Business Activity Central Register and Information Record (CEIDG), and the Main Statistical Office (GUS).
We can obtain contact data directly from the person to whom these data pertain (e.g. via online forms), or through other persons (e.g. from the employer, another employee, or another entity with whom a given person remains in constant cooperation). The present Information on the processing of personal data by DPPBC is a document whose character is purely informative, and it is made public in order to carry out the information obligations under the GDPR .