The Informative Text on Processing Personal Data for CPI Hotels, a.s. clients
This page provides all the essential details required under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the “GDPR”) regarding your personal data as processed by CPI Hotels, a.s., ID No.: 47116757, with registered office at Bečvářova 2081/14, 100 00 Prague 10, registered in the Commercial Register at Prague Municipal Court, under file No. B 1914 (“CPI Hotels” or simply “us”).
CPI Hotels is represented on the market by the following brands: Budha-Bar Hotel Prague, Clarion Hotels, Quality Hotels, Comfort Hotels, Mamaison Hotels & Residences, Spa & Kur Hotels, Holiday-Inn, Fortuna Hotels, Private Label Hotels, Ubytovny.cz and Benada Restaurant.
1. What data do we process?
A) Client data
Based on your reservation (or a stay without a reservation), we process our clients’ personal data in the following scope:
- identification and contact details (first and last name, permanent residential address, identification card number or number of a similar document, as well as e-mail address and phone number),
- in the case of entrepreneurs, we also record their identification, their registered office, registration number, tax ID number and any pertinent VAT-related data,
- for business trips performed by non-entrepreneurs, we also record details of the organisation that reserved or paid for their stay),
- details about the purpose of the trip, specifically if the client is a person subject to spa or recreation fees,
- information about your membership in the loyalty program,
- details concerning your stay and the services you use, as well as the amount and method of payment for such provided services (a bank account number or payment card details if non-cash payment is made),
- in the case of foreign nationals, the data above is expanded to include their date of birth, nationality, the number of their passport or travel document, visa number and permanent residential address abroad,
- the registration plates of vehicles of those guests who park at our hotels are also recorded.
In our Spa & Kur Hotels, we provide spa treatments in addition to accommodation. If such services are used, we will process the following data in addition to that specified above:
- data related to your diagnoses obtained directly from you by our physician during your initial medical exam,
- details of the medical procedures provided to you at our facilities during a treatment stay (medical exam, any medical complications occurring during your stay, etc.)
B) Photographic documentation from organised events
We obtain a reasonable amount of photographic documentation (situational shots of the events) of events we organise, for the purpose of subsequent publication of selected photographs on our website for the promotional purposes of CPI Hotels. Such activity is not primarily focused on showing the visitors to a specific event, but rather depicting the overall atmosphere of the event; such photos are not published in any detailed resolution, and we do not attach any descriptions identifying specific persons attending events. According to the Office for Personal Data Protection, this is not an issue of personal data protection, but falls under protection of personal privacy under the Civil Code; in such cases, consent to personal data processing is not required for such “illustrative” images.
Those in attendance are warned of the fact that photographic documentation is being taken by a camera pictogram, our photographers are clearly identified at all times, and photographic documentation is only taken at the main venue of the event; visitors always have the option to remain in areas where no photographic documentation is taken. Please do not hesitate to contact us using any of the contact information provided below if you have any questions or concerns.
2. On what basis and for what purpose do we process your personal data?
A) Processing necessary to comply with legal obligations
Provision and processing all of the above personal data, with the exception of an e-mail address and phone number and any information concerning your membership in a loyalty program, is necessary for fulfilment of our legal obligations, especially those under the Act on Local Fees and the Act on the Residence of Foreigners in the Czech Republic, and also under accounting and tax regulations.
B) Processing necessary to fulfil a contractual arrangement
The processing of your identification details and details concerning your stay and the provided services, and the amount and method of their payment, is necessary for the purpose of fulfilling the contractual arrangement concerning your stay, and specifically your order and reservation, the conclusion and fulfilment of any contracts concerning the offered and provided accommodation, catering and related services.
In the case of spa treatments, we process the data provided on the registration card, details about any spa stays you have undertaken and medical procedures provided to you at our facilities, as well as data concerning payment for your stay. We process this data on the basis of the legal arrangement between you and CPI Hotels covering spa treatment and rehabilitation care and related services (accommodation, catering, etc.). The purpose of such processing is to provide these services.
C) Consequences for failure to provide data
If you do not provide the data specified above, we cannot provide you with our accommodation services. We do not need any personal data to provide you with catering and other services, and therefore we do not collect or process such data for these purposes.
D) Processing necessary on the grounds of a legitimate interest
Your personal data in the scope of your full name, e-mail address and information concerning your stay is processed on the basis of our legitimate interest for the purposes of direct marketing; the purpose of such processing is exclusively the ability to send you marketing and other business-related materials and specifically information regarding interesting news, discounts, etc..
We also process personal data in this scope for the purposes of sending out satisfaction questionnaires after stays in our hotels to verify your satisfaction with our services and to consistently improve the quality of the services we provide you.
Our guests do not question the services or spa treatment services provided at our hotels. If such a circumstance were to occur, we would be forced to process data from such provided services in the scope necessary to resolve this dispute and specifically for the purposes of protecting our rights in such a dispute. Processing of specific data if no payment was made for our services or if you caused us damage would likewise be necessary.
E) Processing based on consent
Based on your consent or configuration of permissions used by the application in your web browser, we process technical information obtained during visits to our websites; see the separate disclaimer available at www.cpihotels.com/cs/cookies.
We offer our clients a Wi-Fi network service, whereas you have the option of choosing from a paid connection or a free connection. If you choose to use the free connection, you will be informed in advance that CPI Hotels will use data about your e-mail address exclusively for the purposes of sending marketing communications in order to keep you informed of interesting news, discounts, etc. You may opt out of such materials and unsubscribe from marketing communications.
You may withdraw your consent at any time by sending a letter with an explicit statement of withdrawal of your consent to our address (CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10), or our email address email@example.com, or using the contact form at www.cpihotels.com; another option is to change your web browser settings. This withdrawal of consent takes effect at the moment it is delivered to CPI Hotels. Under the GDPR, withdrawal of consent has no prejudice on the lawfulness of processing based on consent granted prior to such withdrawal.
F) Automated processing of your data
Under no circumstances do we perform any automated decision-making or other automated processing of your personal data that would have any legal consequences or otherwise significantly impact you in any way.
3. Sources of personal data
We obtain all the above data from you personally, in connection with dealings related to the conclusion of a contract and the provision of accommodation and catering services.
If your reservation of our services is made by another entity (typically your employer in the case of business trips), we will obtain your basic identification and contact details (in the scope of your full name and phone number, or e-mail address) directly from this entity.
For reservations made using a reservation portal, your basic identification and contact details (in the scope of your full name and phone number, or email address) will be provided by the reservation portal.
4. How long do we process your personal data?
We will process your personal data over the duration of your stay in our hotel. We will only continue to process the following data once your stay has ended:
- Data that we have an obligation to process under relevant legislation, and specifically only for such period as required under such legislation. (For example, accounting and tax documents we issue you that also contain some of your personal data (full name, type of provided services and date on which the document is issued). Such documents are only archived for the purposes of complying with obligations specified under relevant accounting and tax legislation for the period specified in such regulations.)
- Your first name last name, email address and information about your stay for direct marketing use by CPI Hotels (sending information about interesting news, discounts on our services, etc.) and for distributing satisfaction questionnaires. We only process the data for distributing satisfaction questionnaires for as long as we evaluate such questionnaires (a maximum of 1 month after your stay). For direct marketing purposes, we process your personal data as specified above until such time that you no longer agree to such processing.
- Data necessary for the purposes of existing or actually pending disputes. We only process this data until such time a valid decision is made in the dispute and until such time that the obligations arising from such a decision are met or until such time that a dispute may occur regarding provided services as specified under valid legislation.
We regularly delete your personal data after the expiration of such periods, including data in electronic and paper form.
5. To whom do we give access or transmit your personal data?
A) Transmission to third parties
We do not disclose or otherwise transmit your personal data to any third parties, with the exception of public authorities, to whom there is an obligation to provide such data under valid and effective legislation (this is typically data that we process under the Act on Local Fees or on the basis of the Act on the Residence of Foreigners in the Czech Republic).
In the case of spa treatment services, we will not disclose your personal data to anyone, and our physicians and other medical personnel are employees of CPI Hotels.
We do use the services of other processors for the purposes of securing some support services (such as distributing marketing materials, improving communications and the segmentation of offers, providing on-line hotel reservations and processing cookies),. Such processing is exclusively performed for our company on the basis of our instructions. In relation to all such processors, we exercise due diligence in their selection with regards to their credibility and the quality of their services, including the security of the processed personal data. Processing may only be conducted on the basis of an agreement concluded between CPI Hotels and the processor, wherein the processor commits to give the same level of protection to such personal data as provided by CPI Hotels. We will provide details of the processors with whom we are currently cooperating with upon request.
C) Transmission abroad
Our processors maintain their registered offices and personal data processing locations in the Czech Republic or in other EU countries. We only use processors located in the United States of America when sending and evaluating satisfaction questionnaires and in the case of certain reservation systems. However, these are always reputable companies within international hotel, reservation and similar networks providing services to hotels on a global scale.
Under Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield, the European Commission, together with U.S. Government authorities, defined the “Privacy Shield” system as a special tool to ensure an adequate level of protection of personal data even after it has been transferred to a recipient in the United States. Pursuant to this decision, companies established in the United States of America that have committed to the principles of the Privacy Shield program ensure an adequate level of protection of personal data. The US-based processors mentioned above are among the companies that have committed to the Privacy Shield program. More information can be found on the official website of the program https://www.privacyshield.gov. The Privacy Shield remains in place even after GDPR takes effect.
We will not transmit your personal data outside of the EU under any circumstances other than those specified above.
6. How does CPI Hotels protect personal data
Anyone on our part who comes into contact with personal data has a contractual obligation to maintain confidentiality with respect to the processed personal data and the security measures used to protect the security of such data. This obligation persists after the termination of employment with CPI Hotels or another processor.
7. Your rights under valid legislation
You have the following rights under valid personal data protection legislation:
- the right to access your personal datawhich we process; this includes the right to obtain the following information from CPI Hotels:
- confirmation that CPI Hotels processes your personal data
- access to such personal data,
- information about the purposes of processing,
- categories of involved personal data,
- information about the recipients or categories of recipients with access to your personal data,
- the planned archiving period or criteria for its definition,
- the existence of the right to request correction or deletion of personal data, or otherwise restrict its processing, and the right to object to such processing,
- the right to file a complaint with the supervising authority,
- all available information regarding the sources of personal data, if not obtained from you as a data subject,
- if any automated decision-making or profiling occurs,
- suitable guarantees if your personal data is transmitted outside the EU,
- a copy of your personal data so long as the rights and freedoms of others are not affected by such step.
- the right to correct your personal dataif any such data is incorrect, inaccurate or incomplete; corrections shall be made by CPI Hotels without undue delay with considerations given to the technical means to accomplish such correction,
- the right to request deletion of your personal data in the instances specified in the GDPR, for instance, if you no longer consent to processing or object to processing in the event of unlawful processing of your personal data, if your personal data is no longer needed for the purposes for which it was obtained, etc. You may therefore request the deletion of your personal data; however, such an option is not available if processing is required to comply with legal obligations and in certain other situations defined in the GDPR.
- the right to request restricted processing of personal data in the instances foreseen in the GDPR, such as when you call into question the accuracy of personal data, object to processing, etc.
- the right to transferability the data you provided to us and which we process in an automated manner with your consent, or based on the need for its processing to fulfil a contractual arrangement with you, or to implement specific measures adopted prior to conclusion of an agreement at your request. In such cases, we will allow you to obtain your personal data in the structure commonly used and in machine readable format, or, if technically feasible, we will transfer such data to another controller of your choosing,
- the right to object to the processing of your personal data based on the necessity of processing for the purposes of legitimate interests, including processing for direct marketing purposes. If we are unable to provide serious and legitimate reasons for processing that outweigh your interests or rights and freedoms, or for determining, enforcing or defending legal claims, in which case we will not continue to process your personal data.
- the right to withdraw your consent to processing of personal data sent in explicit communication to such effect to our address (CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10), or email address at firstname.lastname@example.org, or using the contact form at www.cpihotels.com; another option is to change your web browser settings. Withdrawal of consent takes effect at the moment it is delivered to CPI Hotels. Under GDPR, withdrawal of consent has no prejudice on the lawfulness of processing based on such consent granted prior to withdrawal.
- the right to be exempt from any decision-making based exclusively on automated processing, including profiling, which may have binding legal effects for you, or otherwise significantly impact you in a similar manner, with the exception of those instances expressly specified in the GDPR,
- in addition to the above, you have if you believe that your personal data has been processed in violation of the GDPR, the right to file a complaint with the supervising authority, specifically the Office for Personal Data Protection, with registered office at Pplk. Sochora 27, 170 00 Prague 7.
8. Disclaimer regarding the CCTV system used at CPI Hotels, a.s
• processing is performed to protect property and to improve the security of individuals
• the scope of processing only includes video recorded by the CCTV system, with no sound recording
• Identification of the controller: CPI Hotels, a.s., ID No.: 47116757, with registered office at Bečvářova 2081/14, Prague 10, postal code 10000
• CCTV system recordings are kept on a HDD / hard drive operated by CPI Hotels, a.s. exclusively for this CCTV system and no other processor is used for this CCTV system
• the site of processing is the registered office of CPI Hotels, a.s. and its offices located at Vladislavova 1390/17, Nové Město, 110 00 Prague, as well as the individual hotels specified below, along with the specific number of cameras in their CCTV systems:
|Hotel Fortuna West||Mrkvičkova 1091/2, 163 00 Prague, Řepy||32|
|Hotel Imperial Ostrava||Tyršova 1250/6, 702 00 Moravská Ostrava||35|
|Clarion Hotel Prague Old Town||Hradební 768/9, 110 00 Prague, Staré Město||8|
|Comfort Hotel Olomouc||Wolkerova 1197/29, 779 00 Olomouc||12|
|Buddha-Bar Hotel Prague||Jakubská 649/8, 110 00 Prague, Staré Město||33|
|Spa Kur Hotel Harvey||Dlouhá 222/2, 351 01 Františkovy Lázně||37|
|Grand Hotel Zlatý Lev||Gutenbergova 126/3, 460 05 Liberec||8|
|Clarion Hotel Špindlerův Mlýn||Labská 111, 543 51 Špindlerův Mlýn||13|
|Spa Kur Hotel Prague||Ruská 27/12, 351 01 Františkovy Lázně||18|
|Clarion Hotel České Budějovice||Pražská tř. 2306/14, 370 04 České Budějovice||63|
|Clarion Hotel Prague City||Tylovo náměstí 15/3, 120 00 Prague, Vinohrady||12|
|Mamaison Residence Belgická||Belgická 318/12, 120 00 Prague, Vinohrady||2|
|Clarion Congress Hotel Ostrava||Zkrácená 2703/84, 700 30 Ostrava, Zábřeh||30|
|Hotel Černigov Hradec Králové||Riegrovo náměstí 1494/4, 500 02 Hradec Králové||12|
|Mamaison Hotel Riverside||Janáčkovo nábřeží 1115/15, 150 00 Prague||8|
|Comfort Hotel Prague City East||Bečvářova 2081/14, 100 00 Prague 10||68|
|Quality Hotel Ostrava City||Hornopolní 3313/42, 702 00 Moravská Ostrava, Ostrava||26|
|Mamaison Residence Downtown Prague||Na Rybníčku 1329/5, 120 00 Nové Město, Prague||48|
• only law enforcement or other administrative authorities involved in infringement proceedings may obtain data from the CCTV system
• cameras monitor:
- in the individual hotels: the entrances and reception area, corridors and underground garages, parking spaces in front of the hotel, entrances and exits for vehicles, staff entrances, stocking and handling areas, terraces, entrances to fitness and wellness facilities (at Clarion in Špindlerův Mlýn and Orava), halls and foyer, entrances to conference rooms, loading docks and any courtyard / inner courtyard.
• recordings are stored for a maximum of 7 days, after which the data is automatically deleted by overwriting with a new recording as the CCTV system runs on a loop
• mode of camera operation: continuous (or based on an automatic motion detector)
• contact details for requests for information: registered office of CPI Hotels, a.s., or via email@example.com
You have the following general rights under valid personal data protection legislation:
- the right to access your personal data that we process,
- the right to correct your personal data if it is in any way incorrect, inaccurate or incomplete,
- the right to request the deletion of personal data or to restrict its processing,
- the right to object to the processing of your personal data,
- in addition to the above, you may file a complaint with the supervising authority, specifically the Office for Personal Data Protection, with registered office at Pplk. Sochora 27, 170 00 Prague 7.
If anything is unclear or you have any questions regarding the processing of your personal data, please feel free to contact us at any time by sending us a letter to the registered address of CPI Hotels, a.s., or via email at firstname.lastname@example.org.
9. Our contact details
If anything is unclear or you have any questions regarding the processing of your personal data, please feel free to contact us at any time by sending us a letter to the registered address of CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10, or via email to our data protection officer email@example.com, or by using the contact form at www.cpihotels.com.