1. Personal Data Controller Information: We would like to inform you that the controller of your personal data is SCORPION GROUP sp. z o.o., Stawiszcze 39a, 98-200 Sieradz, with Tax Identification Number (NIP) PL8272341966, hereinafter referred to as the “Hotel.” You may contact the Hotel regarding personal data protection at the following email address: biuro@polboru.pl2. Purposes and Legal Bases for Processing Personal Data To provide services in accordance with its business profile, the Hotel processes your personal data for various purposes, but always in compliance with the law. The personal data you provide will be processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), commonly referred to as the GDPR. We collect personal data from you as part of the process leading to the conclusion of a contract or from our partners at booking portals, provided you have given your consent. Below you will find a detailed list of the purposes of personal data processing along with the legal bases. 1. In order to provide a quote for a service, make a reservation, and perform the service, as well as when entering into other contracts related to our business activities, we may process the following personal data:• First and last name;
• Address (street, house/apartment number, ZIP code, and city);
• Phone number;
• Email address;
• Company details, including tax ID number (in the case of issuing a VAT invoice to a company);
• License plate number of the Customer’s vehicle (when using the hotel parking lot);
• Basic bank account information to confirm a bank transfer;
• ID number;
• Information regarding nationality;
• Your payment card number and other card details, as well as authentication credentials and other billing and account information related to mobile payments;
• Reservation number. The legal basis for such data processing is Article 6(1)(b) of the GDPR, which permits the processing of personal data if it is necessary for the performance of a contract or for taking steps to enter into a contract.Children’s data, such as first name, last name, nationality, and date of birth, are collected exclusively from their parents or legal guardians to determine their age and any discounts to which they are entitled, as well as for internal statistical purposes.1. To process complaints, we process the following personal data:• First and last name;
• Address (street, house/apartment number, ZIP code, and city);
• Phone number;
• Email address;
• Reservation number;
• Check-in details;
• Bank account number (if applicable)—in the event of a refund.The legal basis for this data processing is Article 6(1)(b) of the GDPR, which permits the processing of personal data if it is necessary for the performance of a contract or for taking steps to enter into a contract.¹ In order to issue an invoice and fulfill other obligations under tax law, such as retaining accounting records for 5 years, we process the following personal data:• First and last name;
• Company name;
• Residential address or registered office address;
• Tax ID number;
• Reservation number.The legal basis for such data processing is Article 6(1)(c) of the GDPR, which permits the processing of personal data if such processing is necessary for the Data Controller to comply with legal obligations;1. To assess satisfaction with our services, conduct audits, and improve and modify our services, we process the following personal data:• Email address;
• Reservation number;
• First and last name;
• Guest comments or suggestions. The legal basis for such data processing is Article 6(1)(f) of the GDPR, which permits the processing of personal data if the Data Controller is pursuing its legitimate interest (in this case, the Hotel’s interest is to gather customer feedback on the services provided in order to tailor them to the needs and expectations of the guests);1. To ensure the safety of Hotel employees and guests and to prevent fraud, we process the following personal data:• Data from the key card system;
• Facial images captured by video surveillance;
• First and last name;
• Email address;
• Phone number;
• IP address. The legal basis for such data processing is Article 6(1)(f) of the GDPR, which permits the processing of personal data when the Data Controller pursues its legitimate interest (in this case, the Hotel’s interest is to ensure the safety of all persons on the Hotel premises). CCTV data is deleted no later than 30 days after the date of recording.1. In order to create records and registers related to the GDPR, including, for example, a register of customers who have objected in accordance with the GDPR, we process the following personal data:• First and last name;
• Email address. The provisions of the GDPR impose specific documentation obligations on us to demonstrate compliance and accountability. If, for example, you object to the processing of your personal data for marketing purposes, we need to know whom not to target with direct marketing.The legal basis for such data processing is Article 6(1)(c) of the GDPR, which permits the processing of personal data if such processing is necessary for the Data Controller to fulfill its legal obligations (the provisions of the GDPR); and Article 6(1)(f) of the GDPR, which permits the processing of personal data if the Data Controller is pursuing its legitimate interests (in this case, the Hotel’s interest is to have knowledge about individuals who exercise their rights under the GDPR); 1. To establish, assert, or defend against claims, we process the following personal data: • First and last name (if the last name was provided) or, if applicable, company name;
• Residential address (if provided);
• PESEL number or NIP number (if provided);
• Email address;
• IP address;
• Reservation number. The legal basis for such data processing is Article 6(1)(f) of the GDPR, which permits the processing of personal data if the Data Controller pursues its legitimate interest in this manner (in this case, the Hotel’s interest is to possess personal data that will enable it to establish, assert, or defend against claims, including those from customers and third parties); 1. For analytical purposes—that is, to study and analyze activity on the Hotel’s website—we process the following personal data:• Date and time of the visit to the website;
• Type of operating system;
• Approximate location;
• Type of web browser used to view the website;
• Time spent on the website;
• Subpages visited;
• The subpage where the contact form was filled out. The legal basis for such data processing is Article 6(1)(f) of the GDPR, which permits the processing of personal data if the Data Controller pursues its legitimate interest in this manner (in this case, the Hotel’s interest is to understand customer activity on the website); 1. In order to use cookies on the website, we process such text-based information (cookies will be described in a separate section). The legal basis for such processing is Article 6(1)(a) of the GDPR, which permits the processing of personal data based on voluntarily given consent (a request for consent to the use of cookies appears upon your first visit to the website);1. To administer the website, we process the following personal data: • IP address;
• Server date and time;
• Web browser information;
• Operating system information—this data is automatically recorded in server logs each time you use the Hotel’s website. Administering the website without using a server and without this automatic logging would not be possible. The legal basis for such data processing is Article 6(1)(f) of the GDPR, which permits the processing of personal data if the Data Controller pursues its legitimate interest in this manner (in this case, the Hotel’s interest is the administration of the website); 3. Cookies 4. The Hotel, like other entities, uses so-called cookies on its website—short text files stored on the user’s computer, phone, tablet, or other device. They can be read by our system, as well as by systems belonging to other entities whose services we use (e.g., Facebook, Google).5. Cookies serve many functions on the website, most of which are useful; we will try to describe them below (if the information is insufficient, please contact us):• ensuring security—cookies are used to authenticate users and prevent unauthorized access to the customer portal. They therefore serve to protect the user’s personal data from unauthorized access;
• improving the website’s performance and user experience — cookies are used to ensure the website runs smoothly and to enable you to use its features, which is possible, among other things, by saving settings between visits to the site. Thanks to them, you can navigate the website and its individual pages efficiently;
• session status — cookies often store information about how visitors use the website, such as which subpages they view most frequently. They also help identify errors displayed on certain subpages. Cookies used to store the so-called “session state” thus help improve services and enhance the browsing experience;
• maintaining session state — when a customer logs into their account, cookies help maintain the session. This means that when navigating to another subpage, you do not have to re-enter your username and password each time, which enhances the user experience;
• generating statistics — cookies are used to analyze how users interact with the website (how many people visit the website, how long they stay, which content generates the most interest, etc.). This allows us to continuously improve the website and tailor its functionality to users’ preferences. To track activity and generate statistics, we use Google tools such as Google Analytics; in addition to reporting website usage statistics, the Google Analytics pixel can also be used, together with some of the cookies described above, to help display more relevant content to the user in Google services (e.g., in the Google Search engine) and across the web;
• Use of social media features—our website includes a so-called Facebook pixel, which allows you to “like” our Facebook page while using the site. However, to make this possible, we must use cookies provided by Facebook. 3. Your web browser allows cookies on your device by default, so we ask you to consent to the use of cookies on your first visit. However, if you do not wish to have cookies used while browsing the website, you can change your browser settings—either to completely block the automatic use of cookies or to be notified each time a cookie is placed on your device. You can change these settings at any time.4. While we respect the autonomy of all users of this website, we feel obliged to warn you that disabling or restricting cookies may cause significant difficulties in using the website, such as such as having to log in on every subpage, longer page loading times, limitations on functionality, and restrictions on liking the page on Facebook, etc.5. Right to Withdraw Consent6. If the processing of personal data is based on consent, you may withdraw that consent at any time.
2. If you wish to withdraw your consent to the processing of personal data, please send a request to biuro@polboru.pllub or to the following address: Hotel Na Półboru – Reception, Stawiszcze 39A, 98-200 Sieradz. If the processing of your personal data was based on consent, withdrawing that consent does not mean that the processing of your personal data up to that point was unlawful. In other words, until you withdraw your consent, we have the right to process your personal data, and its withdrawal does not affect the lawfulness of the processing that has taken place so far.7. Requirement to Provide Personal Data8. Providing any personal data is voluntary and depends on your decision. However, in some cases, providing certain personal data is necessary to meet your expectations regarding the use of our services.
2. To book a service at the Hotel, you must provide the data specified in Section 2A of this Privacy Policy.
3. In order for you to receive an invoice for the services, you must provide all data required by tax law—without this, we are unable to issue an invoice correctly.
4. To contact you by phone regarding matters related to the provision of the service, you must provide your phone number and email address—without this information, we are unable to contact you by phone or send a reservation confirmation.9. Automated Decision-Making and Profiling: Please be advised that we do not engage in automated decision-making, including decision-making based on profiling. The content of the inquiry submitted via the form is not evaluated by an IT system. The quoted price for the service is based on our hotel’s price list. 7. Recipients of Personal Data 8. Like most businesses, we rely on the assistance of other entities in our operations, which often involves the need to transfer personal data. Therefore, when necessary, we transfer your personal data to lawyers who work with us and provide services, companies handling instant payments, an accounting firm, a web hosting provider, a company responsible for sending text messages, and an insurance company (should it become necessary to compensate for damages).
2. In addition, it may happen that, for example, based on a relevant legal provision or a decision by a competent authority, we will also have to transfer your personal data to other authorities or entities. 9. Transfer of Personal Data to Third Countries 10. Like most businesses, we use various popular services and technologies offered by entities such as Facebook, Microsoft, and Google. These companies are based outside the European Union and are therefore considered third countries under the provisions of the GDPR.
2. The GDPR imposes certain restrictions on the transfer of personal data to third countries because, since European regulations do not generally apply there, the protection of personal data of European Union citizens may, unfortunately, be insufficient. Therefore, every personal data controller is required to establish the legal basis for such transfers.
3. We will be happy to provide you with further clarification regarding the transfer of personal data at any time, particularly if this matter causes you concern.11. Retention Period for Personal Data12. In accordance with applicable law, we do not process your personal data “indefinitely,” but only for as long as necessary to achieve the specified purpose. After this period, your personal data will be permanently deleted or destroyed.
2. In situations where we do not need to perform any operations on your personal data other than storing it (e.g., when we store the content of an order for the purpose of defending against claims), we take additional security measures—through pseudonymization—until the data is permanently deleted or destroyed. Pseudonymization involves encrypting personal data or a set of personal data in such a way that it cannot be read without an additional key, thereby rendering such information completely useless to an unauthorized person.
3. Regarding the specific periods for processing personal data, please be advised that we process personal data for the following periods:• the term of the contract—with respect to personal data processed for the purpose of entering into and performing the contract;
• 3 years or 10 years + 1 year — with respect to personal data processed for the purpose of establishing, pursuing, or defending claims (the length of the period depends on whether both parties are business entities or not);
• 6 months — with respect to personal data collected in connection with a service quote, where a contract was not immediately concluded;
• 5 years — with respect to personal data related to the fulfillment of obligations under tax law;
• until consent is withdrawn or the purpose of processing is achieved, but no longer than 5 years — with respect to personal data processed on the basis of consent;
• until a valid objection is filed or the purpose of processing is achieved, but no longer than 5 years—with respect to personal data processed on the basis of the Data Controller’s legitimate interest or for marketing purposes;
• until the data becomes outdated or loses its usefulness, but no longer than 3 years—with respect to personal data processed primarily for analytical purposes, the use of cookies, and website administration.4. We calculate these periods in years from the end of the year in which we began processing personal data to streamline the process of deleting or destroying personal data. Calculating a separate deadline for each concluded contract would entail significant organizational and technical difficulties, as well as a substantial financial burden; therefore, establishing a single date for the deletion or destruction of personal data allows us to manage this process more efficiently. Of course, if you exercise your right to be forgotten, such situations are considered on a case-by-case basis. 5. The additional year associated with the processing of personal data collected for the purpose of performing a contract is dictated by the fact that you might hypothetically file a claim just before the statute of limitations expires, the claim might be served with a significant delay, or you might incorrectly determine the statute of limitations for your claim.6. INFORMATION ON MONITORING AT SCORPION GROUP SP. Z O.O. SCORPION GROUP sp. z o.o. informs you that video surveillance is in operation on the premises and around the facility.Video surveillance covers: – the restaurant, conference rooms, and ballroom; – the hotel section; – the Company’s property grounds, in particular: building entrances, access roads, and pedestrian walkways.The purpose of video surveillance is to ensure employee safety, provide fire protection, and safeguard the Company’s property.¹¹ Rights of Data Subjects.¹² We kindly inform you that you have the right to:• access your personal data;
• rectify your personal data;
• erase your personal data;
• restrict the processing of your personal data;
• object to the processing of your personal data;
• request the right to be forgotten where permitted by other legal provisions;
• receive a copy of your data;
• have your personal data ported.2. We respect your rights under data protection laws and strive to facilitate the exercise of these rights to the greatest extent possible.3. Please note that the rights listed above are not absolute, and therefore, in certain situations, we may lawfully refuse to comply with your request. However, if we refuse to comply with a request, it will be only after a thorough analysis and only when such a refusal is necessary.4. Regarding the right to object, we explain that you have the right at any time to object to the processing of personal data based on the Data Controller’s legitimate interest (as listed in Section III) in connection with your particular situation. However, please note that, in accordance with the law, we may refuse to honor your objection if we demonstrate that:• there are legitimate grounds for processing that override your interests, rights, and freedoms, or
• there are grounds for establishing, exercising, or defending legal claims.5. In addition, you may object at any time to the processing of your personal data for marketing purposes. In such a case, upon receiving your objection, we will cease processing for this purpose.6. You may exercise your rights as follows:• send an email to the Personal Data Controller at: biuro@polboru.pl• or send such a request to the mailing address: Stawiszcze 39A, 98-200 Sieradz;• or inform the front desk clerk during your visit to our hotel.11. Right to File a ComplaintIf you believe that your personal data is being processed in violation of applicable law, you may file a complaint with the President of the Personal Data Protection Office.12. Final Provisions13. In matters not covered by this Privacy Policy, the provisions of personal data protection law shall apply.
2. The hotel reserves the right to amend this Privacy Policy, provided that services rendered prior to any amendment to the Privacy Policy shall be governed by the version of the Privacy Policy in effect at the time the service was booked.
3. Changes to the Privacy Policy may not infringe upon the rights acquired by Guests.
4. Notice of any changes to the Privacy Policy will be published on the Hotel’s website: www.polboru.plna 14 calendar days before such changes take effect.14. This Privacy Policy is effective as of October 1, 2018.
