Privacy Policy

This privacy policy (hereinafter referred to as the “Policy”) contains information about the processing of your personal data by Ing. Rudolf Kaltenbach, with registered office at Potočná 16, 909 01 Skalica, ID No.: 11735091 , registered in the Trade Register of the Senica District Office, Trade Register No. 206-7056 (hereinafter referred to as the “Operator”), which occurs through the website https://en.penzionskalica.eu/domov/ and the Operator’s social media profiles and communication channels.

Through this Policy, the Controller provides you with information about why your personal data is processed, how it is processed, how long the Controller stores it, what your rights are in relation to the processing of your personal data and other relevant information about the processing of your personal data.

The Controller processes your personal data in accordance with Regulation 2016/679 of the European Parliament and of the Council of the European Union on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “Regulation”), the relevant Slovak legislation, in particular Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments and Additions to Certain Acts (hereinafter referred to as the “Act”) and other regulations on the protection of personal data (the Regulation, the Act and other regulations on the protection of personal data are hereinafter collectively referred to as the “Personal Data Protection Regulations”).

You can contact the Data Controller in matters relating to the processing and protection of personal data at Ing. Rudolf Kaltenbach, Potočná 16, 909 01 Skalica or by e-mail to rezervacia@penzionskalica.sk. The Controller has not appointed a responsible person in the area of processing and protection of personal data.

The Controller obtains your personal data directly from you via the website or social network profiles, if you provide it to the Controller yourself. The provision of personal data for all the personal purposes below is voluntary.

INFORMATION ON PROCESSING OPERATIONS (categories of personal data, purposes of processing, legal bases and retention periods)

The Controller processes your personal data exclusively in accordance with the principle of minimisation, which means that the Controller does not request personal data from you that is not necessary for the specific and justified purpose of the processing. The Data Controller processes personal data only if there is a legal basis for processing it and therefore it is processed in accordance with the principle of lawfulness. The specific purposes, including the legal basis and the retention period, for which the Controller processes your personal data can be found in the table below.

Purpose of processing Responding to messages and handling queries/requests from messages received by the Controller via messages on social networks, email communication or by telephone
Legal basis Art. 6(1)(f) of the Regulation – the processing of personal data is carried out on the basis of the legitimate interest of the Controller, which is to respond to the messages received for the proper conduct of business communication, improving the quality of the services provided and attracting new clients
Categories of personal data Name, surname, e-mail address, telephone number, other data provided in the message
Retention period 30 days from the date of receipt of the request or until the request is processed (purpose fulfilled), whichever is earlier
 
Purpose of processing Receipt and registration of reservations
Legal basis Art. 6(1)(b) of the Regulation – the processing of personal data is carried out in the performance of pre-contractual relations (booking a stay on the basis of a request from the data subject)
Categories of personal data Name, surname, e-mail address, telephone number, country, credit card number, name and surname of the cardholder
Retention period Until the conclusion of the contractual relationship (reserved stay) and after its conclusion until full settlement of contractual and other claims arising from the contractual relationship. If the contractual relationship is not concluded (stay based on a reservation), 60 days after the reserved stay date.
 
Purpose of processing Publication of client testimonials on satisfaction with the Operator’s services on the Operator’s website in the course of presentation activities
Legal basis Art. 6(1)(a) of the Regulation – the processing of personal data is carried out on the basis of the data subject’s consent
Categories of personal data Name, surname, location, other personal data specified in the reference
Retention period 5 years from the date of consent or until its withdrawal, whichever is the earlier
   
Purpose of processing Handling of exercised rights of data subjects
Legal basis Art. 6(1)(c) of the Regulation – the processing of personal data is carried out in the performance of a legal obligation
Categories of personal data Ordinary personal data included in the request
Retention period Pending the exercise of the rights invoked
   
Purpose of processing Records of exercised rights of data subjects
Legal basis Art. 6(1)(f) of the Regulation – the processing of personal data is carried out on the basis of the legitimate interest of the Data Controller, which is to record the exercised rights of data subjects for the purpose of demonstrating compliance with obligations arising from legal provisions
Categories of personal data Ordinary personal data included in the request
Retention period 5 years from the date of exercise of rights
   
Purpose of processing Processing of personal data for the purpose of measuring website traffic and targeting the Operator’s advertising (via cookies)
Legal basis Art. 6(1)(a) of the Regulation – the processing of personal data is carried out on the basis of the data subject’s consent
Categories of personal data Data about activity on the website of the Operator and preferences in the online environment
Retention period 2 years from the date of consent or until its withdrawal, whichever is earlier

Za účelom zabezpečenia ochrany Vašich osobných údajov prijal Prevádzkovateľ primerané bezpečnostné opatrenia.

TO WHOM DOES THE CONTROLLER PROVIDE YOUR PERSONAL DATA?

In certain cases, the controller is obliged to provide your personal data to public authorities that are authorised to process your personal data, e.g. courts, law enforcement authorities as well as supervisory and oversight authorities (e.g. Slovak Trade Inspection) (third parties).

The Controller also provides your personal data to its processors, i.e. external entities that process your personal data on behalf of the Controller. The processors process personal data on the basis of a contract concluded with the Controller, in which they undertake to take appropriate technical and security measures for the purpose of secure processing of your personal data. The Controller’s processors include:

a company providing hosting services (including mail hosting services) (Websupport s.r.o.),
a company providing website and social media profile management services – online advertising services (Cread Digital, s.r.o.); and
a company providing an online reservation system (Cread Digital, s.r.o.).

The recipients of your personal data include Google Ireland Limited, which provides analytical and marketing services through the use of cookies, which are stored on your device by the website if you grant the Operator your consent to the storage of these files.

The recipients of your personal data also include the operator of the social networks Facebook and INSTAGRAM (Facebook Ireland Limited) in case you contact the Operator via a message on the Operator’s social networks, share the website or its content on social networks. The said company acts as a joint controller with the Controller when processing personal data and the processing of personal data in this case is governed by the joint controllers’ agreement within the meaning of Article 26 of the Regulation, according to which the Controller is the point of contact.

TRANSFER TO THIRD COUNTRIES AND INTERNATIONAL ORGANISATIONS

In some cases, your personal data may be transferred to third countries, to the USA:

Facebook, Inc. (parent company of the European operator of the social networks Facebook and INSTAGRAM), in the handling of your messages received by the Controller on social networks and in the use of marketing cookies on the Controller’s website (online marketing services in case of your consent); and
Google, LLC, when using analytics and marketing services and tools using cookies.
The transfer is carried out in accordance with the Data Protection Regulations, on the basis of standard contractual clauses (which are part of the terms and conditions of use of the above services) and the Operator fulfils all obligations associated with the transfer.

The Controller does not use profiling when processing your personal data and does not process personal data in any form of automated individual decision-making, which would involve the evaluation of your personal aspects.

WHAT ARE YOUR RIGHTS IN RELATION TO THE PROCESSING OF PERSONAL DATA?

You have the following rights as a data subject in relation to the processing of your personal data:

Your rights 
Right of access – As a data subject, you have the right to obtain confirmation from the Data Controller as to whether it is processing your personal data and, if so, to obtain access to that personal data and information pursuant to Article 15 of the Regulation. The Controller will provide you with a copy of the personal data that is being processed. If you make a request by electronic means, the information will be provided to you by the Controller in a commonly used electronic format, unless you request otherwise.   Right to rectification – The Controller has taken reasonable steps to ensure that your personal data is accurate, complete and up-to-date. As a data subject, you have the right to have your inaccurate personal data rectified or your incomplete personal data completed by the Controller without undue delay. 
RIGHT TO OBJECTYou have the right to object to the processing of your personal data, for example, if the Controller processes your personal data on the basis of a legitimate interest or in the case of processing involving profiling. If you object to such processing of your personal data, the Controller will not further process your personal data unless it demonstrates the necessary legitimate grounds for further processing of your personal data.  
Right to erasure (“right to be forgotten”) – You also have the right to obtain from the Data Controller the erasure of your personal data without undue delay if certain conditions are met, for example, if the personal data are no longer necessary for the purposes for which the Data Controller obtained or processed them. However, this right of yours must be considered on a case-by-case basis, as there may be situations where the Controller is prevented from erasing your personal data by other circumstances (for example, a legal obligation of the Controller). This means that in such a case, the Controller will not be able to comply with your request for erasure of your personal data. Right to data portability – In certain circumstances, you have the right to have your personal data transferred to another controller that you designate. However, the right to data portability only applies to personal data that the Data Controller processes on the basis of the consent you have given to the Data Controller, on the basis of a contract to which you are one of the parties or where the Data Controller processes personal data by automated means. 
RIGHT TO WITHDRAW CONSENTIf the Controller processes your personal data on the basis of your consent, you have the right to withdraw the consent given at any time in the same way as you gave it. Withdrawal of consent does not affect the lawfulness of the processing carried out prior to the withdrawal of consent.
Right to restriction of processing – You also have the right to have the Controller restrict the processing of your personal data. This will be the case, for example, if you challenge the accuracy of the personal data or if the processing is unlawful and you request the restriction of processing, or if the Controller no longer needs your personal data for the purposes of processing but you need it to prove, exercise or defend legal claims. The Controller will restrict the processing of your personal data if you request it. Right to lodge a complaint or complaint – If you feel that your personal data is being processed in violation of applicable law, you may lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, located at Hraničná 12, 820 07 Bratislava 27; website: dataprotection.gov.sk, phone number: 02 3231 3214; e-mail: statny.dozor@pdp.gov.sk 
Your rights listed in the table above can be exercised at the contact addresses of the Data Controller listed at the beginning of this document.
 

The Controller will provide you with an answer to the exercise of your rights free of charge. In the event of a repeated, unfounded or unreasonable request for the exercise of your rights, the Controller is entitled to charge a reasonable fee for the provision of information. The Controller shall provide you with a reply within 1 month from the date on which you exercised your rights. In certain cases, the Controller is entitled to extend this period, in the event of a high number and complexity of requests from data subjects, but not more than 2 months. The Controller will always inform you of the extension of the time limit.

SOCIAL NETWORKS AND LINKS TO OTHER WEBSITES

In order to promote marketing and advertising, you will find links to various social networks, such as Facebook and INSTAGRAM, on the website of the Controller. The Operator hereby wishes to inform you that once you click on the add-on on the website and go to the social network, the privacy policy of the social network operator will become applicable, except in cases where you contact the Operator via a message on the social network (in which case the processing of your personal data is also governed by this Policy and your personal data is processed by the Operator in accordance with the information provided above).

For more information on the processing of your personal data by social network operators, please refer to the following links: (i) Facebook: https://sk-sk.facebook.com/policy.php and (ii) Instagram: https://www.facebook.com/help/instagram/155833707900388.

FULL

This Policy is valid and effective as of 01.05.2022. As the information on the processing of personal data contained in this Policy may need to be updated in the future, the Controller is entitled to update this Policy at any time. In such case, however, the Controller will notify you of this in an appropriate manner in advance.