Privacy Policy - Hotel Nadmorski w Gdyni

Hotel Nadmorski – Privacy Policy

PRIVACY POLICY UPDATE

On 25 May 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) entered into force. In accordance with Article 13 of the General Data Protection Regulation of 27 April 2016 (OJ EU L 119 of 4 May 2016), we hereby inform you that:

WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?

The controller of your personal data is the owner of the Hotel Nadmorski****, HADEX Spółka Akcyjna with its registered office in Gdynia, ul. Ejsmonda 2, registered by the District Court Gdańsk-Północ in Gdańsk, 8th Commercial Division of the National Court Register in the register of entrepreneurs under the number 0000098882, with the Tax Identification Number (NIP): 586-001-12-53, being the owner of the Hotel Nadmorski**** in Gdynia and the websites www.nadmorski.pl and www.instytutgenesis.pl (hereinafter referred to as the Company).

HOW CAN YOU CONTACT US?

By phone: +48 58 667 77 77;
By e-mail: ;
By post to the following address: Hotel Nadmorski, 81-409 Gdynia, ul. Ejsmonda 2.

WHAT RIGHTS DO YOU HAVE IN CONNECTION WITH THE PROCESSING OF YOUR PERSONAL DATA?

a)  the right to express and withdraw consent to:
the processing of your contact details, i.e., your email address, for the purpose of receiving marketing communications electronically to your email address.
You may express or withdraw consent at the Company’s registered office, by telephone, via a button on the website, via email, or by post.
b)  the right to:
object to the processing of your data for direct marketing purposes, and
lodge a reasoned objection to the processing of your personal data within the Company’s legitimate interests for reasons related to your particular situation;
c)  the right to access your data, including obtaining a copy of the data being processed, also in electronic form;
d)  the right to rectify (amend) your personal data; if the data in our possession is inaccurate or incomplete, the Company will rectify it upon your request;
e)  the right to delete your data if your data is no longer necessary for the purposes for which it was collected and the Company has no basis for processing it, e.g., based on your consent or compliance with a legal obligation, when an effective objection has been raised against the processing of your data or the need to delete your data arises from a legal obligation;
f)  the right to transfer the data you have provided to us in a machine-readable format, e.g., to make it available to another service provider;
g)  the right to restrict the processing of your data in the following cases (when submitting the request, please indicate one of the following cases):

if you have any concerns about the accuracy of your data;
if you believe that we should not process your data but you do not want us to delete it;
if we no longer need such personal data, but you need it in connection with pursuing claims;
if you have objected to the processing of your data and it is our responsibility to check whether we should continue to process it.

You can exercise your rights by submitting an appropriate request at the Company’s registered office, via traditional mail, email, or telephone.
The Company will promptly, and no later than one month after receiving the request, provide you with information on the actions taken in response to your request. If necessary, the deadline for fulfilling your request may be extended by another two months due to the complex nature of the request or the number of requests submitted to the Company.
In order to fulfill your request, we are entitled to verify your identity to ensure that your data does not reach an unauthorized person.
If your request proves to be manifestly unfounded or excessive, in particular due to its repetitive nature, the Company may charge a reasonable fee for fulfilling the request or refuse to act on it.

WHAT TO DO IF YOU BELIEVE THAT WE ARE PROCESSING YOUR DATA INCONSISTENT WITH LEGAL REQUIREMENTS?

In such a situation, you may lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (the complaint should be sent to the following address: Personal Data Protection Office, ul. Stawki 2, 00 – 193 Warsaw).

PURPOSES AND BASES OF PERSONAL DATA PROCESSING

To provide services in line with its business profile, the Company processes your personal data for various purposes, but always in accordance with the law. Below, you will find detailed data processing purposes and the legal basis.

1. Data collected when completing reservation and/or contact forms on the nadmorski.pl website – for the purpose of order fulfillment.
To improve certain features of our website www.nadmorski.pl , we have introduced a reservation and contact form that requires the provision of personal data such as name, surname, email address, phone number, and billing information.

Providing the above data is voluntary but necessary to make a reservation or contact us via the website.

We emphasize that you do not have to provide this data if you do not wish to use the options indicated above.

The legal basis for such data processing is Article 6(1)(a) of the GDPR, which allows for the processing of personal data based on voluntary consent, and in the case of completing the booking form, Article 6(1)(b) of the GDPR, which allows for the processing of personal data if they are necessary for the performance of a contract or for taking steps to conclude a contract.

2. Data collected for the purpose of using the services offered by the Genesis Institute.
In order to use the services offered by the Genesis Institute, we process the following personal data:

name and surname,
phone number,
email address,
information about health,

In such a case, your personal data will be processed for the purpose of performing the contract and the obligations arising therefrom pursuant to Article 6 paragraph 1 points b), c) and f) and Article 9 paragraph 2 points a), f) and h) of the GDPR.

3. Data collected for the purpose of concluding and performing a contract.
To conclude and perform a contract, we process the following personal data:

name and surname,
residential address,
phone number,
bank account number,

The legal basis for such data processing is Article 6(1)(b) of the GDPR, which allows for the processing of personal data if they are necessary for the performance of a contract or taking steps to enter into a contract; if you decide to provide other personal data, we will consider that you have consented to the processing of these data as well – in which case the legal basis for such processing is Article 6(1)(a) of the GDPR, which allows for the processing of personal data based on voluntary consent;

4. Data collected for the purpose of issuing invoices and fulfilling other obligations arising from tax law.
For the purpose of issuing invoices and fulfilling other obligations arising from tax law, such as retaining accounting records for 5 years, we process the following personal data:

name and surname,
business,
residential address or registered office address,
NIP,

The legal basis for such data processing is Article 6(1)(c) of the GDPR, which allows for the processing of personal data if such processing is necessary for the Personal Data Controller to comply with its legal obligations;

5. Data collected for the purpose of creating registers and records related to the GDPR.
To create registers and records related to the GDPR, including, for example, the register of persons who have filed objections in accordance with the GDPR, we process the following personal data:

name and surname,
email address,

because, firstly, the GDPR provisions impose on us certain documentation obligations to demonstrate compliance and accountability, and secondly, if you, for example, object to the processing of your personal data for marketing purposes, we need to know who we should not use direct marketing towards because they do not wish it.

The legal basis for such data processing is, firstly, Article 6 paragraph 1 point c) of the GDPR, which allows for the processing of personal data if such processing is necessary for the Personal Data Controller to fulfil its legal obligations; secondly, Article 6 paragraph 1 point f) of the GDPR, which allows for the processing of personal data if, in doing so, the Personal Data Controller pursues its legitimate interests (in this case, the Company’s interest is to have knowledge about individuals who exercise their rights under the GDPR).

6. Data collected for the purpose of establishing, pursuing, or defending against legal claims.
For the purpose of establishing, pursuing, or defending against legal claims, we process personal data such as:

name and surname or company name,
residential address or registered office,
Tax Identification Number,
email address,
reservation number,

The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows for the processing of personal data if the Personal Data Controller thereby pursues its legitimate interest (in this case, the interest of the Company is to possess personal data that will enable the establishment, exercise or defense against claims, including those of persons using the activities conducted by the Company and third parties);

7. Data collected for archival and evidentiary purposes.

name and surname,
email address,

— for the purposes of securing information that may be used to demonstrate facts of legal significance. The legal basis for such data processing is Article 6(1)(f) of the GDPR, which permits the processing of personal data if the Personal Data Controller thereby pursues its legitimate interest (in this case, the Company’s interest is to possess personal data that will prove certain facts related to the provision of services, e.g., when a state authority requests it).

8. Data collected through video surveillance.
To ensure the safety of people and property, the Company uses video surveillance and controls access to the Hotel and the premises managed by the Company. Data collected in this way is not used for any other purposes. Personal data in the form of surveillance recordings and data collected in the entry and exit register are processed to ensure security and order on the premises and, if applicable, to defend or pursue claims. The basis for personal data processing is the legitimate interest of the Controller (Article 6, Section 1, Letter f of the GDPR).

9. Personal data collected during recruitment.
As part of the recruitment process, the Company expects personal data (e.g., in a CV or resume) to be provided only to the extent specified in applicable regulations. Therefore, no further information should be provided. If submitted applications contain such additional data, this information will not be used or considered in the recruitment process or for any other purposes. Personal data is processed for the following purposes:

performance of obligations arising from legal provisions related to the employment process, including in particular the Labour Code – pursuant to Article 6 paragraph 1 letter c of the GDPR in connection with the provisions of the Labour Code;
conducting the recruitment process in the scope of data not required by law, as well as for the purposes of future recruitment – pursuant to Article 6(1)(a) of the GDPR;
establishing or pursuing possible claims or defending against such claims – pursuant to Article 6(1)(f) of the GDPR.

10. Data collected in the marketing process for commercial and marketing communications.
If you consent to this when registering at the hotel, signing up for the newsletter, or through other promotional campaigns conducted online or in person, the email address you provide will be stored in our database for marketing purposes. You may withdraw your consent to the storage of your email address at any time.
The basis for processing your personal data will be a legitimate interest, including:

implementing and maintaining business contacts;
direct marketing of our products and services via e-mail or telephone, thanks to which you will gain access to current offers and promotions available in our Company;
preparing internal market analyses and analysing customer satisfaction with the services provided;
making data available to service providers for the Nadmorski Hotel.

Allowing us to process your personal data is voluntary. The legal basis for such processing is Article 6(1)(f) of the GDPR.

11. Data collected automatically for analytical purposes, i.e. researching and analyzing activity on the Company’s website, we process personal data such as:

date and time of website visit,
type of operating system,
approximate location,
the type of web browser used to view the website,
time spent on the website,
visited subpages,
subpage where the contact form was filled out.

12. In order to administer the website, we process the following personal data:

IP address,
server date and time,
information about your web browser,
information about the operating system

This data is automatically saved in server logs whenever the Company’s website is accessed. Administering the website without the server and this automatic saving would not be possible.

13. For the purpose of using cookies.

Some areas of the www.nadmorski.pl and www.instytutgenesis.pl websites , owned by the Company, may use cookies, which are small text files sent to the user’s computer, identifying the user in a way necessary to simplify or cancel a given operation. The following types of cookies are used within www.nadmorski.pl:

session cookies – they remain in your browser until you close it or log out of the website on which they were posted,
permanent – remain in the device’s web browser until they are deleted by the person using the Company’s website or until a predetermined time specified in the cookie file parameters.

WHO HAS ACCESS TO THE DATA?

1. To ensure the security of the personal data entrusted to you, the Controller operates based on internal procedures and recommendations, consistent with the relevant legal acts regarding personal data protection, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
2. The Controller may entrust the processing of personal data to a third party based on an agreement concluded with that third party. The Controller will make every effort to conclude agreements only with entities that offer an appropriate level of security for the processed Personal Data, consistent with the GDPR.
3. The Controller will make every effort to adequately secure the transferred personal data, in accordance with Article 46 of the GDPR.
4. Cooperating entities will include: entities providing website hosting, legal services, analytical tool providers, sales support entities, accounting services, customer service, marketing and promotional activities, and the Controller’s collaborators.
5. We do not sell collected personal data to third parties.
6. The information you provide may only be made available to competent public authorities if required by applicable law.
7. The Administrator exercises due diligence to ensure that personal data is processed within the European Union, and if transferred outside its territory, ensures that it is not used for purposes other than those for which it was collected and is stored in a manner that guarantees an adequate level of security. We do not process or outsource personal data to countries outside the European Union, and if necessary, we will ensure that personal data is processed only by entities that ensure adequate protection to the standards adopted in the European Union.

HOW WE PROTECT AND PROCESS YOUR DATA

1. All your personal data are processed in accordance with applicable regulations.
2. Before processing your personal data, the Company is obligated to fulfill the information obligation arising from the provisions of the GDPR.
3. Collected personal data are processed for specified and lawful purposes.
4. Processing of your personal data is carried out in accordance with the principles of substantive accuracy and adequately to the purposes for which the data were collected.
5. Your personal data are processed for no longer than necessary to achieve the processing purposes.
6. Your data are not shared without your consent, unless they are shared with authorized persons or entities in accordance with personal data protection regulations. 7.
Your data are processed both within an IT system and in traditional form (in written/paper form).
8. The Company verifies and ensures the possibility of effectively fulfilling each of your requests related to the protection of your personal data.
9. The Company ensures an appropriate level of security for your data through adopted procedures appropriate to the risk of violation of your rights and freedoms as a result of its processing of your personal data.

HOW WILL WE CONTACT YOU?

After making an online reservation, you will receive a confirmation email from us. We may also contact you by phone if we have important information regarding your reservation.
If you have subscribed to our newsletter or otherwise consented to receiving it, we will send you messages with information about current offers at the Nadmorski Hotel**** in Gdynia via e-mail.
If you stay at our Hotel or use the services of the Genesis Institute, we will contact you by telephone and e-mail regarding important matters.

HOW CAN YOU INFORM US ABOUT A CHANGE IN YOUR DATA?

You can inform us about changes to your data by telephone, email, post or via the contact form.

HOW LONG WILL WE STORE PERSONAL DATA?

1. In accordance with applicable law, we process your personal data for the time necessary to achieve the designated purpose. After this period, your personal data will be irreversibly deleted or destroyed.
2. If we do not need to perform any operations on your personal data other than storing it, we additionally secure it through pseudonymization until it is permanently deleted or destroyed.
3. Regarding the individual periods of personal data processing, we hereby inform you that we process personal data for the following periods:

duration of the contract – in relation to personal data processed for the purpose of concluding and performing the contract;
3 years or 6 years + 1 year – in relation to personal data processed for the purpose of establishing, pursuing or defending claims (the length of the period depends on whether both parties are entrepreneurs or not);
5 years – in relation to personal data related to the fulfillment of tax law obligations;
until the consent is withdrawn or the purpose of processing is achieved, but no longer than 3 years – in relation to personal data processed on the basis of consent;
until an effective objection is raised or the purpose of processing is achieved, but no longer than 5 years – in relation to personal data processed on the basis of the legitimate interest of the Personal Data Controller or for marketing purposes;
until they become outdated or no longer useful, but no longer than for 3 years – in relation to personal data processed mainly for analytical purposes, the use of cookies and website administration.

REQUIREMENT TO PROVIDE PERSONAL DATA

Providing any personal data is voluntary and at your discretion. However, in some cases, providing certain personal data is necessary to enable you to use our services and meet your expectations.

AUTOMATED DECISION MAKING AND PROFILING

We hereby inform you that the Company identifies instances in which profiling of processed data will occur and has mechanisms in place to ensure its compliance with the law. If instances of profiling and automated decision-making are identified, the Company complies with the applicable rules.

COOKIES AND SERVER LOGS

1. The Personal Data Controller uses cookies, which are small text files stored on the User’s end device (e.g., computer, tablet, smartphone). Cookies can be read by the Personal Data Controller’s IT system.
2. The Personal Data Controller stores cookies on the User’s end device and then accesses the information contained therein for statistical purposes, for marketing purposes (remarketing), and to ensure the proper operation of the Company’s website.
3. The Personal Data Controller hereby informs the User that it is possible to configure the web browser to prevent cookies from being stored on the User’s end device. In such a situation, the User’s use of the Company’s website may be hindered.
4. The Personal Data Controller hereby indicates that cookies may be deleted by the User after they have been saved by the Personal Data Controller, through appropriate browser functions, programs designed for this purpose, or by using appropriate tools available within the User’s operating system.
5. Server logs contain information about certain User behavior. This data is used solely for website administration and to ensure the most efficient service delivery. The resources being viewed are identified by their URL addresses.
In addition, the following may be recorded:

time of arrival of the request
response time
name of the User’s station – identification performed via the HTTP protocol
information about errors that occurred during the execution of the HTTP transaction
URL address of the page previously visited by the User (referrer link) – if the Website was accessed via a link
information about the User’s browser
IP address information.

The above data is not associated with specific people browsing the pages and is used only for server administration purposes.

If you have any questions or concerns, please contact us by email: .