NOTICE ON THE PROCESSING OF PERSONAL DATA
D.O.O.E.L ROJAL VJU, with headquarters at the address Jane Sandanski 2, 6000 Ohrid, Republic of North Macedonia, with the registration number 6630103, contact email address: [email protected]
Controller, intends to, in the capacity of data controller, before, during and after the person’s stay at Hotel Royal View
Hotel collect and process certain personal data. Bearing this in mind, and in accordance with Article 23 of the Law on the Protection of Personal Data of the Republic of Serbia (“Official Gazette of the Republic of North Macedonia, No. 42/20 и 294/21, hereinafter: the “Law”), the Controller informs all guests of the Hotel (individually each of the Hotel guests: “Guest”) about the following:
- Data to be collected and processed
The Controller intends to collect and process personal data from the Guest that is necessary for the fulfillment of the accommodation contract and based on the regulations governing the hospitality industry (but may collect other or the same data for other purposes, listed in the text below). Guest data that the Controller intends to collect and process are:
- Personal data: name and surname, date of birth, residential address, ID card and/or passport number
- Contact information: email address and phone number
- Data on payment cards
- Recordings from security cameras
- Emergency contact information
- Controller’s Identity
- Data, identity, and contact information of the Controller are disclosed in the introductory provisions above.
- Legal basis and purpose of Data collection and processing
- The purposes of Data collection and processing are:
- Fulfillment of the accommodation contract
- Fulfillment of the requirements of the regulations in force governing the hospitality industry
- For direct marketing purposes
- For sending offers
- For the purpose of improving and personalizing the service to the Guest
- For the purpose of protecting property and the safety of individuals by applying video surveillance measures.
- The legal basis for the collection and processing of Data from points 1 and 4 of Article 1, is to comply with the Controller’s legal obligations.
- The legal basis for the collection and processing of Data from point 3 of Article 1, is fulfillment of the accommodation contract.
- The legal basis for the collection and processing of Data from point 2 of Article 1, is the consent of the Guest.
- The legal basis for the collection and processing of Data from point 5 of Article 1 is the legitimate interest of the Controller.
- Information on recipients of the Data
- Guest data will be stored on the servers owned by the Controller. The location of the specified servers is located in the Republic of North Macedonia, namely in Hotel Royal View. If there is a transfer of Guest Data to a country that does not provide an adequate level of protection of personal data, all mechanisms that ensure the necessary level of protection of personal data of the Guest will be applied to this transfer of Data. The Guest can familiarize themself with all applied protection measures in the manner provided for in Article 5.7 of this Notice.
- Data on User’s payment cards shall be kept locally until date of accommodation completion.
- Rights, including right to be notified, that belong to the Guest in case of unauthorized processing of personal data
- Right of access: The Guest has the right to request access to a copy of the Data, together with information about: – which of the Guest’s personal data is processed by the Controller – what is the purpose of processing – whether the Data is shared with third parties and the identity of those third parties, if any – what is the data storage period – what are the rights of the Guest in relation to the Data, and above all information about the right to correction, deletion, restriction of processing, objection and complaint to the competent authority in country of residence – whether Guest’s Data was used for any automated decision-making.
- Requesting Right of access is free of any charge.
- The right to object: The Guest can at any time lodge an objection regarding any aspect of Data processing by the Controller by contacting the e-mail address [email protected].
- Right to revoke consent: At any time, the Guest can withdraw consent given for processing of Data, in which case the Controller stops further processing of the Data obtained based on Guest’s consent. If the Guest exercises this right, it will not affect the earlier processing that was carried out in accordance with the User’s consent and in accordance with the Law.
- Right to rectification of Data: The Guest can at any time ask the Controller to change or complete any incorrect or incomplete Data.
- The right to delete Data: The Guest can at any time ask the Controller to delete the Data if the Controller no longer needs the Data for the purpose for which it was collected.
- The right to information regarding the appropriate protection measures: The Guest can at any time be informed about all the protection measures applied to the Data, including the measures applied when exporting the Data to countries that do not provide an adequate level of protection of personal data in accordance with positive regulations, via email address [email protected].
- The right to data portability: The Guest can at any time ask the Controller to transfer all or some of the Data to him or to a third party, in a way and in a form that can be easily transferred.
- The right to limit the processing of Data: The Guest can at any time ask the Controller to limit the processing of Data. In case of such a request by the Guest, the Operator will suspend all activities related to the Data on which such request is applicable, until this request is resolved.
- Automated decision-making and profiling: The Operator informs the Guest that no automated decision-making or profiling is applied to the Data as a method of decision making, nor will such actions be carried out in the future.
- Right to file a complaint: The Guest can file a complaint at any time: – To the Commissioner for Information of Public Importance and Protection of Personal Data via the email address [email protected], if there is a complaint regarding the collection and processing of Data.
- Obligation and legal basis, i.e. voluntary provision of Data and processing
- Giving consent to the processing of Data for the stated Purpose is voluntary.
- Giving and revoking consent
- Consent can be revoked via the email address [email protected], or in writing via the address of the Controller’s headquarters, with consequences as stated in Article 5.4 of this Notice.
- Revocation of consent does not affect the admissibility of processing based on consent prior to revocation.
- In case of revocation of consent, Guest who previously gave consent is obliged to compensate the Controller for reasonable costs and possible damage, in accordance with the regulations governing liability for damage.
- Other information relevant to Data processing
- Data collected by the Controller based on compliance with legal obligations and in accordance with applicable regulations, are stored for the amount of time determined by a specific law or bylaw.
- Data collected by the Controller based on the execution of the contract will be kept only as much as is necessary for the purpose of fulfilling the contract, i.e. providing the service.
- Data collected by the Controller based on its legitimate interest will be kept for 30 days.
- Other Data will be stored until the fulfillment of the specific Purpose for which it was collected, or until the Guest’s consent is revoked.