Personal Data Protection

Respecting the right to personal data protection at Element Guesthouse.

We take all necessary steps to process your personal data in accordance with the principles set out in the data protection legislation applicable in Romania, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).

Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

WHAT PERSONAL DATA DO WE PROCESS?

If you are a customer or potential customer

We collect personal data during most of our interactions with you, as well as in the course of other aspects of our business. The categories of data we process are as follows:

1. data required to make bookings (for example, surname, first name, e-mail, telephone);
2. data on the arrival and departure registration form, required under national legislation (for example, citizenship, address, date of birth);
3. bank card details (card type, credit/debit card number, cardholder name, expiry date and security code);
4. information about the guest’s stay, including arrival and departure dates, special requests and preferences;
5. information you provide about your marketing preferences;
6. personal data you provide in order to sign up and subscribe to the newsletter;
7. information about vehicles you may bring onto our property, for example the registration number;
8. information collected by various contractual partners (travel agencies, event organisers) and passed on to Element Guesthouse;
9. data required to provide additional services, where applicable;
10. reviews and opinions about our services;
11. any other types of information you choose to provide to us.

In addition, surveillance cameras and other security measures on our properties may capture or record images of guests in public areas, as well as your location data (through images captured by surveillance cameras).

You can choose at any time which personal data you wish to provide to us. However, if you choose not to provide certain personal data where our request is based on compliance with a legal obligation, a contractual obligation or an obligation necessary to enter into a contract, we will be unable to provide certain services, for example: (i) if you do not wish to give us your surname, first name, e-mail address or telephone number when you want to make a booking, we will not be able to make the booking, or (ii) since you will have to enter certain personal data required by law on the arrival and departure registration form that you complete when checking in to our guesthouse, if you do not wish to complete those mandatory fields, we will not be able to accommodate you at our guesthouse.

If you are a visitor at our premises

Surveillance cameras may capture or record images of visitors in public areas.

If you are a user of our website

You do not need to provide any personal data to read the information on the website.

However, for the technical operation of the portal, we collect the time and date the website was accessed and the IP address from which our website was accessed.

Certain personal data is required to use some services (e.g. online bookings, job applications). For details, please see the Cookie Policy section.

If you are a representative or contact person of our suppliers or business partners

We collect your surname, first name and job title, as well as any other data provided by you or by the company you represent.

PERSONAL DATA OF MINORS

We protect the confidentiality of data obtained from children under 16. If you are under 16, you must obtain the consent or authorisation of your parents or guardian before providing any personal data.

SPECIAL CATEGORIES OF DATA

The term “special categories of data” refers to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data, data concerning health or data concerning a person’s sex life or sexual orientation.

In general, we do not collect special categories of data unless you choose to provide them to us.

FOR WHAT PURPOSE AND ON WHAT LEGAL BASIS DO WE PROCESS YOUR PERSONAL DATA?

If you are a customer

• Bookings at the guesthouse, or requests for quotes you send us for certain events that are organised or may be organised.

Purpose: we process your personal data (i) to book you a place at the guesthouse (ii) to respond to requests for quotes you send us.

Legal basis: entering into a contract

• Check-in

Purpose: we process your personal data for registration/accommodation at the guesthouse.

Legal basis: at check-in, under the legal provisions in force, you are required to complete the arrival and departure registration form, which contains the minimum data needed for us to accommodate you.

• Customer service (this service covers, among other things: transport to the guesthouse, cleaning, laundry, activities held at the guesthouse, guided tours, etc.)

Purpose: we process your personal data to give you the most enjoyable experience possible, in line with your standards and those of the guesthouse.

Legal basis: performance of the contract for the provision of tourism services.

• Profiling

Purpose: in order to provide personalised services, certain special preferences of yours (for example: whether you prefer rooms on the upper or lower floors, whether you like a particular type of wine, etc.) are stored so that when you return, we will already know what you like

Legal basis: consent

• Feedback:

Purpose: we process your personal data to make sure you had a pleasant experience at the guesthouse.

Legal basis: our legitimate interest in constantly improving the services we offer and providing services that best suit and meet our customers’ standards.

• Marketing:

Purpose: we process your personal data for marketing purposes, such as commercial newsletters and marketing communications about new products and services or other offers we think may be of interest to you.

Legal basis: we rely on our legitimate interest in promoting our services by sending offers we consider may be of interest to you (see “Right to object” in the “Your rights” section)

Where required by applicable law, we will obtain your consent before processing your personal data for direct marketing purposes. In this case, please note that you may withdraw your consent to processing for marketing purposes at any time, in which case you will no longer receive any marketing communications from us.

We will include an unsubscribe link that you can use if you no longer wish to receive messages from us.

Also, when certain events are held at our guesthouse, we may take some photographs, and some of these may be shared online to show others what our events are like. In any case, because we respect your right to privacy, we will do our best to make sure you are informed that photographs will be taken (for objections regarding our photographs, see “Right to object” in the “Your rights” section).

• Other communications: by e-mail, post, telephone or SMS

Purpose: these communications will be made for a specific reason, such as: (i) to respond to your requests, (ii) if you have not completed an online booking or a request for a quote, we may send you an e-mail reminding you to complete it, (iii) to inform you how complaints and/or incidents that occurred during your stay have been resolved.

Legal basis: our legitimate interest in providing services to the desired standard by resolving any requests/complaints and assuring you of our full availability.

• Analysis, improvement and research:

Purpose: to ensure the continuous improvement in the quality of our services, we make sure to analyse every complaint/suggestion from you, and we prepare statistical reports to identify problems and find the best solutions to remedy them.

Legal basis: we rely on our legitimate interest in providing services that meet your standards.

If you are a user of our website

Purpose: monitoring traffic in order to identify errors and/or any other malfunction of the website.

Legal basis: we base this processing activity on our legitimate interest, namely providing you with a fully functional website by fixing any errors and continuously improving it.

If you are a representative or contact person of our suppliers or business partners

Purpose: managing contractual relationships with our suppliers or business partners.

Legal basis: performance of a contract.

Nevertheless, we assure you that any such processing will be carried out in accordance with this policy and by implementing measures to ensure the confidentiality of your data.

• Security:

Purpose: we process personal data for the security of property and the physical safety of individuals.

Legal basis: we rely on our legitimate interest in protecting your property and that of the guesthouse, as well as protecting the people within the guesthouse premises.

• Legal reasons:

Purpose: in certain cases, we must process the information provided, which may include personal data, in order to resolve legal disputes or complaints, for investigations and compliance with applicable legal regulations, to enforce an agreement, or to comply with requests from public authorities insofar as these requests meet the conditions imposed by law.

Legal basis: the grounds for processing may be a legal obligation (where we are legally required to disclose certain personal data to public authorities) or our legitimate interest in resolving any disputes and/or complaints.

WHO DO WE SHARE YOUR PERSONAL DATA WITH?

In order to offer you the expected level of hospitality and provide high-quality services, your data may be shared with our service providers and other third parties, as detailed below:

1. Suppliers: in order to provide the requested services, in some cases we will need to pass some of your personal data to suppliers, who act as processors and process the data on our behalf, for our account and in accordance with our instructions (such as software, IT, accounting and medical service providers).
2. Group events or meetings: if you visit our guesthouse as part of a group or an event, the information required to plan the meeting and the event may be shared with the organisers of these meetings and events and, where applicable, with the guests organising or attending the meeting or event.
3. Business partners: in certain cases, we partner with other companies to provide you with products, services or offers. For example, we may arrange car hire for you or act as an intermediary for optional services for products beyond our own offer.
4. Public authorities and/or institutions in order to: (i) comply with legal provisions, (ii) respond to their requests, (iii) for reasons of public interest (e.g. national security). For example, under the regulation set out in the section “FOR WHAT PURPOSE AND ON WHAT LEGAL BASIS DO WE PROCESS YOUR PERSONAL DATA” item b), every accommodation establishment is required to submit the arrival and departure registration forms of each guest daily.

The confidentiality of your data is important to us, which is why, where possible, personal data is shared as described above only on the basis of a confidentiality undertaking from the recipients, guaranteeing that the data is kept secure and that the information is provided in accordance with the legislation in force and the applicable policies. In any case, we will only ever share with recipients the information strictly necessary for the purpose in question.

DO WE COLLECT PERSONAL DATA FROM THIRD PARTIES?

In order to offer you the expected level of hospitality and provide the best level of service, we may collect information about you from our business partners and other third parties, as detailed below:

1. Business partners: such as card partners, social media services in line with the settings you have chosen for those services, travel agencies, event organisers

In any case, we assure you that your data collected from third parties will be processed under the same conditions as if it had been collected directly from you. We will also only collect what is necessary to fulfil our purposes (see the section “FOR WHAT PURPOSE AND ON WHAT LEGAL BASIS IS YOUR PERSONAL DATA PROCESSED?”).

In addition, when we contact you for the first time, we will first inform you of the source from which we obtained your personal data.

DO WE TRANSFER YOUR PERSONAL DATA OUTSIDE THE EU/EEA?

We may transfer your data to some suppliers based in countries other than the one you are in and, in some cases, in countries outside the EU/EEA.

Although the data protection laws in these countries may differ from those in your country, we will take the necessary measures to ensure that your personal data is processed in accordance with this policy and with applicable legislation.

PROVIDING US WITH THE PERSONAL DATA OF OTHER INDIVIDUALS

If you provide us with the personal data of other individuals, please inform them before doing so and tell them how their data will be processed, as described in this privacy policy.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

Your personal data is kept for as long as necessary to fulfil the purposes detailed in this policy, unless a longer retention period is required or permitted by applicable law.

We constantly review the need to keep your personal data, and where processing is no longer necessary and there is no legal obligation to keep your personal data, we will delete/destroy your personal information as soon as possible and in a way that means it cannot be recovered or reconstructed (for example, we will delete/destroy all data of people who were not hired following interviews, unless there is a serious prospect of employment in the future).

If personal information is printed on paper, it will be destroyed in a way that ensures it is completely eliminated, and if it is stored on electronic media, it will be deleted by technical means to ensure that the information cannot later be recovered or reconstructed.

WHAT ARE YOUR RIGHTS?

As a data subject, you have the following rights under the GDPR:

1. Right of access: you can ask us for (i) confirmation as to whether or not personal data is being processed and, if so, access to that data and information about it, and (ii) a copy of the personal data we hold about you (Art. 15 GDPR);
2. Right to rectification: you can inform us of any change to your personal data or ask us to correct the personal data we hold about you (Art. 16 GDPR);
3. Right to erasure (“right to be forgotten”): in certain situations (for example (i) where the data was collected unlawfully, (ii) the retention period for the data has expired, (iii) you have exercised your right to object, or (iv) the processing was based on consent and you have withdrawn your consent), you can ask us to delete the personal data we hold about you (Art. 17 GDPR);
4. Right to restriction of processing: in certain situations (for example, where you contest the accuracy of the data or the lawfulness of the processing), you can ask us to restrict the processing of your data for a certain period (Art. 18 GDPR);
5. Right to data portability: to ask us to send your personal data to a third party or directly to you (Art. 20 GDPR);
6. Right to object: in certain situations (for example, processing based on legitimate interest), you can ask us to stop processing your data (Art. 21 GDPR).
7. Where we use your personal data on the basis of your consent, you have the right to withdraw that consent

Where we use your personal data on the basis of your consent, you have the right to withdraw that consent at any time. In that case, we will no longer process your data, unless a legal provision requires us to retain and archive it. In any case, we will inform you if such a legal provision exists and will state it explicitly.

IS YOUR DATA SAFE?

We take your personal security seriously, which is why we take significant security measures to protect against unauthorised access to data or unauthorised alteration, disclosure or destruction of data. This involves internal reviews of our data collection, storage and processing practices and security measures, as well as physical security measures to protect against unauthorised access to the systems where we store personal data.

We also require our service providers and business partners to take all necessary measures to protect against unauthorised access to data or unauthorised alteration, disclosure or destruction of data.

LINKS TO OTHER WEBSITES

Our website contains links to third-party websites. Please note that we accept no responsibility for the collection, use, retention, sharing or disclosure of data or information by such third parties. If you use or provide information on third-party websites, the terms and privacy policy of those websites apply. We advise you to read the privacy policy of the websites you visit before submitting any personal data.

Use of the internet services provided by Element Guesthouse is subject to the terms of use and privacy policy of the internet service providers. You can access those terms and policies using the links on the login page of the respective service or by visiting the internet service provider’s website.

QUESTIONS OR COMPLAINTS

If you have any questions or concerns about the processing of your personal data, or if you wish to exercise any of the rights mentioned above, you are welcome to contact us by sending an e-mail to the following address: pensiuneaelement@gmail.com, and we will reply within 30 days of receiving your request.

Also, if you do not have access to electronic means or do not wish to use them, you can submit a written request at (i) the address 2A Mircea Eliade Street, Alba Iulia

If you are not satisfied with how your request has been handled, you can file a complaint with the National Supervisory Authority for Personal Data Processing.

CHANGES TO THIS POLICY

This privacy policy may change from time to time in line with changes to data protection legislation or based on changes to our services or the way we are organised. If we make material changes to it, we will publish a link to the revised policy on the home page of our website. If we make significant changes that will affect your rights and freedoms (for example, when we start processing your personal data for purposes other than those specified above), we will contact you before starting such processing.

To help you keep track of the most important changes, we will include a change history below to acknowledge the changes made to this policy.