Infotext for Customers of CPI Hotels, a.s. on Personal Data Processing

This document provides all the essential details required under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the “GDPR”) regarding your personal data as processed by CPI Hotels, a.s., ID No.: 47116757, with its registered office at Bečvářova 2081/14, 100 00 Prague 10, registered in the Commercial Register at Prague Municipal Court, under file No. B 1914 (“CPI Hotels” or “us”).

CPI Hotels is represented on the market by the following brands: Budha-Bar Hotel Prague, Clarion Hotels, Comfort Hotels, Mamaison Hotels & Residences, Spa & Kur Hotels, Fortuna Hotels, Private Label Hotels, Ubytovny.cz and Benada Restaurant.

1. What data do we process?

A) Customer data

Based on your reservation (or a stay without a reservation), we process your personal data to the following extent:

• identification and contact details (full name, permanent residential address, identification card number or the number of a similar document, as well as email address and phone number),
• in the case of entrepreneurs who are natural persons, we also record their designation as a natural person doing business, registered office, Identification Number, tax ID number and any VATrelated data,
• for business trips carried out by nonentrepreneurs, we also record details of the organisation that reserved or paid for their stay,
• details about the purpose of the trip, specifically if the customer is a person subject to spa or recreation fees,
• information about your membership in the loyalty program,
• details concerning your stay and the services you use, as well as the amount and method of payment for such services provided (a bank account number or payment card details if noncash payment is made),
• in the case of foreign nationals, the data above is expanded to include their date of birth, nationality, the number of their passport or travel document, visa number and their permanent residential address abroad,
• the registration plates of vehicles of those guests who park at our hotels, are also recorded.

In addition to accommodation, we also provide spa treatments at our Spa & Kur Hotels. For guests using these treatments, we also process the following data:

• data related to your diagnoses obtained directly from you by our physician during your initial medical exam,
• details of the medical procedures provided to you at our facilities during a treatment stay (medical exam, any medical complications occurring during your stay, etc.)

B) Photographic documentation of events organised

We take a reasonable volume of photographs (event shots) at our organised events and selected photos are subsequently published on our website for the promotional purposes of CPI Hotels. The main purpose is not to obtain pictures of the guests at each event, but rather to capture the general atmosphere at each event; we do not publish close-ups and do not add descriptions of the specific persons in attendance at each event. According to the opinion of the Office for Personal Data Protection, this is not primarily a data privacy issue, but rather an issue concerning the protection of privacy under the Civil Code; therefore, we are not required to ask for consent to process personal data for “illustrative" images.

Those in attendance are warned of the fact that photographic documentation is being taken by a camera pictogram, our photographers are clearly identified at all times, and photographic documentation is only taken at the main venue of the event; visitors always have the option to remain in areas where no photographic documentation is taken. Please do not hesitate to contact us using any of the contact information provided below if you have any questions or concerns about the taking of photographs.

2. On what basis and for what purpose do we process your personal data?

A) Processing necessary to comply with legal obligations

Provision and processing all of the above personal data, with the exception of an e-mail address and phone number and any information concerning your membership in a loyalty program, is necessary for fulfilment of our legal obligations, especially those under the Act on Local Fees and the Act on the Residence of Foreigners in the Czech Republic, and also under accounting and tax regulations.

B) Processing necessary to fulfil a contractual arrangement

The processing of your identification data and data concerning your stay and the services provided, as well as the amount and method of their payment, is necessary for the purpose of fulfilling the contractual arrangement concerning your stay, and specifically your order and reservation, the conclusion and fulfilment of any contracts concerning the offered and provided accommodation, catering and related services.

For spa treatments, we process the data provided in your registration card, as well as information on your completed therapeutic stays, the healthcare treatments provided to you at our facilities and payment details for your stay. We process these data based on the legal relationship established between you and CPI Hotels for the provision of therapeutic spa and rehabilitation treatments and related services (accommodation, catering, etc.). These data are processed so that we can provide these services.

Consequences of failure to provide data

Failure to provide the aforementioned data means that we cannot provide you with our accommodation services. We do not require your personal information to provide catering and other services and therefore we do not obtain and process your personal data for this purpose.

C) Processing necessary for our legitimate interests

Your personal data in the scope of your full name, e-mail address and information concerning your stay is processed on the basis of our legitimate interest for the purposes of direct marketing; the purpose of such processing is exclusively the ability to send you marketing communications and specifically information regarding interesting news, discounts, etc. that are similar and relate to our services you have already used.

You can reject the sending of marketing communications in advance. In the event of the sending of marketing communications, at any time you can object to the processing of your personal data for the purposes of sending marketing communications and we will stop sending them.

We also process personal data in this scope for the purposes of sending out satisfaction questionnaires after stays at our hotels to verify your satisfaction with our services and to consistently improve the quality of the services we provide you with.

There are no cases where guests question the standard or spa care services provided in our hotels. Should such a case arise, we would be forced to process data on the services provided to the extent necessary to conduct such a dispute, solely for the purpose of protecting our rights in said dispute. In a similar manner, we would be forced to process the necessary data also in the event of non-payment for our services or in the event we suffer damage.

D) Processing based on consent

Based on your consent or configuration of permissions used by the application in your web browser, we process technical information obtained during visits to our websites – see the separate infotext available at www.cpihotels.com/cookies.

We offer wi-fi services, and you can choose between a paid connection option and a free connection option. In the event of connection, you can grant your consent to CPI Hotels using data about your e-mail address for the purposes of sending marketing communications for services similar and related to those that you used.

You can withdraw your consent at any time in an e-mail with a marketing communication or by sending notice rescinding consent to our address (CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10) or by email to dp@cpihotels.com. The withdrawal of consent will come into force upon its delivery to CPI Hotels. The rescinding of consent does not affect the legality of any processing based on the consent prior to it being rescinded.

E) Processing of your data by automated means

Under no circumstances do we perform any automated decision-making or any other automated processing of your personal data that would have any legal consequences or otherwise significantly impact you in any way.

3. Source of personal data

We obtain the above data from you personally, in connection with contract negotiations and the provision of accommodation and catering services;

or

if your reservation for our services was arranged by another person (typically your employer in the case of business trips), we obtain your identification and contact data directly from such person;

or

in the case of reservations input through reservation portals, your identification and contact data are handed over by the reservation portal.

4. How long do we process your personal data for?

We process your personal data for the duration of your stay at our hotel. Once it is over, we will only process the following:

- Data that we are under obligation to process by law, for the length of time required by law only (e.g. the accounting and tax documents we issue to you will also contain certain personal data regarding you, such as your full name, type of service provided, document issue date. We retain these documents for the sole purpose of fulfilling the obligations established in the relevant accounting and tax legislation, for the period set out in those regulations only.)

- Your full name, email address and information about your stay, for the direct marketing purposes of CPI Hotels (to send communications on news and discounts on our services, etc.) and to send satisfaction surveys. The data we process to send satisfaction surveys is only processed until the surveys have been evaluated.

- Data necessary for the purposes of existing or actually pending disputes. We only process such data until such time a valid decision is made in the dispute and until such time that the obligations arising from such a decision are met or until such time that a dispute may occur regarding services provided, as specified under valid legislation.

- We process cookie and log data for the period that is stated in information about cookies on individual websites of hotels under the CPI Hotels banner.

We regularly erase your personal data after the expiration of such periods, including data in electronic and paper form.

5. Who do we provide access to your personal data or transfer it to?

A) Transmission to third parties

We disclose your personal data to public authorities to whom there is an obligation to provide such data under valid and effective legislation (this is typically data that we process under the Act on Local Fees or on the basis of the Act on the Residence of Foreigners in the Czech Republic) and as a part of the hotel partner network.

In the case of spa treatment services, we do not disclose your personal data to anyone, and our physicians and other medical personnel are employees of CPI Hotels.

B) Processors

We use the services of processors which provide certain support services (e.g. sending marketing communications, improving communication and offer segmentation, providing online hotel bookings and processing cookies). This always involves processing carried out exclusively for our company and on the basis of our instructions. We always select the processors with regard to the trustworthiness and quality of their services, including the security of the personal data processed. Processing is only possible on the basis of a contract concluded between CPI Hotels and the processor which binds the processor to the same degree of personal data protection as CPI Hotels provides itself. We will inform you about the processors we are currently working with upon request.

C) Transfer abroad

Our processors have their registered offices and their personal data processing sites in the Czech Republic or in other EU countries. Only in the case of sending and evaluating satisfaction surveys and in the case of some reservation systems do we use processors in the territory of the USA. They are always reputable companies in the field of international hotel, reservation and similar networks, providing services for hotels throughout the world.

We will not transmit your personal data outside of the EU under any circumstances other than those specified above.

6. How do CPI Hotels protect personal data

Everybody from our organisation who comes into contact with personal data is obliged to maintain confidentiality regarding the personal data processed, including the security measures aimed at protecting them. This obligation also remains in place, if an individual’s employment with CPI Hotels or the processor is terminated.

7. Your rights under valid legislation

You have the following rights under valid personal data protection legislation:

- the right to access to your personal data which we process; this includes the right to acquire the following information from CPI Hotels:

• confirmation that CPI Hotels has processed your personal data;
• access to such personal data;
• information regarding the purpose of the processing;
• the categories of personal data involved;
• information about the recipients or categories of recipients with access to your personal data;
• the planned archiving period or the criteria for its definition;
• the existence of the right to request the rectification or deletion of personal data or to otherwise restrict its processing and the right to object to any such processing;
• the right to file a complaint with the supervising authority;
• all available information regarding the sources of the personal data, if it has not been obtained from you as the data subject;
• whether any automated decision-making or profiling takes place;
• suitable guarantees, if your personal data has been transferred outside the EU;
• a copy of your personal data, as long as this does not affect the rights and freedoms of others.

- the right to rectification of your personal data if it is in any way incorrect, inaccurate or incomplete; the rectification will be undertaken by CPI Hotels without any undue delay based on the available technical options;

- the right to the erasure of your personal data in the cases set out in the GDPR, for example, if you have withdrawn your consent to processing of the data or if you have objected to the processing thereof, in the case of any unlawful processing of personal data, in cases where personal data are no longer necessary for the purpose of their processing and so on. You can therefore request the erasure of your personal data in these cases. However, this option does not apply if the processing is necessary to fulfil legal obligations and under certain other cases provided for by the GDPR.

- the right to request the restriction of the processing of your personal data in the cases foreseen by the GDPR, such as when you dispute the accuracy of the personal data, object to the processing thereof and so on.

- the right to the portability of the data that you provided us with and that we have processed using automated processing either on the basis of your consent or on the basis of the essential nature of the processing for the fulfilment of a contract with you or for the realisation of any measures adopted at your request prior to the conclusion of the contract. In such cases, we will enable you to acquire your personal data in a structured, regularly used and machine-readable format or, if it is technically feasible, we will make it available to your designated administrator,

- the right to object to the processing of your personal data based on the necessity of the processing for the purposes of legitimate interests, including any processing for the purposes of direct marketing. If we are unable to provide serious and legitimate reasons for the processing that outweigh your interests or rights and freedoms or for the determination, enforcement or defence against any legal claims, we will not continue to process your personal data in such cases.

- the right to withdraw your consent to the processing of your personal data at any time by sending explicit notification to our address (CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10) or by email to dp@cpihotels.com. The withdrawal of consent will come into force upon its delivery to CPI Hotels. According to the GDPR, the withdrawal of consent does not affect the lawfulness of any processing based on the consent prior to it being withdrawn.

- the right not to be the subject of any decision based exclusively on automated decision-making, including profiling which has binding legal effects for you or substantially affects you in a similar way, with the exception of the cases expressly set out in the GDPR;

- in addition to the aforementioned, if you are of the opinion that the processing of your personal data is at odds with the GDPR, you are entitled to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection based at Pplk. Sochora 27, 170 00 Prague 7.

8. Our contact details

If anything is unclear or you have any questions regarding the processing of your personal data, please feel free to contact us at any time by sending us a letter to the address of CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10, or to the e-mail address of our data protection officer dpo@cpipg.com.

9. CPIPG Group

CPI Hotels is part of the CPI Property Group (“CPIPG”). You can find the CPIPG data protection policy here: https://cpipg.com/en/data-protection-policy.