Personal Data Protection and Processing
This document provides the information on what type of personal data we need and how we process it. This information is regularly updated. The information on processing your personal data is published at our website: www.ruzbachy.sk.
Your personal data are processed pursuant to Act No 18/2018 Coll. on Personal Data Protection, as amended, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and applicable regulations.
Controller: KÚPELE VYŠNÉ RUŽBACHY, a.s., Vyšné Ružbachy 48, 065 02 Vyšné Ružbachy, ID: 31714501, e-mail: marketing@ruzbachy.sk
Contact for matters regarding personal data protection: marketing@ruzbachy.sk
KÚPELE VYŠNÉ RUŽBACHY, a.s., Vyšné Ružbachy 48, 065 02 Vyšné Ružbachy, ID: 31714501
Methods of personal data processing, its scope and storage periods vary depending on a purpose of collection thereof.
Personal data of clients/patients that is required for the provision of services
Data we need:
Contact data and data required for the purpose of provision of health care and spa care:
· Name, surname, academic degree, street and number, postal code, city, date of birth, birth registration number and phone number;
· Data on a health condition (processing operations: Medical Data Records, Register of Accommodated Guests, Register Administration, Accounting Documents, Complaints, Litigations, Requests for Information).
Information and data specified in Act No 153/2013 Coll. on the National Health Information System, insurer numerical codes, as well as important epidemiological facts, if required.
We process all personal data pursuant to special healthcare legislation, and we use them exclusively for the purpose of the proper provision of spa treatments, keeping medical records and provision of accommodation and board services.
Pursuant to the legislation, we are obliged to store personal data for 20 years after the provision of spa care.
The provision of spa care is conditioned by collecting personal data from our guests.
Your personal data are transferred in compliance with special healthcare legislation, primarily to health insurance agencies and the National Health Information System.
Processors:
Some of the personal data may be processed, under contractual instructions, by the technical support of software and IT suppliers.
Accommodation services
Identification and contact data:
· Name, surname, academic degree, address, ID card no., date of birth, place of birth of a foreigner, accommodation duration, nationality of a foreigner, purpose of a stay of a foreigner, passport number of a foreigner, visa number of a foreigner, names a surnames of children of a foreigner, data on provided accommodation, car registration plates, data on things lost and found, signature of a foreigner.
Your personal data are processed pursuant to special legislation, primarily Act No 253/1998 Coll. on Reporting of Citizen Residency and the Registry of Residents of the Slovak Republic and Act No 404/2011 Coll. on Stay of Aliens, for the following key purposes:
· Registration of accommodated guests;
· Keeping accounting records;
· Processing declarations of honour;
· Reviews, complaints and the Book of Suggestions;
· Registration of parked vehicles.
Pursuant to the legislation, we are obliged to store the data for 10 years of the year when the accounting documents are issued.
Accommodation services may only be provided if such data are provided.
Your personal data are transferred strictly in compliance with the law to the Ministry of Interior of the SR, Police of the SR, Vyšné Ružbachy Municipality Office and other entitles that are entitled to receive it under the law.
Processors:
Some of the personal data may be processed, under contractual instructions, by the technical support of software and IT suppliers.
Accommodation services may only be provided to persons older than 18 years. Minors may only use our services upon consent of their parents.
Orders and reservations
Identification and contact data:
· Name, surname, academic degree, address, phone number, e-mail address, reservation data, IP address and browser of a used device, date and time of ordering.
Your personal data are processed under a service agreement and within the performance of pre-contractual obligations for the following purposes:
· Registration of accommodation reservations;
· Time management and schedules of therapeutic procedures and therapies;
· Processing of orders, reservations, vouchers etc.;
· Keeping accounting books.
We are obliged to store the provided personal data for 12 months after processing an order/a reservation. Under the law, we are obliged to store the accounting documents for 10 years after the year when they are issued.
Without collecting such data we are not allowed to process a reservation/an order.
Processors:
Some of the personal data may be processed, under contractual instructions, by the technical support of software and IT suppliers.
Orders/reservations of services may only be provided to persons older than 18 years. Minors may only use our services upon consent of their parents.
Newsletter
Personal data we process:
· E-mail address, name, surname, date of birth, IP address and browser of a device, subscription date and statistics of opening the newsletter.
We process such personal data on the basis of a legitimate interest and upon your consent. You are at any time entitled to revoke your consent to receiving the newsletter.
We store the provided data for 10 years of the consent date or of the last provision of services.
Provision of data for the purpose of receiving the newsletter and marketing information is optional.
Some of the personal data may be processed, under contractual instructions, by the technical support of software and IT suppliers and of a provider of marketing services.
Communication
Identification and contact data:
· Name, surname, academic degree, address, phone number, e-mail address and data contained in the received and sent documents.
We process such personal data on the basis of legitimate interests by applying various methods: via an e-mail, by phone, by post and via social networks. Registered received and sent communications are processed as prescribed by law.
The collected and provided data are stored until the subject of the communication is resolved.
Registered received and sent communications are stored as prescribed by law, i.e. for 10 years after the year when they are resolved. Upon expiry of the statutory storage period, the provided data is deleted.
Some of the personal data may be processed, under contractual instructions, by the technical support of software and IT suppliers and of a provider of marketing services.
The camera system and security monitoring
Personal data includes video recordings in which persons may be identified.
The monitoring with the camera system producing video recordings is performed on the basis of a legitimate interest, primarily for safety reasons and for the protection of property.
The monitored areas in the spa resort are labelled as prescribed by law and relevant regulations.
Video recordings are stored for 14 days of the recording dates.
Video recordings are only shared as prescribed by relevant law, primarily with courts and law enforcement authorities.
Recording telephone calls
Identification and contact data:
· Name, surname, academic degree, address, phone contact, e-mail address and phone number.
Telephone calls are recorded on the basis of a legitimate interest for the purpose of increasing the quality of services, raising claims and registration of communication.
Recordings are stored for 3 months of the recording dates.
Provision of data is optional.
Some of the personal data may be processed, under contractual instructions, by the technical support of software and IT suppliers and of a provider of marketing services.
Making photographs and recording promotional videos
Personal data include photographs, video recordings and joint photographs at events.
Promotional materials are produced continuously on the basis of a legitimate interest of the company. Provision of such data is optional and you are entitled to object to it.
Such data are stored for 5 years.
Provision of such data is optional and has no effect on the provision of other services.
Some of the personal data may be processed, under contractual instructions, by the technical support of software and IT suppliers, photographers, suppliers of graphical materials and printed media, and of a provider of marketing services.
Such data may be published at our websites, on social networks and in marketing materials.
Personal data of job applicants
Identification and personal data:
· Name, surname, academic degree, qualification, practical experience, e-mail address, phone number and address.
Personal data are processed as prescribed by law and registry administration rules.
Rights of data subjects are defined in Sections 19–28 of Act on Personal Data Protection and our company is committed to respecting these rights.
Data subjects have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed.
Data subjects have the right to be informed of the appropriate safeguards relating to the transfer pursuant to Section 48(2–4) if personal data are transmitted to a third country or an international organisation.
Controller is obliged to provide data subjects with their personal data that is being processed.
Data subjects have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.
Data subjects have the right to obtain from the controller the erasure of personal data concerning him or her.
Data subjects have the right to obtain from the controller restriction of processing if the controller failed to substantiate the purpose of processing personal data.
Data subjects have the right to obtain from the controller the personal data concerning them which they provided to the controller.
Data subjects have the right to object to processing their personal data.
Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling, which have legal consequences that apply to them or have similar important effects.
Method of exercising rights
You may exercise your rights by sending a written request to the following address:
KÚPELE VYŠNÉ RUŽBACHY, a.s.
Vyšné Ružbachy 48
065 02 Vyšné Ružbachy;
or via an e-mail to the e-mail address: marketing@ruzbachy.sk. Information on personal data is provided without any delay and free of charge. If you believe that processing your data is in conflict with these GTC or the law, you may send your appeal to the supervisory authority, the Office for Personal Data Protection of the Slovak Republic, to its postal address: Úrad na ochranu osobných údajov SR, Hraničná 12, 820 07 Bratislava 27, or to its e-mail address: statny.dozor@pdp.gov.sk
The principle of accountability (Section 12 of Act on Personal Data Protection)
Any employee who processes personal data shall be held accountable for the safety of personal data by protecting it against theft, loss, damage and destruction, against making it available to unauthorised persons, changing and disseminating (publishing) it. Any employee who has access to personal data within the performance of their occupational duties is accountable for the safety of personal data and shall, in particular, protect it against distribution, unauthorised access, loss and theft.
Processing personal data by our company shall be legal and such legality shall be ensured by conducting it on the basis of at least one of the following legal bases:
a) A data subject expressed their consent to processing their personal data for at least one particular purpose;
b) Processing of personal data is necessary for the purpose of performance of an agreement to which the data subject is a party or for the purpose of implementing a measure prior to the conclusion of the agreement based on a request of the data subject;
c) Processing of personal data is necessary under a special regulation or an international treaty which is binding for the Slovak Republic;
d) Processing of personal data is necessary for the purpose of protecting life, health or property of the data subject or any other natural person;
e) Processing of personal data is necessary for the purpose of performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
f) Processing of personal data is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child; that legal basis should not apply to the processing by public authorities in the performance of their tasks. The company processes personal data so that their processing and registration is adequate, relevant and limited only to a scope that is necessary for the purpose for which it is processed.