http___www.uhpa.hr_o-nama_zastita-privatnosti-5b0d5aff4bb49_politika-zastite-osobnih-podataka-5b0e8495a935c_1.xml
1.1 2.1 3.1 3.2 3.3 3.4 4.1 5.1 5.2 5.3 6.1 7.1 8.1 9.1 10.1 11.1 13.1 14.1 15.1 15.2 15.3 16.1 17.1 18.1 22.1 23.1 24.1 24.2 24.3 24.4 24.5 25.1 26.1 27.1 28.1 29.1 30.1 31.1 31.2 31.3 32.1 33.1 33.2 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 43.2 43.3 43.4 43.5 44.1 44.2 44.3 44.4 44.5 45.1 46.1 47.1 48.1 48.2 48.3 48.4 48.5 48.6 48.7 48.8 48.9 48.10 48.11 49.1 50.1 50.2 50.3 50.4 51.1 52.1 53.1 54.1 54.2 54.3 54.4 54.5 54.6 54.7 54.8 55.1 55.2 55.3 55.4 55.5 55.6 55.7 55.8 55.9 55.10 55.11 56.1 57.1 57.2 57.3 57.4 58.1 58.2 59.1 60.1 61.1 62.1 63.1 63.2 63.3 63.4 63.5 63.6 63.7 63.8 63.9 63.10 64.1 65.1 65.2 65.3 65.4 65.5 65.6 65.7 65.8 65.9 66.1 67.1 68.1 69.1 69.2 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 77.2 77.3 77.4 77.5 77.6 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 88.2 88.3 88.4 88.5 88.6 89.1 90.1 90.2 90.3 90.4 90.5 90.6 90.7 90.8 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 101.1 101.2 101.3 101.4 101.5 101.6 102.1 103.1 103.2 103.3 103.4 103.5 104.1 105.1 106.1 106.2 106.3 106.4 106.5 106.6 106.7 106.8 106.9 106.10 106.11 106.12 106.13 106.14 106.15 106.16 106.17 107.1 108.1 108.2 108.3 108.4 108.5 108.6 108.7 109.1 110.1 110.2 110.3 110.4 110.5 110.6 111.1 112.1 112.2 112.3 112.4 112.5 112.6 112.7 112.8 112.9 113.1 113.2 113.3 113.4 113.5 113.6 113.7 113.8 114.1 115.1 115.2 115.3 116.1 117.1 117.2 117.3 117.4 117.5 118.1 118.2 119.1 120.1 121.1 122.1 123.1 124.1 125.1 126.1 127.1 127.2 127.3 128.1 129.1 130.1 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1 139.1 140.1 141.1 142.1 143.1 144.1 145.1 146.1 147.1 148.1 148.2 149.1 149.2 150.1 150.2 150.3 150.4 151.1 152.1 153.1 153.2 153.3 153.4 153.5 153.6 154.1 154.2 154.3 155.1 155.2 155.3 156.1 157.1 157.2 157.3 158.1 158.2 158.3 159.1 159.2 160.1 161.1 161.2 161.3 161.4 162.1 163.1 164.1 165.1 165.2 166.1 167.1 168.1 168.2 168.3 168.4 169.1 170.1 170.2 170.3 170.4 171.1 172.1 173.1 174.1 175.1 176.1
Private Policy Data Protection DSGVO (from 28. We are very pleased about your interest in our company. Data protection is of particular importance to the management of MOROSANI HOTELS DAVOS ("we", "us" and "our" are interpreted accordingly). We are the operators of the website ("Site") www.morosani.ch and therefore responsible for the collection, processing and use of your personal data and the compatibility of data processing with the applicable data protection law. Of course, we observe the legal provisions of the Federal Data Protection Act (DSG), the Federal Data Protection Act (VDSG), the Telecommunications Act (FMG) and other applicable data protection provisions under Swiss or EU law, in particular the General Data Protection Regulation (DSGVO). WHAT IS THIS PRIVACY POLICY IS FOR? This Privacy Policy gives you information about how we will use personal data and other private information that we collect from you as a user of this Site, or hotel guest or customer of The MOROSANI HOTELS DAVOS (“you” or “your” being interpreted accordingly). When we refer to ‘personal data’ in this Privacy Policy it means any information that relates to you from which you can be identified. This Privacy Policy governs the processing of your personal data, including in connection with your use of our Site, so please read it carefully. Name and Address of the controller Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection is: MOROSANI HOTELS DAVOS Promenade 50 CH-7270 Davos Platz Schweiz Email: reservations@morosani.ch Website: www.morosani.ch Based on Art. 27 GDPR, AG Hotels Schweizerhof and Post Davos have appointed an EU Data Protection Representative. For all questions related to European data protection contact our EU Data Protection Representative: EU-Datenschutz-Vertreter ADVOVOX Rechtsanwalts GmbH Sven Krüger Arkonastr. D-13189 Berlin E-Mail: gdpr@advovox.de WHAT PERSONAL DATA MAY WE COLLECT? When you access our website, information of a general nature is automatically recorded. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your Internet service provider and the like. This is only information that does not allow conclusions about your person. This information is technically necessary to correctly deliver the contents of web pages requested by you and is mandatory when using the internet. Anonymous information of this kind is statistically evaluated by us, in order to optimize our Internet appearance and the technology behind it. We may collect the following personal data about you: - The personal details you provide (such as name, address, e-mail address, business address and phone number) when submitting an enquiry, reservation request or membership application. - Personal details you choose to give when corresponding with us by phone, e-mail, or that you provide to us when you visit The MOROSANI HOTELS DAVOS. - Any other personal or private information about you that you choose to submit to this Site or any other websites we operate. - Information about other guests included in your booking details. - Information about your preferences (e.g. advertising interests, cookie data, clickstream data, browsing history, responses to direct marketing, and opt-outs from direct marketing) and any information provided to us by third parties. As the controller, the MOROSANI HOTELS DAVOS has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g. by telephone. USE OF OUR WEBSITE When visiting our website, our servers temporarily store every access in a log file. The following technical data will be collected by us, as always with every connection to a web server, without your intervention and stored by us after 7 days until automated deletion: - the IP address of the requesting computer, - the name of the owner of the IP address range (i.d.R., your internet access provider), - the date and time of access, - the website from which the access was made (referrer URL), if applicable, with the search term used, - the name and URL of the retrieved file, - the status code (for example, error message), - the operating system of your computer, - the browser you are using (type, version and language), the transmission protocol used (e.g., HTTP / 1.1) and - If applicable, your username from a registration / authentication. The collection and processing of this data is for the purpose of facilitating the use of our website (connection establishment), to ensure the long-term security and stability of the system and to optimize our Internet offerings and for internal statistical purposes. This is our legitimate interest in the processing of data within the meaning of Art. 6 para. 1 lit. f DSGVO. The IP address will also be evaluated together with the other data in case of attacks on the network infrastructure or other unauthorized or abusive website use for information and defense and, where appropriate, in criminal proceedings for identification and civil and criminal proceedings against the users concerned used. This is our legitimate interest in the processing of data within the meaning of Art. 6 para. 1 lit. f,b DSGVO. COOKIES For detailed information on the cookies we use, please see our Cookie Policy. REGISTRATION ON OUR WEBSITE When registering for the use of our personalized services, some personal information will be collected, such as name, address, contact and communication information such as telephone number and e-mail address. If you are registered with us, you can access content and services that we offer only to registered users. Registered users also have the option of changing or deleting the data specified during registration at any time. Of course, we also provide you with information about the personal data we hold about you at any time. We are happy to rectify or delete these at your request, as far as no statutory storage requirements preclude. To contact us in this context, please use the contact details given at the end of this Privacy Policy. When the request is done, the data will be deleted. This is our legitimate interest in the processing of data within the meaning of Art. 6 para. 1 lit. f,b DSGVO. SUBSCRIPTION & NEWSLETTER On our website, users are given the opportunity to subscribe to our company newsletter. Which personal data are transmitted to the data controller when the newsletter is ordered results from the input mask used for this purpose. This requires a registration. As part of the registration, the following data must be provided: - Salutation - First and Last Name - E-mail address The above data is necessary for data processing. We process this data exclusively to personalize the information and offers you have received and to better align it with your interests. By registering you give us your consent to the processing of the given data for the regular sending of the newsletter to the address you have specified and for the statistical evaluation of the user behavior and the optimization of the newsletter. This consent constitutes, within the meaning of Art. 6 para. 1 lit. a DSGVO is our legal basis for the processing of your e-mail address. We are entitled to commission third parties with the technical handling of advertising measures and are entitled to pass on your data for this purpose (see section 13 below). The personal data collected in the context of registering for the newsletter will be used exclusively to send our newsletter. Subscribers to the newsletter may also be notified by e-mail if this is necessary for the operation of the newsletter service or registration, as might be the case in the event of changes to the newsletter or technical changes. Subscription to our newsletter may be terminated by the person concerned at any time. The consent to the storage of personal data that the data subject has given us for the newsletter dispatch can be revoked at any time. For the purpose of revoking the consent, there is a corresponding link in each newsletter. At the end of each newsletter you will find a link where you can unsubscribe at any time. As part of the deregistration you can voluntarily inform us of the reason for the deregistration. We will periodically delete the information you provide when we are confident that no business relationship will be established between you and us. Reserved are statutory retention periods. Any further processing will only be done anonymously to optimize our newsletter. It is also possible to unsubscribe from the newsletter at any time, directly on the controller's website, or to inform the controller in a different way. CONTACT FORM Our website contains information that enables a quick electronic contact to our company, as well as direct communication with us, which also includes a general address of the so-called electronic mail (e-mail address). If a data subject contacts the controller by e-mail or via a contact form, the personal data transmitted by the data subject are automatically stored. Such personal data transmitted on a voluntary basis by a data subject to the data controller are stored for the purpose of processing or contacting the data subject. There is no transfer of this personal data to third parties. You have the option to use a contact form to contact us. For this we need the following information: - Contact subject - First and Last Name - E-mail address - Message We use this data as well as a voluntarily given telephone number only to answer your contact request in the best possible and personalized way. The processing of this data is therefore within the meaning of Art. 6 para. 1 lit. b DSGVO is required for the implementation of precontractual measures or is in our legitimate interest in accordance with Art. 6 para. 1 lit. f DSGVO. We will periodically delete the information you provide when we are confident that no business relationship will be established between you and us. Reserved are statutory retention periods. APPLICATIONS & APPLICATION PROCEDURE The data controller shall collect and process the personal data of applicants for the purpose of the processing of the application procedure. The processing may also be carried out electronically. This is the case, in particular, if an applicant submits corresponding application documents by e-mail on the website to the controller. If the data controller concludes an employment contract with an applicant, the submitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. If no employment contract is concluded with the applicant by the controller, the application documents shall be erased after notification of the refusal decision, provided that no other legitimate interests of the controller are opposed to the erasure. This is our legitimate interest in the processing of data within the meaning of Art. 6 para. 1 lit. b DSGVO. PROVISION OF PAID SERVICES To provide paid services we ask for additional data, such as: Payment details. Opening a customer account To make reservations on our website, you can order as a guest or create a customer account. When registering for a customer account, we collect the following data: - Salutation - First and Last Name - Mailing address - Date of birth - Phone number - E-mail address - Password The collection of these and other data voluntarily provided by you (eg company name) is done for the purpose of providing you with password-protected direct access to your basic data stored with us. You can view your past and current bookings or manage or change your personal information. The legal basis for the processing of the data for this purpose lies in the consent given by you pursuant to Art. a,b GDPR. We will periodically delete the information you provide when we are confident that no business relationship will be established between you and us. Reserved are statutory retention periods. Booking on the website, by correspondence or by phone call If you make bookings either via our website, by correspondence (email or letter post) or by telephone call, we need the following data for the execution of the contract: - Salutation - First and Last Name - Mailing address - Date of birth - Phone number - Language - Credit card information - E-mail address We will only use this information and other information voluntarily provided by you (eg expected time of arrival, motor vehicle license plate, preferences, remarks) to process the contract, unless otherwise stated in this privacy statement or you have not specifically consented thereto. We will process the data by name in order to record your booking as requested, to provide the booked services, to contact you in case of any uncertainties or problems and to ensure the correct payment. The legal basis for data processing for this purpose lies in the fulfillment of a contract pursuant to Art. 6 para. 1 lit. b DSGVO. PAYMENT INFORMATION Any credit/debit card payments and other payments you make through this Site will be processed by our third party payment provider, and the payment data you submit will be securely stored by us. We may also store and use this card or payment information for the purpose of processing any future payments that you make for additional goods and services. We will store this data in accordance with our legal obligations under applicable law and only for so long as legally permitted. You may choose to opt-out of us, or our service providers, holding your card or payment data, although this means that you will need to re-supply us with card/payment details to initiate any future bookings. This is our legitimate interest in the processing of data within the meaning of Art. 6 para. 1 lit. b DSGVO. DATA PROCESSING IN CONNECTION WITH YOUR STAY Data processing to fulfill legal reporting obligations Upon arrival at our hotel, we may need the following information from you and your escorts: - First and Last Name - Postal address and canton - Date of birth - Place of birth - Nationality - Official ID and number - Arrival and departure day - Room number We provide this information for the fulfillment of legal reporting obligations, which arise in particular from the hospitality or police law. Insofar as we are required to do so under the applicable regulations, we will forward this information to the relevant police authority. In fulfilling the legal requirements, our legitimate interest within the meaning of Art. 6 para. 1 lit. f, b DSGVO. Acquisition of related services If you receive additional services during your stay (for example, make use of the mini-bar or the pay-TV service), we will collect the service and the date of receipt of the service for billing purposes. The processing of this data is within the meaning of Art. 6 para. 1 lit. b DSGVO required for the execution of the contract with us. STORAGE AND EXCHANGE OF DATA WITH THIRD PARTIES booking platforms If you make bookings via a third-party platform, we will receive various personal information from the respective platform operator. These are usually the in Ziff. 5 of this privacy policy. In addition, inquiries about your booking may be forwarded to us. We will process this data by name in order to record your booking as requested and to make the booked services available. The legal basis for data processing for this purpose lies in the fulfillment of a contract pursuant to Art. 6 para. 1 lit. b DSGVO. Finally, we may be notified by the platform operators about disputes related to a booking. In doing so, we may also receive data on the booking process, which may include a copy of the booking confirmation as proof of the actual posting. We process this data in order to safeguard and enforce our claims. This is our legitimate interest within the meaning of Art. 6 para. 1 lit. f DSGVO. Please also note the privacy policy of the respective provider. Central storage and linking of data We store the data specified in paragraphs 2-5 and 8-10 in a central electronic data processing system. The data relating to you are systematically recorded and linked to the processing of your bookings and the processing of the contractual services. For this we use a software (PROTEL) of REBAG DATA AG, Einsiedlerstrasse 533, PO Box 426, CH-8810 Horgen. The processing of this data as part of the software is based on our legitimate interest within the meaning of Art. 6 para. 1 lit. f DSGVO on customer-friendly and efficient customer data management. retention period We only store personal information for as long as is necessary to use the above tracking services as well as any further processing within the scope of our legitimate interest. Contract data is kept longer by us, as this is required by statutory storage requirements. Retention requirements, which oblige us to keep data, result from rules on the right to report, over the accounting and from the tax law. According to these regulations, business communication, closed contracts and accounting documents must be kept for up to 10 years. As far as we no longer need this data to carry out the services for you, the data will be blocked. This means that the data may then only be used for accounting purposes and for tax purposes. Passing on the data to third parties We only pass on your personal data if you have expressly consented to a legal obligation to do so or if this is necessary to enforce our rights, in particular to enforce claims arising from the contractual relationship. In addition, we pass your data on to third parties, as far as this in the context of the use of the website and the contract (including outside the website), especially the processing of your bookings is required. A service provider, to whom the personal data collected via the website are passed on or who can access or have access to it, is our web host ENNIT AG, Projensdorfer Str. The website is hosted on servers in Germany. The transfer of data is for the purpose of providing and maintaining the functionality of our website. This is our legitimate interest within the meaning of Art. 6 para. 1 lit. f DSGVO. Finally, we will forward your credit card information to your credit card issuer and credit card acquirer when making a credit card payment on the website. If you decide to pay by credit card, you will be asked to enter all the necessary information. The legal basis for passing on the data lies in the fulfillment of a contract pursuant to Art. 6 para. 1 lit. b DSGVO. Regarding the processing of your credit card information by these third parties, we ask that you also read the General Terms and Conditions and the privacy policy of your credit card issuer. Please also note regarding the data transfer to third parties and the notes in no. 7-8 and 10-11. Transfer of personal data abroad For the purpose of the data processing described in this data protection declaration, we are also entitled to transfer your personal data to third parties (contracted service providers) abroad. These are obligated to the same extent as we ourselves for data protection. If the level of data protection in one country does not correspond to the Swiss or the European one, we contractually ensure that the protection of your personal data at all times corresponds to that in Switzerland or in the EU. Note about data transfers to the USA For the sake of completeness, we would like to point out to users domiciled or domiciled in Switzerland that there are surveillance measures in the US by US authorities, which generally require the storage of all personal data of all persons whose data were transferred from Switzerland to the USA. allows. This is done without any differentiation, restriction or exemption on the basis of the objective pursued and without an objective criterion that would limit the US authorities' access to the data and its subsequent use to very specific, strictly limited purposes, which would be the same - be able to justify access to these data as well as interference with their use. Furthermore, we would like to point out that in the USA there are no legal remedies for the persons concerned from Switzerland that allow them to obtain access to the data concerning them and to obtain their rectification or deletion, or no effective judicial protection against general access rights of US authorities. We explicitly inform the person concerned about this legal and factual situation in order to make a correspondingly informed decision to consent to the use of his data. For users residing in EU Member States, please note that, from the point of view of the European Union, the US does not have sufficient data protection levels due, inter alia, to the issues mentioned in this section. To the extent we have explained in this privacy policy that recipients of data (such as Google) are based in the US, we will either be governed by contractual arrangements with these companies or by ensuring the certification of such companies under the EU or Swiss-US -Privacy Shield to ensure that your data is protected at a reasonable level by our partners. HOW WE USE YOUR DATA? We may use your personal data in the following ways: - To operate our business and provide you with services you have requested. - To display the content of this Site, and any customisations you may select. - To verify your identity. - To acknowledge, confirm and deal with your enquiry, including a reservation request. - Where we are asked to deal with any other enquiries or complaints you may make. - To notify you about any changes to this Site, or services provided through this Site. - To provide you, or permit selected third party service providers (e.g. our masseur and fitness trainers and providers) to provide you with information about goods or services we feel may interest you. We, or those selected third parties, will however only contact you if you have previously consented to such contact and only by such means (e.g. email or post) as you have also previously consented to. Any marketing email that you receive from us will allow you to unsubscribe to further email promotions. - To contact you in connection with user/customer/member surveys and use any information you choose to submit in response. - To administer our Site and ensure that our Site is presented in the most effective manner for you and for your computer/device. - For internal business/technical operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes and as part of our efforts to keep our Site secure. - On an aggregate basis, to understand how individuals collectively use the features of our Site. - To give effect to your legal rights and your rights under this Privacy Policy. - To protect against fraud, identity theft, and other unlawful activity. - To establish or exercise any legal rights or claims. - To satisfy our obligations under applicable law, this Privacy Policy, and any other policies or terms that are applicable to our relationship with you. For other purposes to which you have consented, and we may combine personal data that you provide to us with other information we collect about you for the purposes set out in this Privacy Policy. DISCLOSURE OF YOUR PERSONAL DATA We may share your personal data with third parties in the following situations: - We may disclose your personal data to our employees and agents to the extent necessary to provide you with services you have requested. - We may make your personal data available to selected third parties who act on our behalf to support our operations (for example, card processing or payment services (see the section below headed ‘Payment Information’) and credit reference agencies to protect against possible fraud, subject to appropriate contractual protections in accordance with applicable law. - Our IT suppliers and contractors (e.g. data hosting providers or delivery partners) who may need to have access to your personal data to provide IT support and enable us to provide membership or guest services and other goods/services available on this Site or otherwise available to members or guests, subject to appropriate contractual protections in accordance with applicable law. - If we sell or transfer all, or any portion, of our business or our company assets to any third party, personal data held by us about you may be one of the transferred assets. - If we need to disclose your personal data to comply with a legal obligation or to enforce our Terms & Conditions, membership rules or other applicable contract terms that you are subject to. - To protect us, our guests or contractors against loss or damage (including, without limitation, exchanging information with the police, courts or law enforcement organisations). - To the extent necessary to establish, exercise or defend legal rights or claims, or for the purposes of investigating actual or suspected unlawful activity. YOUR DATA PROTECTION RIGHTS Subject to applicable law, you may have the following rights in relation to your personal data: - The right of access: In accordance with Article 8 DSG / 15 GDPR, you have the right to request confirmation from us as to whether personal data relating to you is being processed. If this is the case, you have a right to access information about this personal data and to further information mentioned in Article 8 DSG / 15 GDPR. - The right to rectification: In accordance with Article 5 DSG / 16 GDPR, you have the right to request that we immediately rectify inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. - The right to erasure: EU data subjects have the right to request that we immediately erase personal data concerning you. We are obliged to erase personal data immediately, provided that the corresponding requirements of Article 17 GDPR are met. Please refer to Article 17 GDPR for details. Swiss data subjects also have the right of requesting the erasure of data in cases provided for by law, for example, when personal data are no longer necessary or the consent for processing has been revoked. - The right restriction of processing: In accordance with Article 18 GDPR, under certain circumstances, EU data subjects have the right to request that we restrict the processing of your personal data. - The right to data portability: In accordance with Article 20 GDPR, EU data subjects have the right to receive the personal data that they have provided us in a structured, common and machine-readable format, and have the right to have us transfer this data to another controller without hindrance, provided that the processing is based on a declaration of consent pursuant to Article 6 (1) a) GDPR or Article 9 (2) a) GDPR or is based on a contract pursuant to Article 6 (1) b) GDPR and the processing is carried out by automated means. - The right to objection: In accordance with Article 21 GDPR, EU data subjects have the right to object to the processing of personal data concerning them as based on Article 6 (1) e) or f) GDPR. This also applies to profiling based on these provisions. If we process your personal data for direct marketing purposes, you have the right at any time to object to the processing of your personal data for the purposes of such marketing. This also applies to profiling insofar as it is associated with such direct marketing. If you wish to exercise one of your rights, please contact us as the controller at the contact information indicated above or use any of the other forms we offer to communicate with us. If you have any queries, please contact us. - Right to lodge a complaint with a supervisory authority: In accordance with Article 77 GDPR, without prejudice to any other administrative or judicial remedy, EU data subjects have the right to lodge a complaint with the supervisory authority. This right exists in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. Swiss data subjects can avail themselves of the legal remedies of Art. If you wish to exercise any of these rights please contact us as described in the section above headed ‘Contact’. Any access request may be subject to a small fee to meet our costs. We may also need to ask you for further information to verify your identity before we can respond to any request. DATA SECURITY We will take appropriate technical and organisational security measures to protect the personal data that you submit to us against unauthorised/unlawful access or loss, destruction or damage, although we cannot 100% guarantee the security of data that you provide to us online. In accordance with applicable law, we will do everything we reasonably can to make sure that those subcontractors comply with appropriate security standards to protect the personal data that they handle. By submitting your personal data, you agree to the transfer and processing of your personal data outside Switzerland / EU for the purposes set out in this Privacy Policy. Where we have given you (or where you have chosen) a password or log-in which enables you to access certain restricted parts of our Site, you are responsible for doing everything you reasonably can to keep these details secret. We do not to share your password or log-in details with any third parties. Unfortunately, the transmission of information over the internet or public communications networks can never be completely secure. We also take corporate privacy very seriously. Our employees and the service companies commissioned by us have been obliged by us to secrecy and to comply with data protection regulations. DATA RETENTION & DELETION We will only retain your personal data for as long as we require those personal data in connection with the purposes set out in this Privacy Policy, except where we are required or permitted, under applicable law, to retain your personal data for additional periods of time. We adhere to the principles of data avoidance and data economy. Therefore, we only store your personal data for as long as is necessary to achieve the purposes mentioned here or as provided for by the various storage periods provided for by law. After discontinuation of the respective purpose or expiration of these deadlines, the corresponding data will be routinely and in accordance with the legal provisions blocked or deleted. Each data subject shall have the right granted by the European legislator to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies, as long as the processing is not necessary: - The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. - The data subject withdraws consent to which the processing is based according to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing. - The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR. o The personal data have been unlawfully processed. - The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject. - The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR. If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by the MOROSANI HOTELS DAVOS, he or she may at any time contact our Data Protection Officer or another employee of the controller. The MOROSANI HOTELS DAVOS or employees shall promptly ensure that the erasure request is complied with immediately. Where the controller has made personal data public and is obliged pursuant to Article 17(1) to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required. The Data Protection Officer of the MOROSANI HOTELS DAVOS or another employee will arrange the necessary measures in individual cases. CHANGES IN OUR PRIVACY POLICY We reserve the right to change this Privacy Policy from time to time to ensure that it complies with current legal requirements or to implement changes to our services in the Privacy Policy, such as: For example, when introducing new services. Your new visit will be subject to the new privacy policy. Any changes we may make to our Privacy Policy in the future will be posted on this page. Please check back frequently to see any updates or modifications. CONTACT Questions, comments or requests regarding this Privacy Policy should be addressed to reservations@morosani.ch or by post to Toni C. Morosani MOROSANI HOTELS DAVOS Promenade 42-50 CH 7572 Davos Platz
1.1 2.1 3.1 4.1 4.2 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 14.2 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 40.2 41.1 42.1 42.2 43.1 43.2 43.3 44.1 45.1 46.1 46.2 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 56.2 56.3 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 74.2 75.1 76.1 77.1 78.1 78.2 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 88.2 89.1 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 101.1 102.1 103.1 103.2 104.1 105.1 106.1 107.1 108.1 110.1
Politika zaštite osobnih podataka UVOD Udruga hrvatskih putničkih agencija (u daljnjem tekstu UHPA) u svom poslovanju provodi mjere zaštite osobnih podataka sukladno Općoj Uredbi o zaštiti podataka (GDPR), zakonskim i regulatornim obvezama. Uprava je u potpunosti predana osiguranju kontinuirane i efektivne uspostave ove politike, te isto očekuje od svojih zaposlenika i poslovnih partnera. Svako kršenje ove politike može rezultirati disciplinskim mjerama ili poslovnim sankcijama. Ova politika određuje očekivano ponašanje UHPA-e, njenih stalnih, privremenih i povremenih zaposlenika kao i poslovnih partnera te trećih strana u odnosu na prikupljanje, korištenje, čuvanje, prijenos, otkrivanje ili uništavanje osobnih podataka koji se obrađuju u poslovnim procesima UHPA-e DEFINICIJE - osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („Ispitanik”); pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca; - obrada je svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim bilo neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pronalaženje, obavljanje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanjem na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje; - ograničavanje obrade je označivanje pohranjenih osobnih podataka s ciljem ograničavanja njihove obrade u budućnosti; - izrada profila je svaki oblik automatizirane obrade osobnih podataka koji se sastoji od uporabe osobnih podataka za ocjenu određenih osobnih aspekata povezanih s pojedincem, posebno za analizu ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, pouzdanošću, ponašanjem, lokacijom ili kretanjem tog pojedinca; - sustav pohrane je svaki strukturirani skup osobnih podataka dostupnih prema posebnim kriterijima, bilo da su centralizirani, decentralizirani ili raspršeni na funkcionalnoj ili zemljopisnoj osnovi; - voditelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka; kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice, voditelj obrade ili posebni kriteriji za njegovo imenovanje mogu se predvidjeti pravom Unije ili pravom države članice; - izvršitelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje osobne podatke u ime voditelja obrade; - primatelj je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome je li on treća strana. Međutim, tijela javne vlasti koja mogu primiti osobne podatke u okviru određene istrage u skladu s pravom Unije ili države članice ne smatraju se primateljima; obrada tih podataka koju obavljaju ta tijela javne vlasti mora biti u skladu s primjenjivim pravilima o zaštiti podataka prema svrhama obrade; - treća strana je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije Ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka pod izravnom nadležnošću voditelja obrade ili izvršitelja obrade; - privola Ispitanika znači svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja Ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose; - povreda osobnih podataka je kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani; - poduzeće ili društvo je fizička ili pravna osoba koja se bavi gospodarskom djelatnošću, bez obzira na pravni oblik te djelatnosti, uključujući partnerstva ili udruženja koja se redovno bave gospodarskom djelatnošću; - nadzorno tijelo znači neovisno tijelo javne vlasti koje je osnovala država članica; - međunarodna organizacija je organizacija i njezina podređena tijela uređena međunarodnim javnim pravom ili bilo koje drugo tijelo koje su sporazumom ili na osnovi sporazuma osnovale dvije ili više zemalja. PODACI KOJE PRIKUPLJAMO Tijekom različitih oblika interakcije sa UHPA-om (korištenje Internet stranice, slanje upita/zahtjeva e-mailom, poštom) prikupljaju se osobni podaci koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Ime, prezime - Funkcija - e-mail adresa - broj telefona UHPA tijekom različitih oblika interakcije može prikupljati i podatke koji ne spadaju u grupu osobnih podataka, koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Podatke o uređaju putem kojeg se spajate na Internet - Vrstu i verziju Internet preglednika koji koristite - Načine korištenja Internet stranice UHPA-e Korištenje podataka UHPA koristi osobne podatke za slijedeće svrhe: - Pružanje usluga članovima i partnerima sukladno ugovornim obvezama – UHPA osobne podatke može upotrijebiti tijekom pružanja ugovorenih usluga, te za pružanje različitih oblika komunikacije tijekom procesa realizacije suradnje - Marketinške i prodajne aktivnosti – UHPA osobne podatke može upotrijebiti s ciljem obavještavanja o novim pogodnostima, popustima ili sličnim aktivnostima - Zaštita zaposlenika UHPA-e – UHPA osobne podatke pojedinaca može otkriti ako vjeruje da je neophodno ili prikladno kako bi se zaštitili zdravlje i sigurnost zaposlenika, posjetitelja, imovine i/ili korisnika - Zakonske obveze izvještavanja i obrade podataka Prikupljanje podataka Osobni podaci se prikupljaju na jedan od sljedećih načina: - Izravno od pojedinca – kada osoba stupa u kontakt s UHPA-om slanjem upita za određenu uslugu putem e-maila, telefonskog poziva, popunjavanjem kontakt forme na www.uhpa.hr i dolaskom u prostore UHPA-e - Neizravno – podaci koji su javno dostupni na internetskim stranicama koje ne pripadaju UHPA-i (npr. Sudski i obrtni registar, objave na društvenim mrežama, otvorenim forumima), podaci dobiveni korištenjem kolačića, poveznica i sličnih tehnologija KOLAČIĆI Kolačići (engl. cookies) omogućavaju UHPA-i prikupljanje statističkih podataka o ponašanju korisnika na www.uhpa.hr (npr. na kojim dijelovima Internet stranice se korisnici zadržavaju najduže, a gdje najkraće), koji se Internet preglednik (npr. Internet Explorer, Opera, Safari, Google Chrome, Firefox) koristi i slično. Kolačići su mali skup podataka poslan sa poslužitelja www.uhpa.hr na računalo korisnika, a služi kao anonimni identifikator. Kolačići se također koriste za lakšu navigaciju kroz Internet stranice (npr. ne morate svaki put iznova unositi podatke za registraciju). Kolačići se ne koriste s ciljem pristupa korisničkim podacima ili kako bi se pratile aktivnosti korisnika nakon www.uhpa.hr . UHPA zadržava pravo korištenja kolačića na www.uhpa.hr no svaki korisnik može zabraniti primanje kolačića uređivanjem/promjenama postavki u svom Internet pregledniku. DIGITALNI MARKETING UHPA šalje promotivne materijale putem digitalnih komunikacijskih kanala korisnicima koji su dali privolu za takav oblik komunikacije. Korisnici imaju u svakom trenutku pravo onemogućiti uslugu primanja promotivnih materijala, a UHPA će omogućiti alate kako bi se pravo za brisanje iz baze podataka za slanje obavijesti provelo. Korisnik će biti obaviješten u trenutku prvog kontakta ili u bilo kojoj fazi vršenja usluge o korištenju njegovih podataka u svrhe digitalnog marketinga. ZAHTJEVI ISPITANIKA UHPA osigurava ostvarivanje prava korisnika u odnosu na: - Pristup informacijama; - Prigovor na obradu; - Ograničenje obrade; - Prijenos podataka; - Ispravljanje podataka; - Brisanje podataka. Korisnik zahtjeve za ostvarenje prava podnosi pisanim ili usmenim putem. Ako pojedinac podnese zahtjev koji se odnosi na bilo koje gore navedeno pravo, UHPA će razmotriti svaki takav zahtjev u skladu sa svim primjenjivim zakonima i propisima o zaštiti podataka. UHPA zadržava pravo naplate troškova za obradu zahtjeva korisnika u iznimnim slučajevima kada su zahtjevi nerazumni. Korisnici imaju pravo na informiranje temeljem podnesenog zahtjeva, a nakon uspješne provjere njihovog identiteta, o sljedećem: - Svrsi obrade osobnih podataka; - Izvoru osobnih podataka, ako nije dobiven od korisnika; - Kategoriji osobnih podataka; - Primateljima ili kategorijama primatelja kojima su ili mogu biti preneseni osobni podaci, zajedno s lokacijom tih primatelja; - Predviđenom razdoblje pohrane osobnih podataka ili obrazloženje za određivanje razdoblja pohrane; - Upotrebi bilo kakvog automatiziranog odlučivanja, uključujući profiliranje; Svi zahtjevi za pristup ili ispravak osobnih podataka moraju biti upućeni UHPA-i kao Voditelju obrade koja će evidentirati svaki zahtjev po primitku. Odgovor na svaki zahtjev dostavlja se u roku od 30 dana od primitka pismenog zahtjeva korisnika. Ako se ne može u potpunosti odgovoriti na zahtjev korisnika u roku od 30 dana, dostavlja se obavijest o: - Potvrdi primitku zahtjeva - Svim informacijama koje su prikupljene - Pojedinosti o bilo kojoj traženoj informaciji ili izmjenama koje neće biti dostavljene korisniku, razlogu za odbijanje te o svim mogućim postupcima za žalbu na odluku. - Procijenjeni datum do kojeg će biti dostavljeni preostali odgovori. - Procjena troškova koje mora platiti korisnik (ako je zahtjev prekomjeran). - Ime i kontaktne informacije društva koje bi Ispitanik trebao kontaktirati za daljnje informacije. ZADRŽAVANJE PODATAKA UHPA neće zadržati osobne podatke duže nego što je to neophodno u odnosu na svrhe za koje su izvorno prikupljeni ili za koje je definiran zakonski ili ugovorni rok. Točni vremenski periodi čuvanja podataka navedena su u dokumentu "Politika pohrane podataka". Pri čemu se uzimaju u obzir zakonske i ugovorne obveze, kako minimalne tako i maksimalne. Kad razdoblje zadržavanja istekne, organizacija će osobne podatke izbrisati na način koji osigurava da se oni ne mogu rekonstruirati niti pročitati. ZAŠTITA PODATAKA UHPA provodi fizičke, tehničke i organizacijske mjere koje jamče sigurnost osobnih podataka (npr. prevenciju gubitka ili oštećenja, neovlaštene izmjene, pristupa ili obrade i drugih prijetnji kojima mogu biti izloženi osobni podaci uzrokovani ljudskim djelovanjem ili fizičkim/prirodnim okruženjem). Minimalni skup sigurnosnih mjera koje UHPA provodi u svrhu zaštite osobnih podataka navedeni su u dokumentu „Politika informacijske sigurnosti“ i drugim vezanim politikama i procedurama. Sigurnosne mjere koje se provode imaju za cilj: - Spriječiti neovlaštene osobe da dobiju pristup sustavu obrade podataka u kojima se obrađuju osobni podaci. - Spriječiti osobe koje imaju pravo koristiti sustav obrade podataka od pristupa osobnim podacima koji su izvan njihovih potreba i ovlaštenja. - Osigurati da se osobni podaci tijekom elektronskog prijenosa ili tijekom prijenosa ne mogu čitati, kopirati, mijenjati ili ukloniti bez odobrenja. - Osigurati dostupnost zapisa sustava u svrhu utvrđivanja od koga su uneseni, mijenjani ili uklonjeni osobni podaci iz sustava obrade podataka. - Osigurati da u slučaju kada obradu obavlja izvršitelj obrade, podaci se mogu obrađivati samo u skladu s uputama voditelja obrade. - Osigurati da su osobni podaci zaštićeni od neželjenog uništavanja ili gubitka. - Osigurati da osobni podaci prikupljeni za različite svrhe mogu biti obrađeni odvojeno. - Osigurati da se osobni podaci ne drže duže nego što je potrebno. ZAHTJEVI OD STRANE PRAVOSUDNIH TIJELA U određenim okolnostima, dopušteno je da se osobni podaci dijele bez znanja ili suglasnosti korisnika. I to kada je otkrivanje osobnih podataka potrebno u bilo kojoj od sljedećih svrha: - Sprječavanje ili otkrivanje zločina. - Uhićenje ili progon prekršitelja. - Procjena ili naplata poreza ili pristojbi. - Po nalogu suda ili bilo kojeg zakona. PRIJENOS PODATAKA UHPA zadržava pravo prijenosa osobnih podataka unutar svoje poslovne grupe kao i na treće strane poštivajući načelo odgovarajuće razine pravne zaštite za prava i slobode korisnika. Prijenos osobnih podataka se provodi isključivo ako je zadovoljen barem jedan od sljedećih uvjeta: - Prijenos je neophodan za izvedbu ugovornih obveza/usluga; - Prijenos je neophodan za provedbu predugovornih mjera koje se poduzimaju kao odgovor na zahtjev korisnika; - Prijenos je neophodan za zaključivanje ili izvršenje ugovora sklopljenog s trećom stranom u interesu korisnika; - Prijenos je zakonski obvezan na temelju važnih javnih interesa; - Prijenos je neophodan za osnivanje, vršenje ili obranu pravnih zahtjeva; - Prijenos je neophodan kako bi se zaštitili vitalni interesi korisnika. RUKOVANJE PRITUŽBAMA U slučaju pritužbi vezanih uz pridržavanje ovih i drugih pravila vezanih za zaštitu osobnih podataka, molimo da nam se javite na uhpa1@uhpa.hr . U slučaju pritužbe, istražit ćemo cijelu situaciju koja se odnosi na upotrebu i otkrivanje osobnih podataka sukladno ovim pravilima te ćemo ih pokušati riješiti u najkraćem mogućem roku. KONTAKT Udruga hrvatskih putničkih agencija Kršnjavoga 1/II Zagreb E: uhpa1@uhpa.hr U Zagrebu, 15. svibnja 2018.