The Confidentiality policy regarding the processing of personal data
Your personal data are processed by SC KOLPING CONCEPT SRL SRL in full accordance to the EU Regulations 2016/679 („General data protection regulation” or „GDPR”), as well as any other legislation applicable on the Romanian territory. We wish to inform you about the way in which we collect, use, transfer and protect your personal data when you interact with us in connection to our products and services, inclusively, by means of our website.
We reserve the right to update and modify, periodically, this Confidentiality policy, in order to show any changes of the way in which we process your personal data or any changes of the legal requirements. In case of such changes we will display on our website the modified version of the Confidentiality policy, reason for which we ask you to periodically check the content of this Confidentiality policy.
Who are we and how you can contact us
SC KOLPING CONCEPT SRL, Romanian legal person, having the social address in Brasov, 27 Petofi Sandor street, 500107, Romania, under the registration number at the Trade Register J08/649/2000 unique fiscal registration code RO 13251098, phone: 0748 013 598, email: email@example.com (hereinafter referred to as „Kolping Concept” or „us“). Within the sense of the legislation regarding the data protection, we are operator when we process your personal data.
You can ask for additional information regarding your data processing and we encourage you to contact the Kolping Concept responsible for the data protection, Lucian Ioja, at the e-mail address firstname.lastname@example.org, 0268.413.529 or by post or express at the address 27 Petofi Sandor, Brasov, 500107, Romania – with the mention for the attention of the Kolping Concept responsible for the data protection.
The types of personal data categories we process
In general, we collect your personal data directly from you so you have control upon the type of information that you provide us. As example, we receive information from you such as:
- When you access the form from the Contact page of the site hotel.kolping.rowww.hotel.kolping.ro, you give us: your name, e-mail address, your subject and a message that can contain other personal information.
- When you access the reservation form, you give us: the arrival and departure date, the number of nights for accommodation, the number of rooms, the number of adults and children (including the age range of the child/ children), promotional code, room type, additional services (airport transfer), payment method and bank information.
We can, also, collect and process afterwards certain information regarding your behavior, during your visit on our website, in order to customize your online experience and put at your disposal the offers adjusted to your profile. We invite you to find out more details within this sense by seeing the section below regarding the processing.
We do not collect or process in any other way sensitive data, included by the General regulation regarding the data protection in special personal data categories. Also, we do not wish to collect or process data of persons under 18 years.
What are the purposes and grounds of data processing?
We will use your personal data within the following purposes:
- In order to provide the Kolping Concept services in your interest.
This general purpose may include, when the case, the followings:
- a) processing of orders/ reservations, including their collection, validation, delivery and invoicing;
- b) settlement of cancellations or any type of issues referring to an order/ reservation or the acquired goods or services;
- c) reimbursement of products according to the legal provisions;
- d) reimbursement of the counter value of the products according to the legal provisions;
- e) assuring the assistance services, including providing answers to your questions regarding your orders/reservations or Kolping Concept’s goods and services or the ones of Kolping Concept’s partners.
The processing of your personal data within these purposes is in accordance to the Government Decision no. 237/2001. Also, certain types of processing which come under these purposes are enforced by the applicable legislation, including the fiscal and accounting legislation.
The beneficiaries or the categories of beneficiaries: not the case
- In order to enhance our services
We want to provide you, permanently, the best online experience. For that, we might collect and use certain information connected to your behaviour as Buyer.
The ground for these activities is our legitimate interest to run commercial activities, by always taking care that your fundamental rights and freedoms are not affected.
- For marketing purposes
We want to let you know about the best offers for the products/ services you’re interested about. Within this sense, we can send you any type of message (such as: e-mail/ SMS/ mobile phone/ mobile push/ web push etc.), containing general systematic information, information regarding products similar or complementary to the ones acquired by you, information regarding offers or advertising as well as other commercial messages such as market researches and opinion surveys and we can display customized recommendations on the website. In order to put at your disposal information of interest, we can use certain data regarding your behavior as buyer (for example, the viewed products) in order to create a profile for you. We always make sure that the processing is always made by observing your rights and freedoms and that the undertaken decisions based on these do not have legal effects upon you and they do not affect you similarly in a significant manner.
In most of the cases, we ground our marketing messages on your previous consent. You can change your mind and withdraw your consent, anytime, by:
- Accessing the unsubscribe link within the messages you receive from us;
- Contacting Kolping Concept by using the above written contact details.
In certain cases, we can ground our marketing activities on our legitimate interest to advertise and develop our commercial activity. In any situation, when we use information regarding you for our legitimate interest, we take care and we take all the necessary measures in order not to affect your fundamental rights and freedoms. Nevertheless, you can always request, by the above mentioned means, to stop processing your personal data within marketing purposes, followed by our observance of your request.
- In order to defend our legitimate interests
There can be situations in which we will use or deliver information in order to protect our commercial activity and rights. These may include:
- Measures of protecting the website and its users in regard to the cyber attacks;
- Measures of preventing and detecting the fraud attempts, including delivering certain information to the competent public authorities;
- Measures of managing other different risks.
The main ground for these types of processing is our legitimate interest to defend our commercial activity, being understood that we make sure that all the measures we take guarantee a balance between our interests and your fundamental rights and freedoms.
We, also, in certain cases, ground the processing on legal provisions such as the obligation to assure the security of the goods and assets, required by the legislation applicable within this matter.
How long do we keep your personal data?
We will store your personal data for 3 years, according to the Government’s decision no. 237/2001. You can ask us anytime for the deletion of certain information and we will observe these requests, subject to the storage of certain information including after the termination of the collaboration, in the situations where the applicable legislation or our legitimate interests assert it.
To whom we deliver your personal data
When the case, we can deliver or provide access to some of your personal data to the following beneficiaries’ categories:
- Providers of delivery services;
- Providers of payment/ banking services;
- Providers of marketing/ telemarketing services;
- Providers of market research services;
- Insurance companies;
- Other companies with whom we can develop mutual market offers for our goods and services.
In case if we’ll have a legal obligation or if it is necessary to defend a legitimate right, we can also disclose certain personal data to certain public authorities.
We make sure that the access to your data by third parties as private law entities is made in accordance to the legal provisions regarding the data protection and the information confidentiality, based on the contracts concluded with them.
The countries where we transfer your personal data
We currently store and process your personal data on the Romanian territory.
The intent to transfer data to countries outside the European Economic Area or international organizations: not the case
How we protect the safety of your personal data
We submit to assure the safety of the personal data by implementing proper technical and organizational measures, according to the standards of the industry.
The delivery of your personal data is made by using the last generation encryption algorithms and we store them on secured servers, by assuring in the same time the redundancy of the data.
Despite the measures taken to protect your personal data, we remind you that the delivery of information by means of Internet, generally, or by means of other public networks, is not fully safe because there is always the risk that the data might be seen and used by unauthorized third parties. We cannot be responsible for such vulnerabilities of systems that are not under our control.
What are your rights
The general regulation regarding the data protection will admit a series of rights regarding your personal data. You can require the access to your data, the adjustment of any errors from our files and/ or you can set against the processing of your personal data. Also, you can exercise your right to submit a claim to the competent monitoring authority or to file a lawsuit. Depending on the case, you can also benefit of the right to claim the clearing of your personal data, the right to restrain the processing of your data and the right to data portability.
More information about each of these rights is shown below. In order to exercise your rights, you can contact us by using the above- mentioned contact details. We ask you to keep in mind the following aspects if you wish to exercise these rights:
Identity. We take seriously the confidentiality of all the registrations that include personal data. Due to this reason, we ask you to send us your requests regarding such registrations by using a valid e-mail address, by reserving our right to check your identity by requiring the additional information that has as purpose the confirmation of you identity.
Fees. We will not require a fee in order to exercise any right related to your personal data, except for the case in which your request to access information is groundless, repetitive or abusive, case in which we will levy a reasonable sum under these circumstances. We will inform you about any applied fees before settling your request.
Response time. We intend to answer any valid requests within maximum one month, except for the case in which this thing is extremely difficult or if you have submitted several claims, case in which we will answer within maximum two months. We will announce you if we will need more than one month. We might ask you if you can tell us precisely what you want to receive or what are your concerns. This thing will help us to answer faster or to shorten the response time for your request.
Third party rights. We do not have to take up a request if it might affect negatively the rights and freedoms of other targeted persons.
You can ask us for:
- A confirmation if we will process your personal data;
- To put at your disposal a copy of these data;
- To provide you other information about your personal data, such as the data we use, the purpose of their use;
- To whom we disclose them, if we transfer them abroad and how we protect them, how long we store them, what are your rights;
- How you can submit a claim, where from we got your data, in case if the information was not already provided to you by this notice.
- You can ask us to rectify or to fill in your inaccurate or incomplete personal data
- It is possible to try to check the trustworthiness of the data before their rectification
You can ask us for the deletion of your personal data but only in case if:
- These are not necessary anymore within the purposes for which they were collected;
- You have withdrawn your consent (in case if the data processing is based on consent);
- You claim a legal right to set against;
- They were illegally processed;
- We have a legal obligation within this sense.
At the end of data processing and deletion, you will receive within the legal period of time a confirmation regarding the cease of the processing and the deletion of the processed data.
In case if you want to exercise your above written rights, please contact us at the e-mail address: email@example.com.
We do not have the obligation to observe your request regarding the deletion of your personal data in case if the processing of your personal data is necessary:
- In order to observe a legal obligation;
- In order to ascertain, exercise or defend a right in front of a court.
There are certain other circumstances under which we are not obliged to observe your request to delete the data, though these two are the most plausible circumstances under which we could deny you this request.
Data processing restrainment
You can ask us to restrain the processing of the personal data, but only if:
- Their accuracy is disputed (see the rectification section) in order to allow us to check;
- The processing is illegal but you do not wish the deletion of the data;
- These are not necessary anymore within the purposes of their collection but you need them in order to admit, exercise or defend a right in front of a court;
- You exercised the right to set against and the process of verifying if our rights prevail is pending;
We can continue to use your personal data after receiving a restrainment request, case in which:
- We have your consent;
- To admit, exercise or defend a right in front of a court;
- To defend the rights of Kolping Concept or of any other legal or natural person.
You can ask us to provide you the personal data in a technical form, currently used and that can be read automatically or you can ask for it to be directly transferred to another data operator but in each of the cases, only if:
- The processing is based on your consent or on the conclusion or execution of a contract with you;
- The processing is made by automatic means.
You can set against, any time, based on grounds related to your specific situation, to the processing of your personal data based on our legitimate interest, case in which you think that your fundamental rights and freedoms prevail over this interest.
Also, you can set anytime against the processing of your data within a direct marketing purpose, without invoking any ground, case in which we will terminate as soon as possible this processing.
Undertaking automatic decisions
The existence of certain automatic decisions, including the profiling, the logic behind these processes and the consequences for the targeted person is strictly a part of statistics. You can ask for stop representing the object of a decision based exclusively on the automatic processing but only if the respective decision:
- Incurs legal effects upon you;
- Affects you similarly and significantly.
This right does not apply in case if the undertaken decision following the automatic decision making process:
- Is necessary to us in order to conclude or perform a contract with you;
- Is lawfully authorized and there are guarantees in connection to your rights and freedoms;
- Is based on your express consent.
You have the right to submit a claim to the monitoring authority regarding the processing of your personal data. In Romania, the contact data of the authority for the monitoring of the data protection are the following:
- National Authority for the Monitoring of Personal Data Processing
28-30 Bd. G-ral. Gheorghe Magheru, District 1, postal code 010336, Bucharest, Romania
Telephone: +40.318.059.211 or +40.318.059.212;
Notwithstanding your right to contact any time the monitoring authority, we ask you to contact us previously and we promise that we will take all the necessary measures to settle amiably any issue.
*We remind you the fact that you can contact anytime the person liable for the data protection from Kolping Concept by sending your request by any of the following means
Telephone: +40 268 413 529/ +40 748 013 598
Post or express at the address: 27 Petofi Sandor street, Brasov, 500107, Romania–with the mention: for the attention of the person liable for the data protection from Kolping Concept (Lucian Ioja).