Informative Text about Processing Personal Data for CPI Hotels, a.s. clients

This page provides all the essential details required under European Parliament and Council (EU) Regulation 2016/679 dated 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the “GDPR”) regarding your personal data as processed by CPI Hotels, a.s., ID No.: 47116757, Bečvářova 2081/14, 100 00 Prague 10, registered in the Commercial Register administered by the Municipal Court in Prague, File No. B 1914 (“CPI Hotels” or “we”).

CPI Hotels is represented on the market by the brands: Budha⁠⁠⁠-⁠⁠⁠Bar Hotel Prague, Clarion Hotels, Quality Hotels, Comfort Hotels, Mamaison Hotels & Residences, Spa & Kur Hotels, Holiday⁠⁠⁠-⁠⁠⁠Inn, Fortuna Hotels, Private Label Hotels, Ubytovny.cz and Benada Restaurant.

1. What data do we process?

A) Client data
Based on your reservation (or stay without a reservation) we process personal data of clients in the following scope:

identification and contact data (name and surname, permanent residential address, ID card number or similar document and possibly also e⁠⁠⁠-⁠⁠⁠mail address and telephone number) and data on the existence of a Digital COVID Certificate, or similar data, the processing of which we are required by law to process as part of the COVID⁠-⁠19 measures;
in the case of natural persons engaged in business activities: also the designation of the natural person engaged in business activities, registered office, ID number, VAT number, data on VAT payer;
in the case of business trips by non⁠⁠⁠-⁠⁠⁠entrepreneurs: also data on the organisation that ordered or paid for the stay);
data about the purpose of the stay or information that the client is a person who is not subject to a fee for a spa or recreational stay;
information about your membership in the loyalty program;
information about your stay and services used and the amount and method of payment for services provided (in case of non⁠⁠⁠-⁠⁠⁠cash payment, bank account number, or payment card details);
in the case of foreign nationals (in addition to the above data): also the date of birth, nationality, travel document number, visa number, permanent residential address abroad;
in the case of guests using parking at our hotel: also their car license plate number.

In addition to accommodation, we also provide you with spa treatments in our Spa & Kur Hotels. If used, we also process the following data in addition to the above:

diagnosis data obtained directly from you by our doctor during the initial medical examination;
data on health care provided to you in our facilities and the course of treatment (medical examination, possible health complications during your stay, etc.)

B) Photo documentation from events
We take a reasonable amount of photo documentation (situational shots from events) at the events we organise for the purpose of subsequent publication of selected photos on our website for the promotional purposes of CPI Hotels. This means that the visitors to a specific event are not primarily displayed, but rather the overall atmosphere of the event; the shots are not published in detailed resolution and we do not include captions describing specific event visitors. In the professional opinion of the Office for Personal Data Protection, these cases are not primarily a question of personal data protection, but of privacy protection according to the Civil Code; consent to the processing of personal data for "illustrative" images is therefore not required.

Visitors are notified in advance of photo documentation being taken in the form of a camera pictogram; our photographers are visibly identified and photo documentation is taken only in the main event area and visitors always have the opportunity to remain where no photo documentation is taken. If you have any doubts or questions about acquisition of photo documentation, you have the opportunity to contact us using the contacts listed below.

2. On what basis and for what purpose do we process your personal data?

A) Processing necessary for the fulfilment of legal obligations

The provision and processing of all the above personal data, with the exception of e⁠⁠⁠-⁠⁠⁠mail address and telephone number and information about your membership in the loyalty program, is necessary for the purposes of fulfilling our legal obligations, especially obligations arising from the Act on Local Fees and the Act on the Stay of Foreigners in the Czech Republic and also from accounting and tax regulations.

B) Processing necessary to fulfil the contractual relationship

Processing your identification data and data about your stay and provided services and the amount and method for their payment is necessary for the purposes of fulfilling the contractual relationship related to your stay, i.e., fulfilling orders and reservations, concluding and fulfilling contracts related to accommodation and dining and related services offered and provided by us.
In the case of spa care, we process data provided on the registration card, information about your treatment stays and the health care services provided to you in our facilities, as well as information on the payment for the stay. We process this data on the basis of a legal relationship between you and CPI Hotels, the subject of which is the provision of spa therapeutic rehabilitation treatment and related services (accommodation, dining, etc.). The purpose of this processing is to provide the above services.

C) The consequence of not providing data

We cannot provide you with our accommodation services if you do not provide us with the above data. We do not need any of your personal data to provide dining and other services and therefore we do not acquire or process it for this purpose.

D) Processing necessary for the purposes of legitimate interests

We process your personal data in the scope of your name, surname, e⁠⁠⁠-⁠⁠⁠mail address and information about your stay, on the basis of our legitimate interests for the purposes of direct marketing, the purpose of processing is exclusively the option to send you marketing and business messages, i.e., information about interesting news, discounts, etc.

We also process personal data in the same extent for sending satisfaction questionnaires after your stay in our hotels, for the purpose of verifying your satisfaction with our services and to constantly improve the quality of our services for you.
In our hotels there are no cases in which guests question the services we provide or spa care services. Should such a case arise, we would be forced to process data on the services provided to the extent necessary to conduct such a dispute, solely for the purpose of protecting our rights in said dispute. Similarly, we would be forced to process the necessary data in the case of non⁠⁠⁠-⁠⁠⁠payment for our services or in the case of damages incurred by us.

E) Processing on the basis of consent

Based on your consent or permission settings in the applications used in your internet browser, we process technical information obtained when visiting our website – see in detail the separate informative text available at www.cpihotels.com/cs/cookies.

We offer our clients Wi⁠⁠⁠-⁠⁠⁠Fi network services, and you have the option of choosing a paid connection alternative or a connection alternative provided free of charge. In the case of a free connection, you are informed in advance that CPI Hotels will use the data on your e⁠⁠⁠-⁠⁠⁠mail address exclusively for the purpose of sending marketing communication informing you about interesting news, discounts, etc. You subsequently have the opportunity to express your disagreement with marketing communication being sent to you in the future, at any time.

You can withdraw your consent at any time by sending a notice to our address (CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10), our e⁠⁠⁠-⁠⁠⁠mail address dp@cpihotels.com, by using the contact form at www.cpihotels.com, or by changing the settings in your internet browser. Withdrawal of consent will come into force upon its delivery to CPI Hotels. According to the GDPR, the withdrawal of consent does not affect the lawfulness of processing based on the consent given before its revocation.

F) Automated processing of your data

In no case do we carry out automated decision⁠⁠⁠-⁠⁠⁠making or other automated processing of your personal data that would have any legal consequences for you or would significantly affect you in a similar way.

3. Source of personal data

We obtain all the above data directly from you, in connection with negotiation of a contract and provision of accommodation and dining services.

If reservation of our services was arranged by another person (typically the employer in the case of business trips), we obtain your basic identification and contact information (in the scope of name and surname, telephone number, or e⁠⁠⁠-⁠⁠⁠mail address) directly from this person.

For reservations entered through reservation portals, your basic identification and contact information (in the scope of name and surname, telephone number, or e⁠⁠⁠-⁠⁠⁠mail address) is provided to us by the reservation portal.

4. How long do we process your personal data for?

We process your personal data for the duration of your stay in our hotel. After the end of your stay, we process only:

Data for which the obligation to process it arises from the relevant legal regulations, and only for the time necessary according to said legal regulations. (For example, the accounting and tax documents that we issue to you also contain some of your personal data (name and surname, type of service provided, date of issue of the document). We keep these documents only for the purpose of fulfilling the obligations set out in the relevant accounting and tax legislation, for the period imposed by these regulations.)
Your name, surname, e⁠⁠⁠-⁠⁠⁠mail address and information about your stay for the purposes of direct marketing by CPI Hotels (sending information about interesting news or discounts of our services, etc.) and for sending satisfaction questionnaires. We process data for sending satisfaction questionnaires only until evaluation of the questionnaires (maximum 1 month after your stay). For the purposes of direct marketing, we process your data listed above until you withdraw your consent to further processing.
Data necessary for the purpose of existing or imminent disputes. We process this data only until the legally effective ruling concerning the dispute and fulfilment of obligations arising from the ruling, or until such time disputes over the provided services may arise under applicable law.

We process data on cookies and log data for a maximum of 13 months from the last use of cookies or log data.

After expiration of these periods, we regularly dispose of your personal data, both in paper and electronic form.

5. To whom do we make your personal data available or pass it on?

A) Transfer to third parties
We do not transfer or disclose your personal data to any third parties, with the exception of public authorities, where the obligation to transfer data arises from valid and effective legislation (this is typically the case with data that we process under the Local Fees Act or the Act on Residence of Foreigners in the Czech Republic).

In the case of spa care services, we do not disclose your personal data to anyone; our doctors and other medical staff are employees of CPI Hotels.

B) Processors
For the purposes of providing some support services (e.g., sending marketing messages, improving communication and the segmentation of offers, ensuring online hotel reservations, cookie processing) we use the services of processors. This always involves processing carried out exclusively for our company and on the basis of our instructions. We always select the processors with regard to the trustworthiness and quality of their services, including the security of the processed personal data. Processing is only possible on the basis of a contract concluded between CPI Hotels and the processor, binding the processor to the same degree of personal data protection as that provided by CPI Hotels itself. We will inform you about the processors we currently work with upon request.

C) Transfer of data abroad
Our processors have their headquarters and process personal data in the Czech Republic or in another EU country, these are always renowned companies that belong to international hotel or similar networks that provide services to hotels on a global scale.

In cases other than those listed above, we do not transfer personal data outside the EU.

6. How CPI Hotels ensures the protection of personal data

All people in our organisation who come into contact with personal data are obliged to maintain confidentiality regarding the processed personal data, including the safety measures aimed at protecting it. This obligation also remains in place if said individual’s employment with CPI Hotels or the processor ends.

7. Your rights under the applicable law

According to the valid legal regulation of personal data protection, you have the following rights:
⁠⁠⁠-⁠⁠⁠ the right to access your personal data that we process; this includes the right to obtain the following information from CPI Hotels:

confirmation of whether CPI Hotels processes your personal data
access to this personal data,
information on the purposes of processing,
on the categories of personal data concerned,
information on recipients or categories of recipients to whom personal data will be made available,
on planned storage time, or the criteria for determining this,
on the existence of the right to request the correction or deletion of personal data, or the restriction of its processing, or the right to object to such processing,
on the right to lodge a complaint with the supervisory authority,
on all available information on the source of personal data if not obtained from the data subject ⁠⁠⁠-⁠⁠⁠ from you,
whether there is automated decision⁠⁠⁠-⁠⁠⁠making, including profiling,
on appropriate safeguards for the transfer of personal data outside the EU,
provided that the rights and freedoms of others are not adversely affected, as well as a copy of the personal data.

⁠⁠⁠-⁠⁠⁠ the right to correct your personal data if it is incorrect, inaccurate, or incomplete; the corrections will be carried out by CPI Hotels without undue delay with regard to technical feasibility,
⁠⁠⁠-⁠⁠⁠the right to request the deletion of personal data in cases specified by the GDPR, e.g., in the case of revocation of consent to processing, or if you raise an objection to processing, in the case of illegal processing of personal data, in the case that personal data is no longer needed for the purposes for which it was processed, etc. You can therefore request the deletion of your personal data, but this option does not apply where processing is necessary to fulfil a legal obligation and in some other cases stipulated by the GDPR.
⁠⁠⁠-⁠⁠⁠ the right to request restriction of the processing of personal data in cases provided for by the GDPR, such as when you deny the accuracy of personal data, raise an objection to its processing, etc.
⁠⁠⁠-⁠⁠⁠ ⁠⁠⁠-⁠⁠⁠ the right to the transferability of the data you have provided us and which is processed in automated form, based on your consent, or on the basis of the necessity of its processing for the fulfilment of the contract with you, or for the implementation of measures taken before the conclusion of the contract at your request. In such cases, we will allow you to obtain your personal data in a structured, commonly⁠⁠⁠-⁠⁠⁠used and machine⁠⁠⁠-⁠⁠⁠readable format, or, if technically feasible, will pass it directly to another administrator designated by you;
⁠⁠⁠-⁠⁠⁠ the right to object to the processing of your personal data based on the need for processing, for the purpose of legitimate interest, including processing for direct marketing purposes. If we are unable to provide serious and legitimate reasons for processing, which outweigh your interests or rights and freedoms, or for the determination, enforcement or defence against any legal claims, we will not continue to process your personal data in such cases.
⁠⁠⁠-⁠⁠⁠ the right to withdraw consent to the processing of your personal data at any time by sending a communication to our address (CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10), to our e⁠⁠⁠-⁠⁠⁠mail address info@cpihotels.com, via the online contact form at www.cpihotels.com, or by changing the settings of your internet browser. The withdrawal of consent will come into force upon its delivery to CPI Hotels. According to GDPR, the withdrawal of consent does not affect the lawfulness of processing based on the consent given before its revocation.
⁠⁠⁠-⁠⁠⁠ the right not to be the subject of any decision based solely on automated processing, including profiling, which has legal consequences for you or similarly significantly affects you, except as expressly provided in the GDPR,
⁠⁠⁠-⁠⁠⁠ in addition to the above, if you believe that the processing of your personal data is violates the GDPR, the right to file a complaint with the supervisory authority, i.e., the Office for Personal Data Protection with registered office at Pplk. Sochora 27, 170 00 Prague 7.

8. Information text about the camera system on the premises of CPI Hotels, a.s.

• the purpose of processing is to protect property and increase the safety of persons
• the scope of processing includes only video recording by the camera system, without sound recording
• administrator identification: CPI Hotels, a.s., Company ID No.: 47116757, Bečvářova 2081/14, Prague 10, 100 00
• the recording from the camera system is stored on an HDD device/hard drive operated by CPI Hotels, a.s; no other processor is used for this camera system
• the site of processing is the registered office of CPI Hotels, a.s. and its premises at Vladislavova 1390/17, Nové Město, 110 00 Prague, as well as individually listed hotels, including the number of cameras:

Hotel	Adresa	Number
Hotel Imperial Ostrava	Tyršova 1250/6, 702 00 Moravská Ostrava	35
Clarion Hotel Prague Old Town	Hradební 768/9, 110 00 Prague, Staré Město	8
Comfort Hotel Olomouc	Wolkerova 1197/29, 779 00 Olomouc	12
Buddha⁠⁠⁠-⁠⁠⁠Bar Hotel Prague	Jakubská 649/8, 110 00 Prague, Staré Město	33
Spa Kur Hotel Harvey	Dlouhá 222/2, 351 01 Františkovy Lázně	37
Grand Hotel Zlatý Lev	Gutenbergova 126/3, 460 05 Liberec	8
Clarion Hotel Špindlerův Mlýn	Labská 111, 543 51 Špindlerův Mlýn	13
Spa Kur Hotel Praha	Ruská 27/12, 351 01 Františkovy Lázně	18
Clarion Hotel České Budějovice	Pražská tř. 2306/14, 370 04 České Budějovice	63
Clarion Hotel Prague City	Tylovo náměstí 15/3, 120 00 Prague, Vinohrady	12
Mamaison Residence Belgická	Belgická 318/12, 120 00 Prague, Vinohrady	2
Clarion Congress Hotel Ostrava	Zkrácená 2703/84, 700 30 Ostrava, Zábřeh	30
Hotel Černigov Hradec Králové	Riegrovo náměstí 1494/4, 500 02 Hradec Králové	12
Mamaison Hotel Riverside	Janáčkovo nábřeží 1115/15, 150 00 Praha	8
Comfort Hotel Prague City East	Bečvářova 2081/14, 100 00 Prague 10	68
Quality Hotel Ostrava City	Hornopolní 3313/42, 702 00 Moravská Ostrava, Ostrava	26
Mamaison Residence Downtown Prague	Na Rybníčku 1329/5, 120 00 Nové Město, Prague	48
Quality Hotel Brno Exhibition Centre	Křížkovského 30, 603 00 Brno	49

• only law enforcement or administrative authorities may be the recipient of data from the camera system, for the purposes of misdemeanour proceedings
• the cameras cover:

individual hotel entrances and reception areas, corridors and underground garages, parking spaces in front of the hotel, entrances/exits, staff entrances, supply and handling areas, terraces, entrances to fitness/wellness facilities(in the case of Clarion in Špindlerův Mlýn and Ostrava ), halls/foyers, access to conference rooms, ramp, yard/courtyard.

• the retention period of records is a maximum of 7 days, after which the data is automatically deleted by being recording over, as the camera system is based on a loop mode
• camera operation regime: continuous (or based on automatic motion sensor)
• contact details for receiving requests for information: registered address of CPI Hotels, a.s., or e⁠⁠⁠-⁠⁠⁠mail address dp@cpihotels.com

According to the valid legal personal data protection regulations , you generally have the following rights:

the right to access your personal data, which we process,
the right to correct your personal data in the event that it is incorrect, inaccurate or incomplete,
the right to request the deletion of personal data, or restriction of its processing,
the right to object to the processing of your personal data,
in addition to the above, you also have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection with its registered office at Pplk. Sochora 27, 170 00 Prague 7.

If anything is unclear or you have any questions regarding the processing of your personal data, you can contact us at any time by sending a letter to the registered address of CPI Hotels, a.s. or an e⁠⁠⁠-⁠⁠⁠mail to dp@cpihotels.com.

9. Our contact information

If anything is unclear or you have any questions regarding the processing of your personal data, please contact us at any time by sending us a letter to the registered address of CPI Hotels, a.s. Bečvářova 2081/14 100 00 Prague 10, or to the e⁠⁠⁠-⁠⁠⁠mail address of our data protection officer dp@cpihotels.com, or using the contact form at www.cpihotels.com.