Information Notice on the Processing of Personal Data

Information Notice on the Processing of Personal Data

S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments – EFORIE NORD

This document is the information notice concerning all activities carried out by S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments EFORIE NORD in which your personal data are processed.

Identification details of the data controller

S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments EFORIE NORD operates the property officially classified as ‘3-star rental apartments’ and carries out activities under CAEN 5520 – Holiday and other short-stay accommodation, with its registered office in Eforie Nord, str. Dorobanți nr. 1D, Constanța County, Romania, registered with the Trade Register under no. J13/1613/2017, with Unique Registration Code RO 37634945.

What personal data we collect and why we collect them

We collect the following data:

• data required to make a reservation (surname, first name, city, address, country, telephone number, email address);
• data required for the check-in procedure (registration number and identity card/passport, date of birth, home address, etc.), in accordance with the legislation in force;
• data required to make a payment by bank card (type, number, cardholder, expiry date, security code), by bank transfer (customer’s bank account, bank where the account is held), or the number and series of the holiday voucher if you pay with holiday vouchers/cards;
• the reservation code for your accommodation;
• data collected from access cards (check-in time, check-out time);
• data you have provided by email or telephone;
• data required for employment (surname, first name, address, email address, telephone number, CV, details of education and training, qualifications).

Data are collected using:

• a contact form if you contact us;
• the online room reservation form if you book a room through our website;
• an accommodation form – arrival and departure notification form (online check-in; reception check-in);
• a bank card or holiday card payment form;
• the provision/use of additional services;
• access cards;
• the job application form;
• email/telephone/social media (Facebook, Instagram) if you contact us;

Contact form

When you contact us using the contact form, we retain the submitted contact forms for a certain period (a maximum of 24 months) to serve customers, but we do not use the information submitted in them for marketing purposes or add the address to newsletter campaigns without your consent.

Reservation form

When you make a reservation using the reservation form, we retain the submitted data for a certain period (a maximum of 24 months) to serve customers and comply with the legislation in force, but we do not use the information submitted in it for marketing purposes or add the address to newsletter campaigns without your consent.

Online accommodation form

When you stay at our property, you can check in online. We collect the following personal data – in accordance with H.G. no. 237/2001 (surname, first name, identity document series and number, date of birth, place of birth, home address, citizenship, email address, telephone number, purpose of the trip to Romania) – when you use the online accommodation service and when you stay at our property.

Use of the payment form

Bank card data (holder, account, card number, expiry date, CV code) recorded when making reservations or obtaining additional services will be used only for the stated purpose and for the time necessary to exercise rights and fulfil obligations. All credit card details are encrypted when sent to the hotel. Credit card details are stored by the hotel only for the purpose of collecting payment and guaranteeing the reservation.

By email

When you contact us by email, we retain the submitted data for a certain period (a maximum of 24 months) to serve customers, but we do not use the information submitted in them for marketing purposes or add the address to newsletter campaigns without your consent.

Reservations through Pynbooking

When you book a room through our website, your data are shared with PynBooking, our online management and reservation software.

Reservations through Booking.com

When you book a room through Booking.com, we receive all the information you have personally entered on their website, except your private email address.

Reservations through Travelminit.ro

When you book a room through the travelminit.ro website, we receive all the information you have personally entered on their website, except your private email address.

If you are a prospective employee

We collect the information in the CV you submit, as well as any other information submitted with the CV (using the form on the Careers page, by email or telephone) and/or in the interviews you have attended.

If you are an employee or another type of collaborator

To conclude an employment contract with us, we request the following personal data as required by law (surname, first name, home address, date and place of birth, identity document number and series, education documents, criminal record, tax record, CVs, medical certificate, etc.).

Video surveillance

Surveillance cameras may also capture or record images of visitors in public places (such as hotel or restaurant entrances or reception).

S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments EFORIE NORD is the entity that will receive and process your personal data. These data may most often include: surname, first name, telephone number, email address, arrival date, departure date, personal numerical code (CNP), identity document series and number. They will be received and processed in various situations, such as making a reservation, registering a stay, providing information about our offers or producing marketing materials; in these last two situations, only if we have your consent/agreement to do so.

We also wish to inform you that the personal data we work with may come directly from you (if you make a reservation, for example), from a third party (if you choose our services through a travel agency), or from activities you undertake during your stay at our hotel (if we have your consent to produce certain advertising, marketing and publicity materials).

Our entitlement to process your personal data is based primarily on the need to conclude and perform the services contract; without the provision and use of personal data, such a contract cannot exist.

Please bear in mind that you can contact us at any time at the email address contact@amariseforie.ro if you wish to get in touch with us regarding the processing and protection of your personal data.

Purpose of processing personal data

As a personal data controller, S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments EFORIE NORD processes your data in accordance with the activities classified under CAEN 5520 – Holiday and other short-stay accommodation.

S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments EFORIE NORD processes the personal data you provide, by automated and manual means, for the purpose of processing customer registration and requests and providing the following services and activities, as applicable:

• fulfilling reservation requests through the online or offline reservation systems used by the Company (telephone, email, reception, website, booking, etc.);
• offering and providing hotel accommodation, food service and leisure services;
• processing orders and contracts, providing information on the status of orders and services offered;
• providing accommodation and completing payment formalities;
• invoicing accommodation and other related services, preparing accounting statements and tax declarations;
• settling holiday vouchers through the contracting establishments;
• preparing information and management reports for internal processing to manage the company’s activities and to track and monitor stays/sales;
• preparing mandatory reports/analyses required by I.N.S. (maintaining statistical records of the number of tourists, accommodation capacity and other indicators specific to accommodation services);
• ensuring the security and integrity of the property and valuables of tourists and the controller;
• handling customers’ requests, questions and complaints;
• Displaying on our company’s website or social media websites images/videos from events or promotional materials featuring, among other people, guests of our hotel.
• other related activities in accordance with the company’s business purpose.

The legislation governing the activities and obligations we must comply with as an accommodation service provider is as follows:

• H.G. no. 237/2001 approving the rules on tourist access, registration and protection in tourist accommodation establishments, republished;
• O.G. no. 58/1998 on the organisation and conduct of tourism activities in Romania;
• Law no. 227/2015 on the Fiscal Code;
• M.F.P. Order no. 2634/2015 on financial and accounting documents;
• Law no. 333/2003 on the guarding of facilities, property and valuables and the protection of persons, as subsequently amended and supplemented;
• O.U.G. no. 97/2005 on the registration, domicile, residence and identity documents of Romanian citizens, approved by Law no. 290/2005, republished, as subsequently amended and supplemented;
• H.G. no. 1.375/2006 approving the methodological rules for the uniform application of the legal provisions concerning the registration, domicile, residence and identity documents of Romanian citizens;
• H.G. no. 839/2006 on the form and content of identity documents, residence registration stickers and building registers;
• any other legislation in force applicable to the company’s activities.

In our activities, we will strictly comply with Regulation 679/2016, with particular emphasis on the following articles: Article 5 – Principles relating to processing; Article 6 – Lawfulness of processing; Article 7 – Conditions for consent; Article 8 – Conditions applicable to children’s consent in relation to information society services; Article 9 – Processing of special categories of personal data; Article 32 – Security of processing; and Articles 13 to 22 – Concerning your rights/the rights of data subjects.

Our data protection practices comply with applicable legislation. However, if, for any reason, the terms set out in this data protection policy are not acceptable to you, you may communicate your objection to us at contact@amariseforie.ro.

AMARIS Holiday Apartments has a legal obligation to register people who come to stay at our accommodation property. Personal data are necessary for this purpose. Guests will complete the ‘Arrival and departure notification form’ at reception in accordance with H.G. no. 237/2001, published in M. Of. no. 92/22.02.2001. You complete the form yourself; Hotel Amaris only verifies the authenticity and accuracy of the data.

Under these rules, the arrival and departure notification form includes: the tourist’s surname and first name, date of birth, home address, arrival date, departure date, identity document series and number, and the signatures of the tourist and receptionist.

Data retention period

H.G. no. 237/2001, Article 2:

‘(10) Copies of the arrival and departure notification forms, grouped in the same way as the originals, remain at the tourist accommodation establishments, with an archiving period of 5 years.’

Under Article 5 of Law 190/2018, video recordings will not be retained for more than 30 days.

You should also know that your basic data will be retained throughout the performance of the contract.

Your data in accounting records will be retained in accordance with the specific legal regulations in this field and with Law no. 16 of 1996 on the National Archives.

‘Article 2 paragraph (6) of the rules provides:

(6) Arrival and departure notification forms completed and signed by accommodated tourists are collected, together with identity documents, by receptionists, who must compare the data in the forms with those in the identity document, sign the forms to confirm that they have been completed correctly, and immediately return the identity documents to the tourists.’

This process also involves processing your personal data for the provision, invoicing and payment of the services supplied.

In accordance with Law no. 165/2018 on the granting of value vouchers:

Article 26 paragraph (1)

(1) Each paper holiday voucher is valid only if it bears the serial number assigned by the issuing entity and includes at least the following information:

1. a) the issuer and its identification details;
2. b) the face value of the holiday voucher;
3. c) the employer and its identification details;
4. d) space for entering the surname, first name and personal numerical code of the employee entitled to use the holiday voucher;
5. e) space for entering the period in which it was used and applying the stamp of the affiliated establishment;
6. f) the validity period for using the holiday voucher;
7. g) a prohibition on the affiliated establishment paying in cash the difference between the value of the holiday voucher and the value of the service package used by the holiday voucher holder;
8. h) a prohibition on using the holiday voucher anywhere other than affiliated establishments;
9. i) the visual identity elements of Romania’s tourism brand.

(2) Each electronic holiday voucher is valid only if the information provided for in paragraph (1) point a), c), f), h) and i), as well as the surname, first name and personal numerical code of the employee entitled to use the holiday voucher, are entered on the electronic holiday voucher or stored in it in another way.

Recipients of your data

The collected data are intended to be processed by the data controller and its processors (accounting/invoicing software provider, IT maintenance, website hosting, etc.). They are transmitted only to fulfil their legal obligations to state authorities legally entitled to receive them, namely A.N.A.F., M.A.I., the Ministry of Tourism, I.N.S. or other competent supervisory authorities, where applicable.

Transfer of data abroad

We do not transfer your data abroad.

Source of personal data

Personal data may be obtained from the following sources:

(a) directly from you when you request offers or reservations, or when you come to the hotel reception to register for accommodation;

(b) through activities you undertake while benefiting from the services offered, such as photographs at events or when producing promotional materials, and the history of conversations through various communication channels (email, social media, etc.);

(c) from third parties, such as when we receive your personal data from third parties who forward responses to your requests for offers.

Legal basis for processing personal data

The legal bases for the personal data processing operations described in this notice are:

(i) the performance of a contract to which you are a party, or taking steps before concluding a contract for the provision of hotel services;

(ii) processing is necessary to comply with a legal obligation to which the controller is subject;

(iii) our legitimate interests in accordance with the legal provisions concerning data privacy;

(iv) your consent.

Please note that in cases (i) and (ii), without the personal data required to finalise the relevant contract, it will be impossible to conclude it.

If Hotel Amaris is required by a legislative act (law, regulation, decision), ordinance or court ruling to disclose personal data, compliance will take place without informing the data subject or obtaining their consent.

Data sharing

Pynbooking

If you book through our website, your personal data will be shared with PYNBOOKING NET SRL, Str. Decebal, Nr. 12, Bucharest. For more details, you can read the Pynbooking Privacy Policy.

Booking.com

If you book through the Booking.com platform, your personal data will be shared with Booking.com B.V., at Herengracht 597, 1017 CE Amsterdam, the Netherlands, the company that operates booking.com. Booking.com Privacy Policy.

Travelminit.ro

If you book through travelminit.ro, your personal data will be shared with TRAVELMINIT INTERNATIONAL SRL, with its registered office at 400267 Cluj-Napoca, Str. Stație, Nr. 21, Liberty Technology Park, block D, entrance D1, office 1B, Cluj County, Romania, CUI RO38869249; the owner of the domains travelminit.ro, travelminit.com and travelminit.hu. Travelminit Privacy Policy.

Euplătesc

If you book and pay online by card, your personal data will be shared with EuroPayment Services SRL, at Str. Ion Câmpineanu 11, Bl. Uniune, floor 8, Sector 1, Bucharest, 010031, Romania, the company that operates the Euplătesc payment processor. Credit card information is collected by Euplătesc and managed in accordance with the company’s privacy policy. For more details, you can read the Euplătesc Privacy Policy.

Edenred.

If you pay for your stay with Edenred holiday vouchers, your data are shared with the service provider in accordance with its privacy policies. For more details, you can read the Edenred Privacy Policy.

Sus/Up România.

If you pay for your stay at S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments EFORIE NORD with Up România holiday vouchers, your data are shared with the service provider in accordance with its privacy policy. For more details, you can read the Up România Privacy Policy.

Pluxee

If you pay for your stay at S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments EFORIE NORD with Pluxee Turist holiday vouchers, your data are shared with the service provider in accordance with its privacy policies. For more details, you can read the Pluxee România Privacy Policy.

Facebook.

All Facebook and Instagram social features and services available on our website are governed by Facebook’s Personal Data Processing Policy. For more details, you can read the Facebook Privacy Policy.

Email marketing.

Following reservations made by visitors on our website through the reservation module, as well as through all forms on the website, S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments EFORIE NORD collects email addresses but keeps them confidential, in order to send you newsletters about news and offers, while also offering the option to unsubscribe through each newsletter. We assure you that the email addresses you use on this website will not be passed on to third parties.

Data security

To prevent unauthorised access, maintain data accuracy and ensure the proper use of data, we implement reasonable and appropriate physical, IT and organisational security measures to effectively protect all personal data we process.

The information you provide through online platforms will subsequently be transmitted in encrypted form using SSL (Secure Socket Layer), to prevent misuse of the data by third parties. You can recognise this by the closed padlock symbol in your browser’s status bar and by the URL beginning with ‘https’.

To improve the measures presented in this Personal Data Protection Policy, we will make every effort to ensure that data are accurate, complete, current and relevant to the intended use, and any changes will be described in the updated version.

AMARIS Holiday Apartments will periodically test and review the effectiveness of measures to protect data against the risks of loss, misuse, unauthorised access, disclosure, alteration or unlawful deletion/destruction.

Providing personal information is entirely voluntary, and you have the right not to provide personal information.

If you need assistance accessing, updating, correcting or deleting personal information, or if you no longer wish to use our services, you can send a request at any time to the email address: contact@amariseforie.ro.

Among the organisational measures taken by our organisation to ensure the security of processing your personal data, we inform you that we have approved the following procedures: the Personal Data Protection Procedure, the Procedure for Protecting the Rights of Data Subjects, and the Security Incident Management Procedure. We pay particular attention to training our own employees, the controller’s processors and their employees to comply with GDPR rules and understand their importance.

If we, as a controller, work with another controller in processing personal data, we guarantee the lawful and transparent conclusion of a personal data processing agreement that explains in detail the disclosure of personal data to the other controller, under conditions that ensure the protection of the processing of your personal data.

Changes to the Personal Data Protection Policy

S.C. APARTAMENTE ESTIVAL S.R.L. – AMARIS Holiday Apartments EFORIE NORD reserves the right to amend the Personal Data Protection Policy whenever necessary. Significant changes will be reflected promptly in the updated version of this document.

You can revisit this Personal Data Protection Policy periodically to stay informed about the latest version of this document.

Your rights/the rights of the data subject

With regard to the processing of Personal Data indicated in this Procedure, each data subject has the following rights under the applicable legal provisions:

• The right to information (Articles 13 and 14 of the Regulation);
• The right of access to the information held and information about those to whom it has been disclosed (Article 15 of the Regulation);
• The right to rectification of data (Article 16);
• The right to erasure (‘the right to be forgotten’ – Article 17);
• The right to restriction of processing (Article 18);
• The right to data portability (Article 20);
• The right to object to the processing of data (Article 21);
• The right not to be subject to a decision based solely on automated processing (Article 22);
• The right to lodge a complaint with a supervisory authority (Article 77), namely Autoritatea Națională de Supraveghere și Protecție a Datelor cu Caracter Personal (A.N.S.P.D.C.P.), b-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336, Bucharest, Romania, email: anspdcp@dataprotection.ro, tel. +40.318.059.211, +40.318.059.212, president’s office +40.318.059.220 and fax +40.318.059.602.
• The right to an effective judicial remedy against a supervisory authority/the right to bring proceedings before a court (Article 78).

To exercise the rights mentioned above, you may send a written, dated and signed request to: contact@amariseforie.ro or by post to: AMARIS Holiday Apartments, str. Dorobanților nr. 1D, Eforie Nord, Constanța County, tel. 0720/102.100.