Privacy policy - Grotthuss Hotel

Privacy Policy of Grotthuss Hotel

We have developed a privacy policy to ensure the security of your personal data and the transparent processing of your personal data.

It specifies what personal data we collect, how we receive it, what your rights are, and how they are implemented.

Your personal data is processed by data controllers

UAB „Edama“
Legal entity code: 125409657
Address: Ligoninės g. 7-101, LT-01134 Vilnius
Tel.: +370 5 266 0322
E-mail: info@grotthusshotel.com

The data controllers are hereinafter referred to as “Grotthuss Hotel” or “We”.

Personal data means any information about an identified or identifiable natural person (data subject). A natural person is a person who can be identified, directly or indirectly, by an identifier: name, surname, personal identification number, location data, internet identifier, or one or more physical, physiological, genetic, mental, economic, cultural, social or identity features of the person.

Data subject means a person who uses the services of Grotthuss Hotel, purchases goods, visits the contacts Grotthuss Hotel for goods/services or for any other purpose, as well as a candidate who participates in a selection process for a job advertised by Grotthuss Hotel.

Request means a request by a data subject for the exercise of his or her rights.

Regulation – the so-called GDPR Regulation, 2016/679 of the European Parliament and of the Council (EU) of 27 April 2016 on the protection of natural persons with regard to the processing of Personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the Protection of Personal Data).

Website means the website of Grotthuss Hotel www.grotthusshotel.com

Other terms may be used in this privacy policy in accordance with the provisions of the Regulation.

General provisions

In this privacy policy, we inform you about the basic principles of the processing of personal data and the exercise of the rights of the data subject. Additional information about the processing of your personal data may also be provided in other agreements: purchase and sale, etc.

By using the Grotthuss Hotel services, purchasing goods, submitting your data, sending a CV, filling in enquiry or reservation forms, continuing browsing the Website, you confirm that you have read this Privacy Policy and understand its provisions.

Principles of processing personal data

Grotthuss Hotel processes personal data in accordance with the legal acts of the European Union and the Republic of Lithuania regulating the processing of personal data.

The scope of personal data depends on the services or goods ordered or used, Grotthuss Hotels legal relationship with the data subject and other persons, and the information provided by the person when ordering or using services, purchasing goods, visiting the Website or contacting Grotthuss Hotel.

We only process your personal data under the criterion of legitimate processing – in order to take action at your request before entering into a contract or performing a contract, with your consent, when we are obliged to process personal data by the relevant legal acts, when the processing of personal data is necessary for our legitimate interest or that of a third party.

We aim to process personal data accurately, fairly and lawfully and only for the purposes for which it was collected, in accordance with the clear and transparent principles and requirements for the processing of personal data laid down by law.

How we obtain personal data

We may receive personal data directly from You in the following cases:

You complete enquiry or booking forms on the Website;
you send your curriculum vitae (CV), other information related to your employment;
you place an order for the purchase of services provided by Grotthuss Hotel;
you otherwise contact Grotthuss Hotel;
you interact with Grotthuss Hotel via social networks or simply follow Grotthuss Hotels activities on social networks;
Grotthuss Hotel provides services to you.

We may receive your personal data indirectly:

from your travel agent or another person who commissions the services provided to you by Grotthuss Hotel;
from social media platforms or online reviews;
from Grotthuss Hotel data processors or other external sources.

Personal data may be generated when you use or inquire about the services – by phone, sending a text message, e-mail, ordering services, or visiting the Website.

You are not obliged to provide us with any personal data, but it is possible that without your personal data, we will not be able to perform certain actions – providing services, selling goods or invoicing.

Recipients of personal data

We do not provide personal data to anyone else without your consent, except:

in the case of a dispute, to persons providing legal services to Grotthuss Hotel;
auditors, other consultants;
outsourced data processors, reservation service providers;
public authorities, law enforcement agencies and other persons in accordance with the procedure established by the legislation of the Republic of Lithuania.

If we disclose your personal data to other groups of data recipients than those specified in this privacy policy, we will inform you of this at the latest at the time of the first disclosure of the data, unless we have already provided you with such information in other documents previously provided to you or concluded with you.

Purposes for personal data processing

Grotthuss Hotel processes your personal data for the following purposes: ordering and providing of services/goods, direct marketing, customer service, room reservation, Website traffic statistics and monitoring, Website improvement, promoting Grotthuss Hotels brand awareness, analysing guest opinion, handling complaints, improving services (including monitoring of guest behaviour), protection of property and persons, internal administration, debt collection and administration, legal claims, enforcement and defence, relations with customers and partners, accounting, contract administration and enforcement, enquiry management, employee search and recruitment.

Categories of personal data processed by Grotthuss Hotel

The following main categories of personal data may be processed by Grotthuss Hotel for the purposes set out above:

Name, surname, date of birth, age of the data subject;
ID card (passport) number, date and place of issue;
telephone number, e-mail address, address, signature, IP address;
service purchased/ product, additional services ordered;
date of check-in and check-out at the Grotthuss Hotel hotel, reservation number, information on persons living together;
website browsing history and date;
other information necessary for the provision of services, goods, maintenance of relationships, invoicing and administration of contracts, presentation of legal requirements,
reviews and ratings of Grotthuss Hotel on social media;
videos, other categories of data.

If you have already purchased a product or booked/purchased services from us, or if you have entered into a contract with us and have not objected to the processing of your personal data for direct marketing purposes at the time of collection, we will process your data for this purpose on the basis of a legitimate interest by sending you communications about similar goods or services. In this case, you may at any time unsubscribe from the direct marketing communications provided to you by emailing us at info@grotthusshotel.com or by clicking on the unsubscribe link at the bottom of the newsletter you receive from Grotthuss Hotel.

Your rights in relation to personal data

Where we receive information directly from you about the processing of personal data, we will inform you at the time of receipt of the personal data:

orally (if we only communicate with you orally, e.g. by telephone);
in writing (information sent to you by email is considered to be in writing).

If we do not receive your data directly from you, we will inform you orally or in writing (as set out above) about the processing of your personal data at the latest within one month of receipt of the data, and, if we use your personal data to contact you, at the latest at the time of the first contact with you.

You have the following rights in relation to the processing of personal data:

the right to access your personal data and how they are processed;
you have the right to be informed about the period of retention of your personal data, from which sources and what personal data have been collected, for what purpose they are processed, to whom they are provided;
to request the rectification of personal data and the suspension of the processing of such personal data in the event that, after consulting the personal data, you discover that the data are incorrect, incomplete or inaccurate;
the right to request the destruction of personal data or restriction of processing operations, where the data subject establishes, after having familiarised himself with his personal data, that the processing of personal data is unlawful or fraudulent;
the right to disagree with the processing of one’s personal data, except where such personal data are processed due to a legitimate interest pursued by the later controller or a third person to whom personal data are provided and if the interests of the data subject are not more important;
the right to object to the processing of personal data for direct marketing purposes;
the right to withdraw the consent given to the processing;
the right to have the data erased;
right to the portability of personal data
the right to object to the application to the data subject of only automated processing, including profiling
the right to lodge a complaint with the State Data Protection Inspectorate or a competent court regarding the processing of personal data;
the right to compensation for damages suffered as a result of violation of the data subject’s rights

Procedure for contacting venckai venckuose when exercising your rights as a data subject

You have the right to apply for the exercise of the rights of the data subject orally or in writing by submitting a request in person, by post or by electronic means using the contacts specified in this Privacy Policy.

If you apply for the exercise of the rights of the data subject verbally or if the application is submitted in writing in person, you must confirm your identity by submitting a personal identity document. Failure to do so will prevent us from accepting your request and will result in the non-enforcement of your data subject rights. This does not apply if you request information about the processing of personal data in accordance with Articles 13 and 14 of the Regulation.

If you decide to apply for the exercise of your data subject rights in writing by submitting your request by post, you must submit with your request a copy of a personal identification document certified by a notary public or other legally established procedure.

If your personal data, such as your name, surname or family name, have changed, you must submit copies of the documents confirming the change of these data together; if sent by post, the copies must be certified by a notary public or in accordance with other procedures laid down by legal acts.

If you decide to submit the application by electronic means, the application must be signed with a qualified electronic signature or it must be formed by electronic means, which allows ensuring the integrity and unalterability of the text. This does not apply if you request information about the processing of personal data in accordance with Articles 13 and 14 of the Regulation.

The request to exercise the rights of the data subject must be legible, signed, and must contain your name, surname, address and/or other contact details for communication or for which a reply on the exercise of the rights of the data subject is requested.

You can exercise your rights yourself or through a representative. If you choose to exercise your rights through a representative, your representative must indicate in the request your name, address and/or other contact details for communication purposes and by which your representative wishes to receive a reply, as well as your name and any other data necessary for the proper identification of the data subject, and must provide a document or a copy of a document confirming representation.

If we have any doubts about your identity, we have the right to request additional information necessary to verify it.

Cookies

To improve your visit, we use cookies, which are small pieces of text information that are automatically generated when you browse the Website and stored on your computer or other terminal device.

The information collected by cookies allows us to provide you with a more user-friendly browsing experience, to provide suggestions and learn more about the behaviour of our Website users, to analyse trends and improve both the Website and the services we provide, and to save your completed or incomplete reservations so that you can return to them later. Cookies allow VENCKAI VENCKUOSE to provide services tailored to the needs of our users (for example, by displaying only content of interest to a particular user). Where the VENCKAI VENCKUOSE Website contains links to other websites that also use cookies, these are not described here.

Where functional, tracking, advertising cookies and/or third party cookies are recorded, we ask for your consent. Where we use essential cookies, we use them on the basis of legitimate interest and do not ask for your consent to set such cookies.

If we have obtained your consent, we will not ask for your consent again in the future when using the same cookie for the same purpose. This also applies to cookies used by third parties.

If you do not consent to the recording of cookies on your computer or other terminal device, you can change the settings of your web browser to disable all cookies or enable/disable them one by one in the event that we ask for your consent to record cookies. However, please note that in some cases this may slow down your internet browsing speed, restrict the operation of certain features of the Website or block access to the Website.

Cookie name	Purpose of processing	Moment of creation		Duration
cookielawinfo	A standard cookie is used to support the users session.	When accessing the website		until the website window is closed
catAccCookies	The cookie is used to store information about the cookie alert viewed by the user.	When accessing the website		60 days
Google Tag Manager and Google Analytics cookies:
-ga	An analytical Google Analytics cookie that tracks the user’s actions on the site. The data you receive is used to improve the performance of the Website.		When the customer visits the website		2 yrs.
-gat	Analytical cookie of the Google Analytics application collects and stores information about user behaviour on the website.		During the first visit		1 minute
-gid	Analytical Google Analytics cookie when choosing statistical information about the user (the cookie does not collect any personal data, but gives each user their ID in their records). The data you receive is used to improve the performance of the Website.		When the customer visits the website		24 Hours
-NID	The cookie is used by Google to display personalised advertising on Google’s corporate website depending on previous searches.		When the customer visits the website		6 months.