Data protection policy

The company MPM-QUALITY v.o.s., ID No.: 47987430, with registered office at Příborská 1473, 73801, Frýdek-Místek, registered in the public register maintained by Regional court in Ostrava, Section AXVIII, File No. 956 is fully aware of the importance of data protection in the information company. For the functioning of many business activities, the possibility to process personal data, including data necessary for person’s identification, is crucial and creates a main pillar for functioning of businesses working with new technologies. To guarantee a problem-free functioning of all entrepreneurial activities of the company, we pay attention to adherence of relevant legislative requirements. One of these requirements is ensuring the data protection according to European parliament and The Council of the European Union 2016/679 from 27 04. 2016 o ochraně fyzických osob v souvislosti se zpracováním osobních údajů a o volném pohyb těchto údajů a o zrušení směrnice 95/46/ES (obecné nařízení o ochraně osobních údajů), (dále jen „GDPR“), jakož i všech prováděcích předpisů přijatých na národní úrovni v oblasti ochrany osobních údajů.

This document contains basic information about which personal data in the relation to our customers as users of our web pages are processed, also information about what authorises us to such processing, to whom we can hand personal data and also, which rights follow from this to our customers as subjects.

1. Which principles we follow?

• processing personal data only in agreement with the law and only on the basis of some of the demarcated legal titles to be processed, which we describe below
• Processing personal data only in stated purposes of processing
• Paying attention to exactness and topicality of personal data processing
• Adhering to principle of minimisation of personal data, meaning that we process only those personal data that are essential, given the stated purposes of processing.
• Following the principle of transparency of processing and we always provide our customers with complete information about the processing and their rights.
• Ensuring corresponding security standards for the protection of data processed by us, so that there is not a possibility of them being lost, destroyed or their other illegal handling.
• On the assumption, that we no longer need some of the personal data for some of the stated purposes, we ensure their immediate deletion with conformity with the law.

2. Personal data we process

If you decide to use our services, we will process the following categories of personal data:

2.1 IF YOU ARE A CITIZEN OF THE CZECH REPUBLIC AND THE PURPOSE OF YOUR STAY IS RECREATION:

1. identifying data, which are your name and surname, user name and password to your account.
2. contact data, which are mainly your e-mail address, telephone number, shipping address, billing address;
3. information regarding your questions and requests , setting up newsletters, evaluation of the services provided;
4. data about your orders , which includes data about the goods and services you ordered from us, the method of their implementation and payment, including the payment account number, or data about complaints;
5. data about your behavior on the website , which includes information from which device you access the website, which services you viewed, or how long you spent on the website, as well as data obtained from cookies and similar technologies;
6. data obtained through the use of customer service services, or data obtained after a visit to the hotel facility , which primarily includes records of telephone calls made through the customer line and also recordings of camera systems taken during a visit to the hotel facility;
7. information related to the use of specific services of the hotel facilities , which include the use of a parking space (in which case we also process the vehicle’s license plate number), the rental of sports equipment and mountain scooters (in which case we also require proof of identity card or other identification).

2.2 IF YOU ARE A CITIZEN OF THE CZECH REPUBLIC AND YOUR STAY IS DEMONSTRABLY REALIZED FOR A PURPOSE OTHER THAN RECREATION:

1. identification data , which includes your first and last name;
2. contact data, which are mainly your e-mail address, telephone number, shipping address, billing address;
3. information regarding your questions and requests , setting up newsletters, evaluation of the services provided;
4. data about your orders , which includes data about the goods and services you ordered from us, the method of their implementation and payment, including the payment account number, or data about complaints;
5. data about your behavior on the website , which includes information from which device you access the website, which services you viewed, or how long you spent on the website, as well as data obtained from cookies and similar technologies;
6. data obtained through the use of customer service services, or data obtained after a visit to the hotel facility , which primarily includes records of telephone calls made through the customer line and also recordings of camera systems taken during a visit to the hotel facility;
7. information related to the use of specific services of the hotel facilities , which include the use of a parking space (in which case we also process the vehicle’s license plate number), the rental of sports equipment and mountain scooters (in which case we also require proof of identity card or other identification).

2.3 IF YOU ARE A FOREIGN NATIONAL:

1. identification data , including your first and last name, date of birth, citizenship and ID card or travel document number;
2. contact data, which are mainly your e-mail address, telephone number, shipping address, billing address;
3. information regarding your questions and requests , setting up newsletters, evaluation of the services provided;
4. data about your orders , which includes data about the goods and services you ordered from us, the method of their implementation and payment, including the payment account number, or data about complaints;
5. data about your behavior on the website , which includes information from which device you access the website, which services you viewed, or how long you spent on the website, as well as data obtained from cookies and similar technologies;
6. data obtained through the use of customer service services, or data obtained after a visit to the hotel facility , which primarily includes records of telephone calls made through the customer line and also recordings of camera systems taken during a visit to the hotel facility;
7. information related to the use of specific services of the hotel facilities , which include the use of a parking space (in which case we also process the vehicle’s license plate number), the rental of sports equipment and mountain scooters (in which case we also require proof of identity card or other identification).

3. On what basis do we process personal data?

Within the scope of our activity, we process personal data for several purposes and in various extent, either:

1. without your consent on the basis of legal title of execution of the contract, our legal interest or because of the fulfilment of legal obligations, or
2. on the basis of your consent.

3.1 VISIT OF WEB PAGES BY THE USER

On a visit of our web pages, we process data about your activity on the web pages on the basis of our legal interest (therefore without your consent) in order to:

• create statistics about traffic on our web, including its individual pages and overviews: our legal interest is here the ensuring the efficiency of our web and its optimisation;
• assess the information, on which basis we will be able to improve our webpage, our legal interest being the improvement of functionality for our customers and better offer of services;
• prevention of attacks on the web pages, ensuring the security of data; our legal interest is problem-free functionality of web pages and security of data send to the user.

For this purposes we process personal data for the period necessary for the recording of statistics of traffic, and that maximum for the period of 1 month.

You have the right to apply an objection against the processing realised on the basis of the legal interest.

3.3 ORDER CREATION

Assuming that you create an order with us, we implement the following processing methods:

3.2.1 Performance of the contract

If you order services as a natural person, we process your personal data for the purpose of preparing, concluding and fulfilling the contract, in the scope of identification and contact data, as well as data about your orders.

If you order services as a legal entity, we process the same data for the same purpose based on our legitimate interest, which consists in concluding and fulfilling a contract with the person you represent.

The preparation, conclusion and performance of the contract with our customers means that we need your data for the following reasons:

• to complete the order on the website without problems;
• to carry out all necessary communications relating to this order;
• to secure payment for this order, either in cash or through partners who operate the payment system for us;
• to provide accommodation services in hotel facilities and related services (e.g. wellness);
• to provide services related to your stay through partners who ensure the operation of these services for us (e.g. sports and leisure activities);
• to provide complaints;
• to handle all your related requests.

For this purpose, we process personal data for the duration necessary to fulfill the contract or handle related requests such as complaints. After this period, we will retain the data based on our legitimate interest for the purpose of protecting legal claims and our internal record-keeping and control, for the duration of the statute of limitations and 1 year after its expiration, with regard to claims made at the end of the statute of limitations. In the event of the commencement of judicial, administrative, or other proceedings, we process personal data to the necessary extent for the entire duration of such proceedings and the remaining part of the statute of limitations after its completion. Our legitimate interests in this context are the protection of legal claims and the control of the proper provision of our services.

You have the right to apply an objection against the processing realised on the basis of the legal interest.

3.2.2 Fulfillment of legal obligations

The company further processes selected personal data for the fulfillment of legal obligations imposed by law, for which it is not necessary to obtain the consent of the data subject. We also process your identification and contact data, including information regarding your requests and data about your orders, for the purpose of fulfilling legal obligations according to the following regulations:

• Act No. 89/2012 Coll., Civil Code,
• Act No. 634/1992 Coll., on consumer protection,
• Act No. 235/2004 Coll., on value added tax,
• Act No. 563/1991 Coll., on accounting.
• Act No. 326/1999 Coll., on the residence of foreigners in the territory of the Czech Republic,
• Act No. 565/1990 Coll., on local fees.

For these purposes, we use personal data for a maximum period of 10 years according to the relevant tax regulations.

3.2.3 Legitimate Interest

If you are our regular customer, we can send you a related offer of goods and services based on our legitimate interest, which is the implementation of business activity, in accordance with applicable legislation. The above does not change the fact that you always have the option to simply unsubscribe from this offer, either by contacting our customer service or directly by using the unsubscribe link in the email.

For this purpose, we process personal data for the duration of your subscription to the newsletter.

You have the right to apply an objection against the processing realised on the basis of the legal interest.

3.3 CONSENT TO PROCESSING

We also carry out selected types of processing based on your consent. You may encounter these situations while using our website, for example, if you wish to receive special offers and newsletters related to the full range of the company, if you are interested in personalized tailored advertising, or its display on social media or third-party websites.

In any case, giving consent is always voluntary, and we do not condition the functioning of our services on it. You can revoke your consent at any time depending on the type of processing to which the consent relates, which we describe below. In case of any questions, you also have the option to contact our employees through the contacts listed in Section 8, Exercising Your Rights. However, revoking consent does not affect the lawfulness of processing before such revocation.

• Sending promotional offers and newsletters

  If you are not our customer and still wish to receive a complete offer of our services, special events and discounts, you have the option to subscribe to our newsletter by agreeing on the website. The above also applies if you are our regular customer and wish to receive information about the complete offer of our product range.

• Transfer of data and display of personalized advertising on social and advertising networks

  With the help of cookies, we improve our website, while the information obtained can be forwarded for the purpose of targeting advertising to social and advertising networks. You can refuse the customization of websites and the sharing of data for the purposes of advertising targeting by changing your browser settings (you can find more information about the use of cookies here ). By continuing to use the website without changing your settings, you agree to the targeting of advertising, for which we will use data about your behavior on the website.

3.4 PROCESSING OF PERSONAL DATA OF SERVICE RECIPIENTS

Assuming that a service is ordered for a third party other than the customer, we process their personal data to the extent specified in section 2, on the basis of a legitimate interest for the purpose of preparing, concluding and fulfilling a contract with our customer and also for the purpose of fulfilling legal obligations in particular according to Act No. 235/2004 Coll., on value added tax, Act No. 563/1991 Coll., on accounting, Act No. 565/1990 Coll., on local fees and Act No. 326/1999 Coll. , on the residence of foreigners in the territory of the Czech Republic.

For this purpose, we process personal data for the time necessary to fulfill the contract, or to handle related requests such as complaints. After the expiration of this period, we will continue to retain the data based on our legitimate interest for the purpose of protecting legal claims and our internal records and control, for the duration of the limitation period and 1 year after its expiration with regard to claims made at the end of the limitation period. In the event of the initiation of judicial, administrative or other proceedings, we process your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of the limitation period after its termination. Our legitimate interests here are the protection of legal claims and the control of the proper provision of our services. For the purposes of fulfilling legal obligations, we store personal data for a maximum period of 10 years according to the relevant tax regulations.

You have the right to apply an objection against the processing realised on the basis of the legal interest.

3.5 COMMUNICATION WITH CUSTOMERS

When using the contact form or communicating with our customer department, this involves processing without your consent based on the performance of a contract (preparation of a contractual relationship), our legitimate interest in carrying out business activities, and also the fulfillment of legal obligations, during which we process your identification and contact information, as well as information regarding your requests and order details. The mentioned processing is carried out for the purposes of:

• receiving and processing your requests:
• registration of your requirements and control of their fulfillment.

For this purpose, personal data is kept for the necessary period, i.e. for a period equal to the period of retention in the case of the fulfillment of a contractual relationship (if the communication relates to a completed order, its complaint, etc.), or for a period of 3 months from the sending of your request ( if it is a request without follow-up to an order).

You have the right to apply an objection against the processing realised on the basis of the legal interest.

3.6 VISIT TO THE COMPANY’S HEADQUARTERS, STORE OR THEIR SURROUNDINGS

When you visit the hotel facility or its surroundings, recordings may be made from the camera system , on which you may be captured. The said processing takes place on the basis of the legitimate interest of the company, for the purpose of protecting our property and also protecting people moving around the company’s headquarters and its surroundings.

For this purpose, personal data is kept for the necessary period, namely for 14 days.

You have the right to apply an objection against the processing realised on the basis of the legal interest.

4. To whom do we transfer your personal data and who processes it?

All the mentioned personal data are processed by us as the data controller. We determine and are responsible for all the purposes of processing your personal data obtained through the website and the forms provided here, as well as through other communication tools (email or telephone communication).

We also use the services of other processors to process personal data, who process personal data only according to our instructions and for the purposes set forth here. These processors are:

• • providers of selected sports, relaxation and leisure activities (PUSTEVNY, sro, ID: 27775658);
  • providers and suppliers of technology and support, including the operation of websites (Agnis s.r.o., ID number: 26795736, BT MEDIA INVEST s.r.o., ID number: 01421824);
  • economic software providers (MJ Soft, ID: 66799724);
  • providers of tools for marketing support (AdVisio marketing, ID: 04305116).

• in case we receive your consent to display personalized advertising on social networks or third-party websites, further:
  • social network operators (Facebook Ireland Limited, with registered office at 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland);
  • providers of marketing tools Google AdWords, Google Analytics and Google My Business (Google Ireland Limited, with registered office at Gordon House, Barrow Street, Dublin, D04 E5W5, Dublin, Ireland).

5. Where do we get personal data from?

In most cases, we process personal data that you provide directly to us when ordering services or communicating with us through the provided web forms or by contacting our employees directly. We may also obtain personal data from business partners operating online travel booking services (www.booking.com, www.hrs.com) in accordance with the terms and conditions of the respective service. We can also obtain personal data directly from you by taking a camera recording from the hotel facilities or its surroundings.

6. Transfer of data outside the EU

To process personal data, we select and use suppliers who are established within the European Union. Your personal data is thus not transferred outside the EU. Vaše osobní údaje tak nejsou předávány mimo území EU.

7. We respect your rights in the processing of personal data. What are they?

In connection with the processing of personal data, the company respects the rights of customers as data subjects, in particular the right to access personal data, which includes the right to information about the processing of personal data, the right to correction, erasure (the right “to be forgotten”), the right to restriction of processing, the right to data portability, the right to object to processing based on the legitimate interest of the personal data controller or the right to file a complaint with a supervisory authority. Find out what these rights mean for you and how to exercise them below.

• Right of access

For example, as a customer, you have the right to know what data we process about you, for how long, for what purpose, who are the processors of your personal data or where we get the data from. You can also request a copy of this personal data, which we will provide free of charge after your identification. In the case of repeated requests, we will process them with a fee.

• Right to rectification

If you believe that the data processed by us is inaccurate or incomplete, you have the right to have it corrected or supplemented.

• Right to erasure

We carry out an ongoing review of the purposes for which we process data and the period of data retention. If the specified processing time elapses, we will delete the relevant data immediately. If you believe that we should no longer process your data, you have the right to erasure if the following conditions are met:

• we no longer need the personal data for any of the stated purposes;
• we processed your data on the basis of the consent you revoked as a customer and we have no other legal reason for processing them;
• we process your data on the basis of a legitimate interest to which you object and we assess that we no longer have any legitimate interests;
• the processing is no longer in accordance with legal regulations.

In the event that the processing of personal data is further necessary to fulfill legal obligations, or to exercise the company’s legal claims, the right to erasure does not apply.

• Right to restriction of processing

After using your right to restrict processing, we will temporarily mark your personal data, which will cease to be the subject of processing for a limited period of time. This can happen under the following circumstances:

• as our customer, you deny the correctness of your personal data, whereby the processing will be limited for the time necessary to verify the correctness of this data;
• in exceptional cases, we find that the processing of personal data takes place without a legal basis, however, as our customer, you will prefer to limit the processing before deleting it (typically in the situation if you plan to transfer the data to us in the future);
• on our part, the data is no longer needed for the specified purposes of processing, however you, as our customer, require it for the exercise or defense of your legal claims;
• you object to the processing, whereby the processing will remain restricted for the period during which we check whether our legitimate interests prevail or not.

• Right to portability

We process some of your personal data based on the fulfillment of the contract and also based on your consent. The GDPR grants you the right to data portability in these circumstances. Therefore, if you submit a request to us relating to this right, we will provide you with the data in a machine-readable, structured and commonly used format.

• The right to object to processing

As the data controller, we carry out some processing based on legitimate interests. You have the option to object to these types of processing. In the case of processing involving marketing activities, your personal data will cease to be processed immediately upon objection. In other cases, we will assess whether our legitimate interests persist, and we will promptly inform you whether there are still reasons for our processing to continue, or if the processing has been terminated.

• The right to file a complaint

GDPR also acknowledges the right of a subject of data to file a complaint with supervising authority. For the Czech Republic, that is the The Office for Personal Data Protection, registered at Pplk. Sochora 27, 170 00 Prague 7. The complaint can be filed, if you believe that we processed your data illegally or in contrary with legal regulations.

8. Exercise of your rights

In cases of exercise of your rights regarding the processing of personal data or whatever questions you may have regarding the processing of personal data on our side, do not hesitate to contact us on the addresses given below:

Customers’s department:
E-mail: dpo@mpm-quality.cz

Commissioner of personal data protection:
E-mail: dudova@mpm-quality.cz

All of the demands will be dealt with within the legal period of one month. In the case of more difficult request, we have the right to prolongate this period for two more moths. About this fact, you will be nonetheless immediately informed.