Home

Privacy Policy

Booking
Read more

PRIVACY POLICY

I. Introductory provisions

  1. For the purposes of this Policy:
    • a) INVEST - TATRA, s.r.o., with registered office at Robotnícka 258, 017 01 Považská Bystrica, ID No.: 36 346 799, registered in the Commercial Register of the District Court of Trenčín, Section: Sro, Insert No.: 15931/R (hereinafter referred to as the "Operator")
    • b) Personal data: name and surname, title, date of birth, date of birth, birth number, residence, delivery address, ID card number, passport number, e-mail address, telephone number, billing address, IP address.
  2. The Operator, as the Personal Data Controller, hereby informs you of the manner and scope of the processing of Personal Data, including the scope of the Participant's rights (as defined below) related to the processing of their Personal Data when booking accommodation and ancillary services at the Panorama Hotel (hereinafter referred to as the "Hotel") owned by the Operator.
  3. When processing personal data, the controller shall comply with the following legal regulations in particular:
    • a) Act No. 18/2018 Coll. on the Protection of Personal Data, as amended
    • (b) Regulation (EU) 2016/679 of the European Parliament and of the Council ("the Regulation")
  4. The Participant is a natural person who purchases goods and services from the Operator, in particular accommodation services and related additional services through the reservation system www.hotelpanorama.sk.
  5. The Operator is a legal entity that operates the Hotel for the purpose of providing accommodation and ancillary services to the Participant. In connection with the above, the processing of Personal Data occurs:
    • a) to the extent that they have been provided in connection with the order of accommodation and additional services of the Operator, or in the context of negotiations on the conclusion of a contract with the Operator, as well as in connection with the concluded contract
    • b) for the purpose(s) set out in Article II below on the legal bases set out therein.

II. Purposes and periods of processing of Personal Data

  1. The Controller processes Personal Data for the following purposes:
    • a) The performance of a contract or other obligation and the provision of services:
      • i) Personal data will be processed during the period of negotiations on the conclusion of the contract between the Operator and the Participant, both for the purpose of concluding the contract and during the duration of the contractual relationship; this is in particular the provision of accommodation services, ensuring the registration of accommodated guests in accordance with specific regulations.
      • ii) Sending satisfaction questionnaires: sending satisfaction questionnaires in order to improve the service provided to customers following an order, booking or direct sale. In this case, the period of processing of personal data is 3 years.
      • iii) Marketing promotions: for the purpose of fulfilling the marketing promotion, evaluation, termination, delivery of any prize, etc. Processing period: for the duration of the marketing event.
      • iv) Customer administration: keeping personal records of all customers and their services. Based on the analysis of these records, also making strategic decisions on offers to customers.
    • b) Compliance with a legal obligation (in particular accounting, tax and archiving, providing assistance to administrative authorities, police, courts, etc.):
      • i) The tax document will be kept for 10 years from the end of the contract: In order to fulfil the legal obligation to archive accounting documents on the basis of Act No. 563/1991 Coll. on Accounting, as amended, the Personal Data will be further processed and kept for a period of 10 years from the year following the year in which the contract between the Operator and the Subscriber was concluded.
      • (ii) Performance of obligations in connection with the exercise of rights arising from defective performance, provision of assistance to administrative authorities, police, court: The controller is entitled to process the subscriber's basic personal, identification and contact data, data on the services provided and data from communication between the customer for a period of 4 years from the date of provision of the services.
    • c) Legitimate interests of the Controller, protection of the Controller's rights and legally protected interests:
      • (i) Effective protection of the rights of the controller in the event of a dispute. The processing period is set here at 4 years from the provision of the service and extended by the period for which the dispute is pending.
      • ii) The legitimate interest of the Operator is further to send commercial notices (blanket offers and individual offers) in accordance with Section 7(3) of Act No. 480/2004 Coll. on certain information society services and in accordance with point 47 of the Regulation, if the Operator has obtained details of electronic contact in connection with the sale of goods and services to the Subscriber.
      • iii) Recordings of speeches of a personal nature: on the legal basis of legitimate interest (prevention of abuse of service and protection of property) and on the basis of the provisions of Section 12, Paragraphs 2 and 3 of Act No. 40/1964 Coll. of the Civil Code, as amended, and Section 10, Paragraph 3, Letter a) of the Act, the operator may make visual images or visual-sound recordings for official purposes on the basis of the Act, for artistic purposes, or for the purposes of cinematographic, radio, press, or television reporting. When making such a recording, the controller shall take into account the legitimate interests of the natural persons concerned and shall ensure the least possible interference with their privacy.
      • iv) CCTV monitoring in the Hotel: control of security compliance and protection of the rights and legally protected interests of the operator. All areas with CCTV monitoring are duly marked with a pictogram, the logo of the operator and the address with all information on the processing of personal data. The legal basis is the legitimate interest of the controller.
      • v) Lost and Found: if the Participant forgets his/her belongings in the Hotel and if he/she requests their return, the Operator will hand them over to him/her. However, for this purpose, he/she must verify the identity and record to whom these forgotten items have been handed over. The legal basis is the legitimate interest of the controller.
      • (vi) Trip book: in the case of a trip to a mountain or alpine environment in particular, it is in the legitimate interest of the operator to know, among other things, when the participant plans to return from the trip, in case a search operation is declared by the mountain service. The legal basis for the processing is the legitimate interest of the controller.
    • d) Marketing and commercial offers of the Operator's services:
      • (i) Bulk mailing of commercial offers of products and services: sending general advertising communications without targeting a specific group of recipients. The processing period for personal data in this case is 3 years.
      • (ii) Individual offer: sending of advertising communications after evaluation of certain personal aspects relating to the natural person. The controller does not carry out profiling in accordance with Article 22 of the Regulation, as this is not automated processing, but the manual creation of individual offers. The period of processing of personal data in this case is 3 years.
      • iii) Gift vouchers: if you wish to gift someone with one of our products or one of our services, it is necessary to process the identification data of the donor and the recipient to the extent necessary. The Controller processes the personal data of the holder of the gift voucher in order to control the eligibility of the use of the services provided by the Controller. The personal data is processed for the period necessary to fulfil the purpose of the processing - checking the eligibility of the use of services provided by the operator. The legal basis is the contract concluded between the operator and the donor and the legitimate interest of the operator together with the expectations of the donor.
      • iv) Consumer competitions, sporting events and competitions: personal data is processed for this purpose to the extent necessary for the conduct and registration of the event or competition. It is possible that, in addition to this data, the event or competition will be promoted and a picture or film report will be made of it and published through the operator's communication channels in order to promote sport, nature, the countryside, the event and the Hotel. The legal basis for the processing is the contract on the basis of which the participant accepts the terms and conditions of the competition.
      • v) Cookies: short text files generated by a web server and stored on your computer via your browser. There are two types. Firstly, they are cookies necessary to ensure the functioning and analysis of the website (to carry out the transmission of electronic communications via an electronic communications network, the use of these cookies cannot be opposed) (hereinafter referred to as "technical cookies"). They are also cookies that evaluate certain personal aspects relating to a specific natural person (hereinafter referred to as "advertising and marketing cookies"). The use of the second type of cookies requires the Participant's consent. The processing period in this case is 3 years. Further information and conditions are set out in Article V of this Policy.
  2. Legal basis for processing personal data:
    • a) Performance of the contract - in the case of ordering accommodation or additional services or in the case of participation in a consumer competition.
    • b) Consent - in particular in connection with sending commercial communications about news and current offers or other forms of marketing, in the case of competitions, events, in the case of sending communications about jobs or the inclusion of candidates in the candidate database. Any consent given is voluntary and can be withdrawn at any time, but this does not affect the lawfulness of the processing prior to its withdrawal.
    • c) Compliance with legal obligations - when storing data in accounting records or when disclosing data to state and other authorities supervising the activities of the controller or resolving disputes or enforcing decisions.
    • d) Legitimate interest - in improving and personalising our services, certain marketing activities, or in relation to security and rights protection. In these cases, the controller will always assess whether the processing will not constitute a disproportionate interference with the rights of the subscriber.

III. Data protection and processing information

  1. If the Participant does not provide his/her Personal Data, it is not possible to conclude a contract with the Operator and/or to provide him/her with the services resulting therefrom. In this context, the Personal Data is necessary for the provision of a specific service of the Operator.
  2. Upon expiry of the time limits referred to in Article II. The Controller shall delete or anonymize the Personal Data.
  3. The Participant is obliged to provide only true and accurate Personal Data to the Operator. The Participant is responsible for the correctness, accuracy and truthfulness of the Personal Data provided. The Operator shall not be liable for the accuracy of the data provided.
  4. The controller shall make every effort to prevent unauthorised processing of personal data.
  5. The Operator is entitled to transfer the Subscriber's personal data to third parties for the following purposes: completion of the ordering process, provision of services, sending of commercial notifications, customer satisfaction assessment, customer support services, handling of complaints, registration of a new customer.
  6. Personal data is and will be processed in electronic form in a non-automated manner.
  7. The controller does not intend to transfer any personal data to a third country or international organisation.
  8. The controller does not use automated individual decision-making, including profiling, in the processing of personal data pursuant to § 28 (1) and (4) of the Act.

IV. Participant's rights related to processing (information for the Participant)

  1. Participant's rights in relation to the protection of personal data:
    • a) the right to request access to his Personal Data from the Controller,
    • (b) the right to rectification of the Personal Data provided,
    • c) the right to erasure of the Personal Data provided (the right to be forgotten),
    • d) the right to restrict the processing of Personal Data,
    • (e) the right to lodge a complaint with the Office for Personal Data Protection,
    • (f) the right to transfer the personal data to another controller,
    • (g) the right to object to the processing of personal data,
    • (h) the right to withdraw consent to the processing of personal data.
  2. The Participant may exercise his/her rights under paragraph 1 of this Article by submitting a request to hotel@hotelpanorama.sk.
  3. In the event that the Participant believes that the Controller carries out processing of his Personal Data that is contrary to the protection of his private and personal life or contrary to the applicable law, in particular if the Personal Data are inaccurate with respect to the purpose of their processing, he may:
    • a) request an explanation from the Operator by e-mail to hotel@hotelpanorama.sk,
    • b) object to the processing and request, by e-mail sent to hotel@hotelpanorama.sk, that the Controller ensure the elimination of the situation (e.g. by blocking, correcting, supplementing or destroying the Personal Data). The Controller shall promptly decide on the objection and inform the Participant. If the Operator does not comply with the objection, the Participant has the right to contact the Data Protection Authority directly. This provision is without prejudice to the right of the Subscriber to address his/her complaint directly to the Data Protection Authority.
  4. If the Subscriber exercises any right under this Article, the Operator shall respond within 30 days of receipt of the request by the Subscriber to the Operator.
  5. Receipt of a request to exercise the right under Article IV(1)(a) and (f) shall only be possible by means of a message with a guaranteed electronic signature of the Subscriber or by a letter with a certified signature to the address of the Operator's registered office. The request must be accompanied by an e-mail address to which a verification e-mail will subsequently be sent to confirm the identity of the applicant.
  6. If the Subscriber exercises any of the rights from Article IV, paragraph 1, the Operator shall have the right to require proof of the Subscriber's identity. Thus, the request for access to personal data must be sent from the e-mail address of the applicant. If the request is made in a different form or from a different e-mail address, the Controller shall have the right to request additional verification in the form of a reply to the verification e-mail. If the applicant does not prove his/her identity within 14 days of the sending of the verification e-mail, his/her request to exercise the rights under Article IV, paragraph 1 will not be accepted and therefore not processed.
  7. In the event of a repeated and unjustified request for the provision of a physical copy of the Personal Data processed, the Controller is entitled to charge a reasonable fee for the administrative costs involved.

V. Categories of recipients, third parties and cookies

  1. The controller does not provide, disclose or make public personal data, but may share it with third-party service providers. The data is shared only to the extent necessary for the sale and provision of the service in accordance with the terms and conditions. Data is shared when:
    • a) Reservation of accommodation services, whereby data may be provided to the extent necessary:
      • i) Booking.com, Expedia.com, HRS.com, D-EDGE, Bookolo
    • (b) Transportation, whereby data may be provided to the extent necessary:
      • i) Slovenská pošta, a.s., Partizánska cesta 9, 975 99 Banská Bystrica
    • c) The operation, improvement and maintenance of the websites; personal data are also available to the extent necessary to contractors who provide the controller with services related to the creation and management of the websites, where necessary, and the data may be provided:
      • i) dpMarketingGroup, s.r.o., Námestie sv. Egídia 55, 058 01 Poprad, dpmarketing.sk
    • (d) Providing advertisements and analysing the data from them, whereby the data may be provided to the extent necessary:
      • (i) Google Analytics - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
      • (ii) Google AdWords - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
      • (iii) Facebook Pixel - Facebook Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland
  2. Cookies
    • a) Technical cookies are used by the operator for the proper functioning of the website, and consent to their use is not required from the subscriber.
    • b) Advertising and marketing cookies are used by the operator for the purpose of displaying content according to the subscriber's previous preferences and for the purpose of displaying advertising according to the subscriber's interests, whereby advertising and marketing cookies are only stored by the operator on the basis of the subscriber's consent.
    • c) The Participant is entitled to refuse or delete cookies, while the Operator warns that such action may cause partial or complete non-functionality of the www.hotelpanorama.sk website .
    • d) Information about browsers and how to set your cookie preferences is available on the following websites:
      • i) Chrome
      • ii) Firefox
      • (iii) Internet Explorer

VI. Final Provisions

  1. All legal relations arising from the processing of Personal Data shall be governed by the laws of the Slovak Republic, regardless of where the access to the Personal Data was made. The Slovak courts are competent to resolve any disputes arising in connection with the protection of privacy between the Participant and the Operator.
  2. The data subject (Participant) has the right to contact the Data Protection Authority (https://dataprotection.gov.sk/uoou/sk).
  3. This Policy shall enter into force on 01.06.2025.

‍

Don't miss out and be the first to hear about new offers.

Sign up for our newsletter and you won't miss a thing.

This form is protected by Google's reCAPTCHA technology. Privacy Policy and Terms and Conditions.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.