Privacy Policy (GDPR)

Pursuant to Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, and in accordance with Act No 110/2019 Coll., on the processing of personal data (hereinafter also referred to as "GDPR"), we inform.

Dear guests, on this page you will find the most important information about your personal data processed by Premium Hotels & Resorts a.s. in accordance with the GDPR, 247 47 092, with its registered office at Revoluční 767/25, Staré Město, 110 00 Prague 1, registered in the Commercial Register maintained by the Commercial Register of the Ministry of Justice in Prague, Section B, Insert 25887 (hereinafter referred to as the "Controller" or "Company") in the hotels ŠTEKL at Bezručova 141, Hluboká nad Vltavou and ROŽMBERSKÝ DŮM at Linecká 55, Český Krumlov (hereinafter referred to as the hotels).

The purpose of this brief notice is to inform you about the processing of personal data that occurs in connection with visiting the websites www.hotelstekl.cz and www.rozmberskydvur.cz, as well as about some other cases of processing of personal data where the Company's activities involve the processing of personal data of other persons (e.g. hotel guests, journalists, etc.; hereinafter referred to as "Data Subject").

Processing of personal data from contact forms

By submitting an enquiry via an enquiry form, personal data is also collected, which is located in an encrypted interface and includes the following data:

• Date and time of sending the enquiry form;
• data from the enquiry form sent;
• the visitor's query, if any.

The processing of these log files will be carried out by the Company itself.

Personal data about visitors to the Controller's website processed in connection with the administration of the Controller's website, or the administration of the Controller's booking system and/or the implementation of
internet marketing will only be processed provided that the relevant data subject has given consent to the processing in question within the meaning of Article 6(1)(a) GDPR, and for as long as
the consent in question is valid. In the absence of the Data Subject's consent within the meaning of Article 6(1)(a) GDPR, the Personal Data of Data Subjects are/will be processed at the request of the Data Subject
within the meaning of Article 6(1)(b) GDPR.

Processing of personal data for sending the newsletter

In the event that a website user wishes to receive newsletters and other promotional communications, the Company will process, on the basis of consent, the personal data
provided by such user for these purposes, always at least to the extent of the email address, first and last name. The content of the newsletter and other advertising communications may be personalised on the basis of the data provided and
other data for the personalisation of the content that the Company learns from the user's behaviour on the website or newsletter.

The Company will only start processing the user's personal data after the user has filled in the relevant order form for sending the newsletter and other advertising messages with his/her data and then
the order and confirms his/her consent to the processing of personal data by replying as instructed in the e-mail message received. If the order is not confirmed,
will not store the completed data anywhere.

The personal data provided is processed until the consent given is withdrawn. The actual processing of the personal data provided will be carried out by the Company itself or, where appropriate, via
, by a specialist processor with whom it has concluded a separate contract.

Consent to this processing of personal data is entirely voluntary and may be withdrawn by the user at any time by sending a notice of withdrawal of consent in writing to the Company's registered office (see below).

Processing of personal data in connection with photo documentation of events

For events organised by us, we take photo documentation (situational shots of events) to a reasonable extent for the purpose of subsequent publication of selected photos on our website for promotional
purposes of our hotels. In this way, we do not primarily depict the visitors of a specific event, but the overall atmosphere of the event, the images are not published in close-up, we do not attach
or descriptions of specific persons attending the event. According to the expert opinion of the Office for Personal Data Protection, in such cases the primary issue is not the protection of personal data, but
the protection of privacy under the Civil Code; therefore, consent to the processing of personal data for "illustrative" images is not required.

Visitors are warned in advance of the taking of photo documentation by means of a camera pictogram, our photographers are visibly identified and photo documentation is only taken in
the main event area, so visitors always have the option of staying in areas where photo documentation is not taken. If you have any doubts or questions about the taking of
photo documentation, you can contact us at the contacts below.

Data processing based on booking or stay

On the basis of your reservation (or stay without reservation) we process personal data of our clients to the following extent:

• Identification and contact data (name and surname, permanent address, ID card number or similar document and, where applicable, e-mail address and telephone number);
• in the case of natural persons engaged in business, also the name of the natural person engaged in business, registered office, registration number, VAT number, VAT registration number;
• in the case of business trips of non-business persons, also the details of the organisation that ordered or paid for the stay);
• information on the purpose of the stay, or information on the fact that the client is a person who is not subject to a fee for a spa or recreational stay;
• information about your membership in the loyalty programme;
• details of your stay and the services used and the amount and method of payment for the services provided (in the case of non-cash payment, bank account number or credit card details);
• in the case of foreign nationals, in addition to the above-mentioned data, date of birth, nationality, travel document number, visa number, address of permanent residence abroad;
• in the case of guests who use parking at our hotel, also the license plate number of the car.

Processing for the purpose of compliance with legal obligations

The provision and processing of all of the above personal data, with the exception of your e-mail address and telephone number and information about your membership in the loyalty program, is necessary for
purposes of fulfilling the Company's legal obligations, in particular those arising from the Local Tax Act and the Act on the Residence of Foreigners in the Czech Republic, as well as from accounting and tax
regulations.

Processing necessary for the performance of the contractual relationship

The processing of your identification data and data about your stay and the services provided and the amount and method of payment is necessary for the purposes of fulfilling the contractual relationship relating to your stay,
i.e. securing orders and reservations, concluding and fulfilling contracts relating to the accommodation, catering and related services offered and provided by the Company.

Processing necessary for the purposes of legitimate interest

We process your personal data in the scope of your name, surname, e-mail address and information about your stay on the basis of the legitimate interest of the Company for the purpose of direct marketing, the purpose of
processing here is exclusively the possibility of sending you marketing and commercial communications, i.e. information about interesting news, discounts, etc.

We also process personal data to the same extent to send you satisfaction questionnaires after your stay in order to verify your satisfaction with the Company's services and to continuously improve
the quality of the Company's services for you.

There are no cases of our guests questioning the services provided by the hotels. Should there be a case of a dispute about the services provided by the Company, the Company would be obliged to
process data about the services provided to the extent necessary to conduct such a dispute, solely for the purpose of protecting the Company's rights in such a dispute. Similarly,
would also be obliged to process the necessary data in the event of non-payment of services or in the event of damage to the Company.

Automated processing of your data

We do not in any case carry out automated decision-making or other automated processing of your personal data that would have legal effects for you or similarly
significantly affect you.

In the event of a request for services on the hotel's website www.hotelstekl.cz or www.rozmberskydvur.cz via the enquiry form or by sending an enquiry to the relevant email address listed on that website, the Company will only process the potential customer's personal data, in the scope of name, surname, email address, telephone contact, or company, on the basis of your consent. You can withdraw your consent at any time by sending an explicit communication to stekl@hotelstekl.cz or recepce@rozmberskydvur.cz.

After processing the relevant enquiry, the Company may use the aforementioned data on the basis of your consent for its marketing purposes regarding its accommodation services. In this case
the data subject has the right to withdraw the consent given at any time by sending an explicit communication to stekl@hotelstekl.cz or recepce@rozmberskydvur.cz.

The processing of the personal data provided will be carried out by the Company itself or by a contractual processor.

Processing of personal data in connection with the accommodation service

The personal data of customers (name, surname, date of birth, ID card or passport number, residence, signature) who make their stay in the hotels are processed by the Company on the basis of the legal
grounds imposed by Act No. 565/1990 Coll., on local taxes (§3g), as amended, and Act No. 326/1999 Coll., on the residence of foreigners (§101), as amended. Therefore, this is processing necessary for
fulfillment of a legal obligation in accordance with Article 6(1)(c) GDPR and such processing does not require the consent of the accommodated person (Data Subject).

The Company stores the name, surname and email address of its customers on the basis of consent, also for the purpose of verifying customer satisfaction or a commercial offer of the same nature or service that
was the subject of the order. In this case, the Data Subject has the right to withdraw the consent given at any time by sending an explicit communication to stekl@hotelstekl.cz or recepce@rozmberskydvur.cz.

The feedback will be collected by the Company, and thus the email addresses of the customers will be processed, so that a questionnaire on satisfaction with the course of
stay in the hotels, i.e. a commercial communication, will be sent to these email addresses, in accordance with the above. The questionnaire will only be sent to customers once in connection with the respective purchase of the service. The company will carry out the feedback and thus the processing of the customers'
e-mail addresses itself or via a contractually obliged third party (processor).

Information text on CCTV in hotels

The purpose of the processing is to protect property and increase personal security. The scope of the processing includes only the image recording of the CCTV system, without sound recording. The controller of these recordings is
Company. The CCTV footage is stored on a HDD device/hard drive operated by the Company no other processor is used for this CCTV system. The place of processing is the hotel ŠTEKL at Bezručova 141, Hluboká nad Vltavou and the hotel ROŽMBERSKÝ DŮM at Linecká 55, Český Krumlov.

Only law enforcement authorities or administrative authorities for the purposes of misdemeanour proceedings may receive data from the CCTV system.

The cameras cover the entrance and reception areas, corridor areas, staff entrances, supply and handling areas, terraces, fitness/wellness entrances, lobby/foyer, access to
conference rooms, ramp, courtyard/interior and kitchen staff areas. The areas to be surveyed are properly marked with pictograms with additional written information about the custodian, contact person and phone number.

The retention period of the recordings is a maximum of 72 hours after which the data is automatically deleted by overwriting with a new recording, as the camera system is based on a loop mode.

The operation of the cameras is continuous (possibly based on an automatic motion sensor).

Contact details for receiving requests for information are given below.

Period of processing of personal data

We process your personal data for the duration of your stay at our hotel. Afterwards, we only process it after its termination:

The data for which we are obliged to process under the relevant legal regulations, and only for the period necessary under these legal regulations. (For example, the accounting and tax documents that
issues to you also contain some of your personal data (name, type of service provided, date of issue of the document). We retain these documents only for the purpose of complying with
obligations set out in the relevant accounting and tax legislation, for the period of time imposed by such legislation.)

Your name, surname, e-mail address and information about your stay for the purposes of direct marketing of the hotel (sending you information about interesting news or discounts on our services, etc.) and for sending
satisfaction surveys. We process the data for sending satisfaction surveys only until the surveys have been evaluated (maximum 1 month after your stay). For the purposes of direct marketing of
, we process your data mentioned above until you have informed us of your possible objection to further such processing.

The data is necessary for the purposes of existing or realistically threatened disputes, for the eventual application of data subject compensation and the protection of their rights. We process this data only until the dispute has been finally resolved and the obligations arising from the decision have been fulfilled, or until such time as disputes about the services provided may arise under applicable law.

After the aforementioned periods, we regularly destroy your personal data, both in paper and electronic form.

Other rights related to the protection of personal data

Data subjects whose personal data is processed by the Company are entitled to the following rights related to the processing of their personal data, provided that the conditions set out in the legislation are met:

• the right of access to personal data, consisting in the right to receive it free of charge upon request
• information on which of their personal data the Company processes;
• the right to have their personal data processed corrected;
• the right to have their personal data processed erased;
• the right to restrict the processing of their personal data;
• the right to the portability of personal data;
• the right to withdraw their consent to the processing of personal data at any time, provided that consent is a legal
• basis for the respective processing of personal data (i.e. for the sending of newsletters and other promotional
• communications).

Furthermore, data subjects whose personal data is processed by the Company have the right to object to the processing of their personal data if
the legal basis for the processing is the legitimate interests of the Company, subject to the fulfilment of the prerequisites laid down by law. If personal data are processed for direct marketing purposes, the data subject has the right to object to such processing at any time.
The above rights may be exercised by data subjects whose personal data are processed by the Company in writing or by e-mail to the Company as the data controller, using the contacts listed below
.

The controller can be contacted by:

• in writing at Hotel ŠTEKL Bezručova 141, Hluboká nad Vltavou or

at the hotel ROŽMBERSKÝ DŮM Linecká 55, Český Krumlov;

• by telephone via the telephone number of Hotel ŠTEKL +420 387 967 491

hotel ROŽMBERSKÝ DŮM +420 380 712 551 and

• electronically via e-mail :

Hotel ŠTEKL stekl@hotelstekl.cz or

hotel ROŽMBERSKÝ DŮM recepce@rozmberskydvur.cz.

The aforementioned rights of the data subject are not absolute rights. The Company will assess the rights exercised individually and with regard to its own rights or those of third parties. If the Data Subject considers that there has been a breach of the law in relation to the protection of his/her personal data, he/she has the right to lodge a complaint with a supervisory authority. The supervisory authority for the territory of the Czech Republic is the Office for Personal Data Protection Pplk. Sochora 27,170 00 Prague 7(www.uoou.cz).