PRIVACY POLICY AND PERSONAL DATA PROCESSING NOTICE

Date of last update: 22 September 2026

Version: 2.0.

  1. Introduction

This Privacy Policy and Personal Data Processing Notice (hereinafter: the Policy) explains how HOTEL ASTORIA d.o.o. collects, uses, stores, discloses and protects the personal data of:

  • guests and persons booking accommodation;
  • website visitors;
  • persons communicating with the Hotel;
  • users of the Hotel Wi-Fi network;
  • loyalty programme members;
  • visitors and other persons entering areas under video surveillance;
  • Hotel employees;
  • job applicants.

This Policy applies when you visit our website, book accommodation directly or through an intermediary, stay at the Hotel, use Hotel services, communicate with us, or otherwise provide us with personal data.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the General Data Protection Regulation or GDPR), the Croatian Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/2018), and other applicable regulations.

  1. Data Controller

The controller of your personal data is:

HOTEL ASTORIA d.o.o.

Petrinjska ulica 71, 10000 Zagreb

OIB (Personal Identification Number): 64685504163

(hereinafter: the Hotel or the Controller)

  1. Contact for Personal Data Protection Matters

For questions related to the processing of personal data and the exercise of your rights, you may contact the person responsible for data protection, i.e. the Data Protection Officer:

HOTEL ASTORIA d.o.o.

Data Protection Officer

Petrinjska ulica 71, 10000 Zagreb

E-mail: sasa.hercigonja@hotelastoria.hr

  1. Principles of Personal Data Processing

The Hotel processes personal data:

  1. lawfully, fairly and transparently;
  2. only for specified, explicit and legitimate purposes;
  3. to an extent that is adequate and necessary for the stated purposes;
  4. while ensuring that the data are accurate and kept up to date;
  5. only for the period necessary to achieve the purpose or comply with a legal obligation;
  6. with appropriate technical and organisational security measures in place.

 

  1. Categories of Personal Data

Depending on the method of communication, reservation, services used and legal obligations, the Hotel may process the following categories of personal data.

5.1. Identification Data

  • first and last name;
  • gender;
  • date and place of birth;
  • nationality;
  • permanent or temporary residence address;
  • type and number of identification document;
  • data contained in the identification document required for guest registration;
  • OIB (Personal Identification Number), only where required for invoicing, taxpayer identification or compliance with another legal obligation;
  • data concerning a parent, guardian or accompanying person of a minor guest, where required.

The Hotel does not make copies of identity cards or passports.

5.2. Contact Data

  • permanent/temporary residence address (street, house number, city/town, country);
  • e-mail address;
  • telephone or mobile phone number;

5.3. Reservation and Stay Data

  • date and time of arrival;
  • expected departure date;
  • date and time of departure;
  • room number and type;
  • number of persons covered by the reservation;
  • data on reserved and used services;
  • data on reservation cancellation or guest no-show;
  • special requests related to the stay.

5.4. Financial and Transaction Data

  • prices and invoice amounts;
  • data on services used;
  • payment method information;
  • data required for authorisation, pre-authorisation, charging or refunds;
  • data required for issuing invoices;
  • data on the consumption of food, beverages and other Hotel services.

Payment card data are processed through secure payment systems. The Hotel does not store the CVC/CVV security code. Where tokenised card data are used, the Hotel cannot see the full card number in its information system.

5.5. Preference Data

  • preferred room type;
  • type of bedding or pillow;
  • requests concerning room location;
  • other requests voluntarily provided by the guest in order to tailor the stay.

The Hotel will not record preferences that are not necessary to provide the requested service.

5.6. Health Data

The Hotel may process information on food allergies, intolerances or other health-related restrictions only where the guest voluntarily provides such information for the safe preparation of food or adaptation of the service.

Health data constitute a special category of personal data. The Hotel processes such data only to the minimum extent necessary and shares them only with employees and departments that need them to fulfil the request.

5.7. Technical Data

  • IP address;
  • device type;
  • browser type and version;
  • operating system;
  • language and time settings;
  • network identifiers;
  • data on login to and use of the website;
  • data on use of the Hotel Wi-Fi network;
  • data collected by cookies and similar technologies, where their use is permitted.

5.8. Access Control System Data

If the Hotel uses electronic cards or keys, the system may record:

  • card or key identifier;
  • the room or area accessed;
  • date and time of card use;
  • data on access attempts.

5.9. Video Surveillance Recordings

The Hotel processes recordings of persons entering, leaving or moving within areas covered by video surveillance.

Video surveillance does not cover guest rooms, sanitary facilities, changing rooms or other areas where there is a particularly justified expectation of privacy.

5.10. Communications and Documentation

  • content of enquiries and responses;
  • complaints, objections and requests;
  • data on lost and found property;
  • documentation relating to incidents, damage, injuries and non-payment;
  • other business correspondence.

5.11. Employee Data

In connection with the establishment, duration and termination of employment, the Hotel may process personal data of employees, pupils and trainees undertaking professional practice, and persons engaged through a student employment service, only to the extent necessary for the performance of a contract, compliance with legal obligations and pursuit of the Hotel’s legitimate interests.

Categories of data may include:

  • identification and contact data, including first and last name, OIB, date and place of birth, nationality, address, contact details and data from appropriate identification documents;
  • data on education, professional qualifications, job position, type of contract, working hours, work schedules, attendance, annual leave and other rights and obligations arising from employment;
  • data required for the calculation and payment of salary, allowances and other material entitlements, including IBAN, tax data, data on dependants and disability where required for taxation, and data relating to contributions and insurance;
  • data on registration and deregistration from compulsory insurance schemes, length of service, pension and health insurance;
  • data on residence and work permits and other documents of foreign employees where their processing is required by law;
  • data from occupational safety, fire protection, sanitary examination, hygiene minimum, HACCP control, workplace injury and temporary incapacity-for-work records;
  • data on the issue and return of uniforms, work clothing, keys, cards and other equipment;
  • data contained in employee requests, decisions, certificates, enforcement documents, insurance documentation and other documentation related to exercising rights and obligations arising from employment.

Health data and other special categories of personal data are processed only where necessary and permitted under regulations governing employment, social security, health surveillance or occupational safety, with access restricted to persons who need such data to perform their duties.

5.12. Job Applicant Data

  • first and last name;
  • contact details;
  • curriculum vitae;
  • data on education, experience and qualifications;
  • cover letter;
  • other information voluntarily provided by the applicant in connection with the application.
  1. Purposes, Legal Bases and Retention Periods

For clarity and transparency regarding the Hotel’s processing of personal data, the table below presents the main personal data processing activities together with the purpose and legal basis of processing, recipients of your personal data and the periods for which your personal data are retained.

Processing and data categories Purpose of processing Legal basis Recipients Retention period
Identification and reservation data Receipt and fulfilment of reservations, guest registration, accommodation and provision of contracted services Performance of a contract or steps taken prior to entering into a contract, Art. 6(1)(b) GDPR Hotel PMS, intermediary through which the reservation was made, authorised IT service providers During the contractual relationship and thereafter in accordance with the applicable retention or limitation period
Data required for tourist registration Guest registration and deregistration in the eVisitor system and compliance with other prescribed obligations Legal obligation, Art. 6(1)(c) GDPR Croatian National Tourist Board, competent local tourist board, other bodies authorised by law According to the period prescribed by regulations and the rules of the eVisitor system
Financial and transaction data Charging for accommodation and other services, pre-authorisation, charging for no-shows or cancellations, refunds Performance of a contract, Art. 6(1)(b) GDPR Banks, card companies and payment service providers Until completion of the transaction; documentation is retained in accordance with applicable financial and tax retention periods
Invoices and accounting documents Issuing invoices, accounting, tax filings and financial reporting Legal obligation, Art. 6(1)(c) GDPR Tax Administration, accounting, auditors and other competent authorities In accordance with applicable accounting and tax regulations
Contact data and communications Reservation confirmation, responding to enquiries, organisation of the stay and communication with the guest Performance of a contract or steps prior to entering into a contract, Art. 6(1)(b) GDPR Authorised employees and providers of communication and/or IT services Up to 5 years after the end of the relationship, unless a different period applies
Complaints and objections Handling complaints, evidencing actions taken and protecting legal claims Legal obligation, contract or legitimate interest, Art. 6(1)(b), (c) and (f) GDPR Legal advisers, insurers, competent authorities Until the matter is concluded and applicable limitation periods expire
Food allergies and health restrictions Safe preparation of food and adaptation of meals or services Explicit consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR Kitchen, restaurant and employees for whom the information is necessary As a rule, until the end of the stay, unless further retention is necessary for legal claims
Special guest preferences Adapting the stay to the guest’s requests Performance of a contract or steps taken at the guest’s request, Art. 6(1)(b) GDPR Relevant Hotel departments Until the service is provided or for a shorter period, unless the guest requests storage for future reservations and an appropriate legal basis exists
Video surveillance Protection of persons and property, control of entries and exits, and determination of circumstances surrounding security events Legitimate interest, Art. 6(1)(f) GDPR Authorised employees, security service, police and other competent authorities where a legal basis exists 30 days, unless the recording constitutes evidence in official proceedings
Electronic cards and access control Security of guests, employees, rooms and property, and determination of circumstances surrounding security events Legitimate interest, Art. 6(1)(f) GDPR Authorised employees and system provider 30 days, unless the record constitutes evidence in official proceedings
Hotel Wi-Fi network Providing internet access, network management, information security and resolution of technical incidents Performance of a contract and legitimate interest, Art. 6(1)(b) and (f) GDPR Internet service provider and IT support provider Paper records of issued access tickets are retained for 6 months, while technical network logs related to network access are retained for 1 year
Incidents, damage, injuries and non-payment Establishing facts, protecting persons and property, collecting receivables, and establishing, exercising or defending legal claims Contract, legal obligation and legitimate interest, Art. 6(1)(b), (c) and (f) GDPR Insurers, lawyers, police, courts and other competent authorities As a rule, up to 5 years, and longer if proceedings are ongoing or a longer period applies
Business statistics Reporting on occupancy, overnight stays, revenue and business indicators Legitimate interest, Art. 6(1)(f) GDPR Management, accounting, IT processors Personal data in the PMS for up to 6 years after the end of the relationship, thereafter in anonymised form
Enrolment in the Best Western Rewards loyalty programme Administration of enrolment in and withdrawal from the loyalty programme at the guest’s request Consent, Art. 6(1)(a) GDPR Best Western International, Inc. and related service providers Physical BWR enrolment form: 5 years from enrolment
Analytics and marketing cookies Analysis of website use and measurement of content effectiveness Consent, Art. 6(1)(a) GDPR Google and other providers listed in the Cookie Policy According to the duration of the individual cookie and until consent is withdrawn
Strictly necessary cookies Functioning, security and availability of the website Legitimate interest or necessity for providing the requested electronic service Hosting and IT support provider According to the duration of the individual cookie
Job applicants Conducting the selection procedure and taking steps prior to entering into an employment contract Art. 6(1)(b) GDPR Authorised managers and service providers participating in the selection process One month after completion of the procedure for unsuccessful applicants, unless the applicant gives specific consent to longer retention
Employee records and employment documentation Keeping prescribed records, entering into and performing employment contracts, and exercising rights and obligations arising from employment Performance of a contract and legal obligation, Art. 6(1)(b) and (c) GDPR Authorised Hotel personnel, HR and IT service providers, and competent authorities where prescribed According to the type of data and documentation and the periods prescribed by applicable employment and other regulations; after expiry, data are erased or removed unless another regulation requires longer retention
Calculation of salary, allowances, taxes and contributions Calculation and payment of salary and other remuneration, tax reporting and implementation of compulsory insurance schemes Performance of a contract and legal obligation, Art. 6(1)(b) and (c) GDPR Banks, Tax Administration, HZMO, HZZO, accounting and other recipients authorised by law According to applicable tax, accounting, employment and pension regulations; certain documents are retained for 6, 11 or 40 years, or permanently where prescribed
Working hours and work schedules Organisation of work, working-time records and evidence of employment-related rights exercised Legal obligation and performance of a contract, Art. 6(1)(c) and (b) GDPR Authorised department managers and Finance Department As a rule, 6 years calculated from the end of the year in which the documentation was created, and longer where an employment dispute is ongoing or another period applies
Health surveillance, sick leave, occupational safety, workplace injuries and hygiene minimum Compliance with health and safety obligations, calculation of insurance entitlements and evidence of required training/fitness Legal obligation, Art. 6(1)(c) GDPR; for health data, Art. 9(2) GDPR according to the applicable legal basis Occupational medicine, HZZO, HZJZ and other authorised healthcare institutions, insurers and competent authorities Only for as long as necessary according to the type of documentation and applicable regulation; referrals that are not archived are retained until the examination is carried out, while other documentation is retained for the prescribed period
Documentation of foreign employees Verification of the right to reside and work and compliance with employer obligations under regulations governing foreign nationals Legal obligation, Art. 6(1)(c) GDPR Competent state authorities and authorised Hotel personnel In accordance with applicable regulations and the record of processing activities, as a rule 6 years calculated from the end of the year in which employment ended
Issue of work clothing, uniforms, keys, cards and equipment Records of issued property, access security and protection of Hotel property Performance of a contract, legal obligation and legitimate interest, Art. 6(1)(b), (c) and (f) GDPR Authorised department managers and Finance Department As a rule, 6 years calculated from the end of the year in which employment ended, or longer for legal claims or a legal obligation
Pupils, trainees and students Organisation of professional practice or student work, keeping documentation and calculation of remuneration Performance of a contract and legal obligation, Art. 6(1)(b) and (c) GDPR Schools, student employment service, authorised department managers, Finance Department and competent authorities As a rule, 6 years calculated from the end of the year in which the practice or student work ended; a longer statutory period applies to accounting documents

A longer retention period may apply where the data are required:

  • to comply with a legal obligation;
  • for inspection, administrative, judicial, arbitration or other proceedings;
  • for investigation of an incident;
  • for the establishment, exercise or defence of legal claims.

After expiry of the retention period, data are erased, securely destroyed or irreversibly anonymised.

 

  1. Personal Data Not Collected Directly from You

When you make a reservation through an online booking platform, travel agency, business partner or the Best Western central reservation system, the Hotel does not collect your data directly from you.

Sources of data may include:

  • online booking platforms;
  • travel agencies and tour operators;
  • business partners;
  • Best Western central reservation system;
  • a person who made the reservation on your behalf.

Categories of data received may include:

  • first and last name;
  • contact details;
  • reservation and stay data;
  • data on special requests;
  • data required for payment or reservation guarantee.

We process data received from the above sources for the purpose of fulfilling the reservation and providing the service on the basis of Article 6(1)(b) GDPR, and for compliance with legal obligations on the basis of Article 6(1)(c) GDPR.

We will provide you with this Policy in the reservation confirmation, other direct communication, or at the latest when you check in at reception.

  1. Mandatory and Voluntary Provision of Data

Provision of certain identification data is mandatory for:

  • guest registration;
  • compliance with legal obligations;
  • entering into and performance of the accommodation contract;
  • issuing an invoice.

If you refuse to provide data without which the Hotel cannot comply with a legal obligation or perform a contract, the Hotel may be unable to accept the reservation or provide accommodation services.

Provision of data for the loyalty programme, optional cookies and other consent-based activities is voluntary. Refusal or withdrawal of such consent does not affect your ability to use the basic accommodation service.

  1. Recipients of Personal Data

The Hotel may disclose personal data only where there is an appropriate legal basis and only to the extent necessary to achieve a specified purpose.

9.1. Public Authorities

Data may be provided to:

  • the Croatian National Tourist Board and competent local tourist boards through the eVisitor system;
  • the Tax Administration;
  • the Ministry of the Interior;
  • courts, inspectorates and other competent authorities;
  • other bodies where disclosure is prescribed by law or based on a lawful request.

9.2. Processors

The Hotel may engage providers of:

  • information and communication services;
  • hosting and data storage;
  • maintenance of the Hotel PMS;
  • reservation and sales-channel management systems;
  • accounting and bookkeeping services;
  • legal and advisory services;
  • video surveillance and technical security;
  • Wi-Fi network maintenance;
  • communication and marketing platforms.

Processors may process data only in accordance with the Hotel’s documented instructions and on the basis of a contract governing personal data processing.

9.3. Banks and Payment Service Providers

Data required to carry out transactions may be provided to banks, card companies, payment processors and other entities involved in the authorisation and execution of payments.

9.4. Best Western

When you use the central reservation system, data may be transferred to Best Western International, Inc. and other entities involved in providing those services, while the Hotel remains an independent controller of your data.

At the guest’s request, the Hotel may collect data required for enrolment in the Best Western Rewards loyalty programme and forward them to Best Western International, Inc., which thereafter acts as an independent controller of personal data processed within the Best Western Rewards programme. Processing carried out by Best Western International, Inc. is subject to its privacy notice.

The Hotel is an independent controller of personal data only in relation to receiving requests to enrol in or withdraw from the Best Western Rewards loyalty programme and the administrative actions associated with such requests.

9.5. Corporate Transactions

In the event of a merger, acquisition, sale of the company or other status change, data may be made available to potential acquirers and their advisers within a strictly confidential due-diligence framework, subject to appropriate safeguards and access restrictions.

 

  1. Transfers of Data Outside the European Economic Area

Personal data are primarily processed within the European Economic Area (hereinafter: the EEA).

If data are transferred to a recipient in a country outside the EEA, for example to Best Western International, Inc. in the United States for the purposes of the Best Western Rewards programme, the transfer will take place only if at least one of the conditions laid down in Chapter V of the GDPR is met, for example:

  • there is a European Commission adequacy decision;
  • the recipient in the United States validly participates in the EU-U.S. Data Privacy Framework, where that framework is applicable;
  • European Commission Standard Contractual Clauses have been entered into;
  • Binding Corporate Rules apply;
  • there is another appropriate safeguard or derogation permitted by the GDPR.

Where necessary, the Hotel will assess the circumstances of the transfer and apply additional technical, contractual or organisational measures.

Information on the specific transfer mechanism and an available copy of the safeguards applied may be requested using the contact details in Section 3 of this Policy.

  1. Video Surveillance

The Hotel uses video surveillance to protect:

  • guests;
  • employees;
  • visitors;
  • Hotel property;
  • other persons present in the monitored area.

Video surveillance may cover entrances, exits, reception, corridors and other areas where surveillance is necessary and proportionate to the purpose of protecting persons and property.

Areas under video surveillance are marked with an appropriate notice before entry into the monitored area. The notice contains at least information that the area is under video surveillance, details of the Controller and information on where additional information can be obtained.

Only specifically authorised persons have access to recordings. Any viewing, copying or extraction of a recording must be connected with a justified business or legal need.

Recordings are retained for 30 days, unless a longer period is prescribed by another law or the recordings have been extracted as evidence in judicial, administrative, arbitration, police or other appropriate proceedings.

  1. Electronic Access Control

The Hotel may use electronic cards or keys for access to rooms and certain Hotel areas.

The system may record the card identifier, the area accessed and the date and time of use. Records are not used for continuous monitoring of a guest’s movements, but solely for:

  • providing a functional access service;
  • protecting guest safety;
  • protecting property;
  • determining the circumstances of a security incident.

The legal basis for processing is the Hotel’s legitimate interest. Access to records is restricted to authorised persons.

Records are retained for 30 days, unless a longer period is prescribed by another law or the records have been extracted as evidence in judicial, administrative, arbitration, police or other appropriate proceedings.

  1. Hotel Wi-Fi Network

A guest may receive individual or shared access credentials for use of the Hotel Wi-Fi network.

The Hotel may process data required for:

  • providing internet access;
  • user authentication;
  • network management and maintenance;
  • protecting the network against unauthorised access and harmful activities;
  • resolving technical and security incidents.

The Hotel does not monitor the content of users’ communications.

 

  1. Social Media

The Hotel may use official profiles on social media, including Instagram and Facebook, to present the Hotel and communicate with users.

Where a user sends a private message containing reservation, payment, complaint or stay-related information, the Hotel may direct the user to an official e-mail address for more secure communication.

The Hotel does not publish photographs or video recordings of identifiable guests without an appropriate legal basis, except where a person is merely an incidental and inseparable part of the depiction of a public event and all other legal requirements are met.

Social media providers may carry out their own data processing in accordance with their privacy policies. The Hotel does not have full control over such processing.

  1. Cookies and External Services

15.1. Types of Cookies

The website may use:

  1. strictly necessary cookies, required for the security and proper functioning of the website;
  2. functional cookies, which enable additional features or remember user choices;
  3. analytics cookies, which help us understand website use;
  4. marketing cookies, which are used for targeted advertising only if such cookies are actually used.

15.2. Consent Management

On the first visit, CookieYes or another appropriate consent management system is displayed, enabling the user to:

  • accept all optional cookies;
  • reject all optional cookies;
  • select individual categories;
  • change the decision later;
  • withdraw previously given consent.

15.3. Google Services and Other External Content

The website may include:

  • Google Analytics 4;
  • Google Tag Manager;
  • Google Maps;
  • links or elements connected with Instagram and Facebook.

A complete and up-to-date list of cookies, their providers and purposes is available in the consent management system on the Hotel’s website.

  1. Processing of Children’s and Minor Guests’ Data

The Hotel pays particular attention to the protection of children’s personal data.

Personal data of minor guests are processed only to the extent necessary for:

  • reservation and provision of accommodation;
  • registration of the stay in the eVisitor system;
  • protection of the child’s safety;
  • compliance with other legal obligations.

The Hotel does not use the personal data of minor guests for direct marketing and does not enrol them in loyalty programmes without an appropriate legal basis and the involvement of a parent or legal guardian.

  1. Employees and Job Applicants

17.1. Employees

The Hotel processes employees’ personal data for the establishment, performance and termination of employment, keeping statutory records, calculation and payment of salary and other remuneration, compliance with tax and insurance obligations, organisation of work, occupational safety, health surveillance, protection of property, and the establishment, exercise or defence of legal claims.

As a rule, data are collected directly from employees, but may also be received from competent authorities, compulsory insurance institutions, occupational medicine providers, schools, student employment services or other authorised sources. They are disclosed only to authorised persons and recipients who need them for performance of a contract, compliance with a legal obligation or protection of legitimate interests.

Access to employee documentation is restricted according to business need. Paper documentation is kept in areas with restricted access, while electronic documentation is protected by user permissions, passwords, access logs, encryption and other appropriate security measures.

The retention period depends on the type of documentation. The periods prescribed by regulations governing employment, taxation, accounting, pension and health insurance, occupational safety, foreign nationals and other relevant regulations apply, as do the periods specified in the Hotel’s records of processing activities. After expiry of the applicable period, data are erased, securely destroyed or anonymised, unless longer retention is necessary for legal proceedings or another legal obligation.

17.2. Job Applicants

The Hotel processes applicant data for:

  • receiving and assessing applications;
  • communicating with applicants;
  • organising interviews;
  • verifying that job requirements are met;
  • taking steps prior to potentially entering into an employment contract.

Only persons involved in the selection procedure may access the data.

For an applicant who is not employed, the application and related documents are erased or securely destroyed within one month after completion of the procedure, unless:

  • the applicant gives specific consent to longer retention for future vacancies;
  • the documentation is necessary for the establishment, exercise or defence of legal claims;
  • there is another legal obligation to retain it.

If an applicant is employed, the necessary data are transferred to the employee file and processed in accordance with the separate employee notice.

The Hotel does not use automated decision-making in the selection procedure that would automatically accept or reject an applicant without human intervention.

 

  1. Automated Decision-Making and Profiling

The Hotel does not carry out automated decision-making or profiling that would produce legal effects concerning the data subject or similarly significantly affect them within the meaning of Article 22 GDPR.

If such processing is introduced in the future, before it is implemented the Hotel will provide data subjects with information on:

  • the existence of automated decision-making;
  • the logic involved;
  • the significance and possible consequences;
  • the right to human intervention;
  • the right to contest the decision.

 

  1. Personal Data Security

The Hotel applies appropriate technical and organisational measures to protect personal data against:

  • unauthorised access;
  • unlawful use or disclosure;
  • accidental loss;
  • alteration;
  • destruction;
  • loss of availability.

Measures may include:

  • management of user permissions;
  • access restrictions based on business need;
  • unique user accounts;
  • strong passwords and multi-factor authentication where available;
  • access logs;
  • backups;
  • encryption and tokenisation;
  • antivirus and network protection;
  • contractual confidentiality obligations;
  • employee training;
  • procedures for responding to personal data breaches;
  • periodic reviews of permissions and retention periods.

Access to data is permitted only to employees and associates who need the data to perform specific tasks.

 

  1. Data Subject Rights

Subject to the conditions laid down in the GDPR, you have the following rights.

20.1. Right of Access

You may request confirmation as to whether we process your personal data and access to the data and information concerning their processing.

20.2. Right to Rectification

You may request the rectification of inaccurate personal data and completion of incomplete personal data.

20.3. Right to Erasure

You may request erasure of data where they are no longer necessary, where you withdraw consent and there is no other legal basis, where processing is unlawful, or where other conditions under Article 17 GDPR are met.

20.4. Right to Restriction of Processing

You may request restriction of processing where:

  • you contest the accuracy of the data;
  • the processing is unlawful but you do not want the data erased;
  • the Hotel no longer needs the data, but you require them for legal claims;
  • you have objected and an assessment is pending as to whether the Hotel’s legitimate grounds override your interests.

20.5. Right to Data Portability

Where processing is based on consent or a contract and is carried out by automated means, you may request the data you have provided to us in a structured, commonly used and machine-readable format.

The right to data portability does not apply to data processed by the Hotel solely for compliance with a legal obligation, such as data contained in statutory records.

20.6. Right to Object

You have the right to object at any time to processing based on the Hotel’s legitimate interest.

Following an objection, the Hotel will cease processing the data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the data are required for the establishment, exercise or defence of legal claims.

If the Hotel were to carry out direct marketing, you have the right to object to such processing at any time. Thereafter, your personal data may no longer be processed for direct marketing purposes.

20.7. Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

20.8. Right to Lodge a Complaint with a Supervisory Authority

If you believe that your personal data are being processed contrary to applicable regulations, you may lodge a complaint with:

Croatian Personal Data Protection Agency (AZOP)

Selska cesta 136, 10000 Zagreb

E-mail: azop@azop.hrazop@azop.hr

Website: www.azop.hrwww.azop.hr

  1. How to Exercise Your Rights

You may submit a request:

  • by post to the Hotel’s address, marked “Personal Data Protection”;
  • by e-mail to the Data Protection Officer’s address specified in Section 3.

The request must contain sufficient information to enable us to determine:

  • the identity of the applicant;
  • the data or processing to which the request relates;
  • the right you wish to exercise.

If we have reasonable doubts concerning the identity of the applicant, we may request additional information necessary to confirm identity. We will not request more data than is necessary for that purpose.

We will respond to the request without undue delay and no later than one month after receipt. In the case of a complex request or a large number of requests, the period may be extended by an additional two months, of which we will inform you within the first month, together with the reasons for the extension.

Exercising rights is generally free of charge. If requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Hotel may charge a reasonable fee or refuse to act on the request in accordance with the GDPR.

 

  1. Amendments to the Policy

The Hotel may amend this Policy due to:

  • changes in laws and regulatory guidance;
  • changes in business operations;
  • introduction of new systems or services;
  • changes of service providers;
  • changes in the purposes and methods of personal data processing.

The updated version will be published on the Hotel’s website and will contain the date of the latest amendment.

If an amendment materially affects the way we process your data or your rights, we will inform you in an appropriate and prominent manner.

HOTEL ASTORIA d.o.o.