Handling with personal data

Information for clients on personal data processing

In accordance with Act No. 101/2000 Coll., on Personal Data Protection and on Amendments to Certain Acts, as amended, and in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), which comes into effect as of 25 May 2018, there are a number of obligations imposed on us in relation to protection of your personal data. Rest assured we put great emphasis on compliance with these obligations and this way we would like to give you some important information concerning your personal data processing.

1. What data do we process?

Imperial Karlovy Vary Inc. with the registered office at U Imperialu 7/31, 360 01 Karlovy Vary, Company identification No. 45359318 processes the following personal data.

For your stays in our hotel:

• Contact personal data stated in the registration card you filled in upon your arrival to the spa:
• • Name, surname, academic degree, if any;
  • Date of birth;
  • Permanent residence address;
  • Phone and e-mail contact;
• Data included in the spa care plan – apart from contact details, also the following:
• • Health insurance company information;
  • Insured person number;
  • Diagnosis information;
  • Scheduled period of stay;
• Information about your previous medical stays – information about any medical procedures provided to you in our facilities and other information required by health insurance companies for paid services of spa medical rehabilitation care;
• For self-payers, also information about stay payment (including your bank account number)

We do not process any other personal data.

2. What is the legal basis, purpose and period of your personal data processing?

We process the data filled in the registration card and the data stated in the spa care plan together with the information about the stay payment based on the legal relationship between you and our company, which provides spa medical rehabilitation care and related services (accommodation, catering, etc.). The purpose of the processing is the provision of the above services. The spa care plan is drawn up for the spa by your health insurance company. Similarly, the information about your medical stays is processed on the same legal basis, for paid services of spa medical rehabilitation care (comprehensive or contribution care) there is an extra obligation on our part to provide the health insurance company with information about any medical procedures provided to you in our facilities and any other information required by health insurance companies and to allow supervision performed by the health insurance companies.

If you have given us your consent to processing of your contact information and the information about your stays with us, we process this information based on your consent. We process this information in order to be able to inform you about the offers of our services and products.

For the purpose of providing spa medical rehabilitation care and related services, we process the information about the provided care throughout your medical stay in the spa and after the end of your stay for a period during which the health insurance company, in accordance with generally applicable laws and regulations, is entitled to audit the provided paid services and their account statement. Similarly, for contribution care and for care paid by self-payers, we process the information about the provided care for a period during which the self-payer is entitled to contest the care provision.

The accounting and tax documents used for the care accounting also include certain personal data (client's name and surname, type of provided service, document issue date). We retain these documents solely for the purposes of meeting the obligations set forth in the applicable accounting and tax regulations, for a period of time set forth in these regulations.

There have not been cases of contesting the provided services in our spa by the health insurance companies or you as a self-payer. If such a situation occurred, we would be forced to process the data concerning the provided care for the duration of the dispute, solely in order to protect our rights in such a dispute. In the event of your personal data processing for this purpose, we would inform you about the situation without undue delay.

For data processed based on your consent, the processing period is limited to the period of the consent validity, usually 10 years, unless the consent is withdrawn earlier.

3. Who do we disclose or transfer your personal data to?

We disclose your personal data solely to the respective insurance company for auditing purposes based on the obligation imposed on the health insurance companies by the generally applicable laws and regulations (Act No. 48/1997 Coll., on Public Health Insurance and on Changes and Amendments to Certain Related Acts, as amended). If you are a self-payer of the provided care, we do not disclose your personal data to anyone.

We may transfer your personal data to third parties performing support activities on our behalf – package distribution, debt collection and legal services. These third parties are data processors and we provide solely the personal data necessary for the given purpose to them (package distribution, debt collection and legal services), and solely the data concerning the clients subject to the respective support activity. We select the data processors performing the above activities carefully, we also change and add them continuously, and due to such updates and changes, we are ready to give you the current list of such entities your personal data may be transferred to, based on your written or e-mail inquiry.

We do not transfer your personal data to other countries.

4. Your lawful rights

Furthermore, we would like to inform you that in accordance with the applicable laws governing personal data protection, you have the following rights:

• Right of access to the personal data we process in relation to you;
• Right to rectification of your personal data if they are in any way incorrect or inaccurate;
• If you find out or believe we process your personal data in a manner conflicting with the protection of your private and personal life or in conflict with the law, in particular if your personal data are inaccurate with regard to the purpose of their processing, you have the right to demand an explanation from us and also to demand we rectify the situation (e.g. by blocking, correcting, adding or disposing of your personal data);
• Right to erasure of your personal data and the right to restriction of processing;
  Right to object to data processing in order to assess whether the obligations imposed on us by applicable laws and regulations have been violated;
• If your personal data are processed by us based on your consent, you have the right to withdraw the consent;
• In addition to the above, you also have the right to lodge a complaint with the supervisory authority, namely the Office for Personal Data Protection, with the registered office at Pplk. Sochora 27, 170 00 Praha 7.
• Moreover, you also have the right to data portability concerning any data you provided to us that are processed by us as necessary for the purpose of contract performance. If you wish to transfer the data to another data controller, we will provide your personal data to you in a structured, commonly used, machine-readable and interoperable format or, if technically feasible, we shall transfer the data directly to the data controller.

Should you have any questions or concerns related to the processing of your personal data, please contact us anytime in writing at Imperial Karlovy Vary Inc., U Imperialu 7/31, 360 01 Karlovy Vary, or by email at gdpr@imperial-group.cz.