RULES FOR THE COLLECTION AND PROCESSING OF PERSONAL DATA IN "DUNAV PLAZA" OOD
These rules have been developed in implementation of Art. 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016.
I. ADMINISTRATIVE RECORDS
"Dunav Plaza" OOD, EIK 202638838, with registered office and management address: Ruse, Svoboda Square No. 5, represented by Manager Ivelina Gatseva.
II. CATEGORIES OF PERSONAL DATA AND PURPOSES OF PROCESSING
1. For the needs of the hotel reservation, the following personal data are collected:
First name, last name, phone number and email address. The goal is for the person who made the reservation to be recognized upon arrival at the hotel.
2. The following personal data are collected for the purposes of guest registration at the hotel:
By foreigners who are not citizens of a member state of the European Union (EU) or of a state party to the Agreement on the European Economic Area, or of the Swiss Confederation, on the basis of Art. 116, para. 2 of the Law on Tourism and Order No. T-RD-04-10/11.06.2019 of the Minister of Tourism, the following personal data are collected: the person's full name, personal identification code (if any), date of birth, gender , nationality, identity document number and series, issuing country country issuing the identity document.
By Bulgarian citizens, citizens of a member state of the European Union (EU) or of a state party to the Agreement on the European Economic Area, or of the Swiss Confederation on the basis of Art. 116, para. 2 of the Law on Tourism and Order No. T-RD-04-10/11.06.2019 of the Minister of Tourism, the following personal data are collected: the person's full name, EGN/LNCH, personal identification number (if any), date of birth, gender, citizenship, identity document number, country that issued the identity document.
Data collected during guest registration at a hotel are kept for two years, after which they are destroyed or deleted.
3. When applying for a job, the following personal data are collected:
Name and surname, education, telephone, email and professional experience with previous employers. The term for storing the personal data of candidates and participants in recruitment and selection procedures is 6 months from the date of completion of the selection. The provision of this data is voluntary and implied by its provision. This is the minimum necessary information for the employer to make a decision to conclude an employment contract with a certain candidate. After this date, the documents of applicants and participants are deleted or destroyed. If the applicant has given his consent, his personal data can be stored for a period longer than 6 months. In this case, the purpose and the deadline for data storage are indicated.
4. The types of personal data for the purposes of the employment relationship are defined in the Rules for the internal labor rules of the company.
5. The following personal data is collected from the natural person counterparties of the company: Names of the natural person counterparty, social security number, address, contact telephone number. They are collected for social security and tax purposes. Legal basis Art. 7, para. 6 CSR and Art. 73 VAT. The following personal data are collected from the legal representatives and authorized representatives of the legal entities: names, social security number and address (in the cases provided for by law) and contact telephone number.
III. COLLECTION OF PERSONAL DATA THROUGH VIDEO SURVEILLANCE AND VIDEO RECORDING
It is carried out in the common rooms of the hotels and in the area around them, in the common rooms of the central office, for which relevant information signs are placed. Basis: Art. 5, para. 2, item 4 of Ordinance No. 8121h-1225 of September 27, 2017 on the types of objects under Art. 23, para. 1 of the Counter-Terrorism Act, whose owners and users develop and implement counter-terrorism measures, the minimum requirements for these measures and the order for exercising control, issued by the Minister of Internal Affairs and the Chairman of the National Security Agency. Upon request, they are provided to the authorities of the Ministry of Internal Affairs and the National Tax Service according to the relevant order. The basis for video surveillance in the common parts of hotels and the area around them is also the Ordinance on the requirements for accommodation and catering and entertainment establishments and on the procedure for determining a category, refusal, downgrading, suspension and termination of the category.
According to the requirements for service in hotels of all categories, the hotelier has an obligation to ensure the safety and security of tourists through hired or own security and technical means. Video surveillance is one of these technical means. They are provided to the authorities of the Ministry of Internal Affairs upon request in accordance with the relevant order. The recordings of the performed video surveillance shall be kept for 2 months after their preparation (Article 56, Paragraph 4 of the Law on Private Security Activities).
IV. RIGHTS OF THE PERSONS WHO HAVE PROVIDED PERSONAL DATA TO "DUNAV PLAZA" OOD
1. Access to personal data. Everyone has the right to access their own personal data. An application is submitted. Within 7 days of submitting the application, Dunav Plaza Ltd. provides the requested information or informs the person that the data has been deleted or the media on which it is contained has been destroyed.
2. Correction of personal data. Everyone has the right to request correction of their personal data if the data is inaccurate. An application is submitted. Within 7 days from the submission of the application, "Dunav Plaza" Ltd. makes the correction and informs the person that his data has been corrected or the same has been deleted or the media on which it is contained has been destroyed.
3. Limiting the processing of personal data. Everyone has the right to request that processing be restricted by the administrator or processor of personal data. An application is submitted. within 7 days from the submission of the application, "Dunav Plaza" Ltd. carries out the requested restriction of processing and informs the person that the processing of his personal data is restricted or that the same have been deleted or the carriers on which they are contained have been destroyed. In the event that the processing of personal data cannot be restricted, the legal basis for this shall be indicated.
4. Exercising the right to be forgotten. Anyone who has provided personal data to "Dunav Plaza" OOD can exercise their right to "be forgotten" and have their personal data deleted by submitting an application.
5. The application for access, restriction of processing, correction and deletion of personal data shall be submitted personally by the person or by his proxy with power of attorney with notarization of signatures or by a lawyer with express power of attorney and shall contain: 1. name, address, uniform civil number or personal number of a foreigner or other similar identifier, or other identification data of the natural person, determined by the administrator, in connection with the activity carried out by him, description of the request; preferred form for obtaining information when exercising the rights under Art. 15 – 22 of Regulation (EU) 2016/679, signature, date of submission of the application and address for correspondence. The application is submitted by post, courier or at the company's address. When submitting an application by an authorized person, the power of attorney is attached to the application.
Within 14 days of submitting the application, Dunav Plaza Ltd. informs the person that:
– His request has been granted.
– His request was not satisfied and the legal basis for this is indicated. It is indicated when the obligation of "Dunav Plaza" OOD to store and process the data ceases.
6. The above-mentioned deadlines regarding access, correction, restriction of processing and exercise of the right to be forgotten do not run during the days of public holidays under Art. 154 of the Labor Code.
7. Data portability. The data subject has the right to receive the personal data concerning him and which he has provided to Dunav Plaza OOD in a structured, widely used and machine-readable format and has the right to transfer this data to another administrator under the conditions of Art. . 20 of Regulation 2016/679.
8. Right to object. The data subject has the right, at any time and on grounds related to his specific situation, to object to the processing of personal data relating to him under the conditions of Art. 21 of Regulation 2016/679.
9. Automated individual decision-making, including profiling. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which gives rise to legal consequences for the data subject or similarly affects him to a significant extent when applying Art. 22 of Regulation 2016/679.
V. DATA SUBJECT NOTIFICATION OF PERSONAL DATA BREACH
If there is a possibility that the breach of the security of personal data will create a high risk for the rights and freedoms of natural persons, "Dunav Plaza" OOD shall, without undue delay, inform the data subject of the breach of the security of personal data under the conditions of Art. 34 of Regulation 2016/679.
VI. FILING A COMPLAINT IN CASE OF VIOLATED RIGHTS IN THE PROCESSING OF PERSONAL DATA
Anyone can file a complaint if they believe that Dunav Plaza Ltd. has violated the Personal Data Protection Act and Regulation 2016/679 during the processing of their personal data. The complaint shall be submitted to the Commission for the Protection of Personal Data within six months of becoming aware of the violation, but no later than two years after its commission.
VII. PROVISION OF PERSONAL DATA TO PERSONS OUTSIDE THE COMPANY
Pursuant to Art. 116 of the Tourism Act, the Ordinance on the Organization of the Unified Tourist Information System and Order No. T-RD-04-10/11.06.2019 of the Minister of Tourism, personal data is provided to the office for administrative control of foreigners or to the district administration of the Ministry of Internal Affairs at the location of the hotel.
October 2019 version