In accordance with the Regulation[[1]and the Personal Data Protection Act[2]] operator BOMADA, s. r. o., with registered office at Prostredná 160/38, 900 21 Svätý Jur, ID number: 36 792 152 (hereinafter referred to as the “operator”), processes your personal data for the purpose of providing accommodation services, restaurant and cafe operations and related obligations. Our goal is effective protection of your personal data and a transparent procedure for providing information.

We process your personal data only on the basis of legal conditions (legal basis – authorization to process personal data), which results from the Regulation, the Act on the Protection of Personal Data or other special regulations (for example, the Act on Reporting the Residence of Citizens). As an operator, we have a legal obligation to provide your personal data during inspection, surveillance activities or at the request of authorized state authorities or institutions, if this results from special regulations[3].

We may share your personal data with third parties acting on our behalf, for example with suppliers of certain services – intermediaries (e.g. provider of accounting services) or authorized state authorities, etc. In such cases, these third parties may use your personal data only for the described purposes and only in accordance with our instructions, and on the basis of a concluded mediation agreement or on the basis of the fulfillment of other legal conditions.

Your personal data will be stored securely, in accordance with the security policy of the operator and intermediary, and only for the time necessary to fulfill the purpose of processing. Access to your personal data will only be granted to persons authorized by the operator to process personal data, who process them on the basis of the operator’s instructions, in accordance with the operator’s security policy.

Your personal data is backed up in accordance with the operator’s retention rules. Your personal data will be completely deleted from the backup storage as soon as possible in accordance with the backup rules. Personal data stored on backup storages serves to prevent security incidents, in particular disruption of data availability as a result of a security incident. The operator is obliged to ensure data backup in accordance with the security requirements of the Regulation and the Personal Data Protection Act. We only keep your personal data for a limited time, and they are deleted when they are no longer needed for processing purposes.

When processing personal data by the operator, you are the affected person, i.e. j. the person about whom personal data relating to him are processed.

Personal data will not be transferred to third countries or international organizations.

The company does not process your personal data through automated individual decision-making, including profiling according to Art. 22 Regulations.

I. PURPOSES OF PERSONAL DATA PROCESSING, RETENTION PERIOD, LEGAL BASIS, PROVISION

1.1 Provision of accommodation

For the purpose of providing accommodation services, we process your personal data on the basis of a contract to which you are a party and for the purposes of keeping an accommodation book, which is necessary to fulfill the legal obligation of the operator (accommodator) according to Act no. 253/1998 Z. z. on the reporting of residence of citizens of the Slovak Republic and the register of residents of the Slovak Republic and when reporting short-term residence pursuant to Act no. 404/2011 Z. z. on the residence of foreigners and on amendments to certain laws and Act no. 253/1998 Z. z. on reporting the residence of citizens of the Slovak Republic and the register of residents of the Slovak Republic. Reporting on the stay of foreigners can also be done electronically, through the portal of the Ministry of the Interior of the Slovak Republic https://portal.minv.sk/.

Failure to provide your personal data, which is processed on the basis of a contract or to fulfill a legal obligation of the operator, could result in the impossibility of entering into a contractual relationship with you and providing you with accommodation services.

We will provide your personal data to the Ministry of the Interior of the Slovak Republic and, in the case of an audit, to the auditor.

We will keep your personal data for 5 years after the end of the contractual relationship.

With the aim of speeding up the services we provide and more efficient guest registration, we process your personal data based on the legitimate interest of the operator to the extent of the data necessary for the client’s registration and his entry in the accommodation book. If you do not want us to process your personal data for this purpose, you can object to such processing at any time, during your stay with us in person or by phone or electronically.

We will keep your personal data for the duration of legitimate interest.

1.2 Reservation of premises and organization of various events

For the purpose of providing services consisting of the possibility of reserving a place in a restaurant and/or mass reservations of spaces for various events, closed company and organizing events, we process your personal data on the basis of a contract to which you are a party, or before concluding the contract.

Failure to provide your personal data, which is processed on the basis of a contract, could result in the impossibility of entering into a contractual relationship with you and providing you with space reservation services.

We will keep your personal data for 1 year (in the case of one-time “table” reservations) and 5 years after the termination of the contractual relationship in the case of reservations for the organization of events and room reservations; we will not provide them to recipients.

1.3 Marketing of products and services, including organizing contests and a Loyalty Program based on the provision of discounts; sending information about various promotions, events and special offers (newsletter).

It is in the legitimate interest of the operator to increase the sale of services through marketing methods. The loyalty program is based on a contractual relationship between the client and the company, on the provision of preferential services to the client. In specific cases, the consent of the person concerned may be obtained for the purpose of promoting the company or informing the person about the company’s activities. The person concerned will be informed of the specific conditions before consent is obtained. In the case of participation of the affected person in the competition, the affected person will also be provided with information related to the conditions of the competition.

Failure to provide your personal data, which is processed on the basis of a contract, could result in the impossibility of entering into a contractual relationship with you and providing you with services resulting from the loyalty program.

We will keep your personal data for 2 years after membership in the loyalty program ends; in the case of sending the newsletter for the duration of the legitimate interest or until an objection is filed against data processing for direct marketing; we will not provide them to recipients.

1.4 Presentation of the company on social networks and on the company’s website, including communication through social networks.

It is in the legitimate interest of the company to present its activities on social networks and on the company’s website, through information about realized actions, events, and events. To build its good name and create a community of people and supporters of the company. In specific cases that depend on the operator’s individual assessment, personal data may be processed based on the consent of the person concerned. In that case, the operator will provide all relevant information before obtaining it.

.We will keep your personal data for 1 year after the end of the legitimate interest or until you withdraw your consent; we will not provide them to recipients

1.5 Initiatives, complaints

It is in the legitimate interest of the company to process personal data, with the aim of improving the services provided, documenting any suggestions, proposals, requests of the affected persons or complaints, their investigation or applying/proving the legal claims of the Company. In the case of resolving a complaint in accordance with the Civil Code, your personal data is processed based on the Company’s legal obligation.

Providing your personal data for the purpose of verifying a claim in accordance with the Civil Code is your right. Failure to provide them may result in the impossibility of properly processing your claim.

We will keep your personal data for 3 years after equipment. Your personal data will be provided to interested parties, an intermediary or a company that provides e.g. extrajudicial debt collection.

1.6 Registry administration

It is in the public interest for the Company to proceed with the storage of documents and electronic data in accordance with Act no. 395/2002 Z. z. on archives and registries and on the addition of some laws as amended and based on it managed the registry and kept documentation with professional care.

We will keep your personal data for 10 years after the end of record keeping. They can be provided to the Ministry of the Interior of the Slovak Republic in the administration of the registry and the implementation of its duties and powers when archiving in the public interest, to an intermediary.

1.7 Accounting

To fulfill a legal obligation, we process your personal data for the purpose of keeping accounts and preparing accounting documents; in particular management and invoicing of prices for services and goods provided, processing of accounting and tax documents and invoices.

The legal basis for processing your personal data for this purpose is, in particular, Act No. 431/2002 Z. z. on accounting as amended (hereinafter referred to as the “Accounting Act”) and Act No. 222/2004 Z. z. on value added tax, as amended, Act no. 40/1964 Zb. Civil Code, Act no. 152/1994 Z. z. on the social fund, Act no. 311/2001 Z. z. Labour Code.

Your personal data will be stored for the duration of the contractual relationship and 10 years after its termination, in accordance with the requirements of special regulations governing tax obligations; we will provide your data to the relevant tax authority and intermediary.

1.8 Network and object security, including protection with a camera system

It is in the legitimate interest of the operator and at the same time his obligation arising from the Regulation to take adequate security measures in order to prevent illegal processing of personal data and other information that needs to be protected in the operator’s environment. We can process your personal data through a camera system, by monitoring the premises around the facility, internal common areas of the accommodation facility, or areas of the facility that are not normally accessible to guests and clients.

We will keep your personal data for 1 year after obtaining it, in the case of camera recordings, 10 days; we will not provide them to recipients.

1.9 Contact information

It is in the legitimate interest of the operator to process the contacts of subjects with whom he communicates, has business relations, etc. in connection with § 78 par. 3 of Act No. 18/2018 Z. z. the employer provides or publishes the personal data of its employees.

Your personal data will be processed for the duration of the business, contractual or similar relationship and/or for the period of validity of the contact data. Personal data will be provided to the participants of the communication.

1.10 Processing requests of affected persons exercising their rights

It is a legal obligation of the Company, according to Act no. 18/2018 Z. z. on the protection of personal data and on the amendment of certain laws and Regulation 2016/679 on the protection of natural persons in the processing of personal data and on the free movement of such data, to ensure the proper and timely processing of the rights of data subjects who exercise their rights in connection with the protection of personal data .

Providing your personal data is your right, not your obligation. Failure to provide them to the extent that they are necessary to fulfill the Company’s legal obligations may result in the impossibility of handling your request properly and on time.

Your personal data will be stored for 5 years; we provide them to the person concerned who has exercised his right.

1.11 Lawsuits, out-of-court enforcement of legal claims, executions

The purpose is compatible with the original purpose of processing (on the basis of compatibility tests), if in the given processing activity it is possible to assume the application of legal claims or the defense of the operator’s rights in accordance with the laws: Act no. 162/2015 Z. z. Administrative court procedure, Act no. 160/2015 Z. z. civil dispute procedure Act no. 233/1995 Z. z. on bailiffs and enforcement activities (Executive Regulations).

Your personal data will be stored for 5 years from the end of the procedure; we provide them to the participants in the proceedings.

II. YOUR RIGHTS UNDER THE PRIVACY REGULATION AND ACT

Right of access

You have the right to be provided with a copy of the personal data we hold about you, as well as information about how we use your personal data. In most cases, your personal data will be provided to you in written form or in electronic form; you can ask for the way they will be provided. If you have requested the provision of this information by electronic means, it will be provided to you electronically if technically possible.

Right to rectification

We take reasonable steps to ensure that the information we hold about you is accurate, complete and up-to-date. If you believe that the data we hold is inaccurate, incomplete or out of date, please do not hesitate to ask us to correct, update or supplement this information.

Right to erasure

You have the right to ask us to delete your personal data, for example, if the personal data we have collected about you is no longer necessary to fulfill the original purpose of processing. However, your right must be assessed in light of all the relevant circumstances. For example, we may have certain legal and regulatory obligations which mean that we will not be able to comply with your request.

Right to restriction of processing

In certain circumstances, you are entitled to ask us to stop using your personal data. These are, for example, cases where you believe that the personal data we have about you may be inaccurate or when you believe that we no longer need to use your personal data.

Consent

In cases where we process your personal data based on your consent, you have the right to revoke this consent at any time. You can withdraw your consent electronically, at the address of the Responsible Person, in writing, by sending a notice of withdrawal of consent or in person at the office. Withdrawal of consent does not affect the legality of the processing of personal data that we processed about you on the basis of it.

Right to data portability

In certain circumstances, you have the right to ask us to transfer the personal data you have provided to us to another third party of your choice. However, the right to portability only applies to personal data that we have obtained from you on the basis of consent or on the basis of a contract to which you are a party.

The right to object

You have the right to object to data processing based on our legitimate legitimate interests. If we do not have a compelling legitimate legitimate reason for processing and you file an objection, we will not process your personal data further.

The right to file a complaint

If you believe that we process your personal data unfairly or illegally, you can file a complaint with the supervisory authority, which is the Personal Data Protection Office of the Slovak Republic, https://dataprotection.gov.sk, Hraničná 12, 820 07 Bratislava 27.

In case of any questions regarding the processing of your personal data, you can contact us through our reception or at our address.

Purpose of processingPurpose of processing	Legal basis of the processing activity	Category of recipients
Provision of accommodation services in the Apartment House	Legal obligation Law no. 253/1998 Z. z. on reporting the residence of citizens of the Slovak Republic and the register of residents of the Slovak Republic; Act, no. 404/2011 Z. z. on the stay of foreigners as amended; legitimate interest of the operator consisting in the effective provision of accommodation services, acceleration of registration and entry in the accommodation book, contract and pre-contractual relationship 5 years	Foreign police, authorized authorities of the state
Management and maintenance of apartments (excluding hotel services) based on a management contract	Contract and pre-contractual relationship to which the person concerned is one of the contracting parties 5 years after the end of the contractual relationship	are not provided
Book of walks and ascents kept with the aim of protecting life and health	Legal obligation – Act no. 544/2002 Z. z. about the Mountain Rescue Service 1 year after registration	Authorized state authorities, Mountain Rescue Service
TATRY CART – sale of a discount card for the city of Vysoké Tatry	The mediator, on the basis of the mediation contract for the city of Vysoké Tatry, keeps the city (the deadline is determined by the operator)	the town of Vysoké Tatry
registry administration	Public interest; Legal obligation Law no. 395/2002 Z. z. on archives and registries and on supplementing some laws as amended 10 years	Ministry of the Interior of the Slovak Republic, other authorized entity, Intermediary
property law and legal disputes arising from the activity of the operator	Exercising legal claims Law no. 162/2015 Z. z. Administrative court procedure, Act no. 160/2015 Z. z. civil dispute procedure 5 years after the end of the dispute	participants in the proceedings, other authorized entity
processing of accounting documents	Legal obligation: Act no. 431/2002 Z. z. on accounting, as amended, Act no. 222/2004 Z. z. on value added tax, as amended, Act No. 40/1964 Zb. Civil Code, as amended, Act No. 152/1994 Z. z. on the social fund and on amendments to Act no. 286/1992 Zb. on income taxes, as amended, Act no. 311/2001 Z. z. Labor Code, as amended, 10 years	tax office, intermediary
investigation of complaints according to Act no. 307/2014 Z. z. and some measures related to the reporting of anti-social activity and amendments to some laws	Act No. 307/2014 Z. z. and some measures related to the reporting of anti-social activity and amendments to some laws 5 years	participants in the proceedings
facility security; protection of property, safety of staff and accommodated persons	processing is necessary for the purposes of the legitimate interests of the operator 2 years	SBS broker
network security; information protection	processing is necessary for the purposes of the legitimate interests of the operator 1 year	intermediary
Camera monitoring, object protection and ensuring the protection of property, assets, and health.	processing is necessary for the purposes of the legitimate interests of the operator 15 days	are not provided
Executions	Debt collection (based on compatibility test) Act No. 59/2018 Coll. on bailiffs and enforcement activities (Executive Procedure), Act of the National Council of the Slovak Republic on State Property Management 278/1993, as amended 10 years	persons authorized in accordance with the relevant regulations, notaries
supply contracts (contact details)	processing is necessary for the purposes of the legitimate interests of the operator due to the ability to implement contractual relationships and contact persons For the duration of the contractual relationship or for the period when the person is reported as a contact person	Parties
equipment and records of the rights of the affected persons	Legal obligation according to Chapter III of Regulation 2016/679 on the protection of natural persons in the processing of personal data and on the free movement of such data 5 years	natural persons exercising the rights of affected persons
Handling claims and complaints of accommodated guests	processing is necessary for the purposes of the legitimate interests of the operator consisting in improving the quality of the services provided and building the company’s reputation 5 years	entities ensuring the elimination of defects

[1]Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 of April 2016 on the protection of natural persons in the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (General Data Protection Regulation).

[2]Law no. 18/2018 Z. z. on the protection of personal data.

[3]For example, Act no. 171/1993 Z. z. about the Police Force; Act No. 18/2018 Z. z. on the protection of personal data.