Visitor Information Notice
Dear Guest / Invitee / Visitor,
We process your personal data lawfully, fairly and transparently and ensure their security and confidentiality, under the conditions presented below. By presenting yourself and/or remaining at the location[1] following communication of this document:
- you attest that you have been informed of these conditions,
- you declare that you agree to processing carried out in this manner, both for your own data and for the data of minors accompanying you (strictly for data collected regarding minors),
- you understand and acknowledge that in addition to your consent, other legal bases for processing also apply in the context of our relations,
- you understand and acknowledge that if you make reservations on behalf of other persons / you are the organiser of an event at the location / you bring guests / invitees to the location, you are responsible for communicating this document to the members of your group / your guests / invitees.
This document will also be available to you and your guests / invitees at the location (e.g. reception / front desk / restaurant).
For more details, please consult our Privacy Policy and Video Surveillance Policy available at singurenimanor.com. When visiting the website, you may also access our Cookies Policy.
1. Operator Details
POIANA CAILOR S.R.L., a Romanian company, registered office in Bucharest Sector 6, Calea Giulești No. 333, Building C2, room no. 15, Floor 1, Trade Register No. J40/1605/2021, VAT No. 43649991, Email: contact@singurenimanor.com, for the attention of the Data Protection Officer.
2. Data Collected
- In the context of accommodation services (and related services): data from the reservation placed in advance and the accommodation form, data from the ID card / passport / identification document presented, gender, phone, email, bank account, geolocation data related to the stay (implicit), citizenship, date and place of birth, signature.
- In the context of other services (including restaurant) / activities at the location without accommodation: data from the reservation (if applicable), name, first name, email address, phone number, gender (implicit), bank account in the context of card payments.
- In the context of activities carried out based on an Acknowledgement and Assumption of Risk and Liability Declaration, additionally: data from the ID card / passport / identification document presented, date and place of birth, signature.
- In the context of access to the location: visual images (including during movements within monitored spaces) and the registration number of your vehicle, captured through video cameras; name and first name in the context of access control.
- Data that you provide voluntarily / in the context of specific service instructions.
- Contextually / unsolicited, special or non-special data (regarding race, ethnicity, religion, political orientation, philosophical beliefs, professional group membership, marital status, habits and preferences, or any other data related to physical, physiological, economic, cultural or social identity that may be used for direct or indirect identification) inherent or deducible from the nature / purpose / context of the event or service for which you opt.
- Strictly when necessary, health data (e.g. if you show signs of infection with Covid-19 / conditions that may endanger other guests / conditions on which access to certain activities is conditional).
- Geolocation data (place, date, time) – in the context of reservations / through monitoring bracelets in the adjacent forest area (provided strictly at your request).
- For visitors other than guests / invitees: data related to access to the location, the company / employer authority and position if acting as a representative, and any other data required by the purpose of your visit.
- If you opt for marketing communications: email address.
3. Purposes and Legal Bases of Processing
Processing purposes:
- Data collected in the context of contracting services: negotiating, signing and executing contracts and managing related aspects.
- Data collected in the context of access to the location and surveillance cameras: access control and location security (including health measures in epidemiological contexts); investigation of incidents; prompt intervention in case of incidents.
- The remaining data specified in point 2 are not processed for other purposes.
- For all collected data: fulfilment of the company’s legal obligations, provision to authorities and courts during inspections or at their request; defence of the company’s rights and legitimate interests, including in case of litigation.
Legal bases for processing:
- Your consent (direct; for marketing; monitoring bracelets and, implicitly, for the remaining data) — Art. 6(1)(a) GDPR
- Conclusion and performance of the contract — Art. 6(1)(b) GDPR
- Fulfilment of legal obligations — Art. 6(1)(c) GDPR
- Presentation in case of inspection / requests from authorities — Art. 6(1)(c) and (f) GDPR
- Health and security measures at the location / epidemiological investigations — Art. 6(1)(d) GDPR
- Exercise of our legitimate interests in promoting services and resolving disputes — Art. 6(1)(e) GDPR
4. Duration of Processing and Storage
- Reservation data / vouchers / contracts / contractual communications: 5 years from the termination of the relationship between the parties.
- Accommodation form data: 5 years from completion, in accordance with the law.
- Financial / accounting documents: durations provided by law (minimum 5 years).
- Requests regarding personal data: 3 years from communication of response.
- Data captured through cameras: 20 days from recording.
- Data collected through monitoring bracelets: for the duration of wearing, maximum 5 days after return; in case of incidents / disputes, these periods may be extended until resolution or as required by authorities.
5. Recipients and Data Transfers
Your data will be accessible strictly to employees and internal collaborators expressly designated in the processing flow, as well as external collaborators acting as outsourced departments / execution intermediaries / providers of legal, fiscal-accounting or security services, in the context of fulfilling our legal obligations and defending our legitimate interests.
Part of the collected data is processed on our behalf by the parent company of the group to which we belong, and a number of other data may be transferred intra-group depending on logistical and personnel needs.
As a rule, we do not transfer data outside the EU. Data provided for marketing communications and Cookies data from our website are processed by a third-party provider outside the EU. For such transfers, we ensure adequate guarantees of compliance on a contractual basis with the data recipient.
For more information regarding data collected online, please consult our Privacy and Cookies Policy, available on the website.
6. Your Rights
- Right of access – to obtain confirmation as to whether or not your data are being processed and regarding the conditions of processing.
- Right to data portability (if technically feasible) – the right to request the direct transfer of data to another operator.
- Right to object – when processing is for direct marketing purposes, you have the right to object at any time. Depending on circumstances, objection may lead to the impossibility of providing services for which other collection bases exist.
- Right to rectification of incomplete / inaccurate / changed data. The Company may also make data updates on its own initiative.
- Right to erasure (“right to be forgotten”) – if data are no longer necessary for the purposes for which they were collected, you withdraw consent / object to processing and no other legal basis applies, data have been processed unlawfully, or erasure is required to comply with a legal obligation.
- Right to restriction of processing – to request marking and limited processing (without erasure) when: the accuracy of data is contested; processing is unlawful and you oppose erasure; data are no longer needed by us but are required by you for legal proceedings; or while it is being verified whether our legitimate interests prevail over yours.
- Right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) – if you consider that the company violates data protection legislation.
- Right to be informed – in the event of a personal data breach likely to result in a high risk to your rights and interests, subject to the exceptions provided by law.
Requests must be submitted in writing with adequate identification. We will respond within a maximum of 30 days of receipt. This period may be extended by two months, with prior and reasoned notification to you, where permitted by law.
In the context of exercising your rights regarding data collected through cameras: we will comply with a request for transfer / erasure only if the data of other persons can be adequately separated / anonymised at reasonable costs. The right to rectification is, in principle, not applicable given the specific nature of video surveillance processing.
If you agree to receive information regarding campaigns / promotions / events, you may indicate:
“I agree to receive promotional offers and information regarding services offered by the operator.”
[1] The premises of “Singureni Manor”.
Polo Cup