Having regard to the interests of the security of personal data entrusted, the Controller shall acts on the basis of internal procedures and recommendations, as per the relevant legal acts in the field of personal data protection, in particular, with Regulation (EU) 2016/679 of the European Parliament and of the Council dated April 27, 2016, on the protection of individuals with respect to the processing of personal data and on the free movement of such data and repealing Directive 95/46 EC.

The Controller declares that it takes particular care to protect the interests of the data subjects and, in particular, ensures that this data is:

1. processed in accordance with the law;

2. collected for specified, legitimate purposes and not subjected to further processing incompatible therewith;

3. factually correct and adequate in relation to the purposes for which it is processed;

4. retained in a form that allows identification of persons to whom it relates, for no longer than it is necessary to achieve the purpose of processing.

Personal data is processed on the basis of consent expressed by Website users and in cases where the provisions of the binding laws authorise the Controller to process thereof.

1. users, solely for the purpose of:

   1. answering user queries by using the contact form,

   2. accepting bookings by using the online booking system,

   3. the implementation of services provided by the Controller pursuant to art. 6 par. 1 subpar b) of the GDPR,

   4. marketing, including sending commercial information to an e-mail address, provided the Client has agreed thereto, by ticking the appropriate box in the booking process or submitting an enquiry via the contact form. Consent to the processing of data for marketing purposes and sending commercial information may be withdrawn by clicking the appropriate link in the message received or sent to the Controller’s e-mail address,

   5. implementation of the legitimate interest of the Personal Data Controller in special cases pursuant to art. 6 par. 1 subpar. f) of the GDPR, e.g., debt collection or video monitoring of traffic within the premises of the Facility.

2. Recipients of personal data may be bodies, institutions, and entities authorised under the law, as well as entities providing services towards the Data Controller (e.g., legal, IT, marketing, accounting, and other entities participating in the implementation of the ordered service.

3. The Controller may use automated decision-making, including profiling, for marketing purposes and to adapt the offer.

4. Website user who has provided data has access to the data processed by the Controller. The User also has the right to modify this data, request its removal, and limit or stop processing thereof at any time. At any time, the User may also request the removal of its personal data from the Website. The right to data transfer shall not apply, as no standard
   1. has been set forth for the interchange of such data between hotel facilities.

   2. The Website User has the right to withdraw consent at any time without affecting the lawfulness of the processing, which has been carried out on the basis of consent prior to the withdrawal thereof.

   3. In order to exercise its rights indicated in item 8 hereinabove, the Website User should contact the Controller by using the same email address or phone number provided to the Website by contacting it at a.graczyk@cfihotels.pl.

   4. Each website user may lodge a complaint with the Office for Personal Data Protection.

   5. The Controller performs the functions of obtaining information about users and their behaviour in the following ways:

      1. by voluntarily entering information in forms,

      2. by collecting “cookies”.

   6. Upon the first visit to the CFI Hotels Group website, the User is notified of the use of cookies. By staying on the website, the User shall accept the use of cookies thereon. Should the browser settings are not changed by the User, it shall be construed as consented to the use of “cookies”.

   7. The installation of “cookies” shall be deemed necessary for the proper provision of services on the Website. The “cookies” contain information necessary for the proper functioning of the Website, in particular, this requiring authorisation. The User may, at any time, change the settings of its browser in the field of handling and saving cookies.

   8. The following types of “cookies” are used as part of the Website:

      1. session – shall remain in the wen browser until one turns it off or logs out of the website on which they have been posted,

      2. fixed – shall remain in the web browser of the device until they are removed by the user or until a predetermined time specified in the cookie file parameters.

   9. In terms of functionality, each cookie can be divided into:

      1. conversion files which allow analysing the performance of different sales channels

      2. tracking files which, in conjunction with conversions, help to analyse the performance of different sales channels

      3. marketing files used to personalise the content of ads and their proper targeting

      4. marketing files used to personalise the content of ads and their proper targeting

      5. analytical tools which help to improve the comfort of using the Website by understanding how users use thereof

      6. necessary files, i.e., cookies which are deemed fundamental to the Website’s basic functionality, allow us to develop our Website.

   10. Some “cookies” may be posted by the website provider and online booking system solely for:

       1. improving and supporting the booking process

       2. analysing and collecting statistical data on the use of the Website and online booking system in order to improve it

   11. The Website may contain links to other websites which operate independently of the Website and are not supervised by the Website in any way. These websites may have their own privacy policies and regulations, which we recommend to read carefully.

   12. The Controller reserves the right to amend the Website’s privacy policy, which may be caused by the development of internet technology, possible amendments in the law in the field of personal data protection, and the development of the Website. We will inform users about any and all changes in a visible and understandable way.