1. Introduction

Constantinou Bros Hotels Public Company Limited and/or other member companies and/or entities of and/or related entities to the group of companies which Constantinou Bros Hotels Public Company Limited belongs to (as described in Annex A of this Privacy Notice) (“we”) are committed to privacy issues and want to be transparent about the data we collect and how data is used. In particular, the personal data which is processed by us is that of natural personals who are our clients, employees, directors, UBOs/shareholders, authorised representatives, contractors or visitors to our website and/or affiliates as well as data of other individuals including but not limited to authorised representatives, employees or beneficial owners of our contractors being legal entities (“you”).

During the course of our business relationship with you we collect and process personal data. We are a data controller in respect of your personal data. This means that we determine the purposes and means of the processing of personal data.

For the purposes of this Privacy Notice, ‘personal data’ means any information relating to an identified or identifiable natural person and ‘processing’ means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, storage, use, disclosure, erasure or destruction.

Pursuant to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”) and other applicable data protection laws, as amended from time to time we are required to notify you of the information contained herein.

2. Processing of Personal Data

When we process your personal data it is:

1. Processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); This means that we provide information to you in respect of the processing of your personal data (transparency), that the processing matches the description given to you (fairness), and that it is based on at least one of the lawful basis set out in the GDPR (lawfulness).
2. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; (‘purpose limitation’); This means that we specify exactly what personal data is collected, the purpose of use and limit the processing of personal data to only what is necessary to meet the relevant purpose.
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); This means that we do not process any personal data over and above what is required.
4. Accurate and, where necessary, kept up to date; every reasonable step is taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’); This means that we have in place processes for identifying and addressing out-of-date, incorrect or unnecessary personal data.
5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation’); This means that wherever possible, we process personal data in such a way that limits or prevents identification of the data subject.
6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)

3. Categories of Personal Data

We process the following categories of personal data:

1. Contact information such as first name and last name, first name/last name of adult co-guest(s) , home/business telephone, fax number, e-mail address, residential/work address, country of birth;
2. Personal characteristics such as date of birth and/or nationality;
3. Government issued identifiers such as passport and/or identification card;
4. Financial details (i.e. bank account number/details (including expiration date), payment card type);

In cases we may need to collect and process special categories of personal data which is information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning sex life or sexual orientation. We shall process such data subject to your documented consent and/or where the processing is necessary for the establishment, exercise or defence of legal claims relevant to us.

If during the course of a business relationship there is a change in your personal data you must ensure that the above details (as and where applicable) are updated by contacting us as soon as practically possible.

4. Purposes of Processing

We will process your personal data (as and where applicable) for the purposes of:

1. hotel and facilities booking(s): we will need to process your personal data so that you can:
   a. reserve a hotel room and/or any offered facilities by the hotel;
   b. confirm availability of hotel room(s) and/or appointment(s) and/or reservation(s) in regards to the facilities of the hotel;
   c. manage your booking(s)/reservation(s)/appointment(s);
2. check in and check out: we will need to process your personal data in order to allow you to register your arrival and departure and be provided with a room key ;
3. billing: we will need to process your personal data for completing your payment and issuing an invoice/receipt of your payment;
4. non-arrival: in the event you have made a booking and for any reason you do not appear, without communicating it to us (e.g inform us for the cancellation through email, call, post etc), we will need to process your personal data so as to proceed with payment of any outstanding amounts and to cancel any/all of your bookings and/or reservations and/or appointments;
5. hotel Facilities: we will need to process your personal data in case you wish to enjoy any of the facilities offered by us, such as room service, spa and sauna facilities, pool, restaurant and bar, laundry services, taxi requests, internet connection, including in the event that you have any special requirements in connection to meals (allergies), room amenities etc.
6. meeting our obligations under our business relationship and/or agreement;
7. operation, management and control of the affairs of our business and its purposes;
8. general planning and organisation of our business including but not limited to management of complaints, incidents, claims, accidents and/or comments in regards to your visit and/or stay;
9. maintaining our IT systems, including our human capital, administrative and management systems, processes and policies;
10. health and safety at work/hotel premises;
11. providing you with information about us and our services (marketing) and improving our services from time to time (our business development);
12. complying with any requirement of law and/or regulation and/or of any competent authority or professional body (where applicable) of which we are a member (including inter-alia the Cyprus Tourism Organisation).

5. Lawful Basis of Processing

We are committed to your privacy. As part of the values we stand for, we will always consider your fundamental rights as a data subject. We process your personal data for the purposes mentioned above on the lawful basis that (i) the processing is necessary for compliance with a legal obligation to which we are subject; (ii) the processing is necessary for the performance of an agreement which you have entered into with us and in order to take steps at your request prior to entering into the said agreement(s); (iii) you have given consent (if and where applicable); and (iv) the processing is necessary for the purposes of the legitimate interests pursued by us.

Such legitimate interests include, inter-alia, our business and/or commercial interests and the management, operation and marketing of our business (including inter-alia, newsletters, promotional material and greeting cards), and/or our exercise or defence of legal claims and/or to disclose information to other data recipients such as our service providers, auditors and technology providers and/or to comply with obligations or internal policy requirements of our business, and/or to monitor and improve our relationships with you and/or to keep our internal records and/or to monitor communication to/from you using our systems and/or to protect the integrity of our IT systems.

Where we decide to rely on explicit consent to process personal data, we will contact the relevant data subject to request this accordingly. In case consent is relied solely upon to achieve a lawful basis of processing of personal data, the relevant data subject will have the right to withdraw this consent at any time.

6. Recipients of Personal Data

We disclose your personal data to the following categories of recipients:

1. other member companies and/or entities of and/or affiliated entities to the group of companies which Constantinou Bros Hotels Public Company Limited belongs to;
2. our auditors, administrators, lawyers, tax advisors, valuators, consultants, accountants, investment advisors and other professional advisors (as shall be engaged from time to time);
3. our IT service providers and other companies who assist us with the effective operation of our business by providing concierge services, technological expertise, file storage and record management, logistic services and solutions;
4. banks and/or other financial institutions, payment services providers, insurance companies; and
5. public and regulatory authorities (where applicable), for the purposes described above (including inter-alia the Cyprus Tourism Organisation).

When we transfer personal data to countries located outside of the EEA we carry out such transfers to a recipient (i) who is in a country which provides an adequate level of protection for personal data or (ii) under appropriate safeguards pursuant to the provisions of applicable data protection laws (e.g. under an agreement in the form of standard data protection clauses adopted by the European Commission), the form of which is available at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en. In some cases we may carry out such transfers where we have obtained the explicit consent from the relevant data subjects in respect of the proposed transfer, provided that the data subject has been informed of the possible risks of such transfer (due to the absence of an adequacy decision and appropriate safeguards).

7. Your Rights

Under the GDPR you are entitled to the following rights:

1. The right to access – you have the right to request a copy of the information that we hold about you.
   You have the right to confirmation as to whether or not we process your personal data and, where we do, access to the personal data, together with certain additional information. Such additional information includes inter-alia, details of the purposes of the processing, the categories of personal data concerned and the categories of recipients of the personal data. The right to obtain a copy of your data shall not adversely affect the rights and freedoms of others.
2. The right to rectification – you have a right to correct data that we hold about you that is incomplete or inaccurate.
   You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.
3. The right to erasure (right to be forgotten) – where certain criteria are met you can ask for the data we hold about you to be erased from our records.
   In some circumstances you have the right to obtain the erasure of your personal data without undue delay. Those circumstances include cases where (i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (ii) you withdraw consent on which the processing is based solely on consent; (iii) you object to processing which is based on our legitimate interests and there are no overriding legitimate grounds for the processing; (iv) the processing is for direct marketing purposes; (v) the personal data have been unlawfully processed; and (vi) the personal data have to be erased for compliance with a legal obligation to which we are subject.; The above shall not apply where processing is necessary (i) for exercising the right of freedom of expression and information; (ii) for compliance with a legal obligation which requires processing by a law to which we are subject; and (iii) for reasons of public interest; or for the establishment, exercise or defense of legal claims.
4. The right to restriction of processing – where certain criteria are met you can ask to restrict the processing.
   In some circumstances you have the right to obtain from us the restriction of processing of your personal data. Those circumstances include cases where (i) you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data; (ii) processing is unlawful but you oppose erasure and you request the restriction of their use instead; (iii) we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defense of legal claims; and (iv) and you have objected to processing which is based on our legitimate interests, pending the verification of that objection. Where processing has been restricted on the basis of the above, we will continue to store your personal data. However, we will only otherwise process it (i) with your consent; (ii) for the establishment, exercise or defense of legal claims; (iii) for the protection of the rights of another natural or legal person; or (iv) for reasons of important public interest.
5. The right to object to processing – you have the right to object to certain types of processing.
   You have the right to object to the processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is not necessary for (i) the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or (ii) the purposes of the legitimate interests pursued by us or by a third party. If you make such a request, we will cease to process the personal data unless we have compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims.Additionally, you have the right to object when your personal data are processed for the purposes of direct marketing, including profiling.
6. The right to data portability – where certain criteria are met you have the right to have the data we hold about you transferred to another organisation;
   You have the right to receive personal data which you have provided to us in a structured, commonly used and machine-readable format and the right to transmit those data to another data controller. However, please note that this right to data portability only arises where (a) the processing is based on consent (as and where applicable) or is necessary for the performance of a contract to which you are a party; and (b) the processing is carried out by automated means (as and if applicable). In conforming to such requests we will not adversely affect the rights and freedoms of others.
7. The right to withdraw consent (when and if “consent” legal basis is applicable) – where certain criteria are met you have the right to withdraw your consent
   To the extent that the legal basis for our processing of your personal information is consent (as and where applicable), you have the right to withdraw that consent at any time such withdrawal will not affect the lawfulness of processing before the withdrawal.
8. The right to lodge a complaint to a supervisory authority;
   You have a right to lodge a complaint with the Office of the Commissioner for the Protection of Personal Data in Cyprus at any time.

8. Visitors to our website

We sometimes collect anonymous information from visits to our sites to help us provide better customer service. For example, we measure visitor activity on the Constantinou Bros Hotels Web sites, but we do so in ways that keep the information anonymous. We use the information that we collect to measure the number of visitors to the different areas of our sites, and to help us make our sites more useful to visitors. This includes analysing these logs periodically to measure the traffic through our servers, the number of pages visited and the level of demand for pages and topics of interest. The logs may be preserved indefinitely and used at any time and in any way to prevent security breaches and to ensure the integrity of the data on our servers. This anonymous information is used and analysed only at an aggregate level to help us understand trends and patters. None of this information is reviewed at an individual level.

9. Security

As part of our privacy policy we process personal data which is adequate, relevant and limited to what is necessary in relation to the purposes mentioned above and implement appropriate technical and organizational measures to ensure an adequate level of security appropriate to the applicable risk. Such measures aim to prevent unauthorised or unlawful processing, accidental loss, destruction or damage of personal data and include inter-alia, pseudonymization and encryption of personal data.

10. Retention of personal data

We shall process and store your personal data for as long as we maintain our business relationship and for six years thereafter and/or as required under applicable law. Your personal data may be retained for longer periods for the purposes of our legitimate interests in case of any legal process commencing prior to the completion of the six year period.

11. Further Information

For any questions with regard to the processing of your personal data or in case you wish to exercise any of your rights (where applicable) in respect of your personal data you may contact us in writing by sending an inquiry as follows:

By email at: gdpr@cbh-cyprus.com
By post : Personal Data Protection Department
P.O. Box 60182,
CY8101 Paphos
Cyprus

12. Amendments

This privacy notice is kept under regular review and is updated from time to time. We will, where appropriate, notify you about amendments as soon as practically possible.

Contact Details

 

Web Sites

https://www.cbh-cyprus.com
https://www.athenaroyal-cbh.com
https://www.athena-cbh.com
https://www.pioneer-cbh.com
https://www.asimina-cbh.com

©CONSTANTINOU BROS HOTELS LTD 2018