Privacy Notice - Promotions AccountPrivacy Notice - Promotions Account

PALAS INTERNATIONAL RESORT S.R.L.

Privacy Notice — Promotions Account

This notice explains how we handle your personal data when you create an account to view the promotions published on our website. It supplements our general Privacy Policy and Terms and Conditions, and prevails over them for anything concerning this account.

1. Who processes your data

The controller is S.C. PALAS INTERNATIONAL RESORT S.R.L., the company operating Hotel International Iasi.

Registered office: 5A Palat Street, Iasi, Iasi County, 700032, Romania

VAT number: RO 26293850 · Trade Register: J2009001995223

Email: sales@hotelinternationaliasi.ro

Telephone: +40 332 110 060 · WhatsApp: +40 729 200 100

2. What data we collect

Email address

Required. It identifies your account.

Password

Only if you create an account with a password. We never see it: it is stored in encrypted form by our authentication provider.

Name and profile picture

Only if you sign in with a Google account. These are supplied automatically by Google and held in the authentication record.

Telephone number

Optional. We collect it only if you tick the box consenting to WhatsApp messages.

Your consents

What you ticked, when, and the version of the wording you accepted. We keep this as evidence, as required by Article 7 GDPR. This record contains neither your email address nor your telephone number.

Technical data

IP address and device information, processed by the authentication provider for account security.

We do not collect special categories of data, and we do not ask for payment details in order to create this account.

3. Why we process your data, and on what legal basis

Creating and administering your account

Article 6(1)(b) GDPR — performance of a contract. Without this data we cannot create your account.

Sending offers, promotions and news by email

Article 6(1)(a) GDPR — consent. A separate, optional tick box. You may decline and still keep your access.

Sending messages on WhatsApp

Article 6(1)(a) GDPR — consent. A separate, optional tick box, with a telephone number you provide yourself.

Account security and prevention of abuse

Article 6(1)(f) GDPR — legitimate interest in protecting your account and our website.

Access to the promotions does not depend on the marketing consents. You may decline both and you will still see the promotions.

For commercial communications by electronic means, Romanian legislation on electronic communications applies in addition to the GDPR and requires prior express consent.

4. Who we share your data with

— Authorised hotel staff, strictly to the extent necessary.

— Google Ireland Limited and Google LLC, acting as our processor, for the Firebase Authentication and Cloud Firestore services in which the accounts are held. Google's Cloud Data Processing Addendum applies.

— If you have consented to WhatsApp messages, the messaging service provider, for the purpose of delivering those messages.

We do not sell your data and we do not pass it to third parties for their own advertising purposes.

5. Transfers outside the European Union

The account database is configured in a European Union region. Certain technical operations by the provider may nevertheless involve transfers of data to the United States.

Google LLC is certified under the EU-U.S. Data Privacy Framework, a mechanism recognised by the European Commission, which provides an adequate level of protection for such transfers. The contractual clauses set out in the data processing addendum concluded with the provider apply in addition.

6. How long we keep your data

— Account data: for as long as the account exists, and no longer than 5 years from your last activity, in line with the retention period stated in our Terms and Conditions.

— If you delete your account, or after a prolonged period of inactivity, your contact details are erased.

— The consent record is retained for 3 years after the account is closed, as evidence of consent. It contains neither your email address nor your telephone number.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to withdraw your consent at any time, without this affecting the lawfulness of processing carried out before the withdrawal.

On the promotions page, once signed in, the Preferences button lets you switch email and WhatsApp communications on or off at any time, and delete your account together with the associated data. Withdrawing is as simple as giving consent.

You may write to us at sales@hotelinternationaliasi.ro at any time to exercise any of these rights.

8. Complaint to the supervisory authority

If you believe we have infringed your rights, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest, Romania

anspdcp@dataprotection.ro · www.dataprotection.ro

9. Automated decision-making

We do not take automated decisions producing legal effects concerning you, and we do not build automated profiles from this data.