GDPR Privacy Policy
Antis Estates LTD is the company that operates the Azia Resort and Spa hereafter we, Antis Estates LTD respects your privacy and is committed to protecting your personal data. The following Policy explains how we collect and process your personal data. This Policy includes when you, or someone on your behalf, makes a booking, fill in our Registration form on arrival, requests information from us, contacts us (or we contact you), uses our website/apps, links from our website/apps, connects with us via social media, works with us, or any other engagement we have with you (regardless of where you are based). It also tells you about your privacy rights and how the law protects you. This Policy is in accordance to the provisions of the Cyprus Processing of Personal Data Law 125(Ι) of 2018 (the “law”) and the General Data Protection Regulation EU 679/2016 (“GDPR”).
AIM OF THE INFORMATION AND WHO WE ARE
This Policy aims to give you information on how we collect and process your personal data in our dealings with you, including in providing accommodation and other services to you, including any data you may provide through our website, including by cookies and in other cases of having a legal relationship with you (employee, supplier third party etc). This general privacy notice may be supplemented by other special notices (and is not intended to override them), we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data.
CONTROLLER
The Antis Estates LTD operating the Azia Resort and Spa in which you stay or receive our services and the present web site is the controller for the data processing of such accommodation service or other services’ receipt.
CONTACT DETAILS AND RIGHT TO COMPLAIN
Address: Leoforos Chlorakas 131,8220 Chloraka Paphos. Telephone: 26-845100. Fax: 26-845200, e-mail: info@aziaresort.com
You have the right to make a complaint at any time to the data protection authority supervising us, the Cyprus Data Protection Authority (Iasonos 1, 1082 Nicosia, phone: +357 22818456, fax: +357 22304565, email: commissioner@dataprotection.gov.cy). We would, however, appreciate the chance to deal with your concerns before you approach the Authority so please contact us or use the above mentioned contact details in the first instance.
THE DATA WE COLLECT ABOUT YOU
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped for practical reasons as follows:
- Identity Data includes first name, last name, date of birth, nationality, passport or ID card number, gender and username or similar identifier.
- Contact Data includes permanent address, email address and fax and telephone numbers.
- Booking and Transaction Data includes bank account or payment card details and details about payments and other details of your bookings, stays and other services you have purchased from us, and comments and responses to surveys you provided relating to our service.
- Usage Data includes information about how you use our services or link with us via social media and our website.
- Image data through the CCTV system we lawfully use in our hotel.
- Identity, contact, transaction, curriculum and technical data as well as data we are obliged by National Laws about our employees.
We will not collect all the data referred to above in each case, but only such data required for the specific “Legal Ground”.
In the normal course, we will only collect Special Categories of Personal Data about you (this includes information about your health needs and disabilities to the extent that it is volunteered by you or on your behalf and is needed to cater to your requirements during your stay with us or other use of our facilities or services. We may also, however, need to process such information in the event of an accident or a medical or other emergency during your stay or your other use of our facilities.
We obtain limited information about children who are booked in to stay at our hotel (number, age, and were legally required other data such as name, date of birth, passport number).
HOW WE USE YOUR PERSONAL DATA
We will only use your personal data according the law and GDPR. Most commonly, we will use your personal data in the following circumstances (each one is a “Legal Ground”):
- Consent: Where you provide us your explicit consent to. For any processing that is based on your consent (mainly but not exclusively applying to online advertising to you), you have the right to withdraw such consent at any time by using our opt-out links or contacting us.
- Performance of contract: Where we need to provide the booked accommodation and services, or otherwise perform the contract we have entered into with you (or are about to enter into).
- Legitimate interests (including our interest to improve our services): Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Comply with obligation: Where we need to comply with a legal or regulatory obligation in National or European level.
- Vital interests: In the case of an accident or a medical or another emergency, to protect your or another individual’s vital interests, where you or they are not able to give consent.
We do not undertake automated decision making using your personal data.
IF YOU FAIL TO PROVIDE PERSONAL DATA
Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with accommodation or our other services). In this case, we may have to cancel a booking or other service you have with us but we will notify you if this is the case at the time.
DISCLOSURES OF YOUR PERSONAL DATA
We may have to share your personal data per case with the categories of parties set out below:
- External third parties, including: business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you; these include contractors who provide services to you in their own name such as the third party provider offering Wi-Fi services, as well as our other providers acting as processor on our behalf and as instructed by us (such as the providers of our IT and CCTV infrastructure).
- Professional advisers, including lawyers, banks, auditors and insurers.
- Analytics and search engine providers that assist us in the improvement and optimisation of our services and website (processor acting on our behalf and as instructed by us).
- Tax and customs authorities, public registry authorities, regulators and other authorities.
- Entities involved in credit checking and anti-fraud activities, crime prevention/detection, risk assessment and management and dispute resolution.
Where these third parties are our processors, we require them to respect the security of your personal data and to treat it in accordance with the law and GDPR. We do not allow our third-party processors to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Some of the third parties mentioned above, for example many professional advisers and authorities, are controllers who, like us, are subject to specific obligations under data protection law and GDPR, and who will have their own privacy notices setting out how they deal with personal data.
DATA SECURITY
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. Processors we appoint will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
DATA RETENTION
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including the purposes of satisfying any legal, accounting, or reporting requirements. In many cases your personal data are encrypted.
YOUR LEGAL RIGHTS
You have the right to:
- Request access to your personal data;
- Request erasure of your personal data;
- Request correction of your personal data;
- Object to processing of your personal data;
- Request restriction of processing your personal data;
- Request transfer (portability) of your personal data;
- Withdraw consent.
