PERSONAL DATA PROCESSING POLICY
PERSONAL DATA PROCESSING POLICY
This English version is provided for information purposes. In the event of any discrepancy between the Russian and English versions, the Russian version shall prevail.
1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) sets out the procedure for the processing and protection of personal data by Individual Entrepreneur Artem Gennadyevich Kovalenko, TIN 615429209604, PSRNIE 323619600081042 (hereinafter referred to as the “Operator”), conducting business, inter alia, under the InPremium brand.
1.2. The Policy has been developed in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” and other applicable regulatory legal acts.
1.3. The Policy applies to personal data received by the Operator in the course of InPremium’s activities, including: • when using the InPremium website at inpremiumhotel.com (hereinafter referred to as the “Website”); • when submitting applications and enquiries; • when making and performing Bookings; • when entering into and performing agreements for the provision of hotel services; • during Guest check-in and service provision; • when using the Personal Account; • when making payments and settlements; • when communicating with the Operator by telephone, e-mail, messengers and other communication channels; • when receiving informational and advertising messages.
1.4. The Policy applies to automated, non-automated and mixed processing of personal data.
1.5. The Policy is a publicly available document and is posted on the Website. Access to it is provided, inter alia, from the Website pages on which personal data are collected.
1.6. The Operator processes personal data where an appropriate legal basis exists.
1.7. Use of the Website by itself does not constitute the User’s consent to personal data processing where separate consent is required for such processing.
2. KEY DEFINITIONS
2.1. Personal data — any information relating directly or indirectly to an identified or identifiable individual.
2.2. Personal data subject — an individual to whom the personal data relate.
2.3. Personal data processing — any action or set of actions performed on personal data, whether by automated means or otherwise, including collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer, depersonalisation, blocking, deletion and destruction.
2.4. Automated processing of personal data — processing of personal data using computing equipment.
2.5. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.6. Dissemination of personal data — actions aimed at disclosing personal data to an indefinite group of persons.
2.7. Blocking of personal data — temporary suspension of personal data processing, except where processing is necessary to clarify such data.
2.8. Destruction of personal data — actions as a result of which it becomes impossible to restore the contents of personal data in an information system and/or material media containing personal data are destroyed.
2.9. Depersonalisation of personal data — actions as a result of which it becomes impossible, without additional information, to determine that personal data belong to a particular personal data subject.
2.10. Website means the official InPremium website available at inpremiumhotel.com.
2.11. User — an individual using the Website.
2.12. Personal Account — a personalised section of the Website intended for using InPremium services, storing data provided by the User and communicating with the Operator.
3. RIGHTS OF PERSONAL DATA SUBJECTS AND OBLIGATIONS OF THE OPERATOR
3.1. A personal data subject has the right to: • obtain information concerning the processing of their personal data; • request clarification, blocking or destruction of personal data where such data are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose; • withdraw previously given consent to personal data processing; • request termination of personal data processing where the applicable grounds exist; • opt out of advertising messages; • challenge the Operator’s actions or omissions before the competent authority or in court; • exercise other rights provided by law.
3.2. The Operator shall: • process personal data on a lawful basis; • provide the subject with information concerning the processing of their personal data; • take necessary legal, organisational and technical measures to protect personal data; • ensure the accuracy and relevance of personal data where necessary for the purposes of processing; • terminate processing and destroy personal data when the relevant grounds arise; • comply with personal data localisation requirements when collecting personal data through the Website.
4. PRINCIPLES OF PERSONAL DATA PROCESSING
4.1. Personal data are processed lawfully and fairly.
4.2. Processing is limited to achieving specific, predetermined purposes.
4.3. Processing incompatible with the purposes for which personal data were collected is not permitted.
4.4. Only personal data necessary to achieve the relevant purposes are processed.
4.5. The content and scope of processed data correspond to the stated purposes of processing.
4.6. The Operator takes necessary measures to ensure the accuracy and relevance of personal data.
4.7. Personal data are stored no longer than required by the purposes of processing, unless another retention period is determined by an agreement or another legal basis.
4.8. The Operator does not process special categories of personal data.
4.9. The Operator does not process biometric personal data for the purpose of establishing a data subject’s identity.
5. PURPOSES, CATEGORIES OF SUBJECTS AND PERSONAL DATA PROCESSED
5.1. Applications, Bookings, conclusion and performance of agreements
Purpose of processing: processing applications and enquiries; providing information about InPremium services; selecting services and accommodation terms; making, confirming, changing and cancelling Bookings; entering into and performing agreements; and communicating with the subject regarding the receipt of services.
Categories of subjects: Website Users, Customers, Guests and other persons contacting the Operator to receive services.
Personal data processed: • surname, first name and patronymic (if any); • telephone number; • e-mail address; • messenger identifier or username; • information provided by the subject when submitting an application or enquiry, making a Booking and receiving services.
Legal grounds: actions taken at the subject’s initiative with a view to entering into an agreement; conclusion and performance of an agreement; the subject’s consent where processing is based on such consent.
Method of processing: automated, non-automated and mixed.
5.2. Check-in and provision of hotel services
Purpose of processing: identification of Guests, check-in formalities, providing access to the Accommodation Facility, provision of hotel services and compliance with mandatory requirements relating to Guest accommodation.
Categories of subjects: Guests, including persons for whose benefit a Booking has been made by another person.
Personal data processed: • surname, first name and patronymic (if any); • date of birth; • citizenship, where necessary; • identity document details; • residential or registration address, where necessary; • information concerning the period of stay; • information necessary to arrange access to the Accommodation Facility.
Legal grounds: conclusion and performance of an agreement, as well as compliance with mandatory requirements imposed on the Operator.
Method of processing: automated, non-automated and mixed.
5.3. Personal Account administration
Purpose of processing: creation and administration of the Personal Account and storage of User data to simplify subsequent Bookings, check-in and receipt of InPremium services.
Categories of subjects: Users who have registered a Personal Account.
Personal data processed: • surname, first name and patronymic (if any); • telephone number; • e-mail address; • identity document details; • information about Bookings and services received; • other data provided by the User when using the Personal Account.
Legal grounds: consent of the personal data subject.
Processing period: for the duration of the Personal Account or until the relevant consent is withdrawn.
When the Personal Account is deleted, processing for the purpose of maintaining the Personal Account ceases. Data whose further retention is not required for performance of an agreement or another independent processing purpose shall be destroyed in accordance with the established procedure.
Method of processing: automated and mixed.
5.4. Payments, refunds, accounting and tax records
Purpose of processing: making payments and settlements, refunding funds, issuing payment documents and maintaining accounting and tax records.
Categories of subjects: Customers, Guests and other individuals with whom the Operator carries out settlements.
Personal data processed: • surname, first name and patronymic (if any); • contact details where required for the relevant transaction; • information about the agreement and services provided; • information about payments and refunds; • bank details where required for a refund or other settlement.
Legal grounds: performance of an agreement and compliance with the Operator’s obligations relating to payments, accounting and tax records.
The Operator does not store full bank card details entered by the User on the side of payment service providers.
5.5. Ensuring Website operation and security
Purpose of processing: ensuring the proper and secure operation of the Website and preventing technical failures and unlawful actions.
Categories of subjects: Website Users.
Personal data processed: • IP address; • browser and device information; • date and time of access to the Website; • address of the requested page; • technical identifiers and event logs.
Legal grounds: the Operator’s legitimate interests in ensuring the operability and security of the Website, provided that the rights and freedoms of personal data subjects are respected.
5.6. Website usage analytics
Purpose of processing: obtaining statistical information about Website usage, assessing its effectiveness and improving the Website and the services presented on it.
Categories of subjects: Website Users.
Personal data processed: • IP address; • cookies and technical identifiers; • device, browser and operating system information; • source of referral to the Website; • information about interaction with Website pages; • date, time and duration of the visit.
Legal grounds: User consent where the relevant technology requires such consent.
5.7. Informational and advertising messages
Purpose of processing: providing information about special offers, promotions, discounts, new services, news and other InPremium offers.
Categories of subjects: persons who have provided the relevant consent.
Personal data processed: • name; • telephone number; • e-mail address; • messenger identifier or username; • information concerning the consent provided.
Legal grounds: the subject’s prior consent.
Communication channels: e-mail, SMS, telephone communications and messengers.
Consent to receive advertising messages is voluntary and is not a condition for making a Booking, submitting an application or receiving services.
6. LEGAL GROUNDS, PROCEDURE AND METHODS OF PROCESSING
6.1. The Operator processes personal data on the basis of: • the personal data subject’s consent; • the need to take steps at the subject’s initiative with a view to entering into an agreement; • the need to enter into and perform an agreement; • the need to comply with obligations imposed on the Operator; • the need to exercise the Operator’s rights and legitimate interests, provided that the subject’s rights and freedoms are respected; • other grounds provided by law.
6.2. Where processing is based on consent, the Operator ensures that the fact of obtaining such consent can be demonstrated. Consent to personal data processing is executed separately from other documents and information that the subject confirms or signs.
6.3. The Operator receives personal data directly from the subject, their representative, a person making a Booking for the benefit of a Guest, and through booking services and information systems used by the Operator.
6.4. In the course of processing, the Operator may collect, record, systematise, accumulate, store, clarify, retrieve, use, provide, depersonalise, block, delete and destroy personal data.
6.5. When personal data of citizens of the Russian Federation are collected through the Website, the recording, systematisation, accumulation, storage, clarification and retrieval of the relevant personal data are carried out using databases located within the Russian Federation.
6.6. The Operator does not disseminate personal data to an indefinite group of persons without an appropriate legal basis.
7. TRANSFER OF PERSONAL DATA AND ENTRUSTING PROCESSING
7.1. To achieve the purposes of processing, the Operator may engage third parties and provide them with personal data to the extent necessary. Such parties may include: • booking and Booking management services; • organisations facilitating payments and settlements; • persons ensuring the operation and technical maintenance of the Website and information systems; • telecommunications operators and messaging services; • management companies of the Accommodation Facilities, to the extent necessary to arrange Guest access and stay; • government authorities and other authorised persons in cases provided for by law.
7.2. When entrusting personal data processing to another person, the Operator determines the purposes of processing, the list of personal data and the actions to be performed with them, and establishes confidentiality and personal data security requirements.
7.3. The scope of personal data provided to third parties is limited to information necessary to achieve the relevant purpose.
8. CROSS-BORDER TRANSFER OF PERSONAL DATA
8.1. The Operator carries out cross-border transfers of personal data in compliance with the requirements of Federal Law No. 152-FZ “On Personal Data”.
8.2. Before commencing such transfer, the Operator completes the procedures prescribed by law and takes necessary measures to protect personal data.
9. PROCESSING, RETENTION AND DESTRUCTION PERIODS
9.1. The processing and retention period for personal data is determined by the purpose of processing, the terms of the agreement and the grounds on which processing is carried out.
9.2. Personal data necessary for making and performing a Booking and an agreement are processed for the period necessary to perform the relevant obligations and, after their performance, for the period necessary to comply with mandatory document retention periods and to protect the Operator’s rights and legitimate interests.
9.3. Personal Account data are processed for the duration of the Personal Account. When the Personal Account is deleted, processing for the purpose of maintaining it ceases.
9.4. Personal data processed for sending advertising messages are processed until the relevant consent is withdrawn or a request to stop such messages is received.
9.5. Data related to Website usage, cookies and analytics tools are processed for the period necessary for the relevant purpose, taking into account the lifetime of the technologies used and the settings of the relevant services.
9.6. After the purpose of processing has been achieved, the Operator terminates processing and destroys personal data within a period not exceeding 30 days, unless an agreement with the subject or another legal basis permits further processing.
9.7. Where consent is withdrawn, processing carried out on the basis of that consent ceases. If retention of the relevant personal data is no longer required and there is no other basis for processing, the data shall be destroyed within a period not exceeding 30 days from receipt of the withdrawal.
9.8. If it is impossible to destroy personal data within the prescribed period, the Operator blocks the relevant data and ensures their destruction within the period prescribed by Federal Law No. 152-FZ.
9.9. Destruction is carried out in a manner preventing further restoration and use of the relevant personal data.
10. WEBSITE DATA PROCESSING, COOKIES AND ANALYTICS
10.1. When the Website is used, technical information concerning the User’s device and interaction with the Website may be processed automatically, including IP address, browser and device information, date and time of visit, information about pages visited and other technical data.
10.2. The Website may use cookies and similar technologies to ensure Website functionality, save user settings, ensure security, analyse Website usage and improve its operation.
10.3. The Operator may use web analytics services to obtain statistical information concerning Website usage.
10.4. Where the use of particular cookies or technologies requires User consent, the relevant processing is carried out after such consent has been obtained.
10.5. The User may restrict or disable cookies in their browser settings. This may affect the operation of certain Website functions.
11. PERSONAL DATA PROTECTION
11.1. The Operator takes necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions.
11.2. In particular, the Operator: • restricts access to personal data to persons who require such access to perform the relevant functions; • takes measures to ensure the safekeeping of personal data and media containing such data; • applies necessary information protection means and methods; • takes measures to identify unlawful access to personal data and remedy its consequences; • monitors compliance with established requirements for personal data processing and protection.
11.3. Persons granted access to personal data are required to maintain their confidentiality.
12. DATA SUBJECT REQUESTS, WITHDRAWAL OF CONSENT AND OPT-OUT FROM ADVERTISING
12.1. A subject may contact the Operator regarding personal data processing, exercise of their rights, clarification of data, termination of processing or withdrawal of consent previously provided.
12.2. Requests and inquiries regarding personal data may be submitted to the Operator by email at info@inpremiumhotel.com.
12.3. To consider a request, the Operator may request information necessary to identify the applicant and confirm their authority.
12.4. Withdrawal of consent does not prevent continued processing of personal data where another legal basis for such processing exists.
12.5. The subject may at any time opt out of further advertising messages using the method specified in the relevant message or by contacting the Operator.
12.6. Upon receipt of an opt-out request, the relevant advertising messages shall cease.
13. FINAL PROVISIONS AND OPERATOR DETAILS
13.1. This Policy is publicly available and is posted on the InPremium Website.
13.2. The Operator may amend the Policy where personal data processing processes, services used or applicable requirements change.
13.3. The current version of the Policy takes effect upon its publication on the Website unless otherwise stated in the Policy.