Privacy policy

Privacy policy

Kety Travel D.O.O., with its registered office in Poreč – Nova Vas, Porečka 24a, and a branch in Poreč, Park O. Ban 2, OIB: 79811618739 (hereinafter: Kety Travel), respects the privacy of every person whose personal data it collects. We would like to inform you about the personal data Kety Travel collects, how we protect it and your rights.

Kety Travel reserves all copyright in the use of photographs, texts and other published materials under the applicable laws of the Republic of Croatia. Photographs, texts and other materials may not be published, sold, publicly or privately disseminated or otherwise used without Kety Travel’s consent. Any failure to comply with these conditions entails liability and an obligation to compensate Kety Travel for non-material damage arising from the infringement relating to each individual item of material.

Basic information

Scope

This policy applies to all processing of personal data by Kety Travel, unless another Kety Travel policy provides otherwise. As an exception, for the processing of data relating to Kety Travel guests and service users, this policy takes precedence over other policies if those policies set out different rights and obligations regarding data processing.

Data controller and legal framework

As the controller of your data, Kety Travel respects your privacy and undertakes to protect your personal data. Data is collected and stored in accordance with Regulation EU 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), the Croatian Act on the Implementation of the General Data Protection Regulation (NN 42/2018), and other relevant legislation applicable in the Republic of Croatia.

Data protection officer

Kety Travel has appointed a data protection officer whom you may contact at any time at: [email protected] or by post at Kety Travel d.o.o., Porečka 24a, 52446 Nova Vas, Republic of Croatia.

Application of data protection principles

When applying this policy, Kety Travel pays particular attention to the principles of data processing and processes data as follows:

• Lawfully – processing is carried out only where permitted by law and within the limits allowed by law.
• Fairly – taking account of the particular circumstances of each relationship, applying all appropriate measures to protect personal data and privacy generally, and not preventing data subjects from exercising their rights.
• Transparently – informing data subjects about the processing of their personal data. From the point of collection, when data subjects are informed about all aspects of processing, until processing ends, they are given simple and prompt access to their own data, including the opportunity to inspect it and receive a copy in accordance with the Regulation. Certain information may be restricted only where required by law or necessary to protect third parties.
• With purpose limitation – processing personal data for the purposes for which it was collected, and for other purposes only where the conditions in the Regulation are met. Data may be processed for compatible purposes only after taking account of:

(a) any link between the purposes for which the personal data was collected and the purposes of the intended further processing;

(b) the context in which the personal data was collected, particularly the relationship between the data subjects and Kety Travel;

(c) the nature of the personal data, particularly whether special categories of personal data are processed under Article 9 of the Regulation or data relating to criminal convictions and offences under Article 10 of the Regulation;

(d) the possible consequences of the intended further processing for data subjects; and

(e) the existence of appropriate safeguards.

• With storage limitation – keeping data in a form that permits identification of data subjects only for as long as necessary for the purposes of processing, and for longer only where permitted by the Regulation.
• With data minimisation – processing data that is adequate, relevant and limited to what is necessary. Particular care is taken not to collect data where there is no justified need to process it.
• With regard to accuracy – taking care to keep data accurate and up to date, and deleting inaccurate data where possible.
• With regard to integrity and confidentiality – providing appropriate security for personal data through technical and organisational measures, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage. The relevant measures are applied with regard to the risks associated with each type of data processing.

Disclosure of data to third parties

Where necessary and to a limited extent, third parties acting as processors, such as Kety Travel partners providing IT or other services, may also have access to guests’ personal data. They retain it in their databases until processing is completed. Detailed agreements are concluded with these parties concerning their powers and obligations when processing personal data, in accordance with the Regulation.

In certain circumstances, external parties and Kety Travel may jointly determine the purposes and means of processing personal data. In that case, they are joint controllers. They transparently determine their respective responsibilities for compliance with the Regulation, particularly regarding the exercise of data subjects’ rights and their duties to ensure transparent processing, unless those responsibilities are laid down by law.

Where processing involves transferring data to third countries, Kety Travel ensures compliance with high standards of protection to achieve the highest possible level of personal data protection in accordance with the Regulation’s strict requirements. Where international transfers of personal data apply, Kety Travel informs data subjects of the intention to transfer their data to a third country or international organisation and of the existence or absence of a European Commission adequacy decision. Data subjects are also informed of the appropriate or suitable safeguards and how to obtain a copy or where they are available, where the transfer is subject to safeguards under Article 46 of the Regulation, binding corporate rules under Article 47, or Article 49 paragraph 1 subparagraph 2 applies. All transfers of personal data to third countries are carried out in accordance with Chapter V of the Regulation.

Purposes of data collection

Your personal data is collected and used only on the basis of information you voluntarily provide to Kety Travel when using kety-travel.hr. The personal data collected is stored electronically and on paper. All appropriate technical and organisational measures are applied to prevent personal data breaches. Kety Travel uses emails containing your personal data only to fulfil your requests.

Kety Travel must collect some of your personal data to fulfil the accommodation contract and comply with legislation governing tourism and hospitality activities. Other or the same data may also be collected for other purposes, primarily to contact you, or for the following purposes:

• Fulfilling the accommodation contract
• Meeting the requirements of laws and other applicable legislation governing tourism and hospitality activities
• Direct marketing
• Sending offers
• Issuing airline tickets
• Issuing transport tickets
• Booking car hire, travel or other Kety Travel services
• Organising prize draws
• Improving and personalising services for you as a guest
• Protecting property and the safety of individuals through video surveillance

Kety Travel guarantees that the data collected will be used only for the stated purposes.

Kety Travel may use depersonalised data for statistical purposes.

Legal bases for data collection

The legal bases for the above purposes of collection are:

• Legal obligations,
• Contractual obligations,
• The vital interests of the data subject,
• Legitimate interests that outweigh the data subject’s interests, or
• The data subject’s consent or explicit consent, depending on the purpose of processing and the type of personal data.

Points of data collection

Kety Travel collects your data in the following situations:

• When booking accommodation or other Kety Travel services (online or by email)
• When completing the registration card
• When subscribing to the newsletter on Kety Travel websites
• When joining the loyalty programme
• When entering a prize draw by completing a questionnaire
• At locations covered by video surveillance.

Data retention periods

Data collected by Kety Travel on the basis of a legal obligation must be kept for the period specified by the relevant law or other applicable legislation.

Data collected by Kety Travel on the basis of a contractual relationship is kept only for as long as necessary to fulfil the contract or provide the service.

First names, surnames and email addresses collected by Kety Travel on the basis of legitimate interests for direct marketing are kept in its guest database for 10 years.

Other data collected by Kety Travel on the basis of the guest’s explicit consent (mobile number, number of children, marital status, pets, interests, mode of travel, and accommodation, destination and service preferences) is kept in its guest database for 5 years.

With your explicit consent, Kety Travel may also collect and store information about the content you browse on websites (so-called cookies). In this case, it is kept in the database for 2 years. Kety Travel uses this information to notify you of special and personalised offers, news and events it organises through online channels (email, websites and internet promotions).

Rights of data subjects

Regardless of the basis for collecting your data, you may request the following at any time and free of charge:

• Access to, correction or supplementation of your data in all personal data databases. Kety Travel will provide access or amend your data in all its databases, depending on your request;
• Erasure of your personal data from all personal data databases (the "right to be forgotten"). Kety Travel will remove you from its databases, except those it is required to maintain and retain under applicable legislation, provided there are no overriding legitimate grounds for processing and processing is not necessary for the establishment, exercise or defence of legal claims;
• Restriction of the processing of your data, or the opportunity to object to such processing;
• Transfer of the data we have collected about you to you or third parties (the “right to data portability”), in accordance with applicable legislation;
• Where data was provided on the basis of consent, you may withdraw that consent at any time without adverse consequences;
• The right to lodge a complaint with the supervisory authority – the Croatian Personal Data Protection Agency (more information at www.azop.hr).

Send your written request to the data protection officer at: [email protected] or by post at Kety Travel d.o.o., Porečka 24a, 52446 Nova Vas, Republic of Croatia.

Personal data collected from people and guests who book accommodation and other hospitality and tourism services we provide

Kety Travel, as controller, keeps the personal data you must provide to receive accommodation services in its database solely to fulfil the accommodation contract and statutory obligations to disclose and collect personal data relating to tourism and hospitality activities. It may also use that data for other purposes provided for by applicable legislation. If you do not provide Kety Travel with the minimum information needed to register a guest in all relevant registers, Kety Travel cannot provide the accommodation service in accordance with the contract and the law.

The personal data Kety Travel records when you book and on the registration card when you arrive at the property is collected under legislation governing hospitality activities and for the purpose of providing services to guests. This includes the following information, which may change depending on applicable legislation:

• First name and surname
• Home address (Croatian citizens)
• Date of birth
• Identification document number, type and place of issue
• Nationality
• Property name
• Accommodation unit number
• Guest’s arrival and departure dates
• Gender.

Kety Travel stores this data in its guest database and sends it through the E-visitor system (the electronic guest registration system) to the competent authorities of the Republic of Croatia. The data must be retained in the system for 10 years. Kety Travel must also retain all invoices issued to guests containing their personal data for 11 years, in accordance with statutory requirements.

Only data necessary to deliver the service is made available exclusively to the partners involved, such as accommodation providers, transport providers, insurers and tour escorts. Payment data, such as bank card numbers and expiry dates, is specially protected and is made available only to banks or card companies to authorise payment.

To fulfil its contractual obligations, Kety Travel also collects the following information when you book and on the registration card:

• Email
• Language
• Telephone number.

Other information about the circumstances of your stay, such as your mode of travel, travelling companions, marital status, number of children, pets and other interests, is also collected where directly related to providing accommodation or another service we offer, in order to provide a high-quality service. This information is deleted after your departure.

Kety Travel, as controller, is entitled on the basis of legitimate interests to collect your first name, surname and email address in its guest database and use them for direct marketing, solely to inform you by email about Kety Travel offers and news. You may at any time and free of charge request deletion from the database used for this purpose (the right to be forgotten).

During and after your stay, Kety Travel sends you a satisfaction questionnaire at the email address you provided. You may complete it only with your consent. Its primary purpose is to collect information about the service so that Kety Travel can improve it. Kety Travel depersonalises the questionnaire data and processes it for statistical purposes.

In addition, the person booking accommodation or the guest may give Kety Travel separate permission, or consent, to collect and use all their data, such as:

• First name
• Surname
• Email
• Date of birth
• Country
• Other personal data collected during the stay (such as mobile number, telephone number, gender, number of children, marital status, language, pets, interests and activities during the stay, mode of travel, accommodation preferences and destination preferences)
• Other personal data collected when browsing the website (so-called cookies), including the IP address.

This data is collected and used for further profiling of the data subject and to contact and inform them about special and personalised offers, news and events organised by Kety Travel through online channels (email, websites and internet promotions). The data subject may withdraw consent at any time and free of charge, including for profiling insofar as it relates to such direct marketing, whether for initial or further processing. They also have the right to change their data and the right to be forgotten at any time.

The data is kept in Kety Travel’s guest database for 5 years.

Kety Travel also collects personal data through video surveillance.

Personal data collected when subscribing to the newsletter on Kety Travel websites

When subscribing to the newsletter, a data subject may provide the following additional information with consent. This excludes first name, surname and email address, which Kety Travel collects on the basis of legitimate interests:

• Gender
• Date of birth
• Country
• Language.

When updating a newsletter subscription, a data subject may provide the following additional information with consent:

• Street, house number, postcode and town
• Telephone number
• Mobile number
• Interests
• Mode of travel
• Pets
• Accommodation preferences
• Destination preferences.

The data is collected on the basis of explicit consent to provide information about special and personalised offers, news and events organised by Kety Travel through online channels (email, websites and internet promotions).

The data is kept in Kety Travel’s guest database for 5 years.

The data subject has the right to change their data and the right to be forgotten.

Personal data collected when joining the loyalty programme

By joining the loyalty programme, guests collect points as specified in the general terms for loyalty members when using services through Kety Travel. All membership conditions, Kety Travel’s obligations and data subjects’ rights are set out in the loyalty programme’s general terms, available at www.kety-travel.hr /loyalty. Membership is granted exclusively at the guest’s request and provides various benefits. Guests may leave the loyalty programme at any time.

The following data is collected:

• First name,
• Surname,
• Gender,
• Date of birth,
• Email,
• Mobile number,
• Telephone number,
• Address (street, house number, postcode, town and country).

Kety Travel is entitled, on the basis of legitimate interests, to collect and use the email address, first name and surname of all loyalty members for direct marketing, solely to inform them by email about Kety Travel offers and news. The data subject may object to this processing at any time and free of charge, including profiling insofar as it relates to such direct marketing, whether for initial or further processing.

In addition, a person joining the programme may give Kety Travel separate permission, or consent, to collect and use all the above data, as well as:

• Other personal data collected during any stay (such as number of children, marital status, language, pets, interests and activities during the stay, mode of travel, accommodation preferences and destination preferences).

Kety Travel collects and uses this data for further profiling of the data subject and to contact and inform them about special and personalised offers, news and events through online channels (email, websites and internet promotions). The data subject may withdraw consent at any time and free of charge, including for profiling insofar as it relates to such direct marketing, whether for initial or further processing. They also have the right to change their data and the right to be forgotten at any time.

This data is kept in Kety Travel’s guest database for 5 years.

Personal data collected when entering a prize draw or completing a questionnaire

Kety Travel may occasionally organise prize draws. In that case, your personal data is collected only if you choose to enter. The information required for entry is specified in the rules for each individual prize draw and may vary. Data collected on this contractual basis is used to conduct the prize draw in accordance with its rules and is deleted within 5 years after the prize draw ends.

If you complete a prize draw questionnaire with information not required for entry, which may vary between prize draws, Kety Travel may use all such data in depersonalised form for statistical purposes.

Kety Travel is entitled, on the basis of legitimate interests, to collect and use the first name, surname and email address you enter in a prize draw questionnaire for direct marketing, solely to inform you by email about Kety Travel offers and news. The data subject may object to this processing at any time and free of charge, including profiling insofar as it relates to such direct marketing, whether for initial or further processing.

This data is kept in Kety Travel’s guest database for 10 years.

The data subject has the right to change their data and the right to be forgotten.

In addition, a prize draw entrant may give Kety Travel separate permission, or consent, to collect and use all the data provided in the prize draw questionnaire, which may vary between prize draws, for further profiling and to contact and inform them about special and personalised offers, news and events through online channels (email, websites and internet promotions). The data subject may withdraw consent at any time and free of charge, including for profiling insofar as it relates to such direct marketing, whether for initial or further processing. They also have the right to change their data and the right to be forgotten at any time.

The data is kept in Kety Travel’s guest database for 5 years.

Why do we use your data?

The reasons for using your data, set out in the table below, vary depending on your relationship with us. At least one of the following legal bases must apply when we use your data:

• We need to process the data to perform a contract with you or enter into one.
• We have your consent to use the data.
• We need to use the data to comply with a legal obligation.
• We need to use the data for our legitimate interests or those of a third party, without infringing your interests and fundamental rights.

To process special categories of personal data, we need an additional justification. We use it only with your explicit consent, where you have made the data public, where it relates to legal claims, or where necessary for reasons of substantial public interest.

Cookies and internet technologies

Like many other portals, our website may use cookies: small files stored on your computer when you access our websites to enable their basic or additional functions. We may also use other technologies that help us deliver content according to your interests, process bookings or requests, and/or analyse the characteristics of your visits. Cookies cannot be used to discover your personal identity. When you access our websites, this information identifies the characteristics of your browser to our servers, but does not identify you.

We use different types of cookies:

• Necessary cookies – these are essential for the website to function; without them, it cannot be opened or displayed. They are used to transmit communications or are necessary to provide an information society service explicitly requested by the user. They also enable basic website analysis to improve its operation using fully anonymised information, rather than personal data or information that could be linked to you in any way. Your consent is not required for these cookies and we do not request it.
• Functional cookies – these allow us to carry out more advanced analysis of website performance. They analyse user behaviour, and the anonymous information obtained helps us determine what visitors prefer and view most. This enables us to adapt the website and make its content and functions as easy to use as possible. We request your consent for these cookies.
• Advertising cookies – these help us analyse your interests and preferences so that we can show you relevant information and create offers tailored to your use of Kety Travel websites. We request your consent for these cookies.

Kety Travel stores cookies in its database for no longer than 2 years to provide information about special and personalised offers, news and events organised through online channels (email, the internet and online promotions).

If you change your mind about the cookie settings on Kety Travel websites, you can change them at any time using this link: (link to the cookie consent box). You may always delete cookies stored on your computer, thereby preventing further processing of your personal data through this technology. Each internet browser has its own procedure for deleting cookies. Instructions for the most popular browsers are provided below:

Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=hr

Mozilla Firefox: https://support.mozilla.org/hr/kb/Brisanje%20kola%C4%8Di%C4%87a

Microsoft Edge: https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy

Google Analytics (web analytics)

Our website uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses cookies to facilitate analysis of your use of the website. In general, the information generated by the cookie about your use of our websites is transferred to Google and stored on servers in the USA. When IP anonymisation is enabled on our website, the full IP address is sent to Google and shortened by Google’s servers in the USA. Google uses this information on our behalf to analyse your use of our website, generate reports on website activity and provide additional services, such as Google Adwords and Google DoubleClick, in connection with website and internet use. Google does not associate your IP address with any other data it holds.
We have entered into a data processing agreement with Google, which acts as a processor on our behalf. We have added code to our website to ensure that IP addresses are collected anonymously. You can object to tracking by Google Analytics as described above by clicking the "Disable Google tracking" button at the bottom of this page. A cookie will be set to prevent future collection of data when you visit the website (an “opt-out cookie”). You can also prevent cookies from being stored by changing your browser settings as described above. Please note that you may then be unable to use all the functions of our website to their full extent.
You can also prevent the Google tracking described above by downloading and installing the browser extension (add-on/plugin) available at:
https://tools.google.com/dlpage/gaoptout?hl=en-GB
Further information about data protection for Google Analytics is available in Google’s privacy notice under "Google Analytics cookies": https://tools.google.com/dlpage/gaoptout?hl=en-GB

Links

Kety Travel websites contain links to other websites, such as Facebook, Instagram, hotels, airports and weather forecasts. Please note that Kety Travel cannot be responsible for privacy compliance on those websites. We therefore encourage users to read the privacy statement of every website they visit.

Video surveillance

Kety Travel, as controller, has a legitimate interest in using video surveillance to protect property and individuals. For certain job positions it also has a legal duty to install surveillance cameras that record employees and anyone within the cameras’ field of view.

Kety Travel marks all locations where video surveillance is installed in the prescribed manner.

Kety Travel recognises that video recordings contain personal data of everyone within the cameras’ field of view and therefore stores them with particular care. It has established a security and access system and a deletion policy governed by Kety Travel’s internal security rules.

Video recordings are regularly overwritten and automatically deleted no later than 15 days after recording. As an exception, recordings are kept longer if they constitute evidence in proceedings before the competent public authorities. Recordings retained separately are stored in a central monitoring and alarm system with extremely restricted access.

Kety Travel may use these video recordings in court and/or criminal proceedings. Third-party processors may also access the personal data in the recordings. These are Kety Travel’s contractual partners who are registered and qualified to provide protection services for individuals and property. They do not use the data independently in any way, but ensure the security of the central surveillance and alarm systems. All other matters concerning video surveillance are governed by the specific legislation applicable to this area.

Protection of children’s personal data

Kety Travel advises parents and guardians to teach children how to handle personal data safely and responsibly online. Kety Travel does not wish or intend to collect children’s personal data and will neither use it nor disclose it to third parties. A child may give consent only in relation to any information society services, and only if older than 16 years. Any other processing of data relating to children below that age, and any processing other than that expressly stated here for children under 18, is permitted by Kety Travel only with prior parental consent.

Changing your data

You may contact us at any time to review your personal data or to have it updated, corrected or deleted. Until then, we use your previously recorded data for the stated purposes.

Your agreement

When you provide information to Kety Travel in any way, such as through a booking or registration card, you guarantee that the information supplied is accurate, that you have legal capacity and authority to provide it, and that you fully agree to Kety Travel collecting and using your data in accordance with the law and this privacy policy.

Data protection by design and by default

Kety Travel, as controller, takes account of the highest organisational and technical data protection standards. Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the varying likelihood and severity of risks to individuals’ rights and freedoms, it implements appropriate technical and organisational measures both when determining the means of processing and during processing itself, to enable effective application of data protection principles.

Kety Travel also implements appropriate technical and organisational measures to ensure that, by default, only personal data necessary for each specific processing purpose is processed. These measures apply to the amount of personal data collected, the extent of processing, the retention period and accessibility. In particular, they ensure that personal data is not automatically made accessible to an unlimited number of individuals without the individual’s intervention.

Records of processing activities

Kety Travel, as controller, maintains records of processing activities containing the following information:

• The name and contact details of the controller, any joint controller where applicable, and the data protection officer;
• The purposes of processing;
• A description of the categories of data subjects and personal data;
• The categories of recipients to whom personal data has been or will be disclosed, including recipients in third countries or international organisations;
• Where applicable, transfers of personal data to a third country or international organisation, including identification of that country or organisation and, for transfers under Article 49 paragraph 1 second subparagraph, documentation of suitable safeguards;
• Where possible, the envisaged time limits for erasure of different categories of data;
• Where possible, a general description of technical and organisational security measures.

Handling personal data breaches

Kety Travel, as controller, ensures that a personal data breach is reported to the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.

The report submitted to the supervisory authority contains all information required by the Regulation.

Where a personal data breach is likely to result in a high risk to individuals’ rights and freedoms, Kety Travel, as controller, informs the data subject without undue delay. Data subjects are not informed in cases where the Regulation provides that notification is not required.

Data protection impact assessment

Where a type of processing, particularly using new technologies and taking account of its nature, scope, context and purposes, is likely to result in a high risk to data subjects’ rights and freedoms, Kety Travel, as controller, carries out an assessment of the impact of the envisaged processing operations on personal data protection before processing begins.

A single assessment may cover a series of similar processing operations that present similar high risks.

Kety Travel carries out a data protection impact assessment in the following cases:

• Systematic and extensive evaluation of personal aspects relating to individuals, based on automated processing including profiling, on which decisions are based that produce legal effects concerning the individual or similarly significantly affect them;
• Large-scale processing of special categories of personal data under Article 9 paragraph 1, or data relating to criminal convictions and offences under Article 10 of the Regulation;
• Systematic monitoring of a publicly accessible area on a large scale;
• Other situations specified by the competent supervisory authority.

Kety Travel ensures that the data protection officer is appropriately involved in the impact assessment process.

In accordance with the Regulation, prior consultation with the supervisory authority is carried out where necessary following the impact assessment.

Transparency

This privacy policy is available at www.kety-travel.hr and at our branch.

If the privacy rules change, a notice is published on these websites at www.kety-travel.hr and at our branch to inform users.

Last amended. Poreč, 24.05.2018