Privacy Policy

PRIVACY AND PERSONAL DATA PROCESSING POLICY

Hotel Minerva & Restaurant Nan Jing

Minerva 92 Company (hereinafter referred to as the “Company”) is a Romanian legal entity, headquartered in Bucharest, 2-4 Gheorghe Manu Street, Sector 1, Bucharest. The Company knows how important privacy is to our customers and strives to clearly explain how we collect, use, disclose, transfer and store your personal information. This Privacy Policy applies to devices, websites administered by us and which refer to our services and products (collectively referred to as our “Services”). This Privacy Policy applies regardless of whether you use a computer, mobile phone, tablet or other smart device to access our Services. We inform you that we intend to take steps to store and process personal data under safe and secure conditions, in accordance with applicable law.
Below you will find the main messages included in our Privacy Policy.

Information we collect

We collect information you provide directly to us. The Company will not collect and process any personal data of yours when visiting the Company’s web page/pages, these being collected only if voluntarily provided by you in order to conclude a contract / as part of your steps prior to concluding a contract.
If you order / book a paid product or service from us, we will ask for your name, contact information, delivery and billing addresses, email address, phone number, as well as credit card information to process your order / honour your reservation.
We inform you that the data requested through booking / order forms, arrival and departure notification forms in the tourist accommodation unit, are the minimum data necessary to meet the legal requirements for preparing the offer, contract and invoice, as well as to honour your request / execute the contract.
You may exercise at any time the following rights: the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object. We inform you that your personal data is used for the purposes mentioned above.
Our business object cannot be carried out without processing this data for the purposes mentioned above. If you do not agree, please do not submit your service / product delivery request.

Data retention

The retention period for this data is according to legal provisions, including for identification in case of potential legal disputes.
We will not retain your personal data for longer than necessary for the purpose for which it was collected. This means that the data will be destroyed or deleted from our systems when it is no longer needed.
We take the necessary steps to ensure that your information is processed and retained based on the following logic:
1. at least for as long as the information is used to provide you with a service;
2. according to the requirements of a law, a contract or in connection with legal obligations;
3. as long as necessary for the purpose for which it was collected, processed or as long as necessary according to the provisions of any contract, any applicable law, for identification in case of potential legal disputes or for statistical purposes, subject to adequate protection.

We will use the information we collect for the following purposes:
• to provide/render a service requested by you;
• to ensure your access and protection in our accommodation spaces;
• to deliver the products ordered by you;
• for internal record-keeping specific to accommodation and public food service activities;
• for other purposes, with your separate consent. We may also seek your separate consent for information collection or separately notify you about how we collect your personal information in a way not described in this Privacy Policy, depending on the requirements of certain additional services, if applicable. In this case, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.

Use of your information

The Company processes personal data for the purposes described above. The Company’s legal basis for processing personal data includes processing that: is necessary for the performance of the contract between you and the Company; is necessary for compliance with legal requirements (e.g., to comply with applicable accounting rules and make mandatory disclosures to legal authorities); necessary for the Company’s legitimate interests (e.g., to manage the relationship between us and you and to protect the Company’s or its clients’ assets).

Sharing your information

We may disclose your information internally, within the company or relevant teams, such as, without limitation, the customer relations team, legal team, finance team, sales team, technical support team. If you choose to pay for our services/products by card, your personal data is transferred to the card payment service provider.
We may also disclose your information to the following entities, only to the extent necessary for performing the Services / delivering the products:
• Business partners. We may also share your information with trusted business partners, including, without limitation, wireless network operators and distributors. These entities are required to ensure the security of your information through legal and contractual provisions, these entities have limited ability to use your information for purposes other than providing us with services.
• Other parties when required by law or as necessary to protect our Services. There may be situations where we disclose your information to other parties: to comply with the law or in response to binding legal process (such as a search warrant or court order); to verify or enforce compliance with policies governing our Services; and to protect the rights, property or safety of the Company or its customers.
• Other parties with your consent or at your direction. Apart from the disclosures described in this Privacy Policy, we may share information about you with third parties to which you separately consent or request us to make such sharing, if applicable. In this case, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.

Keeping your information safe

We take your data protection very seriously and have implemented appropriate physical and technical measures to protect the information we collect in connection with our services. However, please note that although we take reasonable measures within the Company’s control to protect your information, no website, internet transmission, computer or wireless connection is completely secure.

International data transfer

Your use of the Services will involve the transfer, storage and processing of your personal information outside your country of residence to countries within the European Economic Area, within which data protection laws are as comprehensive as those in your country. We will take appropriate measures, in accordance with applicable laws, to ensure that personal information remains protected.

Your rights

You have the right to request details regarding the information we collect about you and to ask us to correct inaccuracies in that information, to object to or request restriction of processing, to request access, erasure or portability of your information.
We will provide you free of charge with information regarding actions taken following such a request within one month of receiving the request. This period may be extended by two months when necessary, considering the complexity and number of requests. We will inform you of any such extension within one month of receiving the request, also stating the reasons for the delay. If you submit a request electronically, the information will be provided in electronic format where possible, unless you request a different format.
You have the possibility to lodge a complaint with the supervisory authority in Romania and to bring a judicial remedy.
If we have reasonable doubts concerning the identity of the natural person submitting the request mentioned above, we may request the provision of additional information necessary to confirm the data subject’s identity.

In accordance with applicable law, we may refuse to process requests that are unreasonably repetitive, require disproportionate technical effort, jeopardise the privacy of others, are extremely impractical, or access requests not required by local law. If your requests are manifestly unfounded or excessive, particularly due to their repetitive nature, we may either charge a reasonable fee considering the administrative costs for providing the information or communication or taking the requested action, or refuse to act on the request.
If you wish to request access to your information, or if you have questions about the privacy policy, contact us at gdpr@minerva.ro. If you have questions related to personal data security, these may be sent to DPO MIHAI LAURA, dpo@minerva.ro, phone 0726996600.
If you request deletion of personal information, you understand that you may no longer be able to access or use the Company’s Services and that remaining personal information may continue for a certain period in the Company’s records and archives, in accordance with applicable laws, but that the Company will not use this information for commercial purposes. You understand that although you request deletion, the Company reserves the right to retain your personal information or a relevant part thereof, in accordance with the “Data retention” section and applicable laws. The Company may suspend, limit or terminate your access to the website due to breach of the Terms of Use, when necessary to protect the rights, property or safety of the Company or any of our business partners, employees or customers.

Contact us

It is also important to check the Privacy Policy updates frequently. The latest version of the Privacy Policy will always be available here. You can check the “effective date” posted at the top to see when the Privacy Policy was last updated.
If you have specific questions, contact us at: Bucharest, 2-4 Gheorghe Manu Street, Sector 1, Personal Data Officer – Mihai Laura, dpo@minerva.ro, phone 0726996600. Also, if you wish to exercise your right of access, modification, deletion/erasure, objection, restriction of processing or portability, or if you wish to contact us, you may use the address gdpr@minerva.ro
You may lodge a complaint with the National Supervisory Authority for Personal Data Processing if you consider that the processing of your personal data violates applicable law. You can find details about the Romanian supervisory authority on its website www.dataprotection.ro

Policy on the processing of personal data obtained through the use of video surveillance means

1. Purpose of processing by video means
   MINERVA 92 SRL processes personal data, namely image, through video systems for the purpose of monitoring access of persons to the institution, ensuring the security of the institution’s premises and assets, as well as the safety of persons within the institution’s premises.
   MINERVA 92 SRL uses the video surveillance subsystem to ensure the safety and security of the institution. This subsystem complements detection and alarm systems for attempted break-ins, access control, fire detection, signalling and alarm systems, thus forming an integrated physical security system.
   Since the processing of personal data (image) through video surveillance means is mandatory, the person’s refusal to provide such data results in the cancellation of their access to the Hotel Minerva premises.

This policy establishes:
a. a unitary set of rules regulating the implementation and use of the video surveillance system for the purpose of ensuring the security of persons and property, guarding and protecting assets, real estate, valuables and special regime materials used in the activity of Minerva 92 SRL, while respecting the obligations incumbent upon the institution as a personal data controller, according to data protection legislation and the security measures adopted to protect personal data, privacy, legitimate interests and guarantee the fundamental rights of data subjects.
b. responsibilities regarding the administration and operation of the video surveillance system, as well as those regarding the preparation, approval and endorsement of documents related to these activities.

The Policy on the processing of personal data obtained through the use of video surveillance means of Minerva 92 SRL describes the institution’s video surveillance system and the protection measures taken by the institution’s president to protect personal data, privacy and other fundamental rights and legitimate interests of persons filmed by video cameras.

2. Legitimacy conditions

The processing of personal data through the use of video surveillance means, the installation and technical use of equipment and components of the video surveillance system is carried out in accordance with legal provisions in the field:
a. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR);
b. The European Data Protection Supervisor’s Video-surveillance Guidelines, published 17 March 2010, Brussels;
c. Decision no. 52/2012 on the processing of personal data through the use of video surveillance means, issued by the President of the National Supervisory Authority for Personal Data Processing (ANSPDCP);
d. Law no. 333/2003 on the guarding of objectives, assets, valuables and protection of persons, republished, with subsequent amendments and additions,
e. Government Decision no. 301 of 11 April 2012 approving the Methodological Norms of Law no. 333/2003 on the guarding of objectives, assets, valuables and protection of persons;
f. The methodological norms for applying Law no. 333/2003, approved by GD no. 301/2012, with subsequent amendments and additions;
g. Order no. 52/2002 approving the Minimum Security Requirements for the processing of personal data, issued by the Ombudsman;

Video surveillance is used only when conventional means applied are considerably less effective in achieving the mentioned objectives, according to the risk analysis carried out at the company level.
MINERVA 92 SRL processes the recorded images respecting the legal provisions in the field.

3. Monitored areas
   The placement of surveillance cameras was carried out in accordance with applicable legislation and based on the risk analysis performed at the institution’s level.
   Areas where there is a high expectation of privacy are not monitored (offices where the public does not have access, toilets and other similar locations).
   Video surveillance is used only when conventional means applied are considerably less effective in achieving the mentioned objectives.
   Access areas and spaces intended for customers and restricted/forbidden access areas are monitored by video means, as follows:
   – Access ways within the Minerva 92 SRL premises;
   – Video cameras in the hotel reception and lobby;
   – Video cameras in the restaurant, bar, events area, kitchens, buffet, storage area, parking;

The recording device is located in a space under permanent guard with restricted access, based on password access.

4. Transparency and information

MINERVA 92 SRL provides persons entering the video-surveilled area with the information required by art. 13 of the General Data Protection Regulation and art. 11 of Decision no. 52/2012, issued by the President of ANSPDCP.
In this sense, the information provided for in art. 13 of the GDPR, accompanied by the relevant pictogram, is brought to the attention of data subjects clearly and permanently, by means of an “Information notice” poster posted in monitored locations, positioned at a reasonable distance from where the surveillance equipment is placed, so that it can be seen by any person.

5. Protecting privacy and information security

To protect the security of the video system and increase the degree of life protection, the following technical and organisational measures have been introduced:
– limiting the storage time of filmed material, in accordance with security requirements;
– storage media (digital video recorders) are in secure spaces, protected by physical security measures;
– all users with access rights have signed a job description binding them to comply with legal provisions in the field of personal data processing;
– access rights are granted to users only for those resources strictly necessary for performing their job duties;
– the person who has the right to grant, modify or cancel user access rights, according to the database access procedure, is the system administrator designated by the controller;
– the designated physical security system administrator/responsible keeps an updated list at all times of all persons with access rights to the video surveillance system, specifying the type of access;
– the personal data protection officer will be consulted before installing any new video system.

At the same time, preventing unlawful processing of personal data or unauthorised access to such data has been considered.

6. Access to personal data collected through the video surveillance system

Access to recorded and live video images is limited to a small number of persons (employees of the institution) who can be clearly identified and is determined by the duties specified in the job description (for what purpose and what type of access).
In particular, MINERVA 92 SRL imposes limits regarding persons who have the right:
– to view the filmed material in real time
– to view the recording of the filmed material: viewing of recorded images will be done in justified cases, such as those expressly provided by law and security incidents, by the General Director or his/her substitute.
– to copy, download, delete or modify any filmed material: copying, downloading, deleting or modifying any filmed material will be done by personnel designated to administer and maintain the surveillance systems, namely the IT specialists of the company contracted to maintain the system (Danirom Security – there is a personal data processing agreement), with the approval of the General Director of Minerva 92 SRL.
The video system of Minerva 92 SRL does not aim to capture (e.g., by focusing or selective orientation) or process images (e.g., indexing, profiling) that reveal “special categories of data”.
MINERVA 92 SRL does not intend to use the surveillance system on an ad hoc basis, i.e., temporary, circumstantial.
Any activity of disclosing personal data to third parties will be documented and subjected to a rigorous analysis regarding, on the one hand, the necessity of the communication, and on the other hand, the compatibility between the purpose of the communication and the purpose for which this data was initially collected for processing (security and access control), but only after being approved by the General Director.
MINERVA 92 SRL has the obligation to make available to judicial bodies, upon their written request, video recordings in which the commission of criminal acts is captured, but only after obtaining approval from the General Director.
The video surveillance system is not used for checking attendance or evaluating work performance.
In exceptional cases, but respecting the guarantees described above, access may be granted to the disciplinary investigation committee, as part of a disciplinary investigation, provided that the information helps investigate an offense or disciplinary violation likely to prejudice a person’s rights and freedoms.
All staff members with access rights to video recordings benefit from initial training in data protection. Training is provided to each new staff member, with periodic data protection workshops organised at least once every two years for all staff members with data access rights.
Any security breach regarding the video surveillance subsystem is indicated in the GDPR Incident Register and the General Director is informed about this without unjustified delay, within 12 hours at the latest.

7. Description and technical specifications of the system

Conventionally, the video surveillance system is a static system. Its function is to record images and is equipped with motion sensors. The system can record any motion detected by cameras installed in the monitored area, along with date, time and location.
All cameras are operational 24 hours a day, 7 days a week.
When necessary, image quality allows recognition of those passing through the cameras’ action zone. For greater security of data processing that may result from video surveillance, the cameras are fixed (without zoom function), so the user cannot modify the surveillance perimeter/purpose. The system is used by Minerva 92 SRL only for surveillance. The system is maintained by Danirom Security, which provides service for the surveillance system, without having the right to operate the system.

8. Benefits of the surveillance system:
   – increased control over the monitored perimeter, entrances and exits;
   – elimination of losses caused by unforeseen events;
   – compliance with applicable regulations and legislation for high-risk objectives.
9. Installation, administration, operation of the system
   The equipment is installed so that only those spaces identified in the risk analysis as needing additional protection are under surveillance. Video system users are instructed not to monitor other areas.
   Images captured by the video surveillance system are viewed in real time only on the computer monitor in the information storage room.
   Unauthorised access to the video system is not permitted.
   Access is strictly limited to system administrators and management of Minerva 92 SRL.
   On a case-by-case basis, access to the video system may also be granted to other persons, besides those mentioned above, only with the approval of the General Director or his/her substitute. These persons will not have access to personal data processed in the video surveillance activity.
10. Disclosure of personal data collected through the video surveillance system
    Information recorded by video surveillance systems is intended for use by MINERVA 92 SRL for the purpose of monitoring access of persons to the institution, ensuring the security of the institution’s premises and assets, as well as the safety of persons within the institution’s premises and is made available to judicial bodies and other institutions authorised by law to request this information, upon their express request.
    However, the system may constitute a means of investigation or obtaining information for internal inquiries or disciplinary procedures, including in situations where a physical security incident occurs or criminal behaviour is observed (in exceptional circumstances images may be transferred to investigative bodies as part of a disciplinary or criminal investigation).
    Any activity of transferring and disclosing personal data to third parties will be documented and subjected to a rigorous evaluation regarding the necessity of the communication and the compatibility between the purpose of the communication and the purpose for which this data was initially collected for processing (security and access control), and will be done with the approval of the General Director.
    Any disclosure situation will be recorded by the system administrator in the Disclosure Case Register.

Images recorded through the video surveillance system installed on the Hotel Minerva premises may be made available to judicial bodies, upon their express request.

11. Storage duration
    The storage duration of data obtained through the video surveillance system is proportionate to the purpose for which the data is processed, so that images are stored for a period not exceeding 30 days, except for situations expressly regulated by law or well-justified cases.
    Upon expiry of the storage period, the data is deleted by automatic procedure in the order in which it was recorded.
    In the event of a security incident, as well as in well-justified cases, the retention period of the relevant filmed material may exceed normal limits depending on the time necessary for further investigation of the security incident.
    Retention is rigorously documented, and the necessity of retention is periodically reviewed (at two-month intervals), and will be done with the approval of the General Director.
    If the storage duration exceeds the 30-day term, this will be recorded in the Register of recordings exceeding the storage duration, managed by the system administrator.
    The company director will be consulted before purchasing or installing any new video protection system.
12. Rights of the data subject
    MINERVA 92 SRL guarantees that it ensures respect for the rights of data subjects, in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
    All persons involved in video surveillance activity and those responsible for administering the filmed images will respect the procedure for accessing personal data.
    Information of data subjects is carried out clearly and permanently by means of an appropriate sign, a representative pictogram, with sufficient visibility and located in the monitored area, so as to signal the presence of surveillance cameras.
    In accordance with the provisions of Regulation (EU) 2016/679, the data subject has the following rights regarding the processing of video images:
    – the right of access
    – the right to erasure of data (“right to be forgotten”)

If the data subject has other questions regarding the processing by MINERVA 92 SRL of their personal data, they may contact the Data Protection Officer at dpo@minerva.ro.
The response to the access, intervention or objection request is given within a maximum of 30 calendar days. This period may be extended by one month when necessary, considering the complexity and number of requests.
The data subject will be informed of any such extension within 15 days of receiving the request, also presenting the reasons for the delay.
If the data subject submits a request in electronic format, the information will be provided in electronic format where possible, unless the data subject requests a different format.
The applicant may specify in the request whether they wish the information to be communicated to a specific address, which may also be an email address, or through a courier service that ensures delivery only to them personally.
If the request is submitted through a representative, their identification data as well as the power of attorney granted for this purpose must be provided.
If requests from a data subject are manifestly unfounded or excessive, particularly due to their repetitive nature, MINERVA 92 SRL may
– either charge a reasonable fee considering the administrative costs for providing the information or communication or taking the requested action;
– or refuse to act on the request.
If it has reasonable doubts regarding the identity of the natural person submitting the request seeking to exercise one of the mentioned rights, MINERVA 92 SRL may request the provision of additional information necessary to confirm the data subject’s identity.
If there is an express request from the data subject, the right to view the recorded images concerning them may be granted or a copy of them may be sent. The images provided will be clear, as far as possible, provided that the rights of third parties are not prejudiced (the data subject will be able to view only their own image, images of other persons that may appear in the recording will be edited so that their recognition/identification is not possible). In the event of such a request, the data subject is obliged to identify themselves beyond any suspicion (present identity document when attending the viewing), state the date, time, location and circumstances in which they were recorded by the surveillance cameras.
Also, the data subject will present a recent photograph so that designated users can more easily identify them in the filmed images. The person will be able to view only their own image, images of other persons that may appear in the recording will be edited so that their recognition/identification is not possible.
There is a possibility of refusing the right of access in situations where the exceptions provided by law apply. The need to restrict access may also be imposed if there is an obligation to protect the rights and freedoms of third parties, for example if other persons appear in the images and there is no possibility of obtaining their consent or the irrelevant personal data cannot be extracted by editing the images.
To exercise the rights mentioned above, the data subject must submit a written, dated and signed request to the address:
MINERVA 92 SRL
2-4 Gheorghe Manu, Sector 1, Bucharest, Postal Code 010445
Or by email: dpo@minerva.ro