DATA PROTECTION

 

CONFIDENTIALITY AND PERSONAL DATA PROTECTION POLICY

OF THERME NORD BUCHAREST

1. Introduction

The confidentiality of your personal data represents one of the main concerns of Therme Nord Bucharest in its capacity as data controller. This is why we want to be fully transparent in respect of the processing of personal data, by providing you with all the information you need in connection with this topic.

According to the requirements of General Data Protection Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as further amended, Therme Nord Bucharest, having its registered office in Romania, Sibiu County, 2 Alexandru Vlahuță Street, having a working point in Balotești, 1K Calea Bucharest Street, Ilfov County, has an obligation to manage the personal data provided by you or collected by us in relation to your person safely and solely for the specified purposes.

This document is intended to inform you on the processing of your personal data in the context of the use of the internet website www.therme.ro (and of the related pages, such as shop.therme.ro), and in relation to your visits to Therme Bucharest.

2. Categories of processed personal data

2.1. If you are a client of Therme Bucharest who uses any of its websites that allow for the purchase of online tickets (meaning who uses the shop.therme.ro or b2b.therme.ro platforms) (referred to as this ”Website”), Therme Nord Bucharest will process your personal data, such as your family and first name, phone number, e-mail address, invoicing address, delivery address, data referring to the manner in which you use the website, e.g., your behavior/preferences/habits in Therme Nord Bucharest, as well as any other data categories provided by you directly in the context of creation of a user accounts, placement of orders through the website or in any way resulting from the use of the website.

2.2 For the use of My Therme application, at the time of the account creation, Therme Nord Bucharest will process personal data provided by you, such as: family and first name, e-mail address, phone number and birth date.

2.3 If you are only a visitor of any of the therme.ro websites (meaning that you have not purchased anything from the website but you only visit it), Therme Nord Bucharest will process your personal data provided by you directly in the context of the website use, such as data provided by you under the contact/questions/complaints section, to the extent that you contact us this way, and for the relevant purposes.

2.4 For the Newsletter, the personal data provided by you and processed by us under various information campaigns will strictly refer to the e-mail address and, sometimes, to your family and first name used in tailoring the message.

2.5 At the time of your visit at our Resort, the data collected by us or provided by you in various situations in which you accept to fill in various forms may be:

  • Identification and contact information (first and family name, sex, address, personal identification number (CNP) , birth date, information included in the identity card/passport, phone number, e-mail address, physical address etc.) depending on the various forms and situations;
  • Bank details (in cases where you purchase items through bank cards);
  • Details of the financial transactions performed with THERME;
  • Data referring to your health condition in punctual situations when you request for medical assistance from our first aid point; as well as medical data provided for appointments for massage or similar services.
  • Data concerning your preferences/interests;
  • Physical identification and access data, IP, e-mail address, other online identifiers, or details about your car;
  • Pictures and video recordings.
  • Other information provided by you by filling in various printed forms.

THERME generally creates profiles automatically, based on data of its clients, through various online Therme applications, in order to assess the behavior of its clients and to be able to develop the best services. For this purpose, THERME collects information about the device through which you access its online platforms (computer, tablet, mobile phone number), such as the operating system, browser version, IP address, etc. This information is used for the purpose of managing the security of the online platforms and for potential statistics related to the performance of the online platforms. IP addresses may be used to identify any potential technical or security issues at the THERME servers, to monitor the traffic and use of the online platforms, and may not be used by THERME directly for the identification of a particular person, and helps us in improving the services provided by the online platforms.

2.6 Video surveillance

Please be advised that the premises of Therme Nord Bucharest, as well as the access ways and the parking spaces are equipped with a video surveillance system, which allows for the collection of your image, and for its processing. Recordings are kept for 20 days.

Areas in which there is a high level of expectation related to private life, such as toilets and similar locations, are not subject to monitoring.

3. Processing purposes and legal bases

3.1 If you are a client or visitor of the Website, Therme Nord Bucharest processes your personal data for the following purposes, based on the legal bases explained below: 

  • to perform the contractual relations between you and Therme Nord Bucharest, i.e. to take over, validate, deliver and invoice your orders placed on the Website, and to inform you on the order, organize the return of ordered products etc.
  • to create and administer accounts on the My Therme, Magazin online, and Platforma B2B platforms;

Legal basis: The processing of your data for these purposes is based on the contract concluded between you and Therme Nord Bucharest. The providing of your personal data is necessary for the performance of this contract. The refusal to provide your data may result in an impossibility to perform the contractual relations between you and Therme Nord Bucharest.

  • to fulfill the legal obligations incumbent on Therme Nord Bucharest in the context of services provided through the Website, including the obligations in the taxa area, as well as those related to archiving.

Legal basis: The processing of your data for this purpose is required based on some legal obligations. The refusal to provide your data may result in an inability of Therme Nord Bucharest to comply with the legal obligations incumbent on it and, therefore, in an inability for it to offer you services through the Website.

  • for marketing activities, i.e. for the transmission of marketing communications concerning Campaigns conducted by Therme Nord Bucharest through remote communication means (e-mail).

Legal basis: The processing of your data for this purpose is based on your consent, if you choose to give it. Marketing communications will not be transmitted without your prior consent.

You can give your consent to the processing of data for this purpose by ticking the corresponding box at the time of creating your online account, or after the account creation, under the „newsletter” section. If you want to unsubscribe from receiving such communications, you can use the option at the end of each e-mail message containing commercial communications.

Your consent can be also given directly, in writing, at the facilities of Therme Bucharest, at the time of filling in specific forms.

The providing of your data for this purpose is voluntary. The refusal to give your consent to the processing of your data for this purpose will not have negative effects for you.

  • for the purpose of preparing various analyses, reports on the operation of the Website, or profiling of consumer preferences intended mainly to improve the experience offered on the website.

Legal basis: The processing of your data for this purpose is based on the legitimate interest of Therme Nord Bucharest to permanently improve its clients’ experience on the Website. The providing of your data for this purpose is voluntary. The refusal to provide data for this purpose will not have negative effects for you.

  • for the settlement of complaints and for monitoring the traffic and improving your experience offered on the Website.

Legal basis: The processing of your data for this purpose is based on the legitimate interest of Therme Nord Bucharest to secure the clients’ satisfaction, the proper operation of the Website, and to constantly improve the experience of the Website visitors, including by the settlement of various comments, enquiries or complaints.

The providing of your data for this purpose is voluntary. The refusal to provide data for this purpose will not have negative effects for you.

3.2 At the time when you visit our Resort, as well as in other situations, your identification data will be collected for the following purposes:

  • to provide medical assistance at the first aid point and benefit from massage services.

Legal basis: The processing of the personal data, including medical data, for this purpose is based on your consent. Yet, in the event that your life or health is threatened, Therme may process your personal data for the purpose of removing such threat (this being both your and Therme Nord Bucharest’s legitimate interest).

  • to secure compliance with the General Contractual Conditions- the Internal Regulation and that concerning the use of pools of Therme Bucharest Nord;

Legal basis: The processing of your personal data for this purpose is based on your consent given at the time when purchase the ticket. Yet, the Regulation observance represents also a legitimate interest of Therme Bucharest.

  • conducting the internal and legal proceedings applicable in case of incidents/accidents;
  • monitoring of THERME’s data network;
  • settlement of suggestions and complaints filed in printed format at the time of visits;
  • management, control, reporting and preparation of statistics related to THERME’s activity;
  • implementation of contracts with suppliers, including with insurance suppliers, and maintaining the commercial relations with them;
  • access to European funds and to other funding sources;

Legal basis: The processing of your data for the purposes mentioned above is based on the legitimate interest of Therme Nord Bucharest to secure the proper operation of the Website, and proper safety and comfort during visits, and to permanently improve the experience of visitors, including by the settlement of various comments, enquiries or complaints. 

  • securing safety and health by video monitoring and through the existence of a guard and protection system.

Legal basis: The processing of your data for this purpose is based on a legal obligation and your consent expressed at the time when you buy the ticket.

  • use of pictures and video recordings in various marketing materials, on the online platforms held by THERME or on the Social Media – the purpose is to inform our clients on the opportunities offered by Therme;

Legal basis: The processing of your data for these purposes is based on your consent, if you choose to give it.

  • use of the information collected via the Facebook chat for the purpose of awarding prizes following participation in various Campaigns or for the settlement of suggestions and complaints transmitted by you this way.

Legal basis: The processing of your data for this purpose is based on your consent, if you choose to give it.

  • implementation of contracts with suppliers, including with insurance suppliers, and maintaining the commercial relations with them;

Legal basis: The data processing for this purpose is based both on the contract between the supplier and Therme Nord Bucharest and on the legal obligation to request for and keep specific accounting documents.

  • other situations in which you gave your consent to various processing activities performed by Therme Nord Bucharest;
  • Legal basis: The processing of your data for this purpose is based on your consent, if you choose to give it.

4. The period while data are processed

In principle, Therme Nord Bucharest will process your personal data as long as this is necessary for the attainment of the processing purposes mentioned above.

If you are a client, we will process your data during the entire term of our contractual relations and afterwards, according to the legal obligations incumbent on Therme Nord Bucharest (e.g., in case of financial and accounting supporting documents, in respect of which the term for keeping them set forth by law is of 10 years after the date when the financial year while they were prepared ends). In any case, when a legal provision imposes a minimum retention period, THERME will keep your personal data for such mandatory period.

If you are a client and express your wish to have your user account for any of the therme.ro platforms (including My Therme, B2B) deleted, we would like to inform you that the deletion of your account will not automatically result in the deletion of your personal data. If you want the deletion of your data, you can make use of your rights detailed under point 7, by contacting us at the e-mail address dataprotection@therme.ro. In the event that you request for your account deletion, but that account still has at least one active order, the account deletion application can be registered only after the delivery of the products and the completion of the last active order.

If you withdraw your consent to data processing for marketing purposes by clicking the unsubscribe button of the content of information and marketing e-mail messages, Therme Nord Bucharest will cease to process your personal data for this purpose, without affecting however any processing operation performed on the basis of your consent expressed by you prior to the withdrawal of your consent.

 5. Disclosure of personal data

For the attainment of processing purposes, Therme may disclose your data to its partners, to third persons or entities supporting Therme Bucharest in carrying out its activities through the Website (for instance, courier companies, IT service providers), or to the central/local public authorities in the following indicative situations listed below:

  • for the Website administration;
  • in situations where such disclosure is necessary for the award of prizes or other facilities to data subjects obtained as a result of their participation in various promotional campaigns organized by Therme through the Website;
  • to maintain, personalize and improve the Website and the services provided through it;
  • to conduct data analysis, to test, investigate and monitor the use and activity trends, and to develop safety features and the login of users;
  • to transmit marketing commercial communications under the terms and within the limits set by law, always based on your consent;
  • when the disclosure of personal data is required by law etc.

 

6. Your rights

Under the terms of the legislation concerning the processing of personal data, in your capacity as data subject, you benefit from the following rights:

  • right to information, i.e. a right to receive details on the processing activities carried out by Therme Nord Bucharest, as described in this document;
  • right of data access, i.e. a right to obtain confirmations from Therme Nord Bucharest on the processing of your personal data, as well as details on processing activities, such as the manner in which data is processed, the purposes for which data is processed, the recipients or categories of recipients of data etc.;
  • right to rectification,e. a right to obtain the correction by Therme Nord Bucharest, without unjustified delays, of inaccurate/unjustified personal data, as well as the supplementing of incomplete data; such rectification/supplementing will be communicated to each recipient to which the data was transmitted, except for situations where this proves to be impossible or requires disproportionate efforts.
  • right to data erasure, with no unjustified delays, („right to be forgotten”), in cases where one of the following reasons applies: 
  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • you withdraw your consent, and there is no other legal ground for the processing;
  • the data subject objects to the processing, and there are no overriding legitimate grounds for the processing;
  • the personal data have been unlawfully processed;
  • the personal data have to be erased for compliance with a legal obligation;
  • the personal data have been collected in relation to the offer of information society service sunder the Union or Member State law to which the controller is subject.

Therme Nord Bucharest, following a data erasure request, may anonymize such data (thus depriving them of their personal character) and may continue the processing under these terms for statistical purposes;

  • right to restriction of processing, to the extent that:
    • the accuracy of the personal data is contested by the data subject, for a period enabling us to verify the accuracy of the personal data;
    • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
    • the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; or
    • the data subject has objected to other than for direct marketing purposes pending the verification whether the legitimate grounds of the controller override those of the data subject.
  • right to data portability, i.e. (i) right to receive the personal data in a structured, commonly used and machine-readable format, and (ii) the right to have such data transmitted by Therme Nord Bucharest to another data controller, to the extent that the requirements set by law are met;
  • right to object – in respect of processing activities, this right can be used by transmitting a request as described below;
    • at any time, on grounds related to his or her particular situation, to the processing of personal data concerning him or her carried out based on the legitimate interest of Therme Nord Bucharest or based on a public interest, except for cases where Therme Nord Bucharest demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims;
    • at any time, free of charge and with no justification, to the processing of data concerning him or her for direct marketing purposes.
  • right not to be subject to a decision based solely on automated processing, i.e. a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her;
  • right to address the National Authority for Personal Data Processing Supervision or the courts of jurisdiction, to the extent that you find this necessary, directly on the Authority’s website dataprotection.ro.

 7. Contact

THERME will provide you free of charge with information on the processing of your personal data based on a request, with no unjustified delays, within maximum 30 calendar days as from the date of such request registration. Depending on the complexity of the requested information, such term may be extended by 60 days, and you will be informed on the reasons underlying such extension of the initial term. In case of requests received in an electronic format, the information will be provided also in an electronic format, except for situations where you request for the information in a different format (a printed one). In cases where you request for repetitive, excessive or unfounded information, THERME may refuse to provide the information.

If you want to make use of any of your rights related to the processing of personal data by THERME, to obtain further information or clarifications on the processing of your personal data, please contact THERME, through its Data Protection Officer in charge of securing THERME’s compliance with the requirements set forth by GDPR.

This official can be contacted at the following e-mail address: dataprotection@therme.ro

The website www.therme.ro uses cookies. For further information related to the use of such cookies, please access the following link: http://www.therme.ro/ro/politici-cookie/.