Personal data protection

At Terme Dobrna d.d., we respect your privacy and take care of the security of your personal data. We are committed to protecting data and ensuring security and confidentiality, in accordance with laws and regulations, as well as internal general acts of the company’s operations governing the field of personal data protection.

The company’s Privacy Policy and Cookie Policy inform you about the processing of your personal data.

Validity of information on the processing of personal data from 30.11.2020 onwards.

Privacy Policy

Within the privacy policy, all key information about the protection of personal data in the company Terme Dobrna d.d. is provided on the current page, covering the collection, storage, purpose, and processing of personal data collected by the controller from users, your rights, and the method of exercising them.

Personal data controller

The controller of your personal data is the company Terme Dobrna d.d., Dobrna 50, 3204 Dobrna, registration number: 5053587000, tax number SI 94639272, e-mail: info@terme-dobrna.si.

Obtaining your personal data

We obtain your personal data in the course of lawful business, namely: when you identify yourself when using our services (reservations, contractual, marketing, analytical, payment, and legally harmonised activities related to the provision of the core activity), when you contact us by e-mail, telephone, in writing, or via social networks, when you fill out any input forms, order our services, when you use our website and its functions, or communicate with us in any other way, and thus provide us with personal data.

We also collect data about your use of our website using cookies and similar technologies. More information on how we use these technologies to collect information about you can be found in the COOKIE POLICY.

Categories of your data that we use and the purpose of use

The use and processing of your data take place only within the framework of the legal basis, legitimate interest, and consent statement for a specific purpose of collection, as stated below.

The legal basis for the processing of the above-mentioned categories of personal data is specified according to the purpose of processing in the Notice to individuals pursuant to Articles 13 and 14 of the General Data Protection Regulation for guests/patients of Terme Dobrna d.d.

Categories of personal data that we obtain and process based on the grounds described above and their purpose of use:

Category of personal data Purpose	Purpose
First name, last name, and contact details (address, e-mail, telephone)	Reservations, contractual, marketing, analytical, payment, and legally harmonised activities related to the provision of the core activity; sending mail, e-mails, personalized offers.
Information about your date of birth	Registration of temporary residence in case of stay; verification of age/majority.
Sex, nationality, type and number of identification document	Registration of temporary residence in case of stay; sex data is used for the purpose of sending personalized offers (based on consent).
Payment data	Arrangement of payments and refunds
Data about your reservations, stays, and purchases	Execution of services, resolving complaints, sending personalised offers.
Health data	Management of treatment and rehabilitation of patients in spa and outpatient treatment and for the purpose of monitoring the quality and safety of healthcare
Data obtained in the context of prize draws or promotional activities	Execution of such activities
Data obtained for the purpose of direct marketing (pers. for communication)	For the purpose of direct marketing, based on explicit consent and for the purpose of direct marketing, based on legitimate interests, with a clear possibility of objection under Article 21 of the General Regulation.

Data provided on the basis of consent

When we ask you as an individual for consent for the processing of personal data for which we do not demonstrate another legal basis, we process your personal data exclusively on the basis of your valid consent for an explicitly defined purpose and on the basis of the notification channel chosen by you:

• residential address and e-mail address – e-notification (for the purposes of information and communication, marketing; data is obtained when the guest checks in at the reception);
• mobile number – SMS messaging (for the purposes of information and communication, marketing; data is obtained when the guest checks in at the reception or when submitting consent for SMS reporting on our website) The field is determined by the Slovenian laws ZVOP-2 and ZEKom-2;
• photographs, videos, and other content relating to an individual (e.g., publishing images of individuals on the website for the purposes of documenting activities and informing the public about the company’s work and events);
• other purposes for which the individual agrees by consent.

If an individual gives consent for the processing of personal data, and at some point no longer wishes allowing it, they can request the termination of the processing of personal data with a request or immediate cancellation: by e-mail or by regular mail to the address of Terme Dobrna d.d., or by direct cancellation with each notification, according to the channel through which they received the notification.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. After receiving the withdrawal or request for deletion, the data is deleted within 15 days at the latest. The company may also delete this data before withdrawal when the purpose of processing personal data has been achieved or if so provided by law.

The legal basis for data processing is consent. Data will be processed until revocation or until the withdrawal of consent – cancellation or until the purpose of processing is fulfilled. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Retention

We keep your data for the duration of the business relationship or for the purposes stated in this privacy policy, and for longer in cases where a longer retention period would be necessary or permitted in accordance with the law.

Personal data obtained on the basis of legitimate interest is kept for the duration of the business relationship or purpose, to which we add a period for the possible assertion and defense against legal claims of 5 years (as is the general limitation period under the Code of Obligations). When personal data is stated on an accounting document, it is kept for 10 years from issuance due to tax regulations.

Data obtained with consent is kept until the withdrawal of consent or until the expiration of the purpose, after which the collections or personal data (of the individual) are immediately, effectively, and permanently deleted.

Data obtained on the basis of the Residence Registration Act (upon guest check-in) is kept for one year from the last day of the year of check-out or 5 years in the case of legal claims (during this time the data is not active and not in use).

Medical documentation is kept in accordance with the Healthcare Databases Act and is subject to a special security policy.

We exceptionally process your personal data for longer if required by the applicable regulations in the Republic of Slovenia.

Privacy protection

The company Terme Dobrna d.d. as the processor and controller of your personal data protects it in accordance with the adopted technical and organisational measures to secure your personal data and protect it against unauthorised or unlawful use or processing and against accidental loss or destruction or damage to your personal data.

Forwarding of personal data to third parties

We handle your data carefully and responsibly, as we wish to maintain your trust in the future.

In principle, your personal data is processed only by our professionally trained employees within the scope of their powers. We forward the personal data of guests for external processing only to contractual processors who process the data exclusively within the framework of a concluded contract on the processing of personal data.

Personal data collections are kept in the premises where the activity takes place, i.e. within the EU, and are not exported to third countries.

Data Protection Officer

Terme Dobrna d.d. has an appointed Data Protection Officer who will assist you regarding the handling of personal data and the exercise of your rights.

Requests regarding your rights in the field of personal data protection can be submitted in the most accessible way for you using any notification channel (oral/written, by phone, online, by mail, in person at the reception), namely:

• to our address: TERME DOBRNA D. D., DOBRNA 50, 3204 DOBRNA,
• to our e-mail address: info@terme-dobrna.si
• in person at hotel receptions and to our telephone number +386 3 78 08 110.

Rights of the individual

When exercising your rights and for questions related to your personal data and the exercise of your rights based on the General Data Protection Regulation, the appointed Data Protection Officer at Terme Dobrna d.d. is available to you.

To ensure fair and transparent processing of personal data, the individual whose personal data is being processed may: request access-acquaintance, completion/rectification, blocking or restriction of processing, or deletion of personal data relating to them.

An individual may at any time, permanently or temporarily, in whole or in part, withdraw given consents for the processing of personal data (for one or more specific purposes). This is done in the most accessible way for them, namely it can be done using all notification channels (oral/written, by phone, online, by mail, in person at the reception).

The controller will consider your request and respond to you within 15 days; we would like to point out that rights regarding your personal data can only be exercised by you personally, and by another person on your behalf only on the basis of your written authorisation. The request for the handling of your rights must be submitted in a way that enables your identification.

Information on the rights to lodge a complaint regarding violations of regulations governing personal data protection with the supervisory authority is available to you in the Notice to individuals pursuant to Articles 13 and 14 of the General Data Protection Regulation regarding the processing of personal data of guests/patients of Terme Dobrna d.d.

In accordance with the EU General Data Protection Regulation, your request must be complete and understandable, therefore we have prepared the following forms for you, which can assist you in exercising your rights. Please submit the fully completed and signed form to us for consideration.

• Form 1: Individual’s request for termination of use/deletion of personal data for the purpose of direct marketing
• Form 2: Request for acquaintance with own personal data
• Form 3: Individual’s request
• Notice to individuals pursuant to Articles 13 and 14 of the General Data Protection Regulation regarding the processing of personal data of guests of Terme Dobrna d.d.
• Notice to individuals pursuant to Articles 13 and 14 of the General Data Protection Regulation regarding the processing of personal data of patients of Terme Dobrna d.d.