The best price Book directly and get the guarantee of saving
All reservations made by the website are completely safe
The best offers Only on our website you have access to offers not available on other portals.
PRIVACY POLICY
In all matters related to personal data processing, you can contact the Controller at the above-mentioned address of the registered office or by e-mail: iod@focushotels.pl
The Controller appointed a Data Protection Officer, who can be contacted at the following e-mail address: iod@focushotels.pl or by mail to the Controller’s address indicated above with the note “Data Protection Officer”.
The Controller processes personal data in accordance with the business profile, for the purposes indicated below. If, due to the provisions of law, the properties of the service or the need to settle it, there is a need to process other personal data of data subjects, the Controller will process them to the necessary extent.
Placing an online order / making a reservation by the Website User is associated with the processing of their personal data. Providing data marked as mandatory is required for the purpose of accepting and handling an order / make a reservation, and failure to provide those results in the non-execution of the order.
Personal data are processed for the purpose of executing the placed order / making the reservation – the legal basis for the processing is the necessity of processing before the performance of the agreement (Article 6(1)(b) of GDPR), and in the case of providing data concerning health, the legal basis is the consent (Article 9(2)(a) of GDPR);
The data are processed no longer than until the limitation of claims.
Data processing is necessary for performing the agreement concluded with the customer with regard to providing hotel, catering or other services offered by the Controller.
Personal data are processed:
The data are processed no longer than until the limitation of claims or the expiry of liabilities (in the case of tax liabilities, it will be 5 years, counting from the end of the calendar year in which the tax payment deadline expired, pursuant to Article 70 of the Act of 29 August 1997 Tax Ordinance).
In the event of expressing the consent to receive marketing/commercial information from the Controller by electronic means and/or telephone (including a newsletter or satisfaction survey), Personal Data are processed for the purpose of providing the above-mentioned information.
The legal basis for Personal Data processing is the Controller’s legitimate interest in connection with the consent expressed – Article 6(1)(f) of GDPR in conjunction with Article 10 of the Act on the provision of electronic services or Article 172 of the Telecommunications Law, consisting in building the image and conducting marketing activities, sending special offers, information about new products or services, invitations to participate in promotions. The data are processed for the duration of marketing activities, until the consent to receive commercial information is withdrawn, the data subject effectively lodges an objection or the Controller’s legitimate interest ceases. At any time, the User has the right to withdraw their consent to receive commercial information. This can be done by clicking the appropriate resignation link contained in the marketing message sent or by contacting the Controller directly.
The Controller provides the possibility of contacting it using electronic contact forms, chat, by e-mail, letter or phone. The use of the form requires providing personal data necessary to contact the User and respond to the inquiry. The User may also provide other data to make contact or handling the inquiry easier. Providing data marked as mandatory is required for the purpose of accepting and handling the inquiry and failure to provide them results in the impossibility to respond. Providing other data is voluntary. In the case of sending inquiries to the Controller by phone, e-mail or traditional correspondence, personal data contained in this correspondence are processed for the purpose of communication and solving the matter to which the contact established relates.
The legal basis for personal data processing is the Controller’s legitimate interest – Article 6(1)(f) of GDPR, consisting in ensuring contact with the Controller and providing answers to the questions asked, regardless of the communication channel. The period of data processing depends on the subject of the matter that is the subject of the contact, but not longer than the period of limitation of claims.
Video surveillance is used to ensure the safety of people staying at the Controller’s facilities and to protect property. The use of surveillance as regards personal data processing takes place pursuant to Article 6(1)(c) of GDPR in conjunction with Article 22² § 1 of the Labour Code. In the case of other persons, other than those employed under a contract of employment (i.e. the Controller’s associates and other persons using the Controller’s services or staying at the Controller’s facilities), personal data processing takes place pursuant to Article 6(1)(f) of GDPR, i.e. the Controller’s legitimate interest (such legitimate interests are the purposes of processing, consisting in ensuring the safety of persons and property).
Images from surveillance can be made available to authorised state authorities. Personal data processed by the video surveillance system will be stored for a period not longer than 3 months, unless due to special circumstances, the recordings will constitute evidence in proceedings conducted pursuant to the legislation or the Controller receives information that they may constitute evidence in proceedings, then the storage period of the recording will be extended pending the valid conclusion of such proceedings.
In connection with the business activity pursued, the Controller collects personal data, e.g. during business meetings or through the exchange of business cards for the purposes related to initiating and maintaining business contacts.
Such personal data are processed for the purpose of pursuing the Controller’s and its contractor’s legitimate interest (Article 6(1)(f) of GDPR) consisting in creating a network of contacts in connection with the business activity pursued. The data are processed for the duration of business relations, until the data subject effectively lodges an objection or the Controller’s legitimate interest ceases.
In connection with concluding agreements as part of the business activity pursued, the Controller obtains from contractors/customers the data of persons involved in the performance of such agreements (e.g. data of persons authorised to contact, performing orders, etc.). The scope of the data transferred is in any case limited to the extent necessary for the performance of the agreement and usually does not include information other than the name, surname and business contact details.
Such personal data are processed for the purpose of pursuing the Controller’s and its contractor’s legitimate interest (Article 6(1)(f) of GDPR) consisting in enabling the proper and effective performance of the agreement. The data are processed for the duration of cooperation, and then until the limitation of claims.
Personal data may be processed for the purposes of the current recruitment process, as well as for the purpose of taking part in future recruitments. Candidates’ personal data are processed only for the purpose of conducting the recruitment process, assessing candidates’ qualifications, conducting interviews and selecting a right candidate for a given position. The legal basis for personal data processing to the extent necessary to take steps aimed at concluding a contract is Article 6(1)(b) of GDPR. The data may be processed pursuant to Article 6(1)(c) of GDPR in conjunction with Article 22(1) § 1 of the Labour Code and pursuant to Article 6(1)(a) of GDPR, i.e. the consent of the data subject (in the case of sending an image or other information not required by the Controller or expressing consent to data processing for the purposes of future recruitment). Personal data will be processed until the limitation of claims.
The Controller processes the Users’ Personal Data in connection with implementing legal obligations imposed on it, concerning, among others, keeping accounts and accounting documentation, as well as exercising the rights of data subjects.
Such personal data are processed pursuant to Article 6(1)(c) of GDPR – processing is necessary to comply with a legal obligation incumbent on the Controller until the expiry of those obligations, in accordance with applicable law.
In order to establish, exercise, and defend claims, the Users’ personal data that have been provided by them to the Controller will be processed.
The legal basis for personal data processing is Article 6(1)(f) of GDPR, which allows to process personal data for the purpose of establishing, exercising or defending claims, which is the implementation of the Controller’s legitimate interest. Personal data will be processed up until the moment of limitation of claims.
Personal data of all persons using the Website (including IP address or other identifiers and information collected through cookies or other similar technologies) are processed by the Controller:
The User’s activity on the Website, including their personal data, is processed mainly for purposes related to the provision of services. The Controller also processes them for technical and administrative purposes, for the purpose of ensuring the security of the IT system and managing this system, as well as for analytical and statistical purposes – in this regard, the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of GDPR). The data are processed until the data subject effectively lodges an objection or the Controller’s legitimate interest ceases.
Facebook, Instagram
As part of the Controller’s Facebook or Instagram account, the data processed are the data of persons who:
The Controller processes the following types of personal data:
The Controller processes the above-mentioned personal data based on a legitimate interest (Article 6(1)(f) of GDPR) consisting in: running a fanpage called Focus Hotels in the Facebook social media and focushotels.pl in the Instagram social media, so as to use them to inform about the Controller’s activity, promote events and the brand, products and services, build and maintain a community with the Controller and communicate through the available functionalities of the websites (comments, messages), keep statistics (through the analysis of data on the fanpage users’ activity), establish, exercise or defend claims.
In addition, the Controller indicates that together with Meta Platforms Ireland Limited (hereinafter referred to as “Meta Ireland”), they act as co-controllers with regard to data processing for statistical purposes. You can find more information about data processing for the purposes of website statistics under the link: https://www.facebook.com/legal/terms/information_about_page_insights_data
YouTube
As part of the Controller’s YouTube account, the data processed are the data of persons who:
The Controller processes the following types of personal data:
The Controller processes the above-mentioned personal data based on a legitimate interest (Article 6(1)(f) of GDPR) consisting in: running a fanpage called HoteleFocus in the portal and using it to inform about the Controller’s activity, promote events and the brand, products and services, build and maintain a community with the Controller and communicate through the available functionalities of the YouTube website (publication of videos), keep statistics (through the analysis of data on the viewers’ activity), establish, exercise or defend claims.
In addition, the Controller indicates that together with Google LLC (hereinafter referred to as “Google”), they act as co-controllers with regard to data processing for statistical purposes. You can find more information about data processing for the purposes of website statistics in the Google privacy policy:
https://policies.google.com/privacy?hl=pl#intro
As part of the Controller’s LinkedIn account, the data processed are the data of persons who:
The Controller processes the following types of personal data:
The Controller processes the above-mentioned personal data based on a legitimate interest (Article 6(1)(f) of GDPR) consisting in: running a page/profile called Focus Hotels S.A. in the LinkedIn portal, so as to publish job offers, use the page/profile to inform about the Controller’s activity, promote events and the brand, products and services, build and maintain a community with the Controller and communicate through the available functionalities of the websites (comments, messages), keep statistics (through the analysis of data on the fanpage users’ activity), establish, exercise or defend claims.
In addition, the Controller indicates that together with LinkedIn Ireland Unlimited Company (hereinafter referred to as “LinkedIn Ireland”), they act as co-controllers with regard to data processing for statistical purposes. You can find more information about data processing for the purposes of website statistics under the link: https://pl.linkedin.com/legal/privacy-policy?
We collect cookies on our website. Cookies are small text files stored on the user’s device that are used to collect information about their activity on a website. Cookies are sent by the web server to the User’s browser and stored on their computer. Different types of cookies, such as essential, functional, analytical and advertising, have different purposes and affect the way of using the website. They allow websites to remember the User preferences, such as language, currency or page layout, which improves the user experience. Cookies are also used to analyse user behaviour or adjust the presented contents, which helps catch errors in the website interface or adjust advertising contents. In no way do cookies enable access to data other than cookies stored in the computer’s memory.
What cookies do we use?
“Essential” cookies
We use the so-called essential cookies to enable the use of basic services available on the website. Our use of essential cookies is needed for the proper functioning of the Website, without these cookies the website may not function properly. Their use is required for the provision of telecommunications services (data transmission to display contents) – the User cannot opt out of these cookies if they want to use our website, nor is the User’s consent required to install the essential cookies on their device. Examples of essential cookies include: cookies maintaining a user’s session, or cookies related to privacy settings, which remember the user’s decisions on accepting or rejecting optional cookies and result in the disappearance of the cookie banner when the user selects one of the options.
“Analytical” cookies
We use the so-called analytical cookies so as to improve the quality of services on the Website. Therefore, we and other entities providing analytical and statistical services for our benefit use cookies to store information or gain access to information already stored on the User’s telecommunications end device (computer, phone, tablet, etc.). Cookies used for this purpose include Google Analytics cookies used to analyse the way the website is used by the User, create statistics and reports on the functioning of the website.
Google Analytics cookies are files used by Google to create statistics and reports on the functioning of the Website, so as to analyse the way the Website is used by the User. Detailed information on the scope and principles of data collection in connection with this service may be found at the following link: https://www.google.com/intl/pl/policies/privacy/partners.
“Marketing” cookies
They are used to publish ads adjusted to the User preferences and allow for the display of more relevant ads. A cookie remembers what the user saw on the website and prevents the reappearance of the same ads. They are able to measure the effectiveness of advertising campaigns and monitor the number of clicks. Such information may be made available to other interested parties, such as advertisers.
How to manage the cookie settings?
While visiting our website when you are shown a message about our cookies. You can choose 1 of 3 options regarding cookies, i.e.:
Cookie settings in your browser
Withdrawal of consent to the use of cookies is also possible through the browser settings. Detailed information on this issue may be found at the following links:
In connection with pursuing activity requiring personal data processing, personal data may be disclosed to external entities.
Recipients of personal data entrusted to the Controller by data subjects may be the following entities, to which personal data are transferred to the minimum extent necessary to achieve the purpose(s) for which the data were acquired:
The Controller declares that it does not sell, make available or transfer personal data collected for processing to other persons or institutions, unless it takes place with the express consent or upon request of data subjects, or upon request of state authorities authorised under the Act, for the purposes of their proceedings or activities related to security or defence, for tasks specified by law which are carried out for the public good, when it is necessary to fulfil legal obligations incumbent on the Controller.
The level of protection of personal data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, the Controller transfers personal data outside the EEA only when it is necessary and with an appropriate level of protection, mainly by:
The Controller processes acquired personal data for the period necessary to achieve the purpose(s) for which they were provided. The period of data processing is related to the purposes and grounds for their processing, therefore:
The period of data processing may be extended if their processing is necessary to establish or exercise claims or defend claims, and after this period – only in the case and to the extent required by the legislation. After the expiry of the period of processing, the data are irreversibly deleted or anonymised.
The Controller exercises the rights of data subjects related to processing of their personal data. In particular, each data subject has the right to:
If the basis for personal data processing is the Controller’s legitimate interest, the data subject has the right to object to personal data processing at any time, without the need to justify their decision, particularly in the case where the legitimate interest consists in pursuing activities related to direct marketing.
The consent expressed by data subjects may be withdrawn at any time, without affecting the lawfulness of any data processing carried out prior to its withdrawal.
The Controller informs that there is no obligation to erase data (i.e. to exercise the “right to be forgotten”) if data processing is necessary for:
The above-mentioned rights, as well as the intention to withdraw the consent, may be exercised by sending an appropriate request by e-mail to the e-mail address indicated in point III of the Policy or by post to the address of the Controller’s registered office provided in point I and III of the Policy.
In each case of finding that the rights of a natural person resulting from the legislation and the Policy are violated, Users have the right to lodge a complaint with the Personal Data Protection Office with its registered office in Warsaw at ul. Stawki 2.
Your data may be processed by the Controller in an automated manner, including in the form of profiling. However, decisions concerning an individual related to this processing will not be automated.
To the extent not governed by this Policy, the EU and national legislation on the protection of personal data shall apply.
Date of the last Policy update: 19/06/2024