Privacy policy

SUBJECT, PURPOSE and SCOPE

Kranevo Apartments is a provider of tourist services and as such is the administrator of personal data. The company processes personal data independently or by assigning a data processor, ensuring compliance with the requirements of the Personal Data Protection Act (PDPA), the applicable European legislation (Regulation 2016/679 of the European Parliament and of the Council and related documents), the by-laws normative acts regarding the protection of personal data, the regulatory framework in the field of the tourism industry and the created internal regulatory framework for working with personal data.

This Policy for the protection of personal data of Kranevo (the Policy) defines the main principles and rules related to the processing of personal data, the rights of data subjects, the obligations and responsibilities of Kranevo, as a data controller, and of its employees, respectively, as operators of data, the functions of the personal data protection official and the personal data registers maintained by Kranevo.

The policy is part of a comprehensive system of internal documents, technical and organizational measures that Kranevo implements in order to ensure that its employees, consultants and all other natural and legal persons who, through assignment, process personal data on behalf of Kranevo, will strictly comply with the requirements of applicable European and national legislation and internal rules, thereby guaranteeing the right of natural persons to the protection of their personal data.
The principle of personal data protection is one of the principles of ethical and business behavior to which Kranevo adheres. This principle is adopted in the company’s Code of Ethics, adopted by the Decision of the Board of Directors, objectified in protocol No. 14 of 18.10.2020. Compliance with the principle of personal data protection is the duty and responsibility of every employee and is shared by all structural units and hierarchical levels in Kranevo. This policy develops this principle into specific rules and aims to support employees in their daily work with personal data, so as to avoid its violation.

The violation of the security of personal data can lead to a high risk for the rights of the affected natural persons and have significant negative consequences, both for Kranevo and its shareholders, and for its employees who violated the requirements of the applicable internal and external regulations. Therefore, any non-compliance with this Policy is treated as a serious violation and action that damages the prestige of Kranevo and undermines its trust.

Personal data processed by KRANEVO APARTMENTS:

1. Personal data provided by data subjects

Kranevo processes personal data provided by the data subject through an application, contract, or through another document at the initiative of the person, for the purpose of performing an activity requested by the data subject, or in connection with the exercise of rights.

2. Personal data not provided by data subjects

In the cases provided for by law and when this is related to legal obligations of Kranevo, in its capacity as a subject of civil and commercial legislation, it processes personal data of persons that it receives from the relevant competent state authorities or from other companies.

3. Personal data, depending on the type of data (special categories of personal data)

Kranevo does not process special categories of personal data, with the exception of:

• data on the state of health of its employees, in connection with the fulfillment of legal requirements, in their appointment, for the purposes of occupational medicine and health and safety at work, in connection with the exercise of their rights in case of temporary incapacity for work and in connection with the exercise of the rights them with permanently reduced working capacity;
• data on the health status of users of tourist services, provided by them in fulfillment of contractual requirements for the exercise of rights, preferences and interests.