Antis Estates LTD is the company that operates the Azia Resort and Spa hereafter we, Antis Estates LTD respects your privacy and is committed to protecting your personal data. The following Policy explains how we collect and process your personal data. This Policy includes when you, or someone on your behalf, makes a booking, fill in our Registration form on arrival, requests information from us, contacts us (or we contact you), uses our website/apps, links from our website/apps, connects with us via social media, works with us, or any other engagement we have with you (regardless of where you are based). It also tells you about your privacy rights and how the law protects you. This Policy is in accordance to the provisions of the Cyprus Processing of Personal Data Law 125(Ι) of 2018 (the “law”) and the General Data Protection Regulation EU 679/2016 (“GDPR”).
AIM OF THE INFORMATION AND WHO WE ARE
This Policy aims to give you information on how we collect and process your personal data in our dealings with you, including in providing accommodation and other services to you, including any data you may provide through our website, including by cookies and in other cases of having a legal relationship with you (employee, supplier third party etc). This general privacy notice may be supplemented by other special notices (and is not intended to override them), we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data.
The Antis Estates LTD operating the Azia Resort and Spa in which you stay or receive our services and the present web site is the controller for the data processing of such accommodation service or other services’ receipt.
CONTACT DETAILS AND RIGHT TO COMPLAIN
Address: Leoforos Chlorakas 131,8220 Chloraka Paphos. Telephone: 26-845100. Fax: 26-845200, e-mail: email@example.com
You have the right to make a complaint at any time to the data protection authority supervising us, the Cyprus Data Protection Authority (Iasonos 1, 1082 Nicosia, phone: +357 22818456, fax: +357 22304565, email: firstname.lastname@example.org). We would, however, appreciate the chance to deal with your concerns before you approach the Authority so please contact us or use the above mentioned contact details in the first instance.
THE DATA WE COLLECT ABOUT YOU
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped for practical reasons as follows:
We will not collect all the data referred to above in each case, but only such data required for the specific “Legal Ground”.
In the normal course, we will only collect Special Categories of Personal Data about you (this includes information about your health needs and disabilities to the extent that it is volunteered by you or on your behalf and is needed to cater to your requirements during your stay with us or other use of our facilities or services. We may also, however, need to process such information in the event of an accident or a medical or other emergency during your stay or your other use of our facilities.
We obtain limited information about children who are booked in to stay at our hotel (number, age, and were legally required other data such as name, date of birth, passport number).
HOW WE USE YOUR PERSONAL DATA
We will only use your personal data according the law and GDPR. Most commonly, we will use your personal data in the following circumstances (each one is a "Legal Ground"):
We do not undertake automated decision making using your personal data.
IF YOU FAIL TO PROVIDE PERSONAL DATA
Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with accommodation or our other services). In this case, we may have to cancel a booking or other service you have with us but we will notify you if this is the case at the time.
DISCLOSURES OF YOUR PERSONAL DATA
We may have to share your personal data per case with the categories of parties set out below:
Where these third parties are our processors, we require them to respect the security of your personal data and to treat it in accordance with the law and GDPR. We do not allow our third-party processors to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Some of the third parties mentioned above, for example many professional advisers and authorities, are controllers who, like us, are subject to specific obligations under data protection law and GDPR, and who will have their own privacy notices setting out how they deal with personal data.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. Processors we appoint will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including the purposes of satisfying any legal, accounting, or reporting requirements. In many cases your personal data are encrypted.
YOUR LEGAL RIGHTS
You have the right to:
If you wish to exercise any of the rights set out above, please contact us in a proven (in writing or electronically) form. We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to enable us to deal with your request or to speed up our response. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or we have received a number of requests. In this case, we will notify you and keep you updated.
Note: It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.