PRIVACY POLICY

THIS WEBSITE (“WEBSITE”) IS PROVIDED BY MATIS-ZETAGRADNJA DOO, SERBIA, HEREINAFTER “MATIS-ZETAGRADNJA” OR “WE”.

We comply with data protection laws and regulations such as the EU General Data Protection Regulation and the Law on Personal Data Protection of the Republic of Serbia, which regulate the processing of personal data relating to you and which give you various rights pertaining to your personal data. 
The purpose of this Privacy Policy is to inform you about how we will use your personal data you provide to us through this website, in relation to hotel reservations, your stay in Matis-Zetagradnja hotels, as well as personal data provided and/or collected through us via other channels. 
We also inform you about your rights under the applicable Data Protection Act pertaining to handling of your personal data. Before submitting your personal data to us, we strongly recommend that you read this Privacy Policy, which is also an integral part of our Terms and Conditions governing our hotel services.

I. WHAT IS PERSONAL DATA?

For the purpose of this Privacy Policy, “personal data” means any information you provided during your interaction with us, e.g. through our website or during telephone calls, or information collected about you when using our website, enabling your personal identification, whether directly (e.g. your name), or indirectly, as the data relates to identification such as your name, identification number, location data, network identification (e.g. telephone number) as an individual. We may also collect personal data about you in other events related to your stay at the Matis-Zetagradnja hotel.

II. WHEN AND FOR WHAT REASON ARE CERTAIN TYPES OF DATA STORED AND PROCESSED?

1. WEBSITE USE

Data about you is collected and processed when navigating our website. We collect the following data:

• Information pertaining to the browser or device you use to access our website
• IP address
• Country from which you are visiting the website
• Browsing habits, including web pages visited
• Age
• Marital status and
• Other demographic and statistical data

Data is collected using session cookies (see description below regarding cookies) that we use on our website. They are anonymized before being used to create anonymous user profiles for marketing purposes and to optimize our websites and the services we provide. This data will not be used to personally identify visitors of this Website.

2. INTERACTION WITH US

Each time you interact with us (e.g. when booking a room through our website, telephone or a third-party provider, posting a comment on our blog, signing up for our newsletter), we may collect and process personal data you provide to us.

a. Room reservation
When booking a room, we collect personal data that includes:
• Your chosen hotel
• Your chosen dates
• Number of rooms booked
• Number of persons for the relevant booking (adults and children)
• Children’s age
• Chosen price range/special offer
• Any selected additional package
• Your full name
• Your address, including the city and state
• Your e-mail address and
• Your credit card details
Optional data
• Data on frequent travellers
• Arrival data
• Room, type of bed and/or other preferences
• Telephone/mobile phone number

We use this personal data to manage your booking and to establish and fulfil our agreement with you. This includes verifying your identity, taking guarantees and/or payment information, and sending you promotional materials and/or information regarding your stay.
We take the protection of your personal data very seriously, and for that reason we have reduced mandatory fields to a bare minimum.

b. Newsletter and special offers

If you provide us with your contact details (e.g. when booking our services or when signing up for our newsletter via our website), we can use this personal data to send you our newsletter and details of other special offers that could be of interest to you, based on your previous interactions with us (e.g. booking).
If you sign up for our newsletter via our website, you only need to provide your email address. Any additional information is voluntary and will be used exclusively for personalizing the newsletter. By entering your email address, you agree to receive our newsletter. You can revoke your consent and opt out of receiving the newsletter at any time by clicking the unsubscribe link included in each newsletter. Furthermore, you can also opt out on your personal profile under the “Data Protection” tab. Please contact the person specified at the end of this document for any further questions.
We also include web beacons in newsletters formatted in HTML which we send via e-mail to evaluate the number of accesses to newsletters (or certain articles, links, etc.) and our website to determine how many users have visited these pages.

c. How does the “Contact Us” option work

You can get in touch with us through our website using the “Contact us” option or by telephone. You must provide the following information in order to contact us:
• Your name
• Your e-mail
Any additional information (e.g. home address) is provided voluntarily.
We use your data to respond to your inquiry.

3. PROCESSING OF PERSONAL DATA TO PERSONALIZE YOUR STAY AT THE HOTEL

We can collect and process your personal data if such data is relevant to your stay at the hotel or if it that is in your interest.
Collection of personal data without your express consent
Without your express consent or instructions, we do not undertake any additional investigations and do not record or use such information. In such events, personal data we collect is limited to information we obtained from you personally or from hotel staff during your stay at the hotel and information relevant to your stay at the hotel (e.g. preferences in terms of rooms, beds, food and wine if you consume them at the hotel). In this event, we do not undertake any additional investigations about you, and we especially do not conduct any investigations on social media or the Internet.

III. SHARING OF PERSONAL DATA

Your personal data may be shared:

• Within Matis-Zetagradnja and our hotels, in order to establish and fulfil our contractual obligations with you, or to the extent that you have agreed to such data sharing, for instance. This includes verifying your identity, making payments, contacting you and communicating with you.
• With our commercial partners should you book an event or activity organized by such commercial partners.
• With our third-party service providers who process your data on our behalf. Service providers, i.e. third-party providers, providers of data analysis services, IT services and other similar services requested by Matis-Zetagradnja to provide services on the website and other business-related services. Any data processing on our behalf is in accordance with applicable laws.
We will not transfer your personal data to any third-party recipients unless you consent to such data transfer or unless such transfer is permitted under the applicable law.

IV. TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY

Should the information be transferred outside of Serbia, we will ensure that appropriate safeguards are applied in terms of relevant data protection regulations.

V. SOCIAL MEDIA ICONS

We use the following social media add-ons on our website: Facebook, Google+, Twitter, LinkedIn, Instagram. Add-ons can be identified by social media icons with the logo of the respective social media provider.
We implemented these add-ons using the so-called 2-click solution. This means that when navigating our website, your personal data will initially not be collected by the providers of these social media add-ons. If you click on any of the add-ons, your personal data will be transferred: by activating the add-on, the data is automatically transferred to a respective data provider and stored by such data provider (your personal data will be stored in the USA when dealing with American providers). We have no impact on the collected data and data processing operations carried out by the providers, nor are we aware of the full scope of data collection, purpose or retention period.
Information on the purpose and scope of data collection and processing by the add-on providers can be found in the respective data protection policies of these providers, where you will also find additional information on your rights and privacy protection options.

VI. COOKIES

We use cookies on our website. Cookies are tiny text files that a web server sends to your browser and they are stored locally on your computer. A cookie allows the server to uniquely identify the browser on each page. Cookies do not cause any damage to your computer and they do not contain viruses.
We use the following categories of cookies on our website:
Category 1: Strictly necessary cookies
These cookies are necessary to enable navigation on the website and use of its features. Without these cookies, the services you requested, e.g. remembering login data or booking data, cannot be rendered.
Category 2: Performance cookies
These cookies collect information about how people use our website. For instance, we use Google Analytics cookies to better understand how users come to our website, to search or use the website and to highlight areas where we can improve segments such as navigation, booking and marketing campaigns experience. The data stored by these cookies never shows any personal data from which your personal identity can be determined.
Category 3: Functional cookies
These cookies remember the choices you made, such as the country from which you are visiting our website, language and search parameters, e.g. number of guests, hotel, time of stay. They can then be used to provide you with an experience that is more suitable for your selection and make visits more customized and enjoyable.
The current versions of web browsers offer improved user controls in terms of storage and duration of first- and third-party cookies. Search for “cookies” in the “Help” menu of your web browser for more details on the available cookie management features. You can enable or disable cookies by modifying the settings in your browser. However, should you decide to disable cookies in your browser, you may not be able to complete certain activities on our websites or properly access certain parts thereof.

VII. GOOGLE ANALYTICS

Our website uses Google Analytics, which is a web analysis service provided by a third-party provider, Google, Inc. (“Google”). Google Analytics is used to evaluate your use of the website, compile a report on website activity and other services related to website activity and Internet use. The information generated by the cookie about your use of the website is usually sent and stored by Google on servers in the United States. This transfer is covered by Google’s privacy policy certificate.

VIII. WHAT SECURITY MEASURES DO WE APPLY TO COMPLY WITH DATA PROTECTION OBLIGATIONS?

We strive to maintain appropriate security standards and we have introduced strong technical and organizational measures to protect your personal data in line with the state-of-the-art technologies, especially to protect data from loss, falsification or access by unauthorized third parties. When transferring particularly sensitive information over the Internet, e.g. credit card details, we exclusively use encrypted transmission routes. However, the transmission of information over the Internet is not completely secure. Therefore, although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website. Each data transmission is at your own risk. After we have received your personal data, we will use strict procedures and security functions to prevent unauthorized access. Our internal processing takes place within a VPN set up as a firewall against open Internet, within which any type of communication is processed in an encrypted manner. As regards third parties (i.e. companies-external associates) that provide data processing services to us, we have obliged them in accordance with our data privacy regulations. External providers are supervised by our data protection manager in terms of compliance with these regulations.

IX. YOUR RIGHTS

Regarding the collection and use of your personal data, you can:
• withdraw your consent at any time, e.g. by unsubscribing from the newsletter under the “Data Protection” option,
• ask us whether we are processing personal data about you, for what purposes, which category of personal data the processing refers to, which categories of recipients the information is disclosed to, where possible, the expected period in which the personal data will be stored (or, if not possible, criteria used for determining such period),
• ask us about appropriate safeguards relating to the transfer to a third party, request a copy of personal data being processed and request that we receive your personal data in a structured, customary and machine-readable format and to forward that data to another controller without any obstacles on our side. We guarantee that no unauthorized person will have access to your profile or reservations,
• rectify incorrect data,
• file an objection against further processing and request deletion of your data,
• request that Matis-Zetagradnja restrict the processing of your personal data,
• request not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects for you or has a similar material effect on you.
Should you have any additional questions regarding your personal data stored by us or wish to exercise your rights, please contact our data protection manager using the contact details provided below.

X. RETENTION AND DELETION OF PERSONAL DATA

We will retain your personal data only for a limited period of time necessary to fulfil the said processing procedures. Your personal data will be deleted afterwards. If we process your personal data based on your consent, we will store your personal data for a limited period of time necessary to fulfil the purposes of its processing.
Once we conclude a contract with you, we undertake to store your data during the contractual relationship you have with us, and to the extent permitted, after the expiry of that relationship for as long as is necessary to carry out the purposes set out in this notice. Criteria for determining the retention period are legal and contractual requirements, nature of our relationship with you, nature of the data in question and technical conditions. We may be required by law to retain certain information within certain periods.
Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a shorter period of time afterwards (so that you enable us to implement your requests). We also keep a record of the fact that you have asked us not to send you any material by direct marketing or to process your data so as to fully comply with your request in the future.
In other events, we may retain data during a certain period after terminating any relationship with you, in order to protect ourselves from legal claims or manage our business operations.

XI. UPDATES

This Privacy Policy may be updated periodically.

XII. WHO IS THE CONTACT PERSON FOR DATA PROTECTION MATTERS?

Please contact our data protection manager Nevena Lepović at office@m-zg.rs.