Personal data protection

In various online and/or physical forms of Sava Turizem you have the possibility to choose from one or several types of consent for using your data for the purpose of direct marketing:

1.   Consent (6/I (a) of the General Data Protection Regulation in conjunction with Article 226/2 and 226/6 of ZEKom-2) for general informing about news and special offers by Sava Turizem (by mail, e-mail, SMS, MMS or push notifications)

In this case we process and use merely the data you provided us within the framework of consent for the purpose of informing.

2.   Consent (6/I (a) of the General Data Protection Regulation in conjunction with Article 226/2 and 226/6 of ZEKom-2) for adjusted informing about offers by Sava Turizem regarding your previously used services, consumer behaviour, or expressed interests

Thus, by further processing your personal data, we evaluate personal aspects, such as predicting your interests, behaviour, and personal taste (segmentation and/or profiling) and that way shape an adjusted offer which meets your wants, expressed interest, and personal profile as much as possible.

If you do not write down any date on the form, the date of receipt of your consent at Sava Turizem or the date of entry of the consent into the IT system of Sava Turizem is deemed valid.

Regardless of statements, connected with explicit consent, your personal data, obtained in the framework of legal activities (first name, address of permanent or temporary residence) can also be used in accordance with the General Data Protection Regulation (6/I (f)), e-mail address in accordance with Article 226/2 of ZEKom-2, for the purposes of offering (similar) products and services that you used at Sava Turizem d.d. or expressed active interest in them (e.g. sent a demand). By that we can only use your electronic address after we offer you clear and explicit possibility to reject, simply and without any charges, such use of your electronic address at the time we had obtained it from you.

If you want to cancel your consent or receiving of our marketing messages, you may do so by completing a special form, which is available at all our reception desks and on the website (here) and submit it in one of the specified manners. You may at any time “unsubscribe” from receiving messages through the communication medium, to which you received certain commercial message. Link to unsubscribing or information on how to unsubscribe is stated in each message from Sava Turizem. Your change of consent or selected channels of communication will be recorded in our system in 15 days’ time and we will start to enforce it immediately or in 15 days’ time after the receipt at the latest.

If we do not receive your completely filled in form of consent, it will be deemed that you did not give consent for the purpose of such marketing. Consent is given for the purposes described in the consent and is valid until cancelled. When you partially or completely cancel your consent, Sava Turizem d.d. will no longer use your data for the purposes you provided cancellation, with the withdrawal of the consent shall not affect the legality of the processing until the withdrawal.

In exceptional cases, the hotel will store a guest’s information in order to protect its own legitimate interests and the legitimate interests of the companies in the group, prevent damage to property, and protect its employees and other guests. To determine such cases, the following criteria are used:
guests who failed to pay the bill before departure,
guests who damaged hotel property,
guests who were aggressive towards other guests and the hotel staff.

In the event of non-payment, information on this is logged with the guest’s data in our central booking system, enabling us to claim payment upon their next visit and refuse to provide accommodation if the payment is not made. The data may be provided to other companies in the Sava Turizem d.d. group. The data will also be sent to the court of competent jurisdiction and to the police.
The data will be stored until the payment is made. In the event of aggressive behaviour and other incidents, the data will be stored for up to 3 years, or until the end of the relevant offence proceedings or criminal proceedings.

We want to deserve and keep your trust; therefore we handle your data with the highest possible level of care. Your personal data is generally processed only by our employees, who are committed to confidentiality and receive regular education and training for safe data handling.

In some cases your data is processed by our outsourcers in our name and in accordance with our instructions. We always conclude an appropriate contract about data processing with our outsourcers, by which we commit them to the same or higher level of security of your data. Outsourcers do not process your personal data for their own purposes. We always choose outsourcers inside the European Union (EU). Whenever personal data processing is not carried out by an operator inside the EU, we provide adequate protective measures.

In particular, outsourcers carry out the following services for us:

postal services and providing e-communication tools; 
providing online services and other IT services for our undisturbed operation (website hosting, providers of professional hotel information systems, online advertising agencies, etc.);
professional data analysis in order to better understand wishes and needs of our customers and guests and to adapt our services and offers in accordance with that.
Your personal data is generally not submitted to anyone, unless the law demands or if you give us explicit consent or if you authorise a third person to whom we submit your data.

Due to legal obligation some data about your overnight stays is submitted to AJPES and on the basis of reasoned written demand also to other state bodies, which demand this from us for the purpose of conducting certain procedures.

We do not transfer your personal data to third countries except to the Marketo tool, which processes personal data in the United States. Marketo Inc., a tool provider, has concluded the contract under GDPR with Sava Tourism. The transfer to Marketo is otherwise implemented in encrypted form and based on standard contractual clauses.

Sava Turizem d.d. stores your personal data and protects it in such manner to prevent any unauthorised disclosures of data to unauthorised persons. Personal data is stored for as long as it is necessary to achieve an individual purpose, for which it was collected and processed. Storage time depends on the basis for which the data was processed and for the purpose of processing data.

Most of your personal data, collected with the purpose of using our services or products, is stored for the period of the duration of business relationship, with an additional period for exercising legal claims regarding the business relationship (usually a period of 5 years - the general limitation period under the Obligations Code). Whenever your data is stated on the issued invoice, it is stored for 10 years from issuing the invoice due to tax regulations.

Your data, which is to be kept in accordance with the Residence Registration Act for one year from the end of the last day of the year of withdrawal.

In case you gave us explicit consent for data processing, your personal data is stored for the period for which you gave your consent or until your withdrawal of consent.

In the cases of legal interest, personal data is immediately anonymised where possible. When this is not possible, your personal data is deleted as soon as the legitimate purpose expires (5/I (e) of the General Data Protection Regulation).

The video surveillance recordings are stored for up to one year.

Your personal data is exceptionally processed for a longer period of time if applicable regulations of the Republic of Slovenia demand so.

We adopted adequate technical and organisational measures for protection of your personal data and their protection against unauthorised or illegal use or processing and against incidental use, destruction or damage of your personal data, including:
the principle of the smallest range of data and processing on anonymised basis whenever possible;
training of our employees about the importance of confidentiality and preserving privacy and safety of your data;
commitment to accepting adequate disciplinary measures for the enforcement of the liability of employees for privacy;
continuous and comprehensive updating and testing of our security technology;
careful and responsible choice of our contractual processors;
use of safe servers for storing your personal data;
appointment of an authorised person for personal data protection;
demand for identification of each individual who demands access to personal data and check for the justification of the request.

Warning: transferring information (including personal data) through the internet is not always completely safe. If you send us your personal data or other information through internet (via e-mail, our website or in any other way), you do so at your own responsibility. We cannot be deemed responsible for any costs, expenditures, loss of profit, damaged reputation, responsibility or any other type of loss or damage that you have incurred due to sending your data through the internet.

You may do a lot for security of your own personal data by:

Using only protected wireless connections;
Regularly updating software and antivirus protection of your telecommunication devices (computer, tablet, smart phone);
Using effective passwords, which are regularly changed and not shared with anyone;
Following development of informational technologies and methods of online social engineering;
Complying with advice for the safe use of internet.

Regarding your personal data, Sava Turizem provides the following:

the right to introduction to your own personal data: you may get to know all your personal data that was collected in relation to you and its processing, you may also check the legality;
the right to correct or to supplement personal data: without delay we will correct the inaccurate personal data about you;
the right to delete personal data: without hesitation we will delete your personal data related to you in range, which is allowed by the applicable legislation (the data, which we need to carry out the contract you concluded with us and data, which we need to carry out our legal obligations, will not be able to be deleted despite your request);
the right to restrict personal data: you may demand that we limit the processing of your personal data (whenever you dispute the accurateness of your personal data, whenever processing is illegal and in cases Sava Turizem no longer needs your data for processing, but you need it for exercising, carrying out or defending your legal claims);
the right of transferability: if you request so, we may send you our personal data, which you submitted to Sava Turizem, i.e. in CSV format or other structured, generally used and machine readable form or forward it to another operator that you may choose yourself (only in case the latter is technically workable) – you may exercise this right only in the cases where you have provided us your personal data with personal consent or through a contract;
the right to object: whenever you object processing of your personal data or whenever it is carried out for fulfilling legal interests of Sava Turizem d.d. or the third party. You may at any time object to processing your personal data if it is processed for the purpose of direct marketing, including creating profiles if this is connected with such direct marketing.
Every time you exercise any of your rights, you must send us your name and adequate information, which enable us to undoubtedly recognise you in relation to exercising the right (e.g. if you requested us to send you information about your stay with us, we will send you this information (if we still have it) to your home address or e-mail which you provided us during your stay. If you want to receive data to any other address, we will ask you to identify yourself with a personal identity document).

The rights concerning your personal data may only be exercised by you personally, whereas another person may do so in your name only on the basis of your written authorisation.

The request for realisation of individual right may be filed with a completed form, which is available at all reception desks at Sava Hotels & Resorts destinations and on the website here. Your claim will be processed at Sava Turizem and you will receive our answer without unnecessary delay or in one month’s time at the latest. 

More information and help in exercising the stated rights can be found at the Personal Data Protection hyperlink.  In case of questions about personal data protection at Sava Turizem you may also contact our authorised person for personal data protection at Sava Turizem.

If you think that Sava Turizem did not adequately address your request, you may file a complaint in 15 days’ time from receiving the answer. You have the right to file a complaint at the supervisory authority, i.e. the Information Commissioner for the area of the Republic of Slovenia, whose contact data is available here.

For additional information about your rights regarding your personal data, including certain restrictions that apply for some of these rights, we recommend reading Articles 12 – 23 of the EU General Data Protection Regulation (the so-called GDPR), which is available here.

Sava Turizem d.d. appointed authorised person for protection of personal data, whom you may contact about all questions related to your own personal data and exercising your rights on the basis of General Data Protection Regulation. 

Requests related to your rights in the area of personal data protection, complaints, or questions from this area can be submitt

to our address: Sava Turizem d.d., Dunajska cesta 152, 1000 Ljubljana;
to our electronic address: dpo@sava.si;
personally at the hotel reception desks;
to our telephone number: +386 4 206 51 38.

This information about personal data processing will be regularly updated. In case of major changes that affect the legal grounds for processing your personal data, we will inform you about the changes, whereas your personal data will still be used only in case your personal consent for such purpose will not be necessary in accordance with the applicable legislation of the Republic of Slovenia.

In order to make your data precise and up to date, we kindly ask you to inform us about any changes of the latter.

For everything that is not determined by this General Information or by the contract, concluded by Sava Turizem and an individual, the provisions of the applicable law in the Republic of Slovenia apply.