The right to privacy is one of the most important human rights. At Thermana dd, we are aware of the importance of handling personal data, so we handle your data in accordance with the current legislation in the field of personal data protection.

The transparency of our operations and our relationship with you are very important to our company, which is why below we provide you with all the relevant information that enables you to be informed about the protection of your personal data.

The following policy combines key information on the protection of personal data at Thermana dd. Which of your personal data do we collect and why do we process it, to whom do we pass it on, what are your rights related to personal data and how can you exercise them.

Date of entry into force of the information on the protection of personal data: 25. 5. 2018

Last change: 1. 8. 2024

The manager of your personal data is the company Thermana dd, Zdraviliška cesta 6, 3270, Laško, tax number SI 98372157, registration number 1185462, e-mail address: info@thermana.si.

AUTHORIZED PERSON FOR DATA PROTECTION

In Thermana dd, we have an appointed Data Protection Officer (DPO) pursuant to Article 37 of the General Data Protection Regulation, who is appropriately and timely involved in all matters relating to the protection of personal data and advises us on our obligations regarding the processing of personal data, monitors compliance with applicable regulations, cooperates with the supervisory authority if necessary, and also acts as a contact point for individuals regarding the processing of personal data.

For all questions and assistance in asserting your rights in the field of personal data protection, the authorized personal data protection officer is available at the e-mail address: op.pooblascenec@thermana.si.

HOW WE OBTAIN YOUR PERSONAL DATA

We obtain your personal data in the process of legal business, namely when you provide it to us yourself, use or order one of our services, when you fill in any input forms, when you contact us directly by e-mail, telephone, in writing or via social media networks, or you provide us with personal data in any other way.

We also collect information about your use of our website with cookies and similar technologies. More information about how we use these technologies to collect information about you can be found at HERE.

We also carry out video surveillance in the areas of our company's facilities. Notices about the existence of the video surveillance system are posted before you enter each individual video surveillance area. The notices indicate where you can obtain additional information about the implementation of video surveillance at each location. You can find out more about video surveillance HERE.

WHAT TYPES OF YOUR DATA DO WE COLLECT AND FOR WHAT PURPOSE

For Thermana Club loyalty program members

For membership in the Thermana Club loyalty program, we will need your first and last name, residential address (street, house number, postal code, city, country), e-mail address, mobile number and gender. We need access data for your application and valid membership in the program. You can find all information about the Thermana Club loyalty program HERE.

By signing up for the Thermana Club loyalty program, you agree to the processing of your personal data for marketing purposes and for the purpose of studying data on your purchasing habits.

We will use your e-mail address to inform you about current offers and news. Based on your current and past purchasing habits, we will also inform you about customized offers. We may use information about your date of birth and gender to send you personalized offers, e.g. on special holidays (Women's Day, etc.) or for birthdays. You have the option to refuse the use of your data for these purposes at any time.

Legal basis for processing personal data: Execution of the membership contract in connection with Article 6/I(b) of the General Regulation, personal consent, in connection with Article 6/I(a) of the General Regulation (sending notifications with current offers and news, which is regulated by the Electronic Communications Act (ZEKom-2)) and applicable national legislation in the field of personal data protection. We store access data for as long as is strictly necessary to achieve the purpose of membership in the club. After termination of membership, the data is deleted, except for those that we have to store longer due to legal requirements. For all purposes that go beyond the basic implementation of membership, we process your data only on the basis of your explicit, separate and voluntary consent. The retention period is until the consent is revoked.

Users or categories of users of personal data: Website maintainers, providers of marketing tools, marketing agencies and external contractors of the controller. Users process personal data on behalf of the controller and exclusively according to the instructions and under the control of the controller.

Information on transfers of personal data to a third country or international organization: As part of the loyalty program, data is not transferred to a third country. For messages sent by e-mail, we use the WebPower online platform, which is based in the EU. The company provides protective measures for the security of personal data, approved by the European Commission (the so-called Privacy Shield). WebPower's privacy policy is available on the website: https://email.webpower.hr/lp/informacija-o-obradi-osobnih-podataka_02_11_2023

Retention period: Until consent is revoked.

General terms and conditions of business with the thermana club card – Thermana Laško

The personal data controller (Thermana, dd) does not share personal data about the cardholder and data about purchases made with any other contractual partners, third parties or external providers, except when explicitly required by law or with the consent of the individual for a specific purpose. All personal data is processed exclusively by Thermana, dd, in the EU, and is not shared with other entities for marketing, analysis or database management purposes.

STORAGE TIME
We store member data for as long as is strictly necessary to achieve the participation in the club for which it was processed. It is then deleted. If there is a company and/or tax obligation to retain the data, it is deleted after 5 years, unless otherwise provided by regulations.

Accommodation reservation and online order of gift vouchers

When you submit an inquiry on our website (via the online form or via email), make an online reservation of accommodation, or otherwise contact us regarding a reservation,
We process your name, surname, country of residence and contact information (telephone number, email address), as this information is necessary for the conclusion and performance of the contract.

If you start a booking or purchase process and do not complete it, we may process basic information about the selected service and contact information to send you a two-time reminder to complete the booking or purchase.

To guarantee your arrival at our hotel, we may also request payment card details (type, number, expiry date and CVC code). The card security code (CVC) is not stored.

In the case of booking services related to medical treatment (e.g. based on a decision of the ZZZS or self-paid medical services), we may also process additional identification data (e.g. date of birth, EMŠO or ZZZS number) when this is necessary to make the reservation and further provide the service in accordance with applicable law.

When ordering value and service gift vouchers, in addition to the listed data, we also process the delivery address (street and house number, postal code and city).

We use your contact information to communicate with you regarding your reservation (e.g. sending quotes, confirming your reservation, pre-arrival notifications or informing you of any changes). We may contact you after your stay to obtain feedback on your satisfaction with our services.

If you book your accommodation with us via a third-party website (e.g. Booking.com), we receive your personal data from these providers in accordance with their general terms and conditions. The processing of personal data carried out by these providers within the framework of their services is subject to their privacy policy.

Legal basis for processing personal data: Accommodation contract or the use of services, in connection with Article 6/I(b) of the General Regulation and applicable national legislation in the field of personal data protection.

The processing of personal data for the purpose of booking accommodation, concluding and performing a contract, and communicating in relation to services is based on a contract in accordance with point (b) of the first paragraph of Article 6 of the General Regulation.

The processing of personal data for the purpose of sending a two-time reminder for an unfinished reservation or purchase is based on the legitimate interest of the controller in accordance with point (f) of the first paragraph of Article 6 of the General Regulation.

The processing of personal data for the purpose of obtaining feedback on guest satisfaction is based on the legitimate interest of the controller in accordance with point (f) of the first paragraph of Article 6 of the General Regulation, taking into account that the interests of society do not prevail over the interests of the individual or fundamental rights and freedoms.

Users or categories of users of personal data: Personal data may be processed as contractual users (processors) by website maintainers and hotel information system providers. They process personal data on behalf of the controller and exclusively on its instructions and under its supervision.

Information on transfers of personal data to a third country or international organization: Personal data is not transferred to third countries or international organizations.

Retention period:
We store personal data for the duration of the contractual relationship, to which is added a period of 5 years, during which legal claims related to the business relationship can be asserted (such as the general statute of limitations under the Code of Obligations), and when a longer retention period is necessary or permitted by law, even longer.

We store data related to an unfinished reservation or purchase for a maximum of 30 days, after which it is deleted.

Staying in Thermana dd hotels and using motorhome stops

When registering for a stay at Thermana d.d. hotels and when using motorhome stops, we will ask you to provide us with your first name, last name, date of birth, gender, citizenship and the number and type of identification document. In accordance with the law, we will be able to check the accuracy of the data by looking at your personal document. The collection of this data is legally mandatory due to the daily reporting of guests and overnight stays to the Agency of the Republic of Slovenia for Public Legal Records and Services (AJPES). We are obliged to keep this information in the guest book for one year after the end of the calendar year in which you stayed with us, and we may not delete it even at your request. If you do not wish to provide us with this information, we will not be able to allow you to stay with us.

For the purpose of controlling parking lots and opening gates for entering and exiting the area of marked parking areas, where payment of parking fees has been introduced or parking restrictions, we will ask you for the registration number of your vehicle.

We will need your payment information (this includes your credit card information, if you provide it to us) for insurance, payment arrangements, refunds and handling of potential complaints.

When registering, we may ask you to provide us with your address. We are entitled to this information if we need it in the event that we do not settle all obligations that arose during your stay with us. If you do not wish to provide us with this information, we reserve the right to refuse accommodation.

During your stay, we can monitor when your card or wristband was used to access the room and other areas that are accessible based on identification using the card or wristband. We process this data exclusively for the purpose of ensuring the safety of our guests and staff, and when we specifically warn you about this, also for the purpose of billing for services (e.g. entry to swimming pools, saunas, etc.).

A video surveillance system is installed on the premises of our company. Real-time monitoring of events with continuous recording is absolutely necessary to ensure the safety of people and property (no further processing of recordings is carried out). The video surveillance system is not installed in rooms, toilets, dressing rooms or other similar spaces.

Legal basis for processing personal data: The Residence Registration Act (ZPPreb-1), in conjunction with Article 6/I(c) of the General Regulation (Registration for Accommodation), the Tax Procedure Act (ZDavP-2), in conjunction with Article 6/I(c) of the General Regulation (Issued Invoices), the Contract concluded with an individual, in conjunction with Article 6/I(b) of the General Regulation (For the collection of data on the registration number - The contract is concluded by an individual within the framework of the accommodation contract) and applicable national legislation in the field of personal data protection.
Legitimate interest (Article 6/I(f) of the General Regulation) constitutes the legal basis for the processing of video surveillance data for the purpose of protecting people and property, taking into account that the interests of society do not prevail over the interests of individuals or fundamental rights and freedoms.

Users or categories of users of personal data: Users of personal data are contractual external processors for hotel management. Legally specified personal data on the AJPES web portal are forwarded to competent authorities (police, Statistical Office of the Republic of Slovenia and municipalities). Users process personal data on behalf of the controller and exclusively according to the instructions and under the control of the controller.

Information on transfers of personal data to a third country or international organization: Personal data is not transferred to third countries or international organizations.

Retention period: We store personal data for the duration of the business relationship, to which we add a period of 5 years, during which it is possible to assert legal claims in connection with the business relationship (such as the general limitation period according to the Code of Obligations), when a longer retention period is required or permitted in accordance and with the law even longer. When personal data is listed on an accounting document (issued invoices), it is kept for 10 years from the date of issue due to tax regulations.

Videos of people for the purpose of ensuring the safety of people and property are kept for a maximum of one year.

Use of medical (Medicine Center) or wellness services (Wellness Spa Center, Health and Well-Being Center)

In order to be able to provide the health and holistic treatments and services we provide with the highest possible degree of professionalism, we need to have enough information about your health condition, habits and lifestyle. This includes data that we obtain from you in the context of the use of services and treatment by our professional staff and that are part of the treatment and rehabilitation procedures of patients referred to spa treatment (based on the decision of the ZZZS), outpatient physiotherapy (based on the work order of the ZZZS), specialist diagnostics (on the basis of a referral from the ZZZS), or at your own request (implementation of diagnostic, therapeutic, preventive, curative and holistic measures that are adapted to the needs and condition of patients and visitors).

To ensure the quality and safe care you have chosen, we will only ask you for the medical data we need. We will treat this data as a special type of personal data and accordingly keep it with a higher level of protection. Access to this data will only be granted to persons subject to a legal obligation to protect professional secrecy. We will use them exclusively for the needs of your treatment or therapy. Unfortunately, we cannot provide medical care or treatment without this data.

We also need data on the execution of treatment and services performed for the purpose of analysis and improvement of our services (from e.g. elimination of waiting for medical services to services at the highest level, as well as to prevent possible unwanted consequences of treatment).

A video surveillance system is installed on the premises of our company. Real-time monitoring of events with continuous recording is absolutely necessary to ensure the safety of people and property (no further processing of recordings is carried out). The video surveillance system is not installed in rooms, toilets, dressing rooms or other similar spaces.

Legal basis for processing personal data: Fulfillment of legal obligations for the purposes of fulfilling obligations to insurance companies, medical institutions, competent authorities and other stakeholders in connection with Article 6/1(c) and Article 9/1(h) of the General Regulation (primarily the Health Activities Act (ZZDej), The Act on Patient Rights (ZPacP), the Act on Databases in the Field of Health Care (ZZPPZ) and other (secondary) laws relating to treatment), the Tax Procedure Act (ZDavP-2) in connection with Article 6/1(c) of the General Regulation (Invoices Issued) and applicable national legislation in the field of personal data protection.

Legitimate interest (Article 6/I(f) of the General Regulation) represents the legal basis for data processing for the purpose of improving the offer and optimizing services and implementing video surveillance with the aim of protecting people and property, taking into account that the interests of the company do not prevail over the interests of the individual or fundamental rights and freedoms.

Users or categories of users of personal data: Users of personal data are providers of health information system tools and wellness system providers.
Through the health information system, the data is transferred to the CRPP system, where it is also accessible to the personal physician and other health service providers, the units for reimbursement of treatment and rehabilitation costs of ZZZS, and insurance companies that provide various forms of premium insurance, if this is unavoidably necessary for health care . Users process personal data on behalf of the controller and exclusively according to the instructions and under the control of the controller.
Upon request, individual data can also be forwarded to other authorities and organizations and natural persons (e.g. relatives), if the obligation to forward data is stipulated by law or if the individual specifically consents to this.

Information on transfers of personal data to a third country or international organization: Personal data is not transferred to third countries or international organizations.

Retention period: Medical documentation (the basis of which is a medical record with a list of diseases) is kept permanently or in accordance with the law, 20 years after the death of the patient (if this is known), other medical documentation is kept for 15 years in accordance with regulations in the field of healthcare.

Due to tax regulations, accounting documents (issued invoices) are kept for 10 years from the date of issue.
Videos of people for the purpose of ensuring the safety of people and property are kept for a maximum of one year.

For visitors to our website

When you enter www.thermana.si, our servers record your IP address. An IP address (Internet Protocol address) is the identification of your device that is connected to the Internet, or it is a number that your computer has every time you browse the Internet. This address allows data to be routed correctly between your device and servers on the Internet. We do not associate the IP address with other information about you, i.e. we do not know your identity and your e-mail address, unless you provide us with this information yourself.

Information about how you use the website, which pages you viewed, the time you viewed them, what you clicked... is very important to us, as we want to constantly improve your user experience and only in this way can we provide you with a suitable experience . We collect and analyze this information using cookies. You can find more information about cookies HERE.

If you are logged into the user account of another provider (e.g. Google account, Facebook account, Booking.com account, etc.) while browsing our websites, these providers can monitor your behavior on our websites in accordance with their terms and selected settings in your account with this provider. We suggest that you contact the individual provider for more information.

For residents of the Home for the Elderly and their relatives

The provision of personal data is a legal and contractual obligation and is the basis for the provision of institutional care services for the residents of the Laško Elderly Home and residents in the serviced apartments of the Laško Elderly Home. If you do not provide us with the data we need for the implementation of institutional protection (with the exception of personal data for which the consent of the individual is required), the signing of the contract and its implementation will not be possible.

We will use the obtained personal data:

– to implement contractual obligations towards the residents of the home and their relatives, to implement health, social, rehabilitation, cultural, educational and other activities aimed at improving the quality of life of the residents,
– to fulfill legal and contractual obligations to residents, relatives, insurance companies, healthcare institutions, competent authorities and other stakeholders,
– keeping records and statistics on the residents of the home and their health status (determining the health status of the residents, their needs for medical care and assistance from another person, etc.),
– protecting the health, safety and property of residents, employees and visitors.

A video surveillance system is installed in the area of the Home for the Elderly. Real-time monitoring of events with continuous recording is absolutely necessary to ensure the safety of people and property (no further processing of recordings is carried out). The video surveillance system is not installed in rooms, toilets, dressing rooms or other similar spaces.

Legal basis for processing personal data: Execution of the contract based on the fulfillment of the legal obligation in connection with Article 6/1(b) and 6/1(c) of the General Regulation (Healthcare Activity Act (ZZDEj), Health Care Data Collections Act (ZZPPZ), Act on social care (ZSV)), provision of medical or social care based on the law of the Republic of Slovenia in connection with Article 9/1(h) of the General Regulation and applicable national legislation in the field of personal data protection.
The legal basis for issued invoices is the Tax Procedure Act (ZDavP-2), in conjunction with Article 6/I(c) of the General Regulation.

Based on the performance of tasks in the public interest, or in the exercise of public authority assigned to the manager to ensure the safety and protection of persons and property, we process personal data for the purpose of video surveillance to ensure the safety and protection of persons and property in connection with Article 6/1(e) of the General regulations.

Users or categories of users of personal data: Users of personal data are providers of health information system tools, external providers of used services, who process personal data on behalf of the controller and exclusively according to the instructions and under the control of the controller. The data is forwarded to authorized relatives, but may also be forwarded to other authorities and organizations upon request, if the obligation to forward data is stipulated by law or if the individual specifically consents to this.

Information on transfers of personal data to a third country or international organization: Personal data is not transferred to third countries or international organizations.

Retention period: Personal data is kept in accordance with the law for 20 years after the death of the patient (if known), medical documentation is kept for 15 years in accordance with regulations in the field of healthcare.
Due to tax regulations, accounting documents (issued invoices) are kept for 10 years from the date of issue.
Videos of people for the purpose of ensuring the safety of people and property are kept for a maximum of one year.

Extraordinary cases

There are also exceptional cases of guest data processing, namely:

Unwanted guests
Data of guests (name, surname, country, date of birth) marked as undesirable for various reasons, such as guests who did not settle the bill upon departure, were aggressive towards other guests and hotel staff, destroyed property companies.

We process data to protect our own legitimate interest (Article 6/I(f) of the General Regulation) to prevent property damage and to ensure the safety of other guests and staff and to fulfill potential legal obligations.

We keep the data for the duration of the intended purpose, while we regularly check whether the storage of the data is still justified. If it is determined that there is no longer a need for retention, we delete such data from our records.

Organization of events where the participants do not stay in our accommodation
When organizing events where the participants do not stay in our accommodation (weddings, dances, etc.), we process personal data for the purpose of organizing and implementing this event. From personal data, we need the name, surname, contact information (phone number, e-mail) of the participants, and in the case of contact via regular mail, also the address.

We keep the data as long as it is necessary to fulfill a legitimate interest (Article 6/I(f) of the General Regulation), after which it is deleted from the records. If personal data is found on an issued invoice (accounting documents), it is kept for 10 years from the date of issue due to tax regulations.

AUTOMATED DECISION MAKING

For some purposes of personal data processing, we use automated decision-making, including profiling. Automated decision-making means that computer algorithms are used based on the analysis of the individual's personal data (such as gender, age, nationality, date and duration of stay, room type, payment method, booking history, loyalty club membership, purchases in our online store, etc.). The importance and intended consequences of such processing for you are the receipt of more personal and efficient services that meet your expectations and needs, as well as access to better offers and discounts.

TECHNICAL AND ORGANIZATIONAL MEASURES FOR DATA SECURITY

The protection of collected personal data includes organizational, technical and logistic-technical procedures and measures with which we protect your personal data, prevents accidental or intentional unauthorized destruction of data, their change or loss, and unauthorized processing.

When processing, we follow the principle of minimum data volume and processing on an anonymized basis whenever possible. We train our employees on the importance of confidentiality and maintaining the privacy and security of your data, and we carefully and responsibly select our contract processors.

Regarding security, we implement the following measures, among others:

premises security,
protection of media containing personal data,
security of hardware and software,
constant and comprehensive updating and testing of our security technology,
using secure servers to store your personal data.

You can do a lot yourself to ensure the security of your personal data by:

you use only secured wireless connections,
you regularly update the software and antivirus protection of your telecommunications devices (computer, tablet, smartphone),
you use effective access passwords, change them regularly and do not share them with anyone,
follow the development of information technologies and online social engineering methods,
you follow the tips for safe use of the Internet.

Warning: the transmission of information (including personal data) over the Internet is not always completely secure. If you provide us with your personal data or other information over the Internet (by e-mail, through our website or in any other way), you do so at your own risk. We cannot be responsible for any costs, expenses, loss of profits, damage to reputation, liability or any other form of loss or damage suffered by you as a result of your transmission of data over the Internet.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA AND HOW YOU CAN EXERCISE THEM

To ensure fair and transparent processing of personal data, we guarantee you the following rights in relation to the processing of your personal data:

familiarization or access to your personal data,
correction of incomplete or inaccurate data,
deletion ("forgetting") of data when there is no reason for their further processing, to the extent permitted by applicable legislation,
restriction of processing when you dispute the accuracy of personal data, when the processing is illegal and instead of deleting personal data you request a restriction of their use, and in cases where Thermana dd no longer needs your data for processing, but you need it to assert, implement or defend your legal rights claims,
objection to processing when there are reasons related to the individual's situation,
portability of data in a structured electronic form to another operator.

Depending on the legal basis of personal data processing, you can exercise the following rights:

where the legal basis is a contract: right of access, rectification, restriction of processing and portability,
where the legal basis is the law: the right to access, correction and restriction of processing,
where the legal basis is consent: right of access, rectification, restriction of processing, erasure, right to object and right to portability.

In accordance with the provisions of Article 23 of the General Regulation, these rights may be limited if this is necessary for the protection of important interests, such as national security, defense, public safety, prevention of criminal acts, protection of the rights and freedoms of other persons, etc.

When we process your data based on consent you also have the right to cancel it permanently or temporarily at any time, without this affecting the legality of the data processing that was carried out on the basis of consent until its cancellation.

When exercising and exercising your rights and questions related to your personal data, you can contact the authorized person for personal data protection. You can submit a request to exercise an individual right by completing and signing the form available at HERE. The request for the processing of your rights must be made in a way that allows your identification. We would like to emphasize that the rights related to your personal data can only be exercised by you personally, and another person on your behalf only on the basis of your written authorization.

We will treat each request received individually in accordance with the provisions of the General Regulation, as the exercise of rights depends on the legal basis on which we process personal data, and we will respond to you without undue delay or within one month at the latest.

In addition to the above, you also have the right to file a complaint with the supervisory authority. You can also submit a complaint to the Information Commissioner (address: Dunajska 22, 1000 Ljubljana, e-mail: gp.ip@ip-rs.si, phone: (01)230 9730, website: www.ip-rs.si).

For further information about your rights in relation to your personal data, including certain limitations that apply to some of these rights, we recommend reading Articles 12 to 23 of the General Data Protection Regulation (EU) (the GDPR).

Privacy policy