Data processing

This Information on Data Privacy (Information) applies to ARO-PALACE S.A., its subsidiaries and all hotels within ARO-PALACE (hereinafter referred to as ARO-PALACE, we or us). We do our best to deliver extraordinary products, services and experiences at ARO-PALACE. We are glad that you are our guest and we value your loyalty. We are aware that privacy is an important issue for each guest. We have developed this Information to explain our practices regarding the personal data we collect from you or about you on this site or using our applications/forms, written or oral communication with us when you visit one of our properties or from other sources.

Please note that this Information is not valid for the processing of personal data by us on behalf of third parties and according to their instructions, such as airline companies, car rental companies or other service providers, companies that organize or provide vacation packages, marketing partners or corporate clients.

Collected personal data

We may collect personal data at each meeting or interaction with the guests, as well as within other aspects of our activity. This personal data may include: your identification data; your contact details; information regarding your reservation, stay or visit to a certain property; participation in a program as member or loyalty program; participation in contests, raffles or marketing programs (even if you are not staying at one of our hotels); information relating to the purchase and receipt of products or services; personal characteristics, nationality, passport number and date and place of its issuance; travel history; payment information, such as your credit card number and other card information, as well as authentication information and other billing and account details associated with the mobile billing system; guest preferences; preferences regarding advertising and communications; information about the vehicles you may bring to our properties; reviews and opinions regarding our accommodation facilities (if they are identified or associated with you); and other types of information that you choose to provide to us or that we may obtain about you.

We may ask for details about travellers, including their names. We may also collect information about conversations, including recording or monitoring customer service calls for quality assurance and training, as well as other communications such as in-app messages and SMS.

In addition, we collect other personal data in certain situations, such as:

• Surveys: We may request demographic data or other personal data in guest surveys.
• On-site collection: We collect additional personal data during registration/accommodation at our properties, including information that may be required by law. We may also use video or CCTV cameras and other security measures on our properties that may capture or record images of guests and visitors in public places, as well as information associated with your location while you are on our properties (via access cards and other technologies). We may use CCTV and other audio or video recording technologies for the protection of our staff, guests and visitors to our properties in cases permitted by law.
• Event profiles: If you are planning an event with us, we will collect specifications for the conference or event, event date, number of guests, details about accommodation and information about your organization (name, annual budget and number of sponsored events per year) for corporate events. In addition, we collect information about guests who are part of your group or event. If you visit us in a group, we may have personal data about you that the group has provided to us and send you advertisements following your stay with the group or participation in an event, depending on your preferences and according to the law. If you visit us at an event, we may disclose personal data about you to the event organizers, to the extent permitted by law. If you are an event organizer, we may also disclose information about your event to third-party service providers who may advertise their services to you, to the extent permitted by law.
• Social media: If you access ARO-PALACE pages/accounts using social media, we may collect certain information from your social account depending on the settings of the social media, such as (but not limited to) location, accommodation, activities, interests, photos, status updates and friends list. We may also allow you to take part in contests where you must provide photos, such as photos of your stay on our property, which you can share with people you are connected to on social media for votes, joint offers or other promotions.

In addition to the information collected from you directly, we may derive information about you based on the information you provide to us or other information we receive.

Personal data collected from third parties

We may also collect information about you from third parties, including information from our airline partners, card partners and other partners, from social media services according to your settings for these services and from other third-party sources that are authorized to disclose your data to us. We use and disseminate this information (and we may add this information to other information we have about you) for the purposes described in this Information.

Use of your personal data

We use your personal data for various purposes, including to provide and personalize the services you request and expect from ARO-PALACE, to provide you with the expected level of hospitality in your room and anywhere on our property and to perform direct marketing actions and promotions, as presented below in detail:

• Service administration: We use your personal data to manage the programs you participate in, including to give you access to your account information, such as the status of rewards and offers for which you are eligible; to provide services that are part of such programs; to allow direct communication between the properties within ARO-PALACE and between the ARO-PALACE portfolio and you; and to facilitate collections.
• Conference and event planning: We may use your personal data to provide you with information regarding the conference and event planning.
• Marketing and communication: We may use your personal data to provide you with or offer you newsletters, promotions and recommended special offers, as well as other advertising messages depending on any communication preferences expressed by you. We use your data to provide messages during your stay, account alerts and reservation confirmations; to send you marketing messages; and to conduct studies, raffles, drawing of lots and other contests. We may send these communications by e-mail, mail, online advertising, social media, telephone, text messages (including SMS and MMS), notifications, in-app messages and other means (including proprietary messages, such as room television). With your consent, we use user-generated content (such as photos) from social media services to display ads on our website and in our applications. We may collect information from your card, which may be associated with personal data and used by ARO-PALACE and present and/or send you targeted advertising messages based on your payment method and according to your communication preferences.
• Service improvement: We may use your personal data to improve ARO-PALACE services and to ensure that our site, products and services are of interest to you. We use your personal data to provide you with the expected level of hospitality in the room and anywhere on our property.
• Accuracy, analysis and personalization of data: We may corroborate your personal data with data from third-party sources to update and analyse your data. We also rely on data from third parties to provide better and more personalized services. For example, if you connect social media or other accounts to our services, we may use this information to make your experience with us more personal and social or we may share and use it as described in this Information.

Disclosed personal data

To provide you with the expected level of hospitality and the best level of service, we may disclose your personal data to our service providers and other third parties, as set out in detail below:

• Group events or meetings: If you visit ARO-PALACE in a group or conference, the information required to plan the meeting and event can be shared with the organizers of these meetings and events and, if necessary, with the guests who organize or participate in the meeting or event.
• Business partners: We may partner with other companies to provide you with products, services or offers based on your experience on our properties and we may share information appropriately with our business partners. For example, we may arrange for you to rent a car or to benefit from other services from our business partners and, as a result, we may share your data with them. We may share your personal data, such as your email address, with our travel company partners to support them in assessing compliance with tourism policies or participating in special rate plans or engaging in co-branding with our travel company partners. We may also work with third parties, such as airline or credit card partners, to enable us and our partners to provide announcements to our common customers. Our partners can provide you with more relevant offers based on the information we disclose about your experience with our properties. Additionally, we may allow third parties to recognize you when you visit that partner’s website or application or to recognize you as a customer when you visit ARO-PALACE websites or applications, to provide you with more relevant offers. We may send a hash version of your email address to certain third parties, using the available security measures; they may associate it with their hash versions of e-mail addresses to send you advertisements on our behalf online and via e-mail.
• Co-sponsors of promotions: We may co-sponsor promotions, lotteries, raffles, competitions or contests with other companies or we may provide prizes for lotteries and contests sponsored by other companies. If you participate in these lotteries or contests, we may share your personal data with the collaborating sponsor or a third-party sponsor.
• On-site services: We may disclose personal data to service providers on the property, such as concierge services, spa treatments or festive dinners.
• Service providers: We rely on third parties to provide services and products on our behalf and we may share your personal data with them accordingly. Our service providers are contractually obligated to protect your personal data and may not use or otherwise disclose it, except as required by law. However, our fraud detection service providers may use but not disclose your personal data for fraud detection. We may use service providers to communicate news to you and provide promotional and commercial materials on our behalf, including personalized online and mobile ads based on your preferences and applicable law. For more information, see our Cookie policy. ARO-PALACE collaborates only with third parties that offer the method to unsubscribe from this type of advertising. We may also share information with service providers to allow you to create itineraries by selecting sites, activities and restaurants from customized lists based on your preferences and information obtained from third parties.
• Commercial transactions: As we grow our business, we may sell, buy, restructure or reorganize our business or capital or we may cease to manage or franchise a hotel that is part of our portfolio at this time. In such cases, ARO-PALACE may transfer, sell or assign the information collected, including but without limitation to other information (described below) and personal data, to one or more affiliated or unaffiliated third parties in connection with these commercial transactions. To the extent required by law, we will provide notice of our intention to transfer personal data to third parties for this purpose and we will explain how you can refuse such a transfer.
• Other: In addition, ARO-PALACE may disclose personal data to: (i) comply with applicable laws, (ii) respond to requests from government or public authorities, (iii) protect ARO-PALACE rights, privacy, security or property, site visitors, guests, employees or the public, (iv) allow us to find available remedies or limit the damages we may incur, (v) apply the terms and conditions of our sites and (vi) respond to an emergency.

Other information

When you visit or interact with ARO-PALACE websites and applications, we collect other information that does not directly identify you concerning the site use, such as a catalogue of web pages you visit and the number of visits to our sites (Other information). We use other information, as well as data received from third parties, to send you e-mails and online and mobile advertisements (on our sites and on other sites). We may also use Other Information to allow third partners to recognize you as their customer when you visit ARO-PALACE websites or applications and to provide you with more relevant offers.

We use cookies and other technologies (such as pixel tags, web flags, transparent GIFs, email links, JavaScript, device IDs assigned by Google, Facebook, Apple or similar technologies) to collect this information. If you want to delete or block cookies on your device at any time, you can update your browser settings (refer to the browser’s help menu to learn how to delete or block cookies). ARO-PALACE is not responsible for your browser settings. You can find appropriate and simple instructions on how to manage cookies on different types of browsers at www.allaboutcookies.org. For more information, see our Cookie policy.

Sensitive data

The term sensitive data refers to data about your racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, health, sexual life or orientation, genetic data, criminal record and any other biometric data used for unique identification. In general, we do not collect sensitive data. We may use the health data provided by you to better serve you and meet your special needs (for example, providing access for people with special needs).

Personal data about minors

We do not consciously collect personal data about persons under 18 years of age. As a parent or guardian, please do not allow children to disclose personal data without your permission.

Links to websites and third-party services

Our site and mobile applications may contain links to third-party sites. Please note that we do not assume any responsibility for the collection, use, storage, sharing or disclosure of data or information by such third parties. If you use or provide information on third-party sites, the terms and privacy policy of those sites apply. We advise you to read the privacy policy of the sites you visit before submitting personal data.

ARO-PALACE can partner with a limited number of Internet providers to provide Internet access to our guests. The use of Internet services on property falls under the terms of use and the privacy policy of third-party Internet providers. You may access the respective terms and policies using the links on the authentication page of the service or visiting the website of the Internet provider.

Protection of personal data

ARO-PALACE will take all reasonable steps to: (i) protect personal data from unauthorized access, disclosure or destruction and (ii) keep accurate and up-to-date personal data, as appropriate. We also ask our affiliates and service providers with whom we share personal data to make reasonable efforts to keep the privacy of your personal data. For online transactions, we take reasonable technological measures to protect your personal data provided to us using our website. However, unfortunately, no security system or data transmission system on the Internet can guarantee the security of your data.

For the protection of your privacy, we recommend that you do not disclose us credit card numbers or any other confidential information by email.

We will not contact you via mobile/text messages or emails to request confidential information or credit card details. We will request credit card details only by phone when you make a reservation.

International transfers of personal data

We may partner with other companies outside of Romania to provide you with products, services or offers based on your experience on our properties and we may share information appropriately with our business partners. We do not transfer your personal data outside the European Union.

Changing and accessing your personal data

According to the legislation in force, you benefit from the right of data access, intervention, the right to object, the right to erase data, the right to data portability, the right not to be subject to an automated individual decision and the right to go to court. You can ask us to inform you about the personal data we keep about you and to update, rectify and/or erase your personal data kept in our active database, if necessary. We will make all necessary updates and changes within the time specified by the applicable law and, where permitted by law, we may charge an appropriate fee to cover the costs of responding to the request. Please send the respective requests in writing to office@aro-palace.ro.

To protect your privacy, we may respond to such requests at the e-mail address you have registered with or provided to us by other means. Keep in mind that if you request the erasure of data, we may not be able to offer you the quality and variety of services you are used to.

Also, in certain circumstances, depending on the applicable law, you may request that we stop disclosing your personal data to our business partners or you may request that ARO-PALACE stop using your personal data by writing to us at the e-mail address above. We will try to fulfil this request according to the legislation in force.

Storage of personal data

We store your personal data for the period necessary to achieve the purposes explained in this Information if a longer period of storage is not required or permitted by applicable law.

We will destroy your personal data as soon as possible and in a way that it can no longer be retrieved or restored.

If personal data is printed on paper, it will be destroyed securely by shredding or burning printed documents or otherwise and if it is saved on electronic media, it will be destroyed by technical means to ensure that the data cannot be subsequently retrieved or restored.

Data protection officer

You can reach the data protection officer at the following email adress: dpo@aro-palace.ro.

Preferences – marketing communication

If you have provided us with your contact details (address, fax number, e-mail address or telephone number), we may inform you, depending on your preferences and with your consent, if necessary, about our products and services or invite you to events via email, online advertising, social media, telephone, text messages (including SMS and MMS), automatic notifications, in-app alerts, mail, our customer support centre and by other means (including on-site messaging, for example on the TV in the room).

If you prefer not to receive advertising materials by e-mail, you may unsubscribe using the unsubscribe function in the e-mail received from us. Unsubscribe requests can take up to ten business days to take effect.

To unsubscribe from text messages, please inform the hotel reception that you no longer want to receive text messages from our hotel or reply to the message with the text STOP.

You can control whether our mobile applications send you notifications by changing the notification settings on your mobile device. If we send you messages using the application, we will allow their control using the settings of our applications.

Changes of information

We may change this Information periodically. If we make significant changes to this Information, we will post a link to the revised Information on the homepage of our site and if you have registered for any of our products or services, we will inform you via the communication channel. You can find out the date of the last update of the Information by consulting the link and the date at the beginning of the Information. Any change in this Information will take effect upon the publication of the revised Information on the site.

Terms and conditions

All information and materials used on this site are reserved exclusively for Aro Palace S.A. The use of any text, image, material, file or item from this site for purposes other than non-commercial ones and those specified on the site, without the written consent of Aro Palace S.A., is forbidden.