Information on the Processing of Personal Data
Providing personal data on the OrhideeaSpa.ro website constitutes your consent for such data to be included in the database of the Orhideea Spa Health Foundation, located at 145B Calea Plevnei, Bucharest, which may collect, process and store personal data in accordance with the law.
The Orhideea Spa Health Foundation shall keep this information confidential, except for information requested by the competent legal authorities.
The Orhideea Spa Health Foundation processes personal data collected through the forms available on the website pages for the purpose of managing relationships with users and providing support to them, as well as data collected for advertising and marketing purposes, data analysis, such as market research, opinion surveys, user analysis, segmentation and user profiling, in order to determine user activity on the website, customer analysis, customer segmentation and customer profiling, in order to determine purchasing behavior and user activity, such as repeated purchases of certain goods and purchase data.
For the purposes mentioned above, the user's (data subject's) data will be stored in the database of the Orhideea Spa Health Foundation. This processing is based on Article 6(1)(a) of the GDPR.
The Orhideea Spa Health Foundation may contact the user (data subject) for these purposes by email, SMS, telephone, post, Social Media or Google channels/tools.
Through the website, the Orhideea Spa Health Foundation processes data concerning the data subject's behavior regarding the use of the website, including, but not limited to, session data, browsing behavior, location data, demographic data, Internet Protocol address (IP address), where available, operating system and device browser type. Continuing to browse the website and accepting the collection of information constitutes your consent in this regard.
This statistical data regarding the actions and browsing patterns of visitors to the Orhideeaspa.ro website does not identify any individual and is collected for the purpose of improving and personalizing the website and for communication and marketing purposes, including behavioral advertising based on cookies (more details about cookies). This processing is based on Article 6(1)(a) of the GDPR.
Recipients of the Collected Data
In order to achieve the purposes mentioned above under point 2, the Orhideea Spa Health Foundation uses service providers, namely processors within the meaning of Article 28 of the GDPR, such as providers of services for monitoring user activity on the website or providers of services for sending emails and SMS messages, making telephone calls, or communicating advertising and marketing campaigns. These may be external service providers. Through contractual provisions, the Orhideea Spa Health Foundation ensures that these service providers process personal data in accordance with European data protection legislation, in order to ensure a high level of data protection.
Mandatory/Voluntary Provision of Data and Data Retention Period
- The provision of the following data through the contact forms is mandatory in order to provide user support: first name, last name, city/locality, telephone number, email address, as well as product identification data where a request concerning a product is submitted. These data are collected on the basis of Article 6(1)(b) of the GDPR and retained for a period of 10 years. However, upon termination of the contractual relationship, you may request the deletion, rectification or restriction of this information by contacting us at gdpr@orhideeaspa.ro, except for the information referred to in the sections below.
- Where the user, or their legal guardian if the user is a minor, chooses to subscribe to the newsletter, the following data provided through the dedicated form on the website are collected and processed. The email address is mandatory for the purpose of communication, while the following information is optional: gender, first name, last name and city/locality. The data are collected on the basis of your consent pursuant to Article 6(1)(a) of the GDPR and are stored for a period of 10 years. You may request the deletion, rectification or restriction of this information at any time by contacting us at gdpr@orhideeaspa.ro.
- In the event of the purchase of products or services, data relating to the first name, last name and address will be stored for 10 years, without the possibility of deletion. You may only request their rectification or restriction. These data are collected on the basis of Article 6(1)(b) and (c) of the GDPR for the purpose of performing a contract and complying with a legal and tax obligation incumbent upon us.
Automatic Creation of Customer / Patient Accounts
- In the event of purchasing medical services or enrolling as a member of the Orhideea Spa Health Center (including the purchase of medical recovery packages, personal training, etc.), the system will automatically create an account for you. The automatic creation of accounts (profiles) is provided for under Article 22 of the GDPR.
- Both in the case of medical services, where we may request the Personal Numeric Code (CNP) for the legal identification of the patient, and in the case of access to membership of the center, an individual profile is mandatory for the provision of the services.
- Normally, we keep accounts active for up to 10 years. Upon your written request sent to gdpr@orhideeaspa.ro, in the case of an account created for membership of the health center, we may delete the account at the end of the contractual period.
User Rights
As a data subject, the user may contact the Foundation at gdpr@orhideeaspa.ro to obtain access to information concerning their personal data at any time, by submitting a notification using the contact details mentioned above, in order to exercise their rights in accordance with the GDPR. The request must contain your identification details and contact details. In special circumstances, we are entitled to request additional information from you. In accordance with the law, we must provide a response within 30 days under normal circumstances and within a maximum of 90 days in the case of requests involving a large volume of collected information. Your rights are as follows:
- The right to receive information concerning the processing of data and a copy of the processed data (right of access, Article 15 GDPR).
- The right to request the rectification of inaccurate data or the completion of incomplete data (right to rectification, Article 16 GDPR).
- The right to request the deletion of personal data and, where personal data have been made public, the transmission of information concerning the deletion request to other controllers (right to erasure, Article 17 GDPR).
- The right to request restriction of the processing of data (right to restriction of processing, Article 18 GDPR).
- The right to receive personal data concerning the data subject in a structured, commonly used format and to request the transmission of such data to another controller (right to data portability, Article 20 GDPR).
- The right to object to the processing of data with a view to having the processing discontinued (right to object, Article 21 GDPR).
- The right to withdraw consent at any time in order to stop processing of data based on your consent. Withdrawal of consent shall not affect the lawfulness of processing based on consent given prior to its withdrawal (right to withdraw consent, Article 7 GDPR). Withdrawal of consent regarding the processing of personal data necessary for the performance of contractual obligations and compliance with the rights arising from the distance contract releases the Professional from the performance of such obligations.
Furthermore, withdrawal of consent regarding the processing of personal data cannot apply where the processing is necessary to comply with legal obligations. - The right to lodge a complaint with a supervisory authority if the User reasonably considers that the processing of personal data has been carried out by the Controller in violation of the GDPR (right to lodge a complaint with a supervisory authority, Article 77 GDPR).
What Data Do We Collect at the Orhideea Spa Health Center?
- In the event of entering into membership agreements, access agreements or additional service agreements (personal training agreement, medical recovery services agreement, etc.), OHS collects, processes and stores the following personal data: first name, last name, Personal Numeric Code (CNP), identification document details, correspondence address, telephone number, email address, information concerning family members (who use the center's facilities), and a photograph of the member or accompanying person, where a personalized membership card with a photograph is issued.
First name, last name, Personal Numeric Code (CNP), identification document details and signature are personal data that we collect for the purpose of preparing membership agreements, service agreements or tax documents [GDPR, Article 6(1)(c)]. We also collect data concerning accompanying persons of membership agreement holders in order to maintain records of persons who have benefited from our medical services or who have been members of our center. These data are collected, processed and stored for a minimum of 10 years in accordance with applicable tax regulations. Data subjects may not request the deletion of these data, as they are collected for the purpose of fulfilling a legal obligation incumbent upon us. These data may be accessed by our authorized employees, external providers of center administration services, legal services, financial services, correspondence services, IT services and archiving services. These data may be stored in encrypted format in another Member State.
The correspondence address, telephone number and email address are personal data that we collect for marketing purposes as well as for the purpose of sending urgent information regarding changes to our operating schedule [GDPR, Article 6(1)(a)]. Members may request, during the term of their membership agreement, that their contact details not be used for marketing purposes. However, as long as you are a member of our center, as well as for 3 years thereafter, you may not request the deletion of the above-mentioned data, which may be used for legal communications (notifications concerning outstanding debts). These data may be accessed by our authorized employees, external providers of center administration services, advertising services, correspondence services, and IT and archiving services. In certain situations, we may also disclose these data to legal service providers. These data may be stored in encrypted format in another Member State.
The photograph of the membership card holder and of their contractual accompanying persons is used for the purpose of issuing the membership card [GDPR, Article 6(1)(a)]. Upon your request, we may issue a membership card without a photograph. In this situation, each time you access our center's services, you will be required to identify yourself using an official identification document. Your photograph is stored for the duration of the contractual relationship and for an additional 12 months thereafter. The photograph is not captured using specific technical means capable of uniquely identifying or authenticating a natural person and, therefore, this data cannot be considered biometric data. You may request the deletion of your photograph at any time. These data may be accessed by our employees, external providers of center administration services, and IT and archiving services. These data may be stored in encrypted format in another Member State.
- In the case of health and relaxation programs, we collect, process and store data concerning health status and biometric data.
Health data and biometric data are used as part of the health services we provide [GDPR, Article 9(2)(b) and (h)]. The data are stored for 10 years. You may not request the deletion of these data. These data may be accessed by our authorized employees, external health service providers (doctors, therapists), center administration service providers, and IT and archiving service providers. In certain situations, we may also disclose these data to legal service providers. These data may be stored in encrypted format in another Member State.
- In the case of sports programs, we may sometimes collect, process and store data concerning your health status and biometric data, as well as data concerning your dietary and social behavior.
Health data, biometric data and data concerning your dietary and social behavior are used primarily within personal training programs, where we work together with you to monitor and achieve certain physical parameters [GDPR, Article 9(2)(a)]. We store these data for the duration of the contractual period and for 12 months thereafter. These data may be deleted, rectified or restricted at any time upon your request. These data may be accessed by our authorized employees, external sports service providers (trainers, fitness coaches, etc.) or medical service providers (doctors, therapists, etc.), center administration service providers, and IT and archiving service providers. These data may be stored in encrypted format in another Member State.
- By accessing our center, you are subject to audio-video surveillance in all common areas, except for areas where video surveillance is prohibited by law (intimate/private areas).
Audio-video data are collected, processed and stored for 30 days for your safety [GDPR, Article 6(1)(d) and (f)]. In special circumstances, we may extend the storage period of audio-video recordings until the resolution of legal disputes for which such evidence is required. You may not request the deletion of these recordings, but in certain cases you may request restriction of their processing. These data may be accessed by our authorized employees, external security service providers, center administration service providers, and IT and archiving service providers. In certain situations, we may also disclose these data to legal service providers.
- Recording of Telephone Conversations and Use of the Information Provided
In the case of certain telephone calls, we may record conversations for the purpose of improving our services and for evidentiary purposes. We may retain these recordings for a maximum of 12 months. We may also use the information you provide to us (including, but not limited to: telephone number, email address, postal address) in order to contact you to confirm appointments, provide information regarding your customer account balance, or address other situations.
Beyond all these mandatory legal provisions, we would like to assure you that we make every effort to provide you with an environment of comfort, safety and relaxation at our center. Please feel free to contact us with any questions or suggestions.
We will be happy to assist you.
Warm regards,
The Orhideea Spa Team