We, ANA Hotels SA, located in B-dul Poligrafiei no. 1C, Sector 1, Bucharest, are extremely concerned to guarantee the confidentiality and full protection of your personal data, in accordance with the rules, principles and regulations in force in the European Union in this field, including Regulation no. 679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

Personal data means any information about an identified or identifiable individual, and an identifiable person is that identifiable person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, localization, an online identifier, or one or more specific elements that are physically, physiologically, genetically, psychologically, economically, culturally or socially identifiable.

This Policy refers to the personal data of our customers, business partners, other people who come in contact with us or visit our locations, employees or people in the process of engagement, collaborators, etc. and applies to personal data collected by: e-mail, directly at the hotel receptions, various forms, CVs, video recordings, web-sites, social media. For the purpose of carrying out the activity, ANA HOTELS SA may collect, process and store certain legally required personal data, for the conclusion of a contract or for a legitimate interest. These data may be, but are not limited to, name, surname, nationality, address, telephone, e-mail address, moving images, etc.

The Privacy Policy describes:

• The purpose for which we collect and how we use your personal information;
• How we collect personal data;
• The basis of processing for the above purpose;
• The categories of personal data that we collect and process;
• The storage period for processing;
• Your rights and how you can exercise them;
• To whom can we pass this data.

We also want to let you know what we are doing to ensure the security of your personal data and how you can contact us about privacy and protection of your personal data.

Who we are:

Ana Hotels SA, located in Bulevardul Poligrafiei no. 1C, Sector 1, registered at the Trade Registry with J40/7935/1993, RO 5479061, Bucharest, Romania, is the largest hotel company with Romanian capital in Romania. The measures presented in this information apply to all hotels in the Ana Hotels chain. For more details about Ana Hotels, visit www.anawellness.ro

THE PURPOSE FOR WHICH WE COLLECT AND THE WAY IN WHICH WE USE YOUR PERSONAL DATA

Our company collects data in the following cases:

1. If you are a client or potential customer of the Hotel:

We have an obligation to manage safely and for the specified purposes only the personal data you provide to us about you.

1.1. To provide you with our services

We request data to provide you with our services:

• To book rooms and other services in our hotel; the basis for data processing is in this case the execution of a contract;
• You can stay in our hotel; the processing of personal data is done in this case on the basis of a legal obligation;
• Enroll in the loyalty program (optional), based on the legitimate interest of the hotel;
• Become a member of our SPA, based on the hotel's legitimate interest in processing, as well as executing a contract.

1.2. To communicate with you

It is important for us to be able to communicate with you for various purposes, such as to find out how you evaluate our services, to address your various referrals or to provide personalized, timely services, in electronic format.

1.3. Legal obligation

In some situations, we may require some personal data under a legal obligation imposed by the applicable law.

1.4. Sending information (newsletter)

We request data to send you commercial information / newsletters in electronic format. For this we ask for your consent and we request your e-mail address expressly; we have a legitimate interest in our processing.

You can withdraw your consent at any time, expressing your option not to receive our newsletter in the future by clicking "unsubscribe" when you receive the e-mail.

The categories of data processed in the context of our relationship with you are your name, telephone, fax, address / home, e-mail address (optional) and other personal data you can provide directly to us.

2. If you are an employee or other type of collaborator

2.1. In order to enter into contractual relations with us (Individual Work Contract, etc.)

We request data required by law to enter into employment contracts with us on the basis of a statutory obligation: name, first name, domicile, date and place of birth, identity card details, study papers, criminal record (where applicable).

2.2. To communicate with you

In order to communicate with you in a timely manner, we may request your phone number and e-mail address.

3. If you want to work for ANA Hotels

We use the personal data contained in the CVs we receive to assess the qualifications of applicants for a position within ANA Hotels, including our "internship" programs. We base our processing on the interest in the potential conclusion and performance of a contract of employment.

The categories of data processed in the context of our relationship with you are the name, e-mail address, telephone, fax, address, personal details included in the CV, details of education and training, professional qualifications, and other personal data you can supply directly.

4. If you are a business partner / supplier

4.1. To keep in touch with you

We use your personal data to maintain direct contact and maintain your contractual relationship with you. We collect these data on the basis of the conclusion of commercial contracts.

4.2. Communicating with you

We use your contact information to communicate with you about any relevant issues related to our contractual relationship.

4.3. Legal obligation

In some situations, we may require some personal data under a legal obligation imposed by the applicable law.

5. If you are a visitor to ANA Hotels SA

We use your personal data to ensure our security, for goods and staff. In this case, we base our data processing on the legitimate interest of ANA Hotels SA, namely the protection of these premises, active and personal.

The categories of data processed in this context are your name as well as other personal data that you can provide us directly upon our request as well as your recorded images using the video surveillance system.

6. If you are a user of our internet sites - www.anawellness.ro, etc

We use personal data that we collect from you when you visit our websites to monitor traffic and improve site content. We rely on this data processing activity for our legitimate interest in ensuring the proper functioning of our websites and improving them. The data categories processed in this context are the time and date of access to an Internet site and the IP address from which the site was accessed.

The basis for the processing of personal data may be: a legal obligation (if ANA Hotels is legally obliged to disclose certain personal data to public authorities), the execution of a contract concluded by ANA Hotels in the context of a particular transaction or legitimate interest of ANA Hotels to make a transaction in the most efficient way.

The online booking service is provided through its own website; when you access this service, the terms and conditions that apply are those listed on that website. We advise you to consult them.

7. Providing personal data

When personal data is requested directly from you, ANA Hotels requires you to provide all the data categories we request for the above purposes, otherwise we will not be able to perform our specific activity.

If you provide ANA Hotels with personal data of other individuals, please tell them before such data is provided how ANA Hotels intends to process their personal data as described in this privacy policy.

8. Transmitting personal data to third parties

Although, as a general rule, we do not disclose your personal data to third parties, this may happen if we need:

• to disclose contact details to our marketing service providers (only with your consent);
• to disclose contact details to our guest satisfaction survey service providers (only with your consent);
• if there is a legal obligation to transmit relevant personal data to public authorities in the context of providing us with the services you request;
• In the case of Ana Hotels - Athenee Palace Hilton, operated under the HILTON brand management contract, and Crowne Plaza operated under this franchise agreement with IHG, the personal data of the customers accommodated here belong to Hilton Worldwide and IHG, respectively, and are stored in databases located abroad.

9. Processing Time

We intend to keep your personal data for as short of a time as possible, as long as the minimum necessary for the proper conduct of our business - usually 24 months. However, there are situations where the legislation in force requires that certain sets of data be retained for longer periods of time.

10. Your rights

We intend to keep your personal data for as short of a time as possible, as long as the minimum necessary for the proper conduct of our business - usually 24 months. However, there are situations where the legislation in force requires that certain sets of data be retained for longer periods of time.

As a personal data holder, GDPR gives you a number of rights, including:

• the right of access - allows you to obtain confirmation that your personal data is processed by us and, if so, what are the relevant details of these processing activities;
• Correction Right - Allows you to rectify your personal data if it is incorrect;
• the right to delete - allows you to erase your personal data in certain cases, such as:

o if the data are no longer needed in connection with the purposes for which they were collected;

o whether the processing was based on your consent and whether you have withdrawn your consent, or has expired, or where there is no longer a legal basis for processing your personal data;

o a court or regulatory authority has decided that your personal data in question must be deleted;

o if it is proven that your personal data has been processed unlawfully;

• the right to restrict - allows you to obtain the restriction of processing your personal data in certain cases, for example when you contest the accuracy of your personal data for a period that allows us to verify this accuracy;
• the right to object - allows you to object to the further processing of your personal data under the conditions and within the limits set by the law;
• the right to data portability - allows you to receive the personal data you have provided to us in a structured, commonly used and legible format, or to transmit this data to another data operator.

We are happy to ensure that you exercise these rights, unless this proves impossible or involves a disproportionate effort. You may exercise the aforementioned rights and learn more about such rights by submitting to us, in our capacity of data controller, a written request to ANA Hotels SA, Poligrafiei Avenue no. 1C, Sector 1, Bucharest, or by e-mail to dpo@anahotels.ro

You also have the right to file a complaint with the National Supervisory Authority for Personal Data Processing, in its capacity as an autonomous central public authority with general competence in the field of personal data protection. We are committed to always addressing your requests with the utmost care and to address any questions you may have to answer as soon as possible.

11. VERSIONS OF THIS PRIVACY POLICY

This Privacy Policy enters into force on May 25, 2018. It can be updated based on the legislative changes that may occur. Any updates will apply after 15 days of site publishing.

Revised: 16 Mai 2018