The confidentiality of your personal data represents one of the main concerns of Therme Nord Bucharest in its capacity as data controller. This is why we want to be fully transparent in respect of the processing of personal data, by providing you with all the information you need in connection with this topic.
According to the requirements of General Data Protection Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as further amended, Therme Nord Bucharest, having its registered office in Romania, Sibiu County, 2 Alexandru Vlahuță Street, having a working point in Balotești, 1K Calea Bucharest Street, Ilfov County, has an obligation to manage the personal data provided by you or collected by us in relation to your person safely and solely for the specified purposes.
This document is intended to inform you on the processing of your personal data in the context of the use of the internet website www.therme.ro (and of the related pages, such as shop.therme.ro, b2b@therme.ro), and in relation to your visits to Therme Bucharest.
Based on the legal grounds, we have structured the situations in which your personal data is processed by Therme Nord Bucuresti by specifying the purposes, categories of processed data and the term while the data is kept.
♦ BASED ON YOUR CONSENT, Therme processes your personal data in the following situations :
→ By accepting the cookies existing on the therme.ro website and on the related sub-domains (shop.therme.ro, b2b.therme.ro, feedback.therme.ro etc.)
- Purpose: to improve the experience of browsing on the website.
- Categories of processed data: IP address, geographic address, and banners acessed by users, in order to optimize the display.
- Information storage term: differs depending on the accepted cookies and does not exceed 2 years as from the last session.
You can find further details about the cookies used by us here: http://www.therme.ro/ro/politici-cookie/
→ By subscribing to Therme’s Newsletter – on the website or through other Marketing Campaigns
- Purpose: we collect your e-mail address in order to send you notifications on Therme Nord Bucuresti’s news, offers and Campaigns.
- Categories of processed data: e-mail address and, sometimes, name and surname.
- Information storage term: Your e-mail address is used for this purpose until the moment when you withdraw your consent. This can be done at any time by clicking the unsubscribe button from your confirmation e-mail. Marketing comunications will not be sent without your consent given in advance.
→ For all marketing activities, through any collection method (apps, printed forms etc.) and through all processing operations required for the attainment of this purpose.
- Purpose: data is processed and kept for customization, identification, award of benefits and prizes, as well as for the performance of legal obligations.
- Categories of processed data: personal data required for the enrollment and participation in various Campaigns (family and first name, domicile, e-mail address, phone number or other identification data you provide as required).
- Information storage term: this is limited to (i) the Campaign duration, (ii) the time interval until you withdraw your consent (if you gave it), and (iii) the term set forth by law (for individuals who received prizes).
→ For the use of pictures and video recordings in various marketing materials on the online platforms held by THERME or Social Media:
- Purpose: to provide customers with a clear picture on the opportunities and benefits oferred by Therme.
- Categories of processed data: photo and video images.
- Information storage term: Personal data (your image) is used for the time interval established in the Agreement, usually for maximum 10 years.
→ For the creation of accounts on any of the following platforms: shop.therme.ro, b2b.therme.ro, therme.ro or any other therme.ro sub-domain.
- Purpose: The purposes of processing consist of: creation and administration of accounts for the performance of commercial relations, as well as for the collection of feedback for improving our services.
- Categories of processed data: Therme Nord București will process your personal data, such as name and surname, phone number, e-mail address, invoicing address, delivery address, data on how you use the website, for instance your behavior/preferences/ habits in Therme Nord București, as well as any other categories of data provided directly by you in relation to the creation of your user acount, to placement of orders through the website or in any other way resulting from the website use.
- Information storage term: As a rule, data is kept until the account is closed but, in particular situations, it will be kept for a longer time interval for the performance of legal obligations (10 years for accounting documents) or for the defense of Therme’s legitimate interests.
→ By installing the My Therme app and creating and using the related acount.
- Purpose: The purpose of processing your personal data consists of managing the app in order to provide services intended to build loyalty of Therme Nord Bucuresti’s customers.
- Categories of processed data: personal data provided by you at the moment of the acount creation, such as: name and surname, e-mail address, phone number and birth date.
- Information storage term: Data is kept until the moment when you request for the acount closure. In particular situations, for legal grounds or well justified legitimate interests, data is kept for a longer time interval also after the account closure and the app uninstallment.
→ By using the contact forms on the website (“Contact us”; “organize events” ; “Corporate Sales”; “Send CV”),
- Purpose: Data is processed for the comunication and sending of responses or for redirecting them to the relevant department following the submitted requests (sales, recruitmens etc.).
- Categories of processed data: Therme processes your full name and e-mail address.
- Information storage term: this is set depending on the request type, usually not longer then 3 years.
→ When information is provided to us through the chat or through Therme’s official facebook page
- Purpose: settlement of requests and inquiries from visitors of the facebook page.
- Categories of processed data: family and first name and any other information deemed by data subjects relevant to be provided to us in order to describe a specific situation.
- Information storage term: we keep the data usually 3 years by the last interaction.
→ By filling in various forms when you visit Therme Nord Bucuresti (suggestions, complaints, lost items, child companion employment, massage appointments and other forms whereby your consent is requested).
- Purpose: for the management of suggestions and complaints, comercial management, and for ensuring the guard, health and security of the Facility.
- Categories of processed data: name and surname, address, phone number , e-mail address and any other information deemed by data subjects relevant to be provided to us in order to describe a specific situation.
- Information storage term: this is set depending on the request type, no longer then 3 years.
♦ BASED ON THE GROUND OF PERFORMANCE OF LEGAL OBLIGATIONS, Therme Nord Bucuresti processes your personal data in the following situations:
→ Filling in of sheets at the first aid point following an event of medical nature.
- Purpose: to provide appropriate medical care; to record the event when this is necessary to medical services (hospitals, if the case), and to defend our rights.
- Categories of processed data: name and surname, telephone number, details on the incident and findings.
- Information storage term: Data is kept for a time interval of 30 days, and in situations where potential reports or complaints may be filed, data is kept for 3 years.
→ Ensuring security and health through video surveillance and by having a guard and protection system in place.
The premises of Therme Nord București, as well as the access ways and the parking place are equipped with a video surveillance system, which enables the collection of your image and its processing.
The areas in which there is a high privacy expectation, such as toilets and other similar locations, are not monitored.
- Purposes:
- Categories of processed data: video images, car registration numbers and other personal data, depending on situations.
- Information storage term: As a rule, video images are kept for maximum 30 days. To the extent that particular situations require that video images be kept for a longer time interval (depending on the time required for the further investigation of a Security Breach, for the defence of legal claims, and for the performance of a legal obligation or the defense of a legitimate interest), the term for keeping the data may be extended up to 3 years.
→ Filling in the engagement for food products brought from outside the Facility
- Purposes: to ensure food safety (Ordinance no. 21/1992, as subsequently updated).
- Categories of processed data: name and surname, address and signature.
- Information storage term: 30 days.
→ Use of personal data for the settlement of claims or complaints submitted online or at our premises:
- Purpose: settlement of complaints.
- Categories of processed data: name and surname, address, phone number, e-mail address.
- Information storage term: 3 years as from the last interaction.
→ Providing of personal data by filling in documents required for the performance of legal obligations (payment orders, collection orders, receipts, invoices, minutes concerning money return/retaking possession of goods (Therme cards) etc.
- Purpose: money collection/return, invoicing and others alike.
- Categories of processed data: family and first name, address, phone number, e-mail address, credit card codes, copy of the Passport (for payments order)
- Information storage term: 5 years, according to the legal provisions.
→ Identity document inspection for the identification of data subjects in various situations (return of lost items, return of Therme cards – in case of re-issuance etc.)
- Purpose: identification of data subjects.
- Categories of processed data: data contained in identity cards.
- Information storage term: N/A
→ Keeping track of service providers performing their activities in the Facility
- Purpose: Work Health and Safety.
- Categories of processed data: family and first name, birth date, profession, and signature.
- Information storage term: all along the performance of the service contract.
→ Keeping track of visitors (other than customers)
- Purpose: to ensure health and security.
- Categories of processed data: family and first name.
- Information storage term: 3 years.
→ Use of personal data incumbent on Therme Nord București in the context of the provided services, including obligations in the tax and archiving areas.
- Purpose: the performance of legal obligations in the tax and archiving area.
- Categories of processed data: name and surname and full address, in case of invoices, or any other information required by law for the performance of legal obligations.
- Information storage term: 5 or 10 years starting from the end of the financial year during which such information was prepared, in case of accounting documents (acording to Order no. 2634/2015 of 5 November 2015) and, in case of archiving, data is kept in compliance with National Archive Law no. 16/1996, as subsequently updated.
→ Administration of financial tranzaction by accounting department (in PayU platform) made with credit card by the clients in webshop and B2B platform.
- Purpose: financial and accounting administration for performance the legal obligation.
- Categories of processed data: The PayU application provide acces to name and surname, address, phone number, e-mail, postal code for the card holder.
- Information storage term: Information is not exported or stored by Therme.
♦ BASED ON ITS LEGITIMATE INTERESTS, THERME NORD BUCURESTI processes your personal data in the following situations:
→ Monitoring of THERME’s data network (when you connect to the wifi network during visits). We process your personal data based on your consend given at the moment of creating the user, but also in our legitimate interest in order to ensure a proper security of the network.
- Purpose: to ensure the security of information and for defending legitimate interest
- Categories of processed data: name and surname, e-mail address, phone number, details of device and navigation.
- Information storage term: 1 year
→ Keeping of incident sheets from the first aid point, video images, and complaints (if any) or other relevant documents following events of medical nature.
- Purpose: management of incidents, in order to defend our rights before Authorities.
- Categories of processed data: name and surname, telephone number, data referring to health condition, details on incidents and medical findings, video images and other information provided by customers to justify the situations.
- Information storage term: 3 years or more if the situation so requires, for defending the rights.
→ Management, control, reporting and preparation of statistics on THERME’s activity (this refers to internal reports prepared for the purpose of obtaining information on sales, the most accessed services, data on your preferences/interests etc.)
- Purpose: management and marketing.
- Categories of processed data: Data does not contain identification elements.
♦ BASED ON THE CONTRACT BETWEEN YOU AND THERME NORD BUCURESTI (including the stages preceding the contract execution), your data is processed in the following situations:
→ Through e-mail communications with Therme Nord Bucuresti’s employees involved in sales (including the stages preceding such sales). Through commercial requests sent via the online or B2B store. Providing your personal data is required for the contract performance.
- Purpose: organization and performance of contractual relations (information, takeover, validation, delivery and invoicing of orders placed on the website, your notification on the order’s status, organization of returns of ordered products etc).
- Categories of processed data: name and surname, profession, e-mail address, delivery address, phone number, bank details, and details of financial transactions with Therme.
- Information storage term: for natural persons: 10 years as from the last order/sale, while for representatives of legal entities, 10 years as from the contract expiry.
→ Filling in of support documents for the recovery of damages caused by customers (payment comitments, finding minutes or other support documents)
- Purpose: recovery of damages.
- Categories of processed data: at least name and surname, domicile address, phone number, payment value, and other information required to establish the circumstances of damages will be collected.
- Information storage term: 5 years as from the end of the financial year during which such documents were prepared.
→ Inspection of identity documents of individuals who want to acess areas limited by age
- Purpose: to ensure the observance of the General Contractual Terms- Therme București Nord’s Internal Regulation and that for the Use of Pools.
- Categories of processed data: data subjects’ identity documents will be visually inspected in order to allow access to particular areas restricted based on age criteria.
- Information storage term: data is not kept.
→ Inspection of identity documents (for pupils, students / pensioners / disabled persons etc.) and of support documents (pupil/student report card, pension slip, support document certifying the disability degree etc.) at the time of purchase of acess tickets.
- Purpose: to ensure the observance of the General Contractual Termse- Therme București Nord’s Internal Regulation and that for the Use of Pools.
- Categories of processed data: data subjects’ identity documents and support documents will be visually inspected for identification purposes.
- Information storage term: data is not kept.
→ Appointments for additional services in the Facility (massage appointments)
- Purpose: massage appointments.
- Categories of processed data: first name.
- Information storage term: 60 days.
→ CV data (that existing on specialized websites or sent to us by you via email or to the address of our working point) is processed for the selection of applicants for interview.
- Purpose: recruitment
- Categories of processed data: name and surname, address, birth date , phone number, address, e-mail, education/qualifications, professional experience, skills and other relevant information.
- Information storage term: If an applicant is rejected, his/her CV will not be kept. If an applicant is acepted, his/her CV will be submitted in his/her HR file and will be kept according to the legal provisions.
The usual (non-exceptional) processing situations are highlighted above. For any unusual situation in which your personal data is processed by Therme in accordance with the data protection law you can contact Data Protection Officer to obtain additional informations. The Privacy Policy is updated periodically to provide a correct and updated ovewview for the data subject.
For the attainment of processing purposes, Therme may disclose your data to its partners, to third persons or entities supporting Therme Bucharest in carrying out its activities through the Website (for instance, courier companies, IT service providers, Marketing collaborators, finacial and accountancy service providers), or to the central/local public authorities in the following indicative situations listed below:
Under the terms of the legislation concerning the processing of personal data, in your capacity as data subject, you benefit from the following rights:
Therme Nord Bucharest, following a data erasure request, may anonymize such data (thus depriving them of their personal character) and may continue the processing under these terms for statistical purposes;
THERME will provide you free of charge with information on the processing of your personal data based on a request, with no unjustified delays, within maximum 30 calendar days as from the date of such request registration. Depending on the complexity of the requested information, such term may be extended by 60 days, and you will be informed on the reasons underlying such extension of the initial term. In case of requests received in an electronic format, the information will be provided also in an electronic format, except for situations where you request for the information in a different format (a printed one). In cases where you request for repetitive, excessive or unfounded information, THERME may refuse to provide the information.
If you want to make use of any of your rights related to the processing of personal data by THERME, to obtain further information or clarifications on the processing of your personal data, please contact THERME, through its Data Protection Officer in charge of securing THERME’s compliance with the requirements set forth by GDPR.
This official can be contacted at the following e-mail address: dataprotection@therme.ro
The website www.therme.ro uses cookies. For further information related to the use of such cookies, please access the following link: http://www.therme.ro/ro/politici-cookie/.
