Purpose and Legal Basis for Processing Personal Data

The processing of personal data is based on the performance of a contract between JNBV and the data subject, as well as on the implementation of inquiries, newsletters, requests for quotations, orders of products and services, and other pre‑contractual measures taken at the request of the data subject.

In addition, the processing of personal data is based on JNBV’s legitimate interest (customer relationship and direct marketing) and on the consent of the data subject where required, particularly for the sending of electronic direct marketing communications.

Regular Disclosure of Data and Transfer of Data Outside the EU or EEA

Personal data collected from customers is disclosed only when necessary to border authorities and to service providers, such as hotels, located outside the EU and EEA.

Principles of Data Protection and Data Retention Period

The data controller uses the G Suite by Google Cloud platform provided for businesses to maintain the register. Access to systems containing customer data is restricted to employees who, by virtue of their job responsibilities, are authorized to process customer data. Users access the system with a shared username and password.

Personal data is retained after the termination of the customer relationship until all obligations and other contractual and statutory duties between the parties have been fulfilled, and until the retention and liability periods defined by legislation—such as accounting and tax laws—have expired.

After the customer relationship has ended, JNBV may retain the basic personal data of the data subject as defined in this privacy policy for direct marketing purposes, within the limits permitted by law. JNBV regularly assesses the necessity of retaining personal data and takes reasonable measures to ensure that no personal data that is incompatible with the purposes of processing, outdated, or inaccurate is stored in the register.

​

Rights of the Data Subject

T

Right of Access and Right to Rectification

The data subject has the right to access the personal data concerning them stored in the personal data register, as well as the right to request correction of inaccurate data and deletion of data. Requests related to these rights must be submitted in writing to the contact person referred to in section 2.

Other Rights

In accordance with the General Data Protection Regulation (effective from 25 May 2018), the data subject has the right to object to the processing of their personal data or to request restriction of processing, as well as the right to lodge a complaint with a supervisory authority regarding the processing of personal data.