Privacy Policy

Rainbow Napa operating the property; (hereinafter referred to as the Company, “we”, "us") attaches great importance to the protection of your Personal Data and your privacy when collecting and processing information about you. We hereby assure you that this Privacy and Personal Data Protection Policy (“Policy”) fully respects and complies with EU Regulation 679/2016 (“Regulation”) and the relevant Law 125 / I / 2018 of the Republic of Cyprus.

1- Whom we collect Personal data from (data subjects)

We collect Personal Data as Controller from:

  • Those interested on our services, visitors of our premises, users of our webpage and our Social Media accounts, users of our Wi-Fi.
  • Those receiving our services or participants of events organized in our infrastructure.
  • Natural persons involved in events related to the sale of our services.
  • Those that fill in any of our documents in paper or electronic form.
  • When you cooperate with us as natural person or when your personal data is transmitted to us by third parties - partners under contracts or agreements as well as when you wish to cooperate with us.
  • Our employees

In addition, it is noted that we process personal data, which third parties, usually legal entities, disclose to us if we act as Processors on their behalf.

2- Kind of Personal Data we may collect about you

Data from the following categories of personal information about you may be collected and processed per case in order to serve the purpose of the data collection and in accordance with the relevant legal basis as described in this Policy:

Identification data: information such as, name and surname, identity card or passport number, nationality, gender, age or date of birth, user name or relevant identifiable element in electronic platforms, CCTV images and publicly available photograph.

Contact details: such as address, telephone and/or fax, email.

Transaction and booking data: such as account number, credit card full details, tax number, reason for payments, payment and reservations terms.

Special categories of data: such as health or allergies data, food preferences, anniversaries, special requests and related information.

Evaluation data: such as questionnaires or comments in various sources, social media including.

Employment data: such as data referred in your Curriculum Vitae.

Accident investigation data: such as incident details, data of persons involved or related information.

Internet Protocol (IP) or Media Access Control (MAC) address, or name and type of device and cookies.

3- Purposes of Processing & the Legal Bases of Data Processing

The processing of personal data is based on one of the "legal bases" as referred to in Article 6 of the Regulation (or Article 9 in case of special categories of personal data).

The legal bases on which the collection and processing of personal data is based (in most of the cases) are, the consent, the compliance in performing our contractual obligations, the compliance with our legal obligations, the safeguarding our legitimate interests and the protection of the vital interests of the data subject or of another natural person. For special categories of personal data, the explicit consent, the performance of obligations and the exercise of specific rights of the controller or data subject in the field of labour law and social security / social protection law and for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment.

4- How we ensure the security of Personal Data

We have received reasonable organizational and technical measures to protect the personal data we collect, and in particular any specific categories of personal data. We follow international standards and practices to ensure the security of our networks. We ensure you that your personal data is processed securely and legally, by adhering to policies and developing and implementing procedures in accordance with the purposes and legal bases of processing. For example, the following security measures are used to protect personal data against unauthorised use or any other form of unauthorised processing:

  • Access to personal data is restricted to a limited number of authorised employees under a need to know basis, and the necessary data transfer is done by secure procedures.
  • Our employees are bound by confidentiality rules and agreements, with limited classified access to the necessary data only.
  • In special categories of data, there is only authorised online access. In hard copy, they are locked in lockers where only authorised persons have access.
  • We select trusted collaborators who are bound in writing, in accordance with Article 28 of the Regulation, with the same obligations regarding the protection of personal data. We reserve the right to control them in accordance with Article 28 (3) (h).
  • In our ICT systems used for the processing of personal data, all technical measures are taken to prevent loss, unauthorised access or other illegal processing.

In addition, access to these ICT systems is monitored on a permanent basis in order to detect and prevent illegal use at an early stage. Although the transfer of data through the Internet or a web site cannot be guaranteed to be protected from cyberattacks, we work to maintain physical, electronic and procedural security measures to protect your data.

Some of the security measures we take are not announced for obvious reasons.

5- To whom the Data may be disclosed

Rainbow Napa takes every precaution to ensure that the recipients of personal data are kept to a minimum. The personal data we collect are disclosed to third parties, provided that the legality of such disclosure is fully justified.

Specific personal data from those we lawfully collect as a Controller, may be accessed (or disclosed) on a case-by-case basis by:

  • Any relating supervisory authority within its role.
  • Any public or judicial authority where required by law or judicial decision.
  • The auditor of the company, for necessary data according requirement (financial, employment, contracts and other controls), under confidentiality.
  • The legal advisor advocate of the company, for whatever data is required in legal cases, under confidentiality.
  • The Insurance cooperating company and relevant booking intermediates (e.g tour operators) in case of an incident and only for the relevant part of the information.
  • Partner banks (of the company, the staff or affiliates and suppliers), only for payment related data.
  • The training or systems consultants, the trainer and HRDA (training Authority) for training or systems control issues and only for the necessary pieces of information and data.
  • Our ICT systems administrators under specific strong Non-Disclosure Agreements.

The personal data we collect is not transmitted or transferred by us to third countries or international organizations.

6- Retention of Data Period

We store personal data for as long as it is required by the respective processing purpose and any other permitted linked purpose.

Specifically, for the data we process based on your consent, these are kept from obtaining the consent until it is revoked or there is no longer need to store it.

The video surveillance system data is kept for 21 days. 

Data collected on the basis of contractual and legal obligations shall be retained after the expiry of the contractual and legal obligations as provided by the relevant institutional framework.

Wi-Fi network access data are maintained 6 months without processing such data in any way than storing. Cookies retention period is referred in the relevant section. Specifically on cookies, your browser may be adjusted to maintain cookies or not depending on your preferences.

Data that may be needed for our legitimate interests as a Controller shall be kept until the reason for storing such data ceases.

CVs we do receive are kept for 12 months.

Information that is no longer necessary is safely destroyed. We limit access to your personal data to those employees who need to use it for the specific purpose.

7- Your rights as a Data Subject and how you can exercise them

You have the right to be informed, the right of access to your personal data, the rights of rectification and erasure (in cases it is permitted), the right to restriction of processing, the right to data portability, the right to object. If processing is based on your consent you may withdraw it at any time.

The right to be informed is exercised through this privacy and personal data protection notification. In some cases it is also mentioned on documents – forms we are using.

We inform you that we are not using software of decision making solely based on automated processing including profiling. 

In the event that you make such request in a written or electronic form regarding any of the above rights, we will assess your request and respond within one month of its receipt, either for its satisfaction or to provide you with objective reasons preventing it from being satisfied, or, given the complexity of the request and the number of requests at the given time, request an extension of response for a further two months period (Article 12.3).

The exercise of your rights is free of charge. Where requests from you are manifestly unfounded or excessive, in particular because of their repetitive character, we may refuse to answer or charge you an administrative fee.

If you are dissatisfied with the use of your data by us, or our response after exercising your rights, you have the right to lodge a complaint with a supervisory authority. Before such complaint, you may contact us if you wise so we can provide you with complete information and support.

8- Contact with us

If at any time you want to contact with us or to make a request regarding your rights or any other matter relating to the protection of personal data you get in touch by phone or email.