Prestige Hotels' privacy policy

Introduction

Your privacy is important to us, so, through this document, we explain what data we collect from users, how we use it and for what, among other indications.

For your information, we will never ask for more information than we really need for the required services; we will never share it with third parties, except by legal obligation or with your prior authorization; and we will never use your data for any other purpose not previously indicated.

As user, you must carefully read this Privacy Policy on a regular basis, and whenever you enter your personal data, since this document may be modified since the provider can modify any type of information that may appear on the web to comply with the regulations. or update the policy, and without there being an obligation to notify or inform users of said obligations, publication on the provider's website being sufficient.

Companies to which this privacy policy applies

ALDAN MERIDIAN, SL with NIF B65772832, address at Av. Nord, 45, 17480 Roses, Girona; website: www.prestigehotels.com

BAY VILLAGE EMPORDA, SLU, with NIF B55174882, address at Plaza Catalunya, 20, 17480 Roses, Girona; website: https://www.prestigehotels.com/es/prestige-hotel-mar-y-sol-elit

HOSPITALITY EMPORDA, SL with Tax Identification Number B55174874, address Avenida de la Bocana, 38, 17480 Roses, Girona; website: https://www.prestigehotels.com/es/prestige-hotel-sant-marc

ROSES VACANCES MANAGEMENT, SLU with NIF B55174916, address C/ Port Reig, 25, 17480 Roses, Girona; website: https://www.prestigehotels.com/es/prestige-hotel-goya-park

PG TRAVEL, SL with NIF B55079404, address Av. De la Bocana, 59, 17480 Roses, Girona;

TRESAGEL, SL with NIF B55174890, address Av. Gola de l'Estany, 6, 17480 Roses, Girona; website: https://www.prestigehotels.com/es/prestige-victoria-hotel-spa-elit

BACK SOON HOTELS & RESORTS SLU, with tax identification number B55174908, address c/ Punta Prima 1, 17480 Roses, Girona; website: https://www.prestigehotels.com/es/prestige-bay-hotel

Email: dpd@prestigehotels.com

Data Protection Officer: PYMELEGAL, SL

DPD contact: dpd@prestigehotels.com

ALDAN MERIDIAN, SL is jointly responsible for the treatment with each of the identified hotels.

From now on, all of them will be identified as PRESTIGE HOTELS.

PRESTIGE HOTELS, in accordance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and other applicable regulations on the protection of personal data, and Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSICE), informs you that it has implemented the necessary technical and organizational security measures to guarantee and protect the confidentiality, integrity and availability of the data entered.

Method of obtaining the data, what data we collect and its purpose

The data we collect, how we obtain it, and the purpose of the processing are as follows:

1. Video surveillance: Security of some premises:

Required data: image;
Purpose: security of people, property and facilities (detailed information in the "video surveillance" section within this privacy policy);
Legitimation: legitimate interest of the provider.

2. Newsletter subscription form:

Required information: name, surname, telephone, email
Purpose: to send the User commercial information of interest about our products and/or services through email, SMS, social communities or any other electronic or physical means, if the User has expressly consented to it;
Legal basis: User consent.

3. Contact form and/or information request:

Required information: name, surname, telephone, email
Purpose: to respond to inquiries and/or provide information requested by the User;
Legal basis: User consent.

4. Registration form:

Required information: name, surname, email
Purpose: to create a User account and be able to access the functionalities of the website;
Legal basis: User consent. Your account may be blocked or cancelled if there is evidence that you have committed a crime.

5. If you contract the service / purchase the product through our website:

Required information: name, surname, email, telephone
Purpose: contracting our service/purchasing our product;
Legal basis: User consent.

6. Web chat:

Required data: the information that the User voluntarily and freely provides to us;
Purpose: to respond quickly and immediately to your request for information;
Legitimation: legitimate interest of the controller.

7. CV submission form:

Required information: name, surname, telephone number, email address, education
Purpose: To involve the interested party in current or future recruitment processes for which the candidate may be a suitable candidate. To carry out this selection process, ALDAN MERIDIAN, SL may administer psychometric or competency tests to validate whether the candidate's profile meets the requirements of the vacancy. This information will not be used for any other purpose. Further details are provided in the CV submission section of this policy.
Legal basis: user consent.

8. WhatsApp: Its use is detailed in the WhatsApp section of this policy.

9. Would you like more information about our events?

Required information: name, email
Purpose: To address the user's request;
Legal basis: Consent of the interested party

10. Do you want more information about company meetings?:

Required information: name, email
Purpose: To address the user's request;
Legal basis: Consent of the interested party

11. Would you like more information about family celebrations?

Required information: name, email
Purpose: To address the user's request;
Legal basis: Consent of the interested party

12. We'll call you:

Required information: name, phone number
Purpose: To respond to the request for information;
Legal basis: Consent of the interested party

13. To carry out the contractual relationship and the similar administrative, tax and accounting procedures that are necessary under current legislation

Required information: name and surname, telephone number, address, ID number, email, signature;
Purpose: to carry out internal commercial, tax and administrative management;
Legal basis: consent of the interested party and contractual relationship.

14. Carry out the check -in process:

Required information: name and surname, telephone number, address, ID number
Purpose: compliance with the legal obligations of the entry registration that this entity carries out
Legitimation: under the provisions of Organic Law 4/2015, of March 30, on the protection of citizen security (LPSC).

The responsible parties that are part of PRESTIGE HOTELS can justify the transfer of personal data for internal administrative purposes between them, based on Legitimate Interest in accordance with the provisions of recital 48 of the GDPR.

You can revoke your consent at any time by sending a letter with the subject "Unsubscribe" to the email address provided.

In accordance with the LSSICE (Spanish Law on Information Society Services and Electronic Commerce), PRESTIGE HOTELS does not engage in spam practices; therefore, it does not send unsolicited commercial emails. Consequently, in all communications received from the provider, the user has the option to withdraw their express consent to receive further communications.

We will not process your personal data for any purpose other than those described except as required by law or court order.

You will not be subject to decisions based on automated processing that produce effects concerning you.

Data retention period

Your data will be kept for the duration of the commercial relationship with us or you exercise your right of cancellation or opposition, or limitation of treatment. However, we will keep your data within the legally established terms in the applicable provisions.

Recipients of assignments or transfers

The service provider will only disclose information to law enforcement agencies under a court order or as required by law, without prejudice to its right to block or cancel your account if there is evidence of criminal activity on your part. The information provided will be limited to what the service provider has available at that time.

The information you provide through this website will be stored on PRESTIGE HOTELS' servers, which are hosted by the company providing the web hosting service. The processing of the entity's data is governed by a data processing agreement between the service provider and this company.

PRESTIGE HOTELS may also contract certain services, which will be provided by third-party companies (Data Processors) to whom your data will be disclosed. A confidentiality agreement is signed with all these companies to ensure that the use of the personal data to which we grant them access for the provision of the service is carried out in accordance with current data protection legislation.

If we have your consent, as requested on the corresponding form, we may share your data—name, surname, telephone number, and email address—with Costa Brava City Tour, SL, tax identification number (CIF) B55348924, located at Avinguda de la Bocana 59, 17480 Roses, Girona, Spain. This company collaborates with PRESTIGE HOTELS and offers destination services including activities, guided tours, excursions, rentals, museum tickets, and transportation, among others.

For the management of reservations through our website, data will be transferred to the platform of GNA Serveis Telemàtics, SL, with registered office at Plaça Independència 18, 1er, 3ª in Girona.

The service provider also uses certain tools to provide services necessary for the development of its activity, and may store your data. These tools are as follows:

Google Analytics: to perform an analysis and measurement of how users use the website through cookies. The information generated and collected by these cookies about usage (including IP address) will be directly transmitted to and stored by Google Inc., located in Delaware, 1600 Amphitheatre Parkway, Mount View, CA 94043, USA ("Google"), on its servers in the United States.

Rights of interested persons

As a user-interested party, you may request the exercise of the following rights before PRESTIGE HOTELS by submitting a written request to the postal address at the top of this document or by sending an email to dpd@prestigehotels.com, indicating as Subject: "DATA PROTECTION: RIGHTS OF AFFECTED PARTIES".

Rights:

Right of access: allows the interested party to know and obtain information about their personal data being processed.
Right of rectification or erasure: allows you to correct errors and modify data that is inaccurate or incomplete
Right of cancellation: allows for the deletion of data that is inadequate or excessive
Right to object: the right of the interested party to prevent the processing of their personal data or to have such processing stopped.
Limitation of processing: involves marking the stored personal data in order to limit its future processing, for the exercise or defense of claims.
Data portability: facilitating the processing of data to the data subject, so that he or she can transmit it to another controller without impediment.
Right not to be subject to automated individual decision-making (including profiling) : the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

As a user, you have the right to withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of the processing carried out before you withdrew your consent.

You also have the right to file a complaint with the supervisory authority if you believe that your rights regarding the protection of your data may have been violated (aepd.es).

Additional Information

SECURITY MEASURES:

The data you provide will be treated confidentially. The service provider has adopted all necessary technical and organizational measures and levels of protection to guarantee the security of data processing and prevent its alteration, loss, theft, unauthorized processing, or access, in accordance with the current state of technology and the nature of the data stored. Furthermore, it is guaranteed that the processing and recording of data in files, programs, systems, or equipment, both local and at data centers, comply with the integrity and security requirements and conditions established by current regulations.

LANGUAGE

The language applicable to this privacy policy is Spanish. Therefore, in the event of any discrepancy between the Spanish version and any versions provided in other languages, the Spanish version shall prevail.

SOCIAL NETWORKS

We inform you that PRESTIGE HOTELS may have a presence on social media. The processing of personal data of individuals who become followers on social media (and/or engage in any connection or interaction through social media) with PRESTIGE HOTELS ' official pages will be governed by this section, as well as by the terms of use, privacy policies, and access regulations of the relevant social media platform, which the user has previously accepted.

PRESTIGE HOTELS will process your data for the purposes of properly managing its presence on the social network, informing you of activities, products or services of the provider, as well as for any other purpose that the regulations of the Social Networks allow.

The publication of content is prohibited:

That are allegedly illegal under national, community or international regulations or that carry out allegedly illegal activities or contravene the principles of good faith.

Content that violates fundamental human rights, is discourteous online, is annoying or may generate negative opinions among our users or third parties, and in general any content that PRESTIGE HOTELS considers inappropriate.

And in general that contravene the principles of legality, honesty, responsibility, protection of human dignity, protection of minors, protection of public order, protection of private life, consumer protection and intellectual and industrial property rights.

PRESTIGE HOTELS also reserves the right to remove, without prior notice, from the website or corporate social network any content that is considered inappropriate.

In any case, if you submit personal information through the social network, PRESTIGE HOTELS will be exempt from liability in relation to the security measures applicable to this platform and the user, if they wish to know them, must consult the corresponding specific conditions of the network in question.

SUBMIT CV

If you submit your CV through our website, our recruitment email, in person, or apply to any of our job openings, please be advised that the information you provide will be used to include you in any selection processes we may have. We will analyze your profile to select the best candidate for the open position of Manager. Please note that this is the only official method for submitting your CV; therefore, CVs submitted through any other means will not be accepted. If any of your information changes, please notify us in writing as soon as possible so we can keep your records up to date.

The data will be kept for a maximum of one year, after which it will be deleted, guaranteeing complete confidentiality both during processing and subsequent destruction. Therefore, after this period, if you wish to continue participating in the Data Controller's selection processes, please resubmit your resume.

The data may be processed and/or communicated to the companies that are part of our group during the time your resume is kept and for the same purposes previously informed.

WHATSAPP

The processing of personal data of individuals who submit inquiries via WhatsApp to ALDAN MERIDIAN, SL will be governed by this section, as well as by the terms of use, privacy policies, and access regulations applicable to the application in each case and previously accepted by the user. ALDAN MERIDIAN, SL will process your data for the purpose of properly managing your inquiry, as well as for any other purpose related to the administrative management of the service. Your data is shared with WhatsApp Ireland Limited, whose technical security measures ensure the confidentiality, integrity, and availability of your information, as stated in its own privacy policy, and with WhatsApp LLC, a company located in the USA and adhering to the Data Privacy Framework approved by the European Commission. No further transfers are foreseen, except as required by law or court order. Your data will be kept for as long as necessary to fulfill the purpose for which it was obtained and, once it is no longer needed, it will be duly blocked, archived, and stored for the legally established period. The use of ALDAN MERIDIAN, SL 's WhatsApp account for sending content other than that necessary to respond to your inquiry, or content that is illegal under national or international law, that violates fundamental human rights, or that contravenes the principles of legality, honesty, responsibility, privacy, consumer protection, and intellectual and industrial property rights, is prohibited.

SUBMIT CV

If you submit your CV through our website, please be advised that the information you provide will be used to include you in any selection processes we may be conducting. We will analyze your profile to select the best candidate for the open position of Manager. Please note that this is the only official method for submitting your CV; therefore, CVs submitted through any other means will not be accepted. If any of your information changes, please notify us in writing as soon as possible so we can keep your records up to date.

The data may be processed and/or communicated to the companies that are part of our group during the time your resume is kept and for the same purposes previously informed.

REMARKETING AND RETARGETING

Remarketing is a system that allows you to create tailored or personalized ads for users who have previously visited a website, in this case, ours. It's a solution associated with Google Ads (formerly AdWords) with the goal of achieving a better return on investment (ROI). Remarketing places a cookie on the user's computer, and on websites affiliated with Google AdSense that display display ads, a banner from the provider is shown.

Retargeting is the technique used to show, on other websites thanks to a tracking system, graphic ads to a user who has left our site without completing a process we wanted them to finish (registration, purchase, request, etc.), these ads should be mainly aimed at the conversion goal of our website.

The information we collect through these features is gathered by cookies from Facebook, Twitter, DoubleClick, and Google AdWords. You can learn more about the data these cookies collect in the privacy policies of each service below:

• Facebook

• X

• Google Adword

If you do not want this information to be collected by these cookies, disable Google's use of cookies through Google's ad settings. You can also disable the use of third-party cookies through the Network Advertising Initiative opt-out page.

This type of service allows interaction with social networks or other external platforms. Interactions and information obtained by the provider will always be subject to the user's privacy settings on each social network. If a service that allows interaction with social networks is installed, it is possible that, even if users do not use the service, it may collect web traffic data related to the pages on which it is installed.

FACEBOOK ADS

The provider's website uses Facebook Ads, Facebook's advertising platform. This allows you to create campaigns and ads. When creating an ad, you can segment the audience by:

• Place

• Demographic data (age, sex, etc.)

• Interests (activities, hobbies, etc.)

• What they buy online and through other channels.

• Etc.

From the moment a user submits their information in the form enabled to join the newsletter subscription, the data obtained through Facebook Ads is subject to this privacy policy. Under no circumstances will information from Facebook be used for any other purpose.

X ADS

The provider's website uses Twitter Ads, Twitter's advertising platform. This allows users to create campaigns and ads. When creating an ad, the audience can be segmented by:

• Place

• Demographic data (age, sex, etc.)

• Interests (activities, hobbies, etc.)

• What they buy online and through other channels.

• Etc.

From the moment a user submits their information in the form enabled to join the newsletter subscription, the data obtained through Twitter Ads is subject to this privacy policy. Under no circumstances will information from Twitter be used for any other purpose.

GOOGLE ADWORDS

AdWords is a Google platform for advertisers who want to advertise on Google. The service provider uses Google AdWords, which is Google's advertising platform. This allows you to create campaigns and ads to display on other websites. When creating an ad, you can segment the audience by:

• Place

• Demographic data (age, sex, etc.)

• Interests (activities, hobbies, etc.)

• What they buy online and through other channels.

• Etc.

From the moment a user submits their information in the form enabled to join the newsletter subscription, the data obtained through Google AdWords is subject to this privacy policy. Under no circumstances will information from Google be used for any other purpose.

The provider may select and publish customer testimonials for the Services. These testimonials may contain personally identifiable information, such as your name and/or city, state, or country of residence. If you wish to have your name or testimonial removed from the website, you must contact the provider using the contact information provided above.

Use of reCAPTCHA

This website uses the reCAPTCHA service provided by Google LLC to protect forms and prevent automated submissions (spam). Within the framework of this service, the data controller is the owner of this website, while Google acts as the data processor. reCAPTCHA analyzes user behavior to determine whether the interaction is being carried out by a natural person. To do this, it may collect data such as IP address, browser information, operating system, mouse movements, time spent on the page, and other interaction variables.

This data is processed based on the legitimate interest of the controller in ensuring the security of the website and preventing malicious automated access.

You can find more information about Google's data processing practices at: https://policies.google.com/privacy .

VIDEO SURVEILLANCE

Images are captured for the purpose of preserving the safety of people and property, as well as the facilities.

The user is informed by means of a video surveillance sign located in a place prior to the camera and sufficiently visible, which informs that the facilities are under video surveillance.

No transfers are foreseen, except to the Security Forces and Corps, nor will any international data transfers be carried out.

The images will be stored for a maximum of 30 days from the date of capture. After this period, the images must be deleted, in accordance with current regulations. These regulations stipulate: “Deletion will result in the blocking of the data, which will be retained only at the disposal of Public Administrations, Judges, and Courts, to address any potential liabilities arising from the processing, for the duration of the applicable statute of limitations. Once this period has expired, the images must be permanently deleted.”

CHANGES TO THIS PRIVACY POLICY

PRESTIGE HOTELS reserves the right to modify this policy to adapt it to new legislation or case law.

REVOCABILITY

The consent given, both for the processing and transfer of data of the interested parties, is revocable at any time by notifying PRESTIGE HOTELS in accordance with the terms established in this Policy for the exercise of rights. This revocation will in no case have retroactive effect.

LEGISLATION

In general, the relations between PRESTIGE HOTELS with the Users of its telematic services, present on this website, are subject to Spanish legislation and jurisdiction to which the parties expressly submit, with the Courts and Tribunals of the domicile of the provider (if not considered as a consumer for the purposes of the TRLGDCU) or of the user (if considered as a consumer for the purposes of the TRLGDCU) being competent for the resolution of all conflicts arising from or related to its use.