In compliance with current regulations on data protection, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, known as the General Data Protection Regulation (RGPD or GDPR) and the Organic Law 3/2018 of December 5 (LOPDGDD), we inform you that the Data Protection Policy and Privacy Policy of our company, with regard to the processing of your personal data, is as follows:
RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA:
The controller of the processing of personal data is the natural or legal person, public authority, service or other body which, alone or jointly with others, determines the purposes and means of the processing.
In this case, the data of the person responsible for the treatment are the following:
Identity: Hotel Galena Mas Comangau
Postal Address: c/. Ramon Llull, 1, 17255 Begur, Girona
Telephone 972 62 32 10
Email address: info@mascomangau.com
Hotel Galena Mas Comangau as responsible for the data and the website, in accordance with current legal regulations, and specifically, with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 of April 2016 regarding the protection of natural persons regarding the processing of personal data and the free circulation of these data (GDPR or GDPR), as well as Law 34/2002, of July 11, on Community Services. Information Society and Electronic Commerce (LSSICE), we inform you that we have implemented appropriate technical and organizational measures, according to the state of the art and the cost of their application with respect to the risks and nature of the personal data processed, to guarantee and protect the confidentiality, integrity and availability of your personal data.
PERSONAL INFORMATION:
Personal data is any information about an identified or identifiable natural person (“the data subject”); An identifiable natural person is any person whose identity can be determined, directly or indirectly, in particular by means of an identifier, such as a name, an identification number, location data, an online identifier or one or more elements specific to identity. physical, physiological, genetic, mental, economic, cultural or social of said person.
There is a wide variety of information that is considered personal data, for example, name, contact information, identification number, computer IP, etc.
To expand this information you can consult the website of the Spanish Data Protection Agency or the Catalan Dades Protection Authority, among others.
PROCESSING OF PERSONAL DATA:
Processing of personal data is considered any operation or set of operations carried out on personal data or sets of personal data, whether by automated procedures or not, such as collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of enabling access, collation or interconnection, limitation, deletion or destruction of data.
PURPOSE OF DATA PROCESSING:
For what purpose do we process your personal data?
The personal data provided by the interested parties will be used exclusively for the following purposes:
• Reservation, registration and contracting of products: Manage and execute the provision of the services and/or products contracted or requested by the interested parties, as well as the necessary procedures to carry out the contractual relationship with the interested party, which includes informing, processing , manage, modify and any other operation that is necessary for the management of your reservation or purchase, as well as subsequent billing and collection. Use analyzes can be carried out based on the purchase and reservation history of the same interested party, without in any case automated decisions being made that have legal effects.
• Record book of traveler entries in hospitality establishments: Collect, manage and send the information established by current legal regulations regarding the record book of traveler entries in hotel establishments.
• Queries: Attend, respond and follow up on queries and requests made by interested parties and/or provide information requested by the user.
• Access to the private area “my reservation”: Manage the registration and allow access to the information contained on the website related to the status of your reservation, as well as the general administration of the account, which allows modifying its data. , its maintenance, control, management or cancellation, in the event that you have registered as a user.
• Advertising of our own products and services: Send commercial advertising communications (newsletters) related to our products and services by any means (email, postal mail or telephone), with promotions and discounts, invitations to events organized by the company, etc. in the event that the interested party has accepted and consented to the sending of commercial communications by registering and subscribing to the Newsletter.
• Completion of unfinished reservations: Contact the user by any means (email or telephone) in the event that the reservation has not been finalized in order to find out the reason why it has not been finalized.
• Job bank: Assess and manage your resume and the academic and professional data that you have provided us, for the selection processes to which you have registered or those that adapt to your professional profile, and carry out the necessary actions. for the selection and hiring of personnel, and among them, contact you to expand the information or arrange an interview, in the event that the interested party has registered in the form to work with us and/or has provided his resume.
• Communicate changes to the privacy policy: Notify or communicate relevant changes to the data protection and privacy policy, legal notice or cookie policy.
• Statistics: Carry out market studies and statistics on our products and services, without in any case making automated decisions.
The company informs you that it will not process your personal data for any other purpose except those included in this section, except in cases where there is a legal obligation or judicial requirement.
Your personal data will not be the subject of decisions based on automated treatments that have legal effects for the interested party.
How long will we keep your personal data?
The personal data that you have provided to us will be kept for the time necessary to carry out the requested or contracted service, and for a maximum period of 5 years from the last confirmation on your part of the existence of interest in us maintaining your data. .
This is understood without prejudice to a possible longer conservation for the purposes of eventual compliance with legal obligations and for the exercise and monitoring of legal and judicial actions that may be relevant.
After the indicated deadlines, the personal data will be deleted.
LEGITIMATION FOR THE PROCESSING OF YOUR DATA:
The legal basis for the processing of your personal data responds to the free and legitimate acceptance of the legal relationship by the user at the time of acceptance of this Personal Data Protection and Privacy Policy.
Likewise, the legitimacy for the processing of your data is detailed below for each of the purposes of processing personal data that have been previously identified:
• Reservation, registration and contracting of products: The legal basis for the processing of your personal data is the contractual and, where applicable, pre-contractual relationship established between the parties for the execution of the provision of the services and/or products contracted or requested. by the interested parties, and specifically, for the execution of the reservation of the services and products of our establishment that has been made, according to the terms and conditions that appear in the Contract Terms and Conditions section, as well as the fulfillment of the obligations commercial, fiscal and accounting that correspond. All of this is based on the provisions of article 6.1 sections a) and b) of the RGPD.
• Refusal to provide the personal data requested for the reservation will, therefore, make it impossible to carry out the requested contract or reservation. For more information about contracting our products and services, see the Contract Conditions and Terms section. Once the reservation is made, the interested party will receive a confirmation email with the reservation details.
• Record book of traveler entries in hospitality establishments: The legal basis for the processing of your personal data is the legal obligation established regarding the collection, management and referral to the competent security bodies established in Organic Law 4/2015. , of March 30, Protection of Citizen Security and other development regulations. This is based on the provisions of article 6.1 section c) of the RGPD. Refusal to provide the requested personal data will therefore make it impossible to stay at the establishment.
• Queries: The legal basis for the processing of your personal data is the possibility of responding to queries freely posed by the interested parties. This treatment is carried out based on the provisions of article 6.1 sections a) and b) of the RGPD.
• Access to the private area “my reservation”: If the interested party has registered as a user to be able to access, consult, modify or cancel the status of “my reservations” from the website, the legal basis for the processing of Your data is the contractual or pre-contractual relationship existing between the parties and allow access to the information contained on the website regarding the status of your reservation, as well as modifying its data or canceling it, in the event that it has been registered as a user, as well as your free and express acceptance and consent to process your data. This treatment is lawful based on the provisions of article 6.1 sections a) and b) of the RGPD. Refusal to provide the requested personal data will make it impossible to access said information from the website.
• Advertising of own products and services: If the interested party has checked the box corresponding to accepting receiving commercial advertising communications (newsletters), the legal basis for sending advertising about products and services is the interested party's own free and express consent, which can withdraw at any time, without the withdrawal of consent for this purpose conditioning the execution of the room reservation contract, if applicable. This processing of personal data is based on the provisions of article 6.1 section a) of the RGPD. Refusal to provide the requested personal data will therefore make it impossible to subscribe to the newsletter or receive commercial communications with information about our products or services. We inform you that you have the right to withdraw your consent for this treatment at any time, without affecting the legality of the treatment based on the consent prior to its withdrawal. If you wish to withdraw your consent, consult the “Right of interested parties” section.
• Completion of unfinished reservations: The legitimacy to process the data in this case is the acceptance and express consent by the interested party of this processing so that the company can contact the interested party in the event that a technical incident has occurred. at the time of booking or contracting. This processing of personal data is based on the provisions of article 6.1 section a) of the RGPD. Refusal to provide the personal data requested for the reservation will, therefore, make it impossible to carry out and conclude the requested contract or reservation.
• Job bank: In the event that the interested party has registered in the form to work with our company and/or has provided us with their curriculum vitae, the legal basis for the processing of their data is their free acceptance and consent to process your personal data and the evaluation and management of your employment application, all based on the provisions of article 6.1 sections a) ib) of the RGPD. Refusal to provide the requested personal data will make it impossible for your job application to be managed and processed.
• Communicate changes in the privacy policy: The legitimacy to process personal data in this case is based on the convenience of communicating to the interested parties the changes that may occur in the company's privacy policy, as well as their free acceptance and consent for this treatment, based on the provisions of article 6.1 sections a) ib) of the RGPD.
• Statistics: The legitimacy to process data to carry out market studies and statistics of our products and services, without in any case making automated decisions with legal effects for the interested party, is the free acceptance and consent of the interested party for this. treatment, based on the provisions of article 6.1 sections a) of the RGPD. We inform you that you have the right to withdraw your consent for this treatment at any time, without affecting the legality of the treatment based on the consent prior to its withdrawal. If you wish to withdraw your consent, consult the “Right of interested parties” section.
RECIPIENTS OF DATA ASSIGNMENTS OR TRANSFERS:
Your personal data will be communicated to other companies in the business group for purposes related to the processing of personal data of clients or users.
For the best fulfillment of the services that have been requested of us, we provide certain data to data processors with whom we have signed the corresponding data protection contracts. In these cases, the data provided is only what is strictly necessary for the specific activity to be carried out. By way of example, the services that can be contracted to data processors are listed: computer service providers, security companies, tax, legal or legal advice, etc. The above relationship is provided as an example, with the company being able to use services from companies belonging to other sectors of activity to be able to provide quality services. Outside of these cases, no transfer or communication of data has been planned either inside or outside the EU.
Information will also be provided to third parties in cases where it is imperatively established by current regulations or when judicially required (public administrations, courts and tribunals, security forces and bodies, tax agency, etc.)
RIGHTS OF INTERESTED PERSONS:
We inform you that as an interested person you have the following rights:
• Right of access: anyone has the right to know and obtain information about the personal data we process.
• Right to rectification: interested parties have the right to request rectification, supplementation and/or correction of inaccurate, incorrect or incomplete data.
• Right to deletion (also known as “right to be forgotten”): interested parties, if they consider it appropriate, will have the right to request the deletion of personal data that concerns them, among other reasons, when the data is no longer necessary to the purposes for which they were collected.
• Right of cancellation: interested parties can request the cancellation of their data.
• Right to object: interested parties may object to the processing of their data for marketing purposes, including profiling, and in the rest of the cases established in article 21 of the RGPD. If you request it, the company will stop processing the data, except for compelling legitimate reasons or to exercise or defend possible claims.
• Right to limit processing: in certain circumstances provided for in Article 18 GDPR, interested parties may request the limitation of the processing of their data. In this case, we will only keep them to exercise or defend claims. Specifically, you have the right to limit the processing in cases where:
• The interested party challenges the accuracy of the personal data, during a period that allows the person responsible to verify its accuracy.
• The processing is unlawful and the interested party opposes the deletion of the personal data and requests instead the limitation of its use.
• The controller no longer needs the personal data for the purposes of the processing, but the interested party needs it for the formulation, exercise or defense of claims.
• The interested party has objected to the processing for reasons related to their particular situation to their personal data being processed based on the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the data controller; i/or the processing is necessary for the satisfaction of legitimate interests pursued by the data controller or by a third party, while verifying whether the legitimate reasons of the controller prevail over those of the interested party.
• Right to data portability: interested parties have the right to obtain their personal data in a structured, commonly used and machine-readable format, so that it can be transmitted to another controller, under the terms of article 20 of the RGPD.
• Right not to be subject to automated individual decisions: interested parties have the right not to be subject to a decision based on the automated processing of their data that produces legal effects.
• Right to withdraw the consent given: interested parties have the right to withdraw the consent given at any time. The withdrawal of consent will not affect the legality of the processing carried out before its withdrawal.
To withdraw your consent regarding the sending of commercial communications about our products and services, see the section “How can you exercise your rights?” You can also unsubscribe directly each time you receive a commercial communication by email.
Interested parties can obtain additional information about their rights on the website of the Spanish Data Protection Agency or the Catalan Dades Protection Authority.
HOW CAN YOU EXERCISE YOUR RIGHTS?
You can exercise your rights by writing to the postal address c/. Ramon Llull, 1, 17255 Begur, Girona, Espanya 972 62 32 10 or to the email info@mascomangau.com, with the subject “Personal Data” attaching a photocopy of your identity document or any similar means established by law.
WHAT CLAIM METHODS DO YOU HAVE?
If you consider that your rights have not been adequately addressed, the interested party has the right to file a claim with the Spanish Data Protection Agency or with any competent supervisory authority.
INFORMATION PROCESSED:
What categories of personal data do we process?
We ensure that the information we request is the minimum and necessary for the management of the purposes stated in this Data Protection and Privacy Policy.
Our company may process the following categories of personal data:
• Identification data: name and surname, identification number, country, etc.
• Postal or electronic addresses and telephone number.
• Economic and financial information, for the management of the reservation and subsequent billing and collection of the requested service.
• Data related to the contracted products and services (hotels reserved, frequency, length of stay, hotels previously reserved, etc.).
• Identification codes or keys, in the event that you have registered as a user in the “My reservations” section of the website or in the “Club”.
• Academic data and employment information, in the event that you have decided to register for a job offer or send us your resume.
• Navigation data on the website. For more information, see the section on Cookies or computer cookies.
No specially protected data or special categories of data are processed.
The categories of interested parties whose personal data we process a priori are people interested in the products and services of our company, as well as in contracting or booking them. People who register on the job board or send their resume will also be considered interested.
The interested party guarantees that the personal data provided are true and is responsible for communicating to the company any modification or error therein, therefore being responsible for the veracity and accuracy of the data provided at all times.
If the interested party intends to communicate personal data of third parties, they must have previously informed and obtained their consent, in accordance with our Data Protection and Privacy Policy. For this reason, if the user has entered personal data from a third party, they declare and guarantee that they have the consent of the third party for the communication of their data and subsequent processing thereof by our company, as well as that has previously informed the third party whose data it provides of the content of this Data Protection and Privacy Policy
Personal data we collect automatically:
When the interested party visits our websites we collect certain information automatically, even if in the end no reservation or contract is made. This information may include the IP address, the date and time our services were accessed, information about the hardware, software or internet browser you use, the language selected, among others.
This information allows us to improve the services and user experience on the website, and identify possible fraudulent uses and possible attacks on the security of the website, as well as compile statistics on the use and effectiveness of the website. Unless fraudulent use or use against the security of the website is detected, this data will not be kept. Under no circumstances will automated decisions with legal effects for the user be made based on this information.
For more information, see the section on Cookies or computer cookies.
SENDING COMMUNICATIONS:
Whenever the interested party makes a reservation or contracts a service or product, an email will be sent in which the reservation or contract confirmation will be communicated, with information about it. Likewise, we may contact the interested party in order to inform them of any modification or news related to it.
On the other hand, the company may send commercial communications related to the products or services it offers as long as it has expressly and specifically consented to this by validating the box enabled for this purpose or by any expression of express consent in this regard.
The interested party may withdraw their consent to receive any type of commercial communication at any time by sending communication in the terms set out in the “Right of interested parties” section. Likewise, this possibility will also be offered to the interested party in each commercial communication received via email or SMS.
COMMUNICATION OF DATA BY MINORS:
The services offered through the website are only available to adults. Therefore, those who do not comply with this condition must refrain from providing personal information on the website.
LINKS TO THIRD PARTY WEBSITES:
Our website may contain links to websites of third-party companies and entities. Since we cannot be responsible for the way in which these companies treat the protection of the privacy and personal data of their users, we advise them to carefully read the privacy policy statements of these websites that are not owned by the company in relation to the use, processing and protection of personal data.
SOCIAL MEDIA:
Our company uses social networks to publicize its services and products and share information and experiences with its users and followers.
Since we cannot be responsible for the way in which these companies treat the protection of privacy and personal data, and since each of them has their own policy on the matter, we advise you to carefully read the policy statements of privacy of each social network regarding the processing they carry out with the personal data of their users, before using them.
MODIFICATIONS IN THE PRIVACY POLICY:
The company reserves the right to modify this Data Protection and Privacy Policy in accordance with the data processing carried out and with the legislation applicable at all times, which will be duly informed on the website, and therefore recommends the interested party to review it periodically to be informed of how the company treats and protects their personal data.
QUESTIONS AND DOUBTS:
If you have any questions or concerns about this privacy policy, please contact us by sending an email to (info@mascomangau.com) with the subject “Privacy Policy”.