In compliance with current regulations on data protection, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, known as the General Data Protection Regulation (GDPR) and Organic Law 3/2018 of December 5 (LOPDGDD), we inform you that our company's Data Protection Policy and Privacy Policy, with regard to the processing of your personal data, is as follows:
Responsible for the processing of personal data:
The controller of personal data is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of the processing.
In this case, the data of the data controller are as follows:
Identity: Hotel Llané Petit
CIF:
Postal Address: Playa Llane Petit, s/n 17488 Cadaqués, Girona, Spain
Telephone: (+34) 972 25 10 20
Email address: info@llanepetit.com
Hotel Llané Petit, as the data controller and website owner, in accordance with current legislation and specifically with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSICE), hereby informs you that we have implemented appropriate technical and organisational measures, in accordance with the state of the art and the cost of their application in relation to the risks and nature of the personal data processed, to guarantee and protect the confidentiality, integrity and availability of your personal data.
Personal data:
Personal data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is any person whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
There is a wide variety of information that is considered personal data, for example, name, contact information, identification number, computer IP, etc.
For more information, you can visit the website of the Spanish Data Protection Agency or the Catalan Data Protection Authority, among others.
Processing of personal data:
Personal data processing is any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of enabling access, alignment or interconnection, restriction, erasure or destruction of data.
Purpose of data processing:
For what purpose do we process your personal data?
The personal data provided by the interested parties will be used exclusively for the following purposes:
- Booking, registration, and contracting of products: Manage and execute the provision of the services and/or products contracted or requested by the interested party, as well as the necessary steps to carry out the contractual relationship with the interested party, which includes informing, processing, managing, modifying, and any other operation necessary for managing their booking or purchase, as well as subsequent billing and collection. Usage analyses may be conducted based on the purchase and booking history of a single interested party, without any automated decisions having legal effect being made under any circumstances.
- Traveler check-in logbook for hospitality establishments: Collect, manage, and submit the information established by current legal regulations regarding the traveler check-in logbook for hospitality establishments.
- Queries: Respond to, answer, and follow up on queries and requests made by interested parties and/or provide information requested by the user.
- Access to the private area "My Booking": Manage registration and allow access to the information on the website regarding the status of your booking, as well as general account administration, which allows you to modify your account details, maintain, control, manage, or cancel your account, if you have registered as a user.
- Advertising of our own products and services: Sending commercial advertising communications (newsletters) related to our products and services by any means (email, postal mail or telephone), with promotions and discounts, invitations to events organized by the company, etc., provided that the interested party has accepted and consented to the sending of commercial communications by registering and subscribing to the Newsletter.
- Completion of unfinished bookings: Contacting the user by any means (email or telephone) if the booking has not been completed in order to find out the reason why it has not been completed.
- Job board: To assess and manage your CV and the academic and professional data you have provided to us for the selection processes you have applied for or those that fit your professional profile, and to carry out the necessary actions for the selection and hiring of personnel, including contacting you for further information or arranging an interview, provided that the interested party has registered on the form to work with us and/or has provided us with their CV.
- Communicate changes to the privacy policy: Notify or communicate relevant changes to the data protection and privacy policy, legal notice, or cookie policy.
- Statistics: Conduct market research and statistics on our products and services, without any automated decision-making.
- The company informs you that it will not process your personal data for any purpose other than those listed in this section, except in cases where there is a legal obligation or judicial requirement.
- Your personal data will not be subject to decisions based on automated processing that have legal implications for the data subject.
How long will we retain your personal data?
The personal data you have provided will be retained for the time necessary to carry out the requested or contracted service, and for a maximum period of 5 years from your last confirmation that you are interested in us retaining your data.
This is without prejudice to possible longer retention for the purposes of potential compliance with legal obligations and for the exercise and monitoring of any legal and judicial actions that may be relevant.
After the indicated periods have elapsed, the personal data will be deleted.
Legitimation for the processing of your data:
The legal basis for the processing of your personal data is the user's free and legitimate acceptance of the legal relationship at the time of accepting this Personal Data Protection and Privacy Policy.
Likewise, the legitimacy for the processing of your data for each of the personal data processing purposes identified above is detailed below:
- Booking, registration, and contracting of products: The legal basis for the processing of your personal data is the contractual and, where applicable, pre-contractual relationship established between the parties for the provision of the services and/or products contracted or requested by the interested party, and specifically, for the execution of the booking of the services and products of our establishment that you have made, in accordance with the terms and conditions set forth in the Terms and Conditions of Contract section, as well as compliance with the corresponding commercial, tax, and accounting obligations. All of this is based on the provisions of Article 6.1, sections a) and b) of the GDPR.
- Failure to provide the personal information requested for the booking will therefore make it impossible to complete the requested contract or booking. For more information on purchasing our products and services, please see the Terms and Conditions section. Once the booking is made, the interested party will receive a confirmation email with the booking details.
- Traveler check-in logbook for hospitality establishments: The legal basis for processing your personal data is the legal obligation established regarding the collection, management, and transmission to the competent law enforcement agencies, as set forth in Organic Law 4/2015 of March 30, on the Protection of Citizen Security, and other implementing regulations. This is based on the provisions of Article 6.1, section c) of the GDPR. Failure to provide the requested personal data will therefore make it impossible for you to stay at the establishment.
- Inquiries: The legal basis for the processing of your personal data is the ability to respond to inquiries freely submitted by data subjects. This processing is carried out in accordance with the provisions of Article 6.1 (a) and (b) of the GDPR.
- Access to the private area "My Bookings": If the data subject has registered as a user to access, view, modify, or cancel the status of "My Bookings" from the website, the legal basis for processing their data is the contractual or pre-contractual relationship between the parties. This legal basis is the contractual or pre-contractual relationship between the parties. This legal basis allows access to the information on the website regarding the status of their booking, as well as the ability to modify or cancel bookings, if they have registered as a user. This legal basis also allows them to freely and expressly accept and consent to process their data. This processing is lawful pursuant to Article 6.1 (a) and (b) of the GDPR. Failure to provide the requested personal data will make it impossible to access said information from the website.
- Advertising for our own products and services: If the data subject has checked the box to accept receiving commercial advertising communications (newsletters), the legal basis for sending advertising about products and services is the data subject's own free and express consent, which may be withdrawn at any time. The withdrawal of consent for this purpose does not affect the execution of the room booking contract, where applicable. This processing of personal data is based on the provisions of Article 6.1 (a) of the GDPR. Refusal to provide the requested personal data will therefore make it impossible to subscribe to the newsletter or receive commercial communications with information about our products or services. We inform you that you have the right to withdraw your consent for this processing at any time, without affecting the lawfulness of the processing based on the consent given prior to its withdrawal. If you wish to withdraw your consent, please see the section "Rights of Data Subjects."
- Completion of unfinished bookings: The legitimacy for processing data in this case is the express acceptance and consent of the data subject to this processing so that the company can contact them in the event of a technical incident occurring at the time of making the booking or booking. This processing of personal data is based on the provisions of Article 6.1 (a) of the GDPR. Refusal to provide the personal data requested for the booking will therefore make it impossible to execute and conclude the requested contract or booking.
- Job board: If the interested party has registered on the application form to work with our company and/or has provided us with their resume, the legal basis for processing their data is their free acceptance and consent to process their personal data and the evaluation and management of their job application, all in accordance with the provisions of Article 6.1 (a) (ib) of the GDPR. Failure to provide the requested personal data will make it impossible to process and manage their job application.
- Communicate changes to the privacy policy: The legitimacy for processing personal data in this case is based on the convenience of communicating to the interested parties any changes that may occur in the company's privacy policy, as well as their free acceptance and consent to this processing, based on the provisions of article 6.1 sections a) ib) of the GDPR.
- Statistics: The legitimacy for processing data for market research and statistics on our products and services, without any automated decision-making with legal effects for the data subject, is the free acceptance and consent of the data subject for this processing, based on the provisions of Article 6.1 (a) of the GDPR. We inform you that you have the right to withdraw your consent for this processing at any time, without affecting the lawfulness of the processing based on the consent given prior to its withdrawal. If you wish to withdraw your consent, please see the section "Rights of Data Subjects."
Recipients of data assignments or transfers:
Your personal data will be shared with other companies within the group for purposes related to the processing of customers' or users' personal data.
To better fulfill the services requested from us, we provide certain data to data processors with whom we have signed the corresponding data protection contracts. In these cases, the data provided is only that which is strictly necessary for the specific activity to be carried out. The following services may be contracted from data processors: IT service providers, security companies, tax, legal, or other legal advisors, etc. The above list is provided as an example, and the company may use services from companies belonging to other sectors to provide quality services. Outside of these cases, no transfer or communication of data is planned, either within or outside the EU.
Information will also be provided to third parties in cases where this is required by current regulations or when required by courts (public administrations, courts and tribunals, law enforcement agencies, tax authorities, etc.).
Rights of interested parties:
We inform you that as an interested party you have the following rights:
- Right of access: Anyone has the right to know and obtain information about the personal data we process.
- Right to rectification: Interested parties have the right to request rectification, completion, and/or correction of inaccurate, incorrect, or incomplete data.
- Right to erasure (also known as the “right to be forgotten”): Data subjects, if they deem it appropriate, have the right to request the erasure of personal data concerning them, among other reasons, when the data is no longer necessary for the purposes for which it was collected.
- Right to erasure: Interested parties may request the erasure of their data.
- Right to object: Data subjects may object to the processing of their data for marketing purposes, including profiling, and in the other cases established in Article 21 of the GDPR. Upon request, the company will stop processing the data, except for compelling legitimate reasons or to exercise or defend potential legal claims.
- Right to restriction of processing: In certain circumstances provided for in Article 18 of the GDPR, data subjects may request restriction of the processing of their data. In this case, we will only retain it to exercise or defend legal claims. Specifically, you have the right to restrict processing in the following cases:
- The interested party challenges the accuracy of the personal data, for a period that allows the controller to verify the accuracy of the data.
- The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
- The controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defense of legal claims.
- The data subject has objected to processing, on grounds relating to his or her particular situation, to the processing of his or her personal data based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; i.e., processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, pending the verification of whether the legitimate grounds of the controller override those of the data subject.
- Right to data portability: Data subjects have the right to obtain their personal data in a structured, commonly used, machine-readable format, so that it can be transmitted to another data controller, in accordance with Article 20 of the GDPR.
- Right not to be subject to automated individual decisions: Data subjects have the right not to be subject to a decision based on the automated processing of their data that produces legal effects.
- Right to withdraw consent: Data subjects have the right to withdraw their consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to its withdrawal.
To withdraw your consent to receive marketing communications about our products and services, please see the section "How can you exercise your rights?" You can also unsubscribe directly each time you receive a marketing communication by email.
Data subjects can obtain additional information about their rights on the website of the Spanish Data Protection Agency or the Catalan Data Protection Authority.
How can you exercise your rights?
You can exercise your rights by sending a letter to the postal address Platja Llané Petit, s/n, 1788, Cadaqués, Girona, Spain (+34) 972 25 10 20 or to the email address info@llanepetit.com, with the subject “Personal Data” attaching a photocopy of your identity document or any similar means established by law.
What avenues for complaint are available?
If you believe your rights have not been adequately respected, you have the right to file a complaint with the Spanish Data Protection Agency or any other competent supervisory authority.
Information processed:
What categories of personal data do we process?
We strive to ensure that the information we request is minimal and necessary to fulfill the purposes outlined in this Data Protection and Privacy Policy.
Our company may process the following categories of personal data:
- Identification data: name and surname, identification number, country, etc.
- Postal or electronic addresses and telephone number.
- Economic and financial information, for managing the booking and subsequent billing and collection of the requested service.
- Data relating to the products and services contracted (hotels booked, frequency, length of stay, previously booked hotels, etc.).
- Identification codes or keys, if you have registered as a user in the “My Bookings” section of the website or in the “Club”.
- Academic details and employment information, if you have decided to apply for a job or send us your resume.
- Website browsing data. For more information, see the section on Cookies.
No specially protected data or special categories of data are processed.
The categories of data subjects whose personal data we process a priori are those interested in our company's products and services, as well as in contracting or reserving them. Data subjects are also considered to be those who register with the job board or submit their resumes.
The interested party guarantees that the personal data provided is true and is responsible for informing the company of any changes or errors therein, thereby being responsible for the truthfulness and accuracy of the data provided at all times.
If the data subject intends to share the personal data of a third party, they must have previously informed the third party and obtained their consent, in accordance with our Data Protection and Privacy Policy. Therefore, if the user has entered the personal data of a third party, they declare and guarantee that they have the third party's consent for the sharing of their data and its subsequent processing by our company, and that they have previously informed the third party whose data they provide of the content of this Data Protection and Privacy Policy.
Personal data we collect automatically:
When you visit our websites, we automatically collect certain information, even if no booking or booking is made. This information may include your IP address, the date and time you accessed our services, information about your hardware, software, or internet browser, and your selected language.
This information allows us to improve the services and user experience on the website, identify potential fraudulent uses and potential attacks on website security, and compile statistics on the website's use and effectiveness. Unless fraudulent use or violation of website security is detected, this data will not be retained. Under no circumstances will automated decisions with legal effects for the user be made based on this information.
For more information, see the section on Cookies.
Sending communications:
Whenever the interested party makes a booking or purchases a service or product, they will receive an email confirming their booking or purchase, including information about it. We may also contact them to inform them of any changes or updates related to their booking.
Furthermore, the company may send commercial communications related to the products or services it offers, provided you have expressly and specifically consented to this by checking the box provided for this purpose or by any other express expression of consent in this regard.
The data subject may withdraw their consent to receive any type of commercial communication at any time by sending a communication in accordance with the terms set forth in the "Rights of Data Subjects" section. This option will also be offered to the data subject in each commercial communication they receive via email or SMS.
Communication of data by minors:
The services offered through the website are only available to adults. Therefore, those who do not meet this requirement should refrain from providing personal information on the website.
Links to third-party pages:
Our website may contain links to the websites of third-party companies and entities. Since we cannot be held responsible for the manner in which these companies treat the privacy and personal data of their users, we advise you to carefully read the privacy policy statements of these websites, which are not owned by the company, regarding the use, processing, and protection of personal data.
Social media:
Our company uses social media to promote its services and products and share information and experiences with its users and followers.
Since we cannot be held responsible for the way these companies handle privacy and personal data protection, and each has its own policy on this matter, we advise you to carefully read the privacy policy statements of each social network regarding their handling of users' personal data before using them.
Changes to the Privacy Policy:
The company reserves the right to modify this Data Protection and Privacy Policy in accordance with the data processing it carries out and applicable legislation at any given time, which it will duly inform you of on the website. Therefore, it recommends that interested parties review it periodically to be informed of how the company processes and protects their personal data.
Questions and doubts:
If you have any questions or concerns about this privacy policy, please contact us by sending an email to (info@llanepetit.com) with the subject “Privacy Policy”.