Privacy policy

INDEX

Privacy Policy Objective
Definitions
Identity of the Data Controller
Applicable Laws and Regulations
Principles applicable to the processing of personal data
Data Processing Activities conducted
Necessary and Updated Information
Personal data of minors
Technical and Organizational Security Measures
Rights of the Data Subjects
Complaints before the Supervisory Authority
Acceptance and Changes in the Privacy Policy

1.- OBJECTIVE OF THE PRIVACY POLICY

The purpose of this “Privacy and Data Protection Policy” is to inform about the conditions governing the collection and processing of personal data by HOTEL SIRENAS SEGOVIA S.L., making every effort to safeguard the fundamental rights, honor, and freedoms of the individuals whose personal data is processed, complying with the current regulations and laws governing the Protection of Personal Data according to the European Union and the Spanish Member State, particularly those expressed in the “Data Processing Activities” section of this Privacy Policy.

Therefore, in this Privacy and Data Protection Policy, users of the Website https://www.recordishotels.com are informed of all the details of interest regarding how these processes are carried out, for what purposes, which other entities may have access to their data, and what the rights of the users are.

2.- DEFINITIONS

«Personal data»: Any information about an identified or identifiable natural person (“the user of the Website”); a natural person is considered identifiable when their identity can be established, directly or indirectly, in particular by an identifier such as a name, an identification number, location data, an online identifier, or one or more elements specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
«Processing»: Any operation or set of operations performed on personal data or sets of personal data, whether by automated means or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, or combination, restriction, erasure, or destruction.
«Limitation of processing»: Marking personal data stored for the purpose of limiting their processing in the future.
«Profiling»: Any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects of a natural person, in particular to analyze or predict aspects concerning professional performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that natural person.
«Pseudonymization»: The processing of personal data in such a way that they can no longer be attributed to an identified natural person without additional information, provided that this additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
«File»: Any structured set of personal data accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis.
«Controller» or «controller»: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of the processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
«Processor» or «processor»: The natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
«Recipient»: A natural or legal person, public authority, agency, or another body to whom personal data are disclosed, whether or not a third party. However, public authorities that may receive personal data in a specific investigation in accordance with Union or Member State law shall not be considered recipients; the processing of such data by such public authorities shall comply with the data protection rules applicable to the purposes of processing.
«Third party»: A natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
«Consent of the data subject»: Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
«Personal data breach»: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
«Genetic data»: Personal data relating to the inherited or acquired genetic characteristics of a natural person which provide unique information about the physiology or health of that natural person, obtained in particular from the analysis of a biological sample from that natural person.
«Biometric data»: Personal data obtained from specific technical processing relating to the physical, physiological, or behavioral characteristics of a natural person which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.
«Health data»: Personal data relating to the physical or mental health of a natural person, including the provision of health care services, disclosing information about his or her health status.
«Main establishment»: a) concerning a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment the establishment which has taken such decisions will be considered the main establishment; b) as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if there is no central administration, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place, insofar as the processor is subject to specific obligations under this Regulation.
«Representative»: a natural or legal person established in the Union who has been designated in writing by the controller or processor in accordance with Article 27 of the GDPR, to represent the controller or processor with regard to their respective obligations under this Regulation.
«Enterprise»: a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity.
«Supervisory authority»: an independent public authority established by a Member State pursuant to Article 51 of the GDPR. In the case of Spain, it is the Spanish Data Protection Agency.
«Cross-border processing»: a) processing of personal data taking place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State, or b) processing of personal data taking place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
«Information society service»: any service provided normally for remuneration, at a distance, by electronic means, and at the individual request of a recipient of services.

3.- IDENTITY OF THE DATA CONTROLLER

The Data Controller is the natural or legal person, public or private, or administrative body, who alone or jointly with others, determines the purposes and means of the processing of personal data; in case the purposes and means of the processing are determined by the European Union Law or Spanish Member State.

In the aspects expressed in this Data Protection Policy, the identity and contact details of the Data Controller are as follows:

HOTEL SIRENAS SEGOVIA S.L. – NIF B40185290

Address: CALLE JUAN BRAVO, 30. 40001, Segovia (Segovia), Spain
Email: realsegovia@recordishotels.com
Phone: 921 462 663

HOTEL INFANTA ISABEL S.L. NIF: B40144693

Address: CALLE ISABEL LA CATÓLICA, 1. 40001, SEGOVIA (Segovia), Spain
Email: infanta@recordishotels.com
Phone: 921 461 300

4.- APPLICABLE LAWS AND REGULATIONS

This Privacy and Data Protection Policy is developed based on the following data protection laws and regulations:

Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Hereafter GDPR.
Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights. Hereafter LOPD/GDD.
Law 34/2002, of July 11, on Services of the Information Society and Electronic Commerce. Hereafter LSSICE.

5.- PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

The personal data collected and processed through this Website will be processed in accordance with the following principles:

Principle of legality, loyalty, and transparency: All processing of personal data carried out through this Website will be lawful and fair, with the user being fully informed when personal data concerning them are being collected, used, consulted, or processed. Information on the processing carried out will be transmitted beforehand, easily accessible, and easy to understand, in a simple and clear language.
Principle of purpose limitation: All data will be collected for specific, explicit, and legitimate purposes and will not be further processed in a manner incompatible with those purposes for which they were collected.
Principle of data minimization: The data collected will be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
Principle of accuracy: Data will be accurate and, if necessary, updated, taking all reasonable measures to promptly delete or rectify personal data that is inaccurate with respect to the purposes for which they are processed.
Principle of storage limitation: Data will be kept in a way that allows the identification of the data subjects for no longer than is necessary for the purposes of the processing of personal data.
Principle of integrity and confidentiality: Data will be processed in a way that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss or destruction, by applying appropriate technical and organizational measures.
Principle of proactive responsibility: The entity owning the Website will be responsible for complying with the principles set out in this section and will be able to demonstrate it.

6.- DATA PROCESSING ACTIVITIES

Below are the detailed data processing activities carried out through the website specifying each of the following sections:

Activity: Name of the data processing activity
Purposes: Each of the uses and treatments performed with the collected data
Legal basis: The legal basis legitimizing the data processing
Data processed: Typology of data processed
Origin: Where the data is obtained
Retention: Period during which the data is retained
Recipients: People or entities to whom the data is provided
International transfers: Cross-border transfers of data outside the European Union

ELECTRONIC COMMERCE

Section	Description
Legal basis (Art. 6.1.b GDPR)	Existence of a contractual relationship with the interested party through a contract or pre-contract
Purposes	Electronic commerce
Categories of data and collectives	E-commerce customers (Identifying data; Economic, financial, and insurance data; Transactions of goods and services)
Data source	The interested party or their legal representative
Recipient category	Tax Administration; Banks, savings banks, and rural savings banks
International transfer	Not foreseen
Retention period	For a period of 5 years from the last confirmation of interest

ACCOUNTING, TAXATION, AND TREASURY

Section	Description
Legal basis	Legal obligation of the Data Controller
Purposes	Customer/supplier management, accounting, tax, and administrative
Categories of data and collectives	Customers and suppliers (Identifying data; Economic, financial, and insurance data; Transactions of goods and services)
Data source	The interested party or their legal representative
Recipient category	Tax Administration; Banks, savings banks, and rural savings banks
International transfer	Not foreseen
Retention period	For a period of 5 years from the last confirmation of interest

CUSTOMER MANAGEMENT

Section	Description
Legal basis	Existence of a contractual relationship with the interested party through a contract or pre-contract
Purposes	Management of stay services and activities; Guest registration/Check-in
Categories of data and collectives	Customers (Identifying data; Economic, financial, and insurance data; Personal characteristics; Social circumstances; Transactions of goods and services)
Data source	The interested party or his legal representative
Recipient category	Tax Administration; Banks, savings banks, and rural savings banks
International transfer	Not foreseen
Retention period	For a period of 5 years from the last confirmation of interest