Политика конфиденциальности Hotel Rutllan & Spa

In accordance with the provisions of Law 29/2021, of October 28, on personal data classification (LQPD) and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (RGPD), all our customers are informed that the personal data collected will be incorporated and processed in the files owned by Hotel Rutllan with the sole purpose of managing and carrying out accommodation, catering and/or activities services, and sending information about our products and services...

Our customers and their details are very important to Hotel Rutllan, so we assume the commitment to:

• Do not collect any personal data without your consent

• We collect your data according to the principle of data minimization, that is, only those necessary, essential and not excessive for our purposes

• We collect and process your data only for the purposes described in our policy and we will inform your recipients

• We only collect and process the data necessary for the correct treatment of your request or personalization of the services you request from us

• We are committed to taking appropriate measures to ensure the confidentiality of your data and prevent its disclosure to unauthorized third parties

• In situations of data transfers to authorized third parties, we take all appropriate measures to guarantee the security of such transfer.

• Inform about your rights of access, rectification and opposition in accordance with Law 29/2021, October 28, 2021

DATA CONTROLLER

The party responsible for processing the client's data is Hotel Rutllan

N.R.T.: F-002775-Z

Registered office: Avinguda del Ravell,3 – AD400 La Massana

Telephone: 00 376 738 738

Email: dpd@hotelrutllan.com

DATA TYPOLOGY

Hotel Rutllan may collect and process personal information provided directly and voluntarily by you, such as your name, address, email, telephone number, date of birth, identity document number, computer IP.

We do not collect or process sensitive data such as those related to race, ethnicity, political opinions, religious or philosophical beliefs or sexual orientation.

PURPOSE OF TREATMENT AND BASIS OF LEGITIMACY

Your data is collected when:

• Contact us by phone or email in our reservations department

• Fill in your details at our receptions (check in)

• Make a reservation on our WEBSITE

• Send us an email

• Share a page or an offer through an email or through the intermediate of a social network

• Send us an email

• Subscribe to our Newsletter

To indicate any personal data through the different forms and email addresses of this website, it implies accepting and consenting to its treatment in the terms indicated in this privacy policy.

In this way, the consent or other bases of legitimation such as the execution of the contract, our legitimate interest and compliance with legal obligations, achieve the following purposes, with their respective bases of legitimation, without your data being applied or used for any other purpose for which they were collected:

The personal data provided by the interested parties will be used exclusively for the following purposes:

• Reservation, registration and contracting of products: Manage and execute the provision of services and / or products contracted or requested by the interested parties, as well as the necessary steps to carry out the contractual relationship with the interested party, which includes informing, processing, managing, modifying and any other operation that is necessary for the management of your reservation or purchase, as well as subsequent billing and collection.

• Analysis of uses can be carried out based on the purchase and reservation history of the same interested party, without automated decisions being made under any circumstances that entail legal effects.

• Registration book for travellers in hospitality establishments: Collect, manage and send the information established by current legal regulations regarding the registration book for travellers in hotel establishments.

• Queries: Attend, respond and follow up on queries and requests made by interested parties and/or provide information requested by the user.

• Access to the private area "My reservation": Manage the registration and allow access to the information contained on the website regarding the status of your reservation, as well as the general administration of the account, which allows you to modify the data of the same, its maintenance, control, management or cancellation, in case you have registered as a user.

• Advertising of own products and services: Send commercial advertising communications (newsletters) related to our products and services by any means (email, postal mail or telephone), with promotions and discounts, invitations to events organized by the company, etc. in the event that the interested party has accepted and consented to the sending of commercial communications by registering and subscribing to the Newsletter.

• Completion of unfinished reservations: Contact the user by any means (email or telephone) in the event that the reservation has not been finalized in order to know the reason why it has not been finalized.

• Communicate changes in the privacy policy: Notify or communicate relevant changes in the data protection and privacy policy, legal notice or cookies policy.

• Statistics: Carry out market studies and statistics of our products and services, without automated decisions being made under any circumstances.

The company informs you that it will not process your personal data for any other purpose except those included in this section, except in cases where there is a legal obligation or judicial requirement.

Your personal data will not be subject to decisions based on automated processing that have legal effects for the interested party.

Regarding the processing of your data for promotional or advertising purposes, the interested party will be provided, together with the corresponding data collection form, the possibility of accepting or rejecting this treatment, so that you can freely give your consent for this purpose. The consent granted may be revoked at any time and at no cost to the interested party.

Legitimation for the processing of your data

The legal basis for the processing of your personal data responds to the free and legitimate acceptance of the legal relationship by the user at the time of acceptance of this Personal Data Protection and Privacy Policy.

Likewise, the legitimacy for the processing of your data for each of the purposes of the processing of personal data that have been previously identified is detailed below:

• Reservation, registration and contracting of products: The legal basis for the processing of your personal data is the contractual and, where appropriate, pre-contractual relationship established between the parties for the execution of the provision of services and / or products contracted or requested by the interested parties, and specifically, for the execution of the reservation of the services and products of our establishment that you have made, according to the terms and conditions contained in the section of Terms and Conditions of Contract as well as compliance with the corresponding commercial, fiscal and accounting obligations. All this based on the provisions of article 6.1, sections a) and b) of the LQPD and RGPD. The refusal to provide the personal data requested for the reservation will therefore make it impossible to carry out the contract or reservation requested. For more information on the contracting of our products and services, consult the section Conditions and Terms of Contract. Once the reservation is made, the interested party will receive a confirmation email with the reservation details.

• Registration book for travellers in hospitality establishments: The legal basis for the processing of your personal data is the legal obligation established regarding the collection, management and referral to the competent security forces established in the Regulation of the Tourist Accommodation Occupancy Register (ROAT). This is based on the provisions of article 6.1 section c) of the LQPD and the RGPD. The refusal to provide the requested personal data will therefore make it impossible to stay at the establishment.

• Queries: The legal basis for the processing of your personal data is the possibility of responding to queries freely raised by the interested parties. This treatment is carried out based on the provisions of article 6.1, sections a) and b) of the LQPD and the RGPD.

• Access to the private area "my booking": In the event that the interested party has registered as a user in order to access, consult, modify or cancel the status of "my reservations" from the website, the legal basis for the processing of their data is the contractual or pre-contractual relationship between the parties and allow access to the information contained on the website regarding the status of their reservation, as well as modify the data of the same or cancel it, in case you have registered as a user, as well as your acceptance and free and express consent to process your data. This treatment is lawful based on the provisions of article 6.1, sections a) and b) of the LQPD and the RGPD. The refusal to provide the requested personal data will make it impossible to access this information from the website.

• Advertising of own products and services: In the event that the interested party has checked the box corresponding to accepting to receive commercial advertising communications (newsletters), the legal basis for sending advertising about products and services is the free and express consent of the interested party, which can be withdrawn at any time, without the withdrawal of consent for this purpose conditioning the execution of the room reservation contract, If applicable. This processing of personal data is based on the provisions of article 6.1 section a) of the LQPD and the RGPD. The refusal to provide the requested personal data will therefore make it impossible to subscribe to the newsletter or receive commercial communications with information about our products or services. We inform you that you have the right to withdraw your consent for this treatment at any time, without affecting the legality of the treatment based on the consent prior to its withdrawal. If you wish to withdraw your consent, consult the section "Right of interested parties".

• Completion of unfinished reservations: The legitimacy to process the data in this case is the acceptance and express consent by the interested party of this treatment so that the company can contact the interested party before the possibility that a technical incident has occurred at the time of making the reservation or contracting. This processing of personal data is based on the provisions of article 6.1, section a) of the LQPD and the RGPD. The refusal to provide the personal data requested for the reservation will therefore make it impossible to carry out and conclude the contract or reservation requested.

• Job bank: In the event that the interested party has registered in the form to work with our company and / or has provided us with their curriculum vitae, the legal basis for the processing of their data is their free acceptance and consent to process their personal data and the evaluation and management of their job application, all this based on the provisions of article 6.1, sections a) and b) of the LQPD and the RGPD. The refusal to provide the requested personal data will make it impossible for your job application to be managed and processed.

• Communicate changes in the privacy policy: The legitimacy to treat personal data in this case is based on the convenience of communicating to the interested parties the changes that may occur in the privacy policy of the company, as well as in their free acceptance and consent for this treatment, based on the provisions of article 6.1 sections a) and b) of the LQPD and the RGPD.

• Statistics: The legitimacy to process data to carry out market studies and statistics of our products and services, without in any case decisions are made in an automated way with legal effects for the interested party, is the free acceptance and consent of the interested party for this treatment, based on the provisions of article 6.1 sections a) of the RGPD. We inform you that you have the right to withdraw your consent for this treatment at any time, without affecting the legality of the treatment based on the consent prior to its withdrawal. If you wish to withdraw your consent, consult the section "Right of interested parties".

CONSERVATION OF DATA

The personal data provided will be kept by Hotel Rutllan for as long as there is a contractual and/or commercial relationship and for as long as you do not exercise your right to suppression, opposition and/or limitation of the processing of personal data or, where appropriate, for the maximum legal period permitted by data protection legislation, including the limitation periods for legal actions to deal with possible liability that may arise from the relationship contractual.

In the latter case, Hotel Rutllan will keep the data duly blocked, without giving them any use, as long as they may be necessary for the exercise or defense of claims or any type of judicial, legal or contractual responsibility may arise from their treatment, which must be attended to and for which recovery is necessary.

INFORMATION PROCESSED. WHAT CATEGORIES OF PERSONAL DATA DO WE PROCESS?

We ensure that the information we collect is the minimum and necessary for the management of the purposes contained in this Data Protection and Privacy Policy.

Our company may process the following categories of personal data:

• Identifying data: name and surname, identification number, country, etc.

• Postal or email addresses and telephone number.

• Economic and financial information: for the management of the reservation and subsequent billing and collection of the requested service.

• Data relating to the products and services contracted (hotels reserved, frequency, length of stay, hotels booked in advance, etc.).

• Identification codes or codes: if you have registered as a user in the "My reservations" section of the website or in the "Club".

• Academic data and employment information: in case you have decided to enroll in a job offer or send us your curriculum vitae.

• Browsing data on the website: For more information, see the section on Cookies or computer cookies.

• Specially protected data or special categories of data are not processed.

• The categories of interested parties whose personal data we process: a priori they are the people interested in the products and services of our company, as well as in the contracting or reservations of the same. People who register in the job bank or send their curriculum vitae will also be considered interested.

• The interested party guarantees: that the personal data provided are true and is responsible for communicating to the company any modification or error in them, responding therefore to the veracity and accuracy of the data provided at all times.

In the event that the interested party intends to communicate personal data of third parties, he must have previously informed and obtained his consent, in accordance with our Data Protection and Privacy Policy. That is why, in the event that the user has entered personal data of a third party, he declares and guarantees that he has the consent of the third party for the communication of his data and subsequent treatment of the same by our company, as well as that he has previously informed the third party whose data he provides of the content of this Data Protection and Privacy Policy.

PERSONAL DATA WE COLLECT AUTOMATICALLY

When the interested party visits our web pages we collect certain information automatically, even if in the end no reservation or contracting is made. This information may include the IP address, the date and time when our services were accessed, information about the hardware, software or internet browser you use, the selected language, among others.

This information allows to improve the services and the user experience on the website, and to identify possible fraudulent uses and possible attacks on the security of the website, as well as to compile statistics on the use and effectiveness of the website. Unless fraudulent use or against the security of the website is detected, these data will not be kept. In no case will automated decisions be made with legal effects for the user based on this information.

For more information, see the section on Cookies or computer cookies.

SENDING PAPERS

Whenever the interested party makes a reservation or contracts a service or product, an email will be sent in which the confirmation of reservation or contracting will be communicated, with information about it. Likewise, we may contact the interested party in order to inform him of any modification or news related to it.

On the other hand, the company may send commercial communications related to the products or services it offers provided that it has expressly and specifically consented to it by validating the box enabled for this purpose or by any manifestation of express consent in this regard.

The interested party may withdraw their consent to receive any type of commercial communication at any time by sending communication in the terms contained in the section "Right of interested persons". Likewise, this possibility will be offered to the interested party also in each commercial communication received via email or SMS.

LINKS TO THIRD-PARTY WEBSITES

Our website may contain links to websites of third-party companies and entities. Since we cannot be held responsible for the way in which these companies treat the protection of the privacy and personal data of their users, we advise you to read carefully the privacy policy statements of these web pages that are not owned by the company in relation to the use, processing and protection of personal data.

SOCIAL MEDIA

Our company uses social networks to publicize its services and products and share information and experiences with its users and followers.

Since we cannot be held responsible for the way in which these companies treat the protection of privacy and personal data, and that each of them has its own policy on the matter, we advise you to read carefully the privacy policy statements of each social network regarding the treatment they carry out with the personal data of their users, Before using them

MINORS

The Hotel Rutllan website is not aimed at minors. In any case, we will not collect any personal data from children under 16 without the consent of their legal representative. The data collected from children under 16 years of age will be at the time of checking into our hotels, by legal obligation, and only the data necessary for this obligation.

RECIPIENTS

By registering on our website or at our hotel, you expressly authorize the transfer of your data to Hotel Rutllan so that it carries out the purposes set out in this privacy policy. In the event that you provide Hotel Rutllan with personal data of third parties, you declare that these data are truthful and that you have informed and requested consent from said third parties, whose data you provide us, that your personal data will be processed by Hotel Rutllan under the same terms as the customer has been informed and given their consent in this privacy policy.

COMMUNICATION OF DATA TO THIRD PARTIES

We do not sell, rent or share your personal information with third parties, data will only be transferred in the following cases: (a) when necessary to comply with a request you have made, such as sending newsletters; (b) when required by law or a court order; (c) when necessary to protect our rights or property; or (d) when you have given your express consent to share your information.

EXERCISES OF LAW IN THE FIELD OF DATA PROTECTION

SECURITY MEASURES AND LEVELS

Hotel Rutllan has adopted the necessary measures to maintain the required level of security, according to the nature of the personal data processed and the circumstances of the processing, in order to avoid, as far as possible and always according to the state of the art, their alteration, loss, unauthorised processing or access.

Hotel Rutllan also guarantees that it has implemented mechanisms to:

1. Guarantee the permanent confidentiality, integrity and resilience of the treatment systems and services.

2. Restore availability and access to personal data quickly, in case of physical or technical incident.

3. Verify, evaluate and assess, on a regular basis, the effectiveness of the technical and organizational measures implemented to guarantee the safety of the treatment.

4. Pseudonymize and encrypt personal data, if applicable.

INTERNATIONAL TRANSFERS

Hotel Rutllan does not transfer international data.

COOKIES

Access to our website may involve the use of cookies. Cookies are small amounts of information that are stored in the browser used by each user so that the server remembers certain information that can later be used. This information allows you to be identified as a specific user and allows you to save your personal preferences, as well as technical information such as visits or specific pages you visit.

Those users who do not wish to receive cookies or want to be informed before they are stored on their computer, can configure their browser for this purpose.

For more information, visit our Cookies Policy.

CUSTOMER CONSENT

As a user and customer, you declare that you have read and expressly accepted this Privacy Policy by registering with Hotel Rutllan, granting your unequivocal and express consent to Hotel Rutllan to process your data in accordance with the purposes and services set out herein.

CONFIDENTIALITY AND PROFESSIONAL SECRECY

The data we collect in all private communications between Hotel Rutllan and customers will be treated with absolute confidentiality, so we undertake to be obliged to secrecy of personal data, to the duty to protect them and take all necessary measures to prevent their alteration, loss and unauthorized processing or access. in accordance with the provisions of the applicable data protection regulations.

In addition, information of any kind that the parties exchange with each other, that they agree is of such a nature, or that which simply appears on the content of said information will also be considered confidential.

MODIFICATIONS

Hotel Rutllan reserves the right to modify its security and data protection policy in order to adapt it to new legislation or jurisprudence, as well as those that may arise from existing codes of conduct in the matter, or from strategic corporate decisions, with effect from the date of publication of said modification on our website.