In compliance with current regulations on data protection, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, known as the General Data Protection Regulation (RGPD or GDPR) and the Organic Law 3/2018 of December 5 (LOPDGDD), we inform you that the Data Protection Policy and Privacy Policy of our company, regarding the processing of your personal data, is the following:
RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA:
The person responsible for the processing of personal data is the natural or legal person, public authority, service or other body which, alone or jointly with others, determines the purposes and means of processing.
In this case, the data of the data controller are the following:
Identity: Gall-Bru S.L.
VAT number: B-25299447
Postal Address: Carrer Major, 1-3, 25580 Esterri d'Àneu
Telephone: (+34) 973 62 64 37
Email address: info@pensiolacreu.com
PENSIÓ LA CREU as responsible for the data and the website, in accordance with current legal regulations, and specifically, with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 regarding the protection of natural persons in terms of the processing of personal data and the free circulation of these data (RGPD or GDPR), as well as Law 34/2002, of July 11, on Company Services of Information and Electronic Commerce (LSSICE), we inform you that we have implemented appropriate technical and organizational measures, according to the state of the art and the cost of its application with respect to the risks and the nature of the personal data processed, to guarantee and protect the confidentiality, integrity and availability of your personal data.
PERSONAL INFORMATION:
Personal data is any information about an identified or identifiable natural person ("data subject"); an identifiable natural person is any person whose identity can be determined, directly or indirectly, in particular by means of an identifier, such as a name, an identification number, location data, an online identifier or one or more elements of identity physical, physiological, genetic, psychological, economic, cultural or social of said person.
There is a wide variety of information that is considered personal data, for example, the name, contact information, identification number, IP of the computer, etc.
For more information, you can consult the website of the Spanish Data Protection Agency or the Catalan Authority for the Protection of Dades, among others.
PROCESSING OF PERSONAL DATA:
Processing of personal data is considered to be any operation or set of operations carried out on personal data or sets of personal data, whether by automated procedures or not, such as collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of authorization of access, comparison or interconnection, limitation, deletion or destruction of the data.
PURPOSE OF DATA PROCESSING:
For what purpose do we process your personal data?
The personal data provided by the interested parties will be used exclusively for the following purposes:
- Reservation, registration and contracting of products: Manage and execute the provision of services and/or products contracted or requested by the interested parties, as well as the necessary steps to carry out the contractual relationship with the interested party, which includes informing, processing, manage, modify and any other operation that is necessary for the management of your reservation or purchase, as well as the subsequent billing and collection. Analysis of uses can be carried out based on the history of purchases and reservations of the same interested party, without in any case making automated decisions that have legal effects.
- Record book of traveler entries in hotel establishments: Collect, manage and send the information established by current legal regulations regarding the record book of traveler entries in hotel establishments.
- Queries: Respond to, respond to and follow up on queries and requests made by interested parties and/or provide information requested by the user.
- Access to the private area "my reservation": Manage the registration and allow access to the information that appears on the website regarding the status of your reservation, as well as the general administration of the account, which allows you to modify the data of the same, its maintenance, control, management or cancellation, in the event that you have registered as a user.
- Advertising of our own products and services: Send advertising commercial communications (newsletters) related to our products and services by any means (email, postal mail or telephone), with promotions and discounts, invitations to events organized by the company, etc. in the event that the interested party has accepted and consented to the sending of commercial communications by registering and subscribing to the Newsletter.
- Completion of unfinished reservations: Contact the user by any means (email or telephone) in the event that the reservation has not been finalized in order to find out the reason why it has not been finalized.
- Job bank: Evaluate and manage your curriculum vitae and the academic and professional data that you have provided us, for the selection processes to which you have registered or those that adapt to your professional profile, and carry out the necessary actions to the selection and hiring of personnel, and among them, contacting you for more information or to arrange an interview, in the event that the interested party has registered in the form to work with us and/or has provided us with your resume.
- Communicate changes in the privacy policy: Notify or communicate relevant changes in the data protection and privacy policy, legal notice or cookie policy.
- Statistics: Carry out market studies and statistics of our products and services, without in any case making decisions automatically.
The company informs you that it will not process your personal data for any other purpose except those included in this section, except in cases where there is a legal obligation or judicial requirement.
Your personal data will not be subject to decisions based on automated processing that have legal effects for the interested party.
How long will we keep your personal data?
The personal data that you have provided us will be kept for the time necessary to carry out the requested or contracted service, and up to a maximum period of 5 years from the last confirmation on your part of the existence of an interest in us keeping your data. .
This is understood without prejudice to a possible longer conservation for the purposes of eventual compliance with legal obligations and for the exercise and monitoring of legal and judicial actions that may be relevant.
After the indicated deadlines, the personal data will be deleted.
LEGITIMATION FOR THE PROCESSING OF YOUR DATA:
The legal basis for the processing of your personal data responds to the free and legitimate acceptance of the legal relationship by the user at the time of acceptance of this Privacy and Personal Data Protection Policy.
Likewise, the legitimacy for the processing of your data for each of the purposes of the processing of personal data that have been previously identified is detailed below:
- Reservation, registration and contracting of products: The legal basis for the processing of your personal data is the contractual and, where appropriate, pre-contractual relationship established between the parties for the execution of the provision of the services and/or products contracted or requested by the interested parties, and specifically, for the execution of the reservation of the services and products of our establishment that you have made, according to the terms and conditions that appear in the section of Terms and Conditions of Contract, as well as the fulfillment of the commercial obligations , tax and accounting that correspond. All this based on the provisions of article 6.1 sections a) and b) of the GDPR.
- The refusal to provide the personal data requested for the reservation will therefore make it impossible to carry out the requested contract or reservation. For more information on the contracting of our products and services, consult the section Conditions and Terms of Contract. Once the reservation is made, the interested party will receive a confirmation email with the reservation details.
- Record book of passenger entries in hospitality establishments: The legal basis for the processing of your personal data is the legal obligation established in regard to the collection, management and referral to the competent security forces established in Organic Law 4/2015, of March 30 on the Protection of Citizen Security and other development regulations. This is based on the provisions of article 6.1 section c) of the GDPR. The refusal to provide the requested personal data will therefore make it impossible to stay at the establishment.
- Queries: The legal basis for the processing of your personal data is the possibility of responding to the queries freely raised by the interested parties. This treatment is carried out based on the provisions of article 6.1 sections a) and b) of the GDPR.
- Access to the private area "my reservation": In the event that the interested party has registered as a user to be able to access, consult, modify or cancel the status of "my reservations" from the web, the legal basis for the treatment of their data is the contractual or pre-contractual relationship existing between the parties and allow access to the information that appears on the website regarding the status of your reservation, as well as modify the data of the same or cancel it, in the case in which it has been given registration as a user, as well as your acceptance and free and express consent to process your data. This treatment is lawful based on the provisions of article 6.1 sections a) and b) of the GDPR. The refusal to provide the requested personal data will make it impossible to access said information from the website.
- Advertising of own products and services: In the event that the interested party has checked the corresponding box to accept receiving commercial advertising communications (newsletters), the legal basis for sending advertising about products and services is the free and express consent of the interested party, which may withdraw at any time, without the withdrawal of consent for this purpose conditioning the execution of the room reservation contract, if applicable. This processing of personal data is based on the provisions of article 6.1 section a) of the GDPR. The refusal to provide the requested personal data will therefore make it impossible to subscribe to the newsletter or receive commercial communications with information about our products or services. We inform you that you have the right to withdraw your consent for this treatment at any time, without affecting the legality of the treatment based on the consent prior to its withdrawal. If you wish to withdraw your consent, see the "Right of interested parties" section.
- Completion of unfinished reservations: The legitimacy to process the data in this case is the acceptance and express consent by the interested party of this treatment so that the company can contact the interested party in the event that a technical incident has occurred in the moment of making the reservation or contracting. This processing of personal data is based on the provisions of article 6.1 section a) of the GDPR. The refusal to provide the personal data requested for the reservation will therefore make it impossible to carry out and conclude the requested contract or reservation.
- Job bank: In the event that the interested party has registered in the form to work with our company and/or has provided us with their curriculum vitae, the legal basis for the processing of their data is their free acceptance and consent to treat your personal data and the evaluation and management of your job application, all based on the provisions of article 6.1 sections a) ib) of the GDPR. The refusal to provide the requested personal data will make it impossible to manage and process your job application.
- Communicate changes in the privacy policy: The legitimacy to process personal data in this case is based on the convenience of notifying the interested parties of the changes that may occur in the company's privacy policy, as well as their free acceptance and consent. for this treatment, based on the provisions of article 6.1 sections a) ib) of the GDPR.
- Statistics: The legitimacy to process data to carry out market studies and statistics of our products and services, without in any case making decisions automatically with legal effects for the interested party, is the free acceptance and consent of the interested party for this treatment, based on the provisions of article 6.1 paragraphs a) of the GDPR. We inform you that you have the right to withdraw your consent for this treatment at any time, without affecting the legality of the treatment based on the consent prior to its withdrawal. If you wish to withdraw your consent, see the "Right of interested parties" section.
RECIPIENTS OF DATA ASSIGNMENTS OR TRANSFERS:
Your personal data will be communicated to other companies of the business group for purposes related to the processing of personal data of customers or users.
For the best fulfillment of the services that have been requested from us, we provide certain data to data processors with whom we have signed the corresponding data protection contracts. In these cases, the data provided is only strictly necessary for the specific activity to be carried out. By way of example only, the services that can be hired from data processors are listed: IT service providers, security companies, tax, legal or legal advice, etc. The above relationship is provided as an example, and the company may use the services of companies belonging to other sectors of activity in order to provide quality services. Apart from these cases, no transfer or communication of data has been foreseen either inside or outside the EU.
Information will also be provided to third parties in cases where this is imperatively established by current regulations or when judicially required (public administrations, courts and tribunals, security forces and bodies, tax agency, etc.)
RIGHTS OF INTERESTED PERSONS:
We inform you that as an interested person you have the following rights:
- Right of access: anyone has the right to know and obtain information about the personal data that we process.
- Right of rectification: interested persons have the right to request the rectification, complementation and/or correction of inaccurate, incorrect or incomplete data.
- Right to deletion (also known as the "right to be forgotten"): interested persons, if they deem it appropriate, will have the right to request the deletion of personal data that concerns them, among other reasons, when the data is no longer necessary for the purposes for which they were collected.
- Right of cancellation: interested parties can request the cancellation of their data.
- Right of opposition: interested parties may oppose the processing of their data for marketing purposes, including profiling, and in the rest of the cases established in article 21 of the GDPR. If requested, the company will stop processing the data, except for compelling legitimate reasons or to exercise or defend possible claims.
- Right of limitation in the treatment: in certain circumstances provided for in article 18 RGPD, the interested parties may request the limitation of the processing of their data. In this case, we will only keep them to exercise or defend claims. Specifically, you have the right to limit processing in cases where:
- The interested party challenges the accuracy of the personal data, during a period that allows the person in charge to verify the accuracy of the same.
- The treatment is unlawful and the interested party opposes the deletion of the personal data and instead requests the limitation of its use.
- The person in charge no longer needs the personal data for the purposes of the treatment, but the interested party needs them for the formulation, exercise or defense of claims.
- The interested party has opposed the treatment for reasons related to their particular situation to the fact that their personal data are subject to treatment based on the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the person responsible for the treatment; i/or the treatment is necessary for the satisfaction of legitimate interests pursued by the person in charge of the treatment or by a third party, while it is verified if the legitimate reasons of the person in charge prevail over those of the interested party.
- Right to data portability: interested parties have the right to obtain their personal data in a structured format for common use and mechanical reading, so that they can be transmitted to another person in charge, under the terms of article 20 of the GDPR.
- Right not to be subject to automated individual decisions: interested parties have the right not to be subject to a decision based on the automated processing of their data that produces legal effects.
- Right to withdraw the consent given: the interested parties have the right to withdraw the consent given at any time. The withdrawal of consent will not affect the legality of the treatment carried out before its withdrawal.
To withdraw your consent regarding the sending of commercial communications of our products and services, see the section "How can you exercise your rights?". You can also unsubscribe directly each time you receive a commercial communication by email.
Interested parties can obtain additional information about their rights on the website of the Spanish Agency for Data Protection or on that of the Catalan Authority for the Protection of Dades.
HOW CAN YOU EXERCISE YOUR RIGHTS?
You can exercise your rights by writing to the postal address Carrer Major, 1, 3, 25580 Esterri d'Àneu, Spain (+34) 973 62 64 37 or email info@pensiolacreu.com, with the subject "Personal Data ” attaching a photocopy of your identity document or any analogous means established by law.
WHAT CLAIMS DO YOU HAVE?
If you consider that your rights have not been adequately addressed, the interested party has the right to file a claim with the Spanish Agency for Data Protection or with any competent control authority.
INFORMATION PROCESSED:
What categories of personal data do we process?
We try that the information we request is the minimum and necessary for the management of the purposes that appear in this Data Protection and Privacy Policy.
Our company may process the following categories of personal data:
- Identification data: name and surname, identification number, country, etc.
- Postal or electronic addresses and telephone number.
- Financial economic information, for the management of the reservation and subsequent billing and collection of the requested service.
- Data related to the contracted products and services (reserved hotels, frequency, length of stay, previously reserved hotels, etc.).
- Identification codes or keys, in the event that you have registered as a user in the section of the website "My reservations" or in the "Club".
- Academic data and employment information, in the event that you have decided to register for a job offer or send us your curriculum vitae.
- Browsing data on the website. For more information, see the section on Cookies or computer cookies.
No specially protected data or special categories of data are processed.
The categories of interested parties of whom we treat their personal data a priori are the people interested in the products and services of our company, as well as in the contracting or reservations of the same. People who register in the job market or send their curriculum vitae will also be considered interested.
The interested party guarantees that the personal data provided is true and is responsible for notifying the company of any changes or errors in them, thus responding to the veracity and accuracy of the data provided at all times.
In the event that the interested party intends to communicate personal data of third parties, they must have previously informed and obtained their consent, in accordance with our Data Protection and Privacy Policy. That is why, in the event that the user has entered personal data from a third party, he declares and guarantees that he has the consent of the third party for the communication of his data and subsequent processing thereof by our company, as well as that has previously informed the third party whose data it provides of the content of this Data Protection and Privacy Policy.
Personal data we collect automatically:
When the interested party visits our web pages, we collect certain information automatically, even if no reservation or contract is made in the end. This information may include the IP address, the date and time our services were accessed, information about the hardware, software or Internet browser you use, the language selected, among others.
This information makes it possible to improve the services and the user experience on the website, and to identify possible fraudulent uses and possible attacks on the security of the website, as well as to compile statistics on the use and effectiveness of the website. Unless fraudulent use or against the security of the web is detected, this data will not be kept. In no case will automated decisions with legal effects for the user be made based on this information.
For more information, see the section on Cookies or computer cookies.
SENDING OF COMMUNICATIONS:
Whenever the interested party makes a reservation or contracts a service or product, an email will be sent in which the reservation or contract confirmation will be communicated, with information about it. Likewise, we may contact the interested party in order to inform them of any modification or novelty related to it.
On the other hand, the company may send commercial communications related to the products or services it offers as long as it has expressly and specifically consented to it by checking the box enabled for this purpose or by any manifestation of express consent in this regard.
The interested party may withdraw their consent to receive any type of commercial communication at any time by sending communication in the terms included in the "Right of interested persons" section. Likewise, this possibility will also be offered to the interested party in each commercial communication that they receive via email or SMS.
COMMUNICATION OF DATA BY MINORS:
The services offered through the website are only available to adults. Therefore, those who do not comply with this condition must refrain from providing personal information on the website.
LINKS TO THIRD PARTY WEBSITES:
Our website may contain links to websites of third party companies and entities. Since we cannot be held responsible for the way in which these companies treat the protection of the privacy and personal data of their users, we advise you to carefully read the privacy policy statements of these web pages that are not owned by de the company in relation to the use, processing and protection of personal data.
SOCIAL MEDIA:
Our company uses social networks to publicize its services and products and share information and experiences with its users and followers.
Since we cannot be held responsible for the way in which these companies treat the protection of privacy and personal data, and since each of them has its own policy on the matter, we advise you to carefully read the policy statements of privacy of each social network regarding the treatment they carry out with the personal data of their users, before using them.
MODIFICATIONS IN THE PRIVACY POLICY:
The company reserves the right to modify this Data Protection and Privacy Policy in accordance with the data processing it carries out and with the applicable legislation at all times, of which it will duly inform on the website, for which it recommends the interested party to review it periodically to be informed of how the company treats and protects their personal data.
QUESTIONS AND DOUBTS:
If you have any doubts or questions about this privacy policy, please contact us by sending an email to (info@pensiolacreu.com) with the subject "Privacy Policy".