Privacy policy of Hotel Jaume

Privacy policy

In compliance with current legislation on data protection, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the General Data Protection Regulation (RGPD or GDPR) and Organic Law 3/2018 of 5 December (LOPDGDD), we inform you that the Data Protection Policy and Privacy Policy of our company, with regard to the processing of your personal data, is as follows:

Responsible for the processing of personal data:

The controller of personal data is the natural or legal person, public authority, service or other body which alone or jointly with others determines the purposes and means of the processing.

In this case, the details of the data controller are as follows:

Identidad: Hotel Jaume

Postal Address: C/ Central, 30, 17538 Alp, Girona, Spain

Telephone number: (+34) 972 89 00 16

E-mail address: info@hoteljaume.com

Hotel Jaume, as responsible for the data and the website, in accordance with current legal regulations, and specifically with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (RGPD or GDPR), as well as Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSICE), we inform you that we have implemented appropriate technical and organisational measures, according to the state of the art and the cost of their application with respect to the risks and the nature of the personal data processed, to guarantee and protect the confidentiality, integrity and availability of your personal data.

Personal data:

Personal data are any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is any person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

There is a wide variety of information that is considered personal data, e.g. name, contact information, ID number, computer IP, etc.

For further information, you can consult the website of the Agencia Española de Protección de datos or the Autoritat Catalana de Protecció de Dades among others.

Processing of personal data:

The processing of personal data is considered to be any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.

Purpose of the data processing:

For what purposes do we process your personal data?

The personal data provided by data subjects will be used exclusively for the following purposes:

• Reservation, registration and contracting of products: To manage and execute the provision of the services and/or products contracted or requested by the interested parties, as well as the necessary steps to carry out the contractual relationship with the interested party, which includes informing, processing, managing, modifying and any other operation that is necessary for the management of your reservation or purchase, as well as the subsequent invoicing and collection. Usage analysis may be carried out based on the history of purchases and bookings of the same interested party, without in any case making automated decisions that entail legal effects.
• Register book of passenger entries in hotel establishments: Collect, manage and send the information established by the legal regulations in force regarding the register book of passenger entries in hotel establishments.
• Enquiries: To deal with, answer and follow up enquiries and requests made by interested parties and/or provide information requested by the user.
• Access to the private area ‘my booking’: Manage the registration and allow access to the information on the website regarding the status of your booking, as well as the general administration of the account, which allows you to modify the details of the same, its maintenance, control, management or cancellation, in the case that you have registered as a user.
• Advertising of our own products and services: Send commercial advertising communications (newsletters) related to our products and services by any means (e-mail, post or telephone), with promotions and discounts, invitations to events organised by the company, etc. in the event that the interested party has accepted and consented to the sending of commercial communications by registering and subscribing to the Newsletter.
• Completion of unfinished bookings: Contact the user by any means (email or telephone) in the event that the booking has not been completed in order to find out why the booking has not been completed.
• Job bank: To evaluate and manage the curriculum vitae and the academic and professional data provided to us, for the selection processes for which you have registered or those that adapt to your professional profile, and to carry out the necessary actions for the selection and recruitment of personnel, including contacting you for further information or to arrange an interview, in the event that the interested party has registered on the form to work with us and/or you have provided us with your curriculum vitae.
• Communicate changes to the privacy policy: Notify or communicate relevant changes to the data protection and privacy policy, legal notice or cookie policy.
• Statistics: To carry out market research and statistics on our products and services, without in any case taking decisions in an automated way.

The company informs that it will not process your personal data for any purpose other than those listed in this section, except in cases where there is a legal obligation or court order.

Your personal data will not be subject to decisions based on automated processing involving legal effects for you.

How long will we keep your personal data?

The personal data you have provided to us will be kept for the time necessary to carry out the requested or contracted service, and up to a maximum period of 5 years from the last confirmation by you of the existence of your interest in us keeping your data.

This is without prejudice to possible longer retention for the purposes of possible compliance with legal obligations and for the exercise and follow-up of legal and judicial actions that may be relevant.

After the above-mentioned deadlines, the personal data will be deleted.

Legitimation for data processing:

The legal basis for the processing of your personal data is the free and legitimate acceptance of the legal relationship by the user at the time of acceptance of this Personal Data Protection and Privacy Policy.

Likewise, the legitimacy for the processing of your data for each of the purposes of the processing of personal data that have been identified above is detailed below:

• Booking, registration and contracting of products: The legal basis for the processing of your personal data is the contractual and, where appropriate, pre-contractual relationship established between the parties for the execution of the provision of the services and/or products contracted or requested by the interested parties, and specifically, for the execution of the reservation of the services and products of our establishment that have been made, according to the terms and conditions stated in the section on Contracting Terms and Conditions, as well as the fulfilment of the corresponding commercial, tax and accounting obligations. All this on the basis of the provisions of article 6.1 paragraphs a) and b) of the RGPD.
• The refusal to provide the personal data requested for the reservation will therefore make it impossible to carry out the requested contract or reservation. For further information on the contracting of our products and services, please consult the section Conditions and Terms of Contract. Once the reservation has been made, the interested party will receive a confirmation e-mail with the reservation details.
• The legal basis for the processing of personal data is the legal obligation established for the collection, management and referral to the competent law enforcement bodies established in Organic Law 4/2015, of 30 March, on the Protection of Public Security and other implementing regulations. This is based on the provisions of article 6.1 section c) of the RGPD. Refusal to provide the personal data requested will therefore make it impossible to stay at the establishment.
• Queries: The legal basis for the processing of your personal data is the possibility of responding to queries freely raised by data subjects. This processing is carried out in accordance with the provisions of Article 6.1 (a) and (b) of the GDPR.
• Access to the private area ‘my booking’: In the event that the interested party has registered as a user in order to access, consult, modify or cancel the status of ‘my bookings’ from the website, the legal basis for the processing of data is the contractual or pre-contractual relationship existing between the parties and to allow access to the information on the website regarding the status of their booking, as well as to modify the details of the booking or cancel it, in the event that they have registered as a user, as well as their acceptance and free and express consent to process their data. This processing is lawful on the basis of the provisions of article 6.1 paragraphs a) and b) of the RGPD. Refusal to provide the personal data requested will make it impossible to access this information from the website.
• Advertising of our own products and services: In the event that the data subject has ticked the box corresponding to accepting to receive commercial advertising communications (newsletters), the legal basis for sending advertising about products and services is the data subject’s own free and express consent, which may be withdrawn at any time, without the withdrawal of consent for this purpose conditioning the execution of the room reservation contract, where applicable. This processing of personal data is based on the provisions of Article 6.1 (a) of the GDPR. Refusal to provide the personal data requested will therefore make it impossible to subscribe to the newsletter or to receive commercial communications with information about our products or services. We inform you that you have the right to withdraw your consent to this processing at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal. Should you wish to withdraw your consent, please refer to the section ‘Rights of the persons concerned’.
• Completion of unfinished bookings: The legitimacy to process the data in this case is the acceptance and express consent of the data subject to this processing so that the company can contact the data subject in the event that a technical incident may have occurred at the time of making the booking or contracting. This processing of personal data is based on the provisions of Article 6.1(a) of the GDPR. Refusal to provide the personal data requested for the booking will therefore make it impossible to carry out and conclude the requested contract or booking.
• Communicating changes in the privacy policy: The legitimacy to process personal data in this case is based on the convenience of communicating to data subjects the changes that may occur in the company’s privacy policy, as well as on their free acceptance and consent for this processing, based on the provisions of article 6.1 sections a) and b) of the GDPR.
• Statistics: The legitimacy to process data for market research and statistics of our products and services, without in any case automated decisions with legal effects for the data subject, is the free acceptance and consent of the data subject for this treatment, based on the provisions of Article 6.1 paragraphs a) of the RGPD. We inform you that you have the right to withdraw your consent to this processing at any time, without this affecting the lawfulness of the processing based on the consent prior to its withdrawal. Should you wish to withdraw your consent, please refer to the section ‘Rights of data subjects’.

Recipients of assignments or transfers of data:

Personal data will be communicated to other companies of the group of companies for purposes related to the processing of personal data of customers or users.

In order to better fulfil the services you have requested from us, we provide certain data to data processors with whom we have signed the corresponding data protection contracts. In these cases, the data provided is only that which is strictly necessary for the specific activity to be carried out. By way of example, the services that may be contracted from data processors are listed below: IT service providers, security companies, tax, legal or legal advice, etc. The above list is given by way of example, and the company may use the services of companies belonging to other sectors of activity in order to provide quality services. Apart from these cases, no transfer or communication of data within or outside the EU is foreseen.

Information will also be provided to third parties in those cases in which this is imperatively established by the regulations in force or when required by law (public administrations, courts and tribunals, security forces and bodies, tax authorities, etc.).

Rights of the persons concerned:

We inform you that you have the following rights as a data subject:

• Right of access: any person has the right to know and obtain information about the personal data we process.
• Right of rectification: data subjects have the right to request the rectification, supplementation and/or correction of inaccurate, incorrect or incomplete data.
• Right to erasure (also known as the ‘right to be forgotten’): data subjects shall have the right to request the erasure of personal data concerning them, inter alia, when the data are no longer necessary for the purposes for which they were collected.
• Right of cancellation: data subjects may request the cancellation of their data.
• Right to object: data subjects may object to the processing of their data for marketing purposes, including profiling, and in the other cases set out in Article 21 of the GDPR. Upon request, the company will stop processing the data, except for compelling legitimate reasons or to exercise or defend possible claims.
• Right to restrict processing: in certain circumstances provided for in Article 18 GDPR, data subjects may request that we restrict the processing of their data. In this case, we will only retain the data for the purpose of exercising or defending claims. In particular, you have the right to restrict processing in the following cases:
• The data subject challenges the accuracy of the personal data, within a period of time that allows the controller to verify the accuracy of the data.
• The processing is unlawful and the data subject objects to the erasure of the personal data and requests instead the restriction of their use.
• The controller no longer needs the personal data for the purposes of the processing but the data subject needs them for the purposes of making, exercising or defending claims.
• The data subject has objected to the processing on grounds relating to his or her particular situation to the processing of his or her personal data on the basis of the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; i/o the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, while verifying whether the legitimate grounds of the controller override those of the data subject.
• Right to data portability: data subjects have the right to obtain their personal data in a structured, commonly used and machine-readable format for the purpose of transferring it to another data controller, in accordance with Article 20 of the GDPR.
• Right not to be subject to automated individual decisions: data subjects have the right not to be subject to a decision based on automated processing of their data that produces legal effects.
• Right to withdraw consent: data subjects have the right to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of the processing carried out prior to the withdrawal of consent.

To withdraw your consent to receive commercial communications about our products and services, please see the section ‘How can you exercise your rights? You can also unsubscribe directly each time you receive a commercial communication by email.

Data subjects may obtain further information about their rights on the website of the Agencia Española de Protección de datos or the Autoritat Catalana de Protecció de Dades.

How can you exercise your rights?

You can exercise your rights by sending a letter to the postal address C/ Central, 30, 17538 Alp, Girona, Spain (+34) 972 89 00 16 or to the e-mail address info@hoteljaume.com, with the subject ‘Personal Data’, attaching a photocopy of your identity document or any other similar means established by law.

What avenues of complaint are available to you?

If you consider that your rights have not been adequately addressed, you have the right to lodge a complaint with the Spanish Data Protection Agency or any competent supervisory authority.

Information covered:

What categories of personal data do we process?

We try to keep the information we request to the minimum necessary for the purposes set out in this Data Protection and Privacy Policy.

Our company may process the following categories of personal data:

• Identification data: name and surname, ID number, country, etc.
• Postal or e-mail addresses and telephone number.
• Economic and financial information, for the management of the reservation and subsequent invoicing and collection of the requested service.
• Data relating to the products and services contracted (hotels booked, frequency, length of stay, hotels booked in advance, etc.).
• Identification codes or passwords, if you have registered as a user in the ‘My bookings’ or ‘Club’ sections of the website.
• Academic data and employment information, in case you have decided to apply for a job offer or to send us your curriculum vitae.
• Website browsing data. For more information, see the section on Cookies or computer biscuits.

No specially protected data or special categories of data are processed.

The categories of data subjects whose personal data we process a priori are persons interested in the products and services of our company, as well as in the contracting or booking of the same. Persons who register in the job exchange or submit their curriculum vitae will also be considered as interested parties.

You guarantee that the personal data you have provided are truthful and you are responsible for notifying the company of any modification or error in them, and you are therefore responsible for the truthfulness and accuracy of the data provided at all times.

In case you intend to communicate personal data of third parties, you must have previously informed and obtained the consent of the third party, in accordance with our Data Protection and Privacy Policy. Therefore, in the event that you have entered personal data of a third party, you declare and guarantee that you have the consent of the third party for the communication of their data and subsequent processing of the same by our company, as well as that you have previously informed the third party whose data you provide of the content of this Data Protection and Privacy Policy.

Personal data that we collect automatically:

When you visit our websites we collect certain information automatically, even if you do not make a booking or contract. This information may include your IP address, the date and time you access our services, information about the hardware, software or internet browser you use, the language you select, and other information.

This information allows us to improve the services and experience on the website, to identify possible fraudulent use and possible attacks on the security of the website, and to compile statistics on the use and effectiveness of the website. Unless a fraudulent use or security breach of the website is detected, this data will not be retained. Under no circumstances will automated decisions with legal effect for you be taken on the basis of this information.

For more information, please see the section on Cookies.

Sending communications:

Whenever you make a reservation or contract a service or product, we will send you an email in which we will communicate the confirmation of the reservation or contract, with information about it. We may also contact you to inform you of any changes or new developments related to it.

On the other hand, the company may send you commercial communications related to the products or services it offers, provided that you have expressly and specifically consented to this by validating the box provided for this purpose or by expressly giving your consent in this regard.

You may withdraw your consent to receive any type of commercial communication at any time by sending a communication in accordance with the terms set out in the section ‘Rights of interested parties’. Likewise, this possibility will also be offered to you in each commercial communication you receive by email or SMS.

Communication of data by minors:

The services offered through the website are only available to persons of legal age. Therefore, those who do not comply with this condition should refrain from providing personal information on the website.

Links to third party websites:

Our website may contain links to the websites of third party companies and entities. As we cannot be held responsible for the way in which these companies treat the privacy and personal data protection of their users, we advise you to carefully read the privacy policy statements of these non-owned websites with regard to the use, processing and protection of personal data.

Social media:

Our company uses social networks to publicise its services and products and to share information and experiences with its users and followers.

Given that we cannot be held responsible for the way in which these companies deal with the protection of privacy and personal data, and that each of them has its own policy on the matter, we advise you to carefully read the privacy policy statements of each social network regarding their treatment of the personal data of their users before using them.

Changes to the privacy policy:

The company reserves the right to modify this Data Protection and Privacy Policy in accordance with the data processing it carries out and with the legislation applicable at any given time, which it will duly inform you of on the website, so we recommend that you review it periodically to be informed of how the company treats and protects your personal data.

Questions and doubts:

If you have any questions or concerns about this privacy policy, please contact us by sending an email to (info@hoteljaume.com) with the subject ‘Privacy Policy’.