- Privacy Policy of Abades Hotels in Spain

PRIVACY POLICY

This privacy policy of UNION DE EMPRESAS ABADES, S.L., hereinafter, the Provider, informs you about the processing we carry out on the personal data that you provide or will provide us while surfing, and about the data protection policy that will be applied to such data, so that users can determine freely and voluntarily if they wish to provide such data, and continue surfing.

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?

The Data Controller, the party responsible for such processing, is the commercial entity UNION DE EMPRESAS ABADES, S.L with Company Tax Code (CIF) no.: B19510510 and registered in the Mercantile Register of Granada, Volume: 1477, Book:0, Sheet: 196 , Page: GR-42477 Entry 1.

Unión de Empresas Abades SL may act as the sole data controller or co-responsible party together with any of the companies that make up the Abades Group in the following relationship:

Domains and companies of the Abades Group

Contact details for data protection purposes:

- Registered office: Autovía A92 km. 189 – 18300 Loja – Granada (Spain)
- Telephone no: +34 958 327 200
- Email: lopd@abades.com
- At the following link: https://derechos.datagestion.net/UEABADES

2. FOR WHAT PURPOSES AND ON WHAT GROUNDS DO WE PROCESS YOUR PERSONAL DATA?

The processing of your data pursues the following purposes, with the corresponding legitimacy that we set out below.

(*) In those cases where to make a request it is necessary to fill in a form and click on the send button, the completion of thereof will necessarily imply that you have been informed and have expressly given your consent and acceptance of the privacy policy.

All our forms have check boxes that must be ticked to access the services offered.

1. Service provision, development and execution of the service.

Purpose:
We process your personal data in order to (i) manage the requested service; (ii) follow up the service as well as send you information by electronic means that relates to your request.

Legal basis:
The basis of legitimacy is the provision of a service on the basis of a contract or pre-contract (provision of services that binds us to you).

2. Website contact.

Purpose:
To send you the requested information and answer any queries you may have through the contact section(s) made available to you on the website.

We inform you that your telephone calls may be recorded in order to improve the quality of our customer service and to carry out the contracting of our services. If this is the case, you will be informed in advance.

Legal basis:
The basis of legitimacy is the consent given and that of legitimate interest.

3. Marketing

Purpose:
Sending communications, news or actions that are of interest to you and that you request. As this is an accessory purpose to the main purpose, you must tick the box provided for this purpose.

For example, when you agree to receive personalised information through various means.

In order to be able to offer you products and services more suited to your needs, we may inform you about offers and promotions of interest to you through commercial advertising communications by e-mail, or any other electronic or physical means, present or future, that makes such communications possible. They will be carried out by us and will always be related to our services or those of our companies in the Abades Group.

Regarding signing up to any of our informative Newsletters, present or future, it is necessary for you to provide us with an email address to which, as informed, information related to our activity will be sent. In providing us with your email, you therefore give your consent to the use of your personal data for sending advertising or other marketing activities. This personal data will be stored and used on an ongoing basis for uses, such as sending the aforementioned newsletters, news, through communication channels such as e-mail, SMS, WhatsApp, post or any other channel authorised by you. We may use your data to create and update your user profile in order to send you personalised information about advertising or promotions. We may also use the information you provide to analyse and improve the effectiveness of our Website products/services, advertising, marketing, market research and sales activities.

In order to achieve the above objective, we will create a marketing profile based on the information provided but we will not make automated decisions based on this profile.

Legal basis:
The legitimate basis for processing your data for marketing purposes is the consent you give us.

4. Job offers / sending CVs

Purpose:
To take part in the selection processes that we may carry out.

We will include the CVs we receive in our recruitment processes. If you send us your curriculum vitae to the e-mail address cv@abades.com or by using the CV and human resources form provided for this purpose, you authorise us to analyse the documents you send us in order to assess your candidature and, if necessary, offer you a position in any of the companies that make up the Abades Group.

If you are not selected, we may store your CV for future calls for applications for a maximum of one year, unless you tell us otherwise.

Legal basis:
Providing us with express consent by sending us your CV. To do so, you must accept the information on the privacy policy applied to curriculum vitae indicated at the end of the form before sending it.

5. Use of Cookies

Purpose:
As you browse our website we may collect information through the cookies placed on our website. The purpose is to gain knowledge about how users use our website and to enable us to improve it, and/or to carry out performance analytics. The aforementioned data is stored by means of cookies and is subject to the submission of objections to the processing of this data, as detailed in the Cookies Policy. You can consult the Cookies Policy in the corresponding section of our website.

Your browsing information may be stored by Google Analytics, for which we refer you to Google's Privacy Policy, as Google collects and processes this information: http://www.google.com/intl/en/policies/privacy

Similarly, our website can provide the Google Maps utility, which may have access to your location, if you so permit, in order to provide you with greater specificity about the distance and/or roads to our establishments. In this regard, we refer you to the privacy policy used by Google Maps, in order to find out about the use and treatment of such data: http://www.google.com/intl/en/policies/privacy

Legal basis:
The legal basis for the processing of data is our (i) legitimate interest in knowing our users' browsing habits in order to adapt to their interests and improve our relationship with them; as well as (ii) their consent when browsing our website and accepting the terms of use of cookies.

6. Social media/blog contacts.

Purpose:
The Website may host blogs, and other social networking applications or services for the purpose of facilitating the exchange of content. Any personal information provided by the user may be shared with other users of that service, over whom we have no control.

We process your personal data in order to (i) answer your queries and requests, (ii) manage the requested service, interact with you and create a community of followers.

The website may offer functionalities for sharing content through third-party applications, such as Facebook, Twitter, LinkedIn, Instagram, WhatsApp, etc. These applications may collect and process information related to the user's browsing on the different websites. Any personal information collected through these applications may be used by third party users of these applications. Your interactions are subject to the privacy policies of the companies providing the applications.

Legal basis:
The legal basis for the processing of your data is the acceptance of the contractual relationship with the relevant social network provider expressed when you register with their application and in accordance with their privacy policy, which is external to us and over which we have no control.

7. Exercising the rights to data protection or to make complaints

Purpose:
When your query is related to the exercise of data protection rights about which we inform you below, or to claims related to our products or services, it is to deal with the user's request or claim. In fulfilling these obligations, we may communicate your data to the Public Administrations and courts, provided that such information is required in accordance with the established legal processes.

Legal basis:
What legitimises us to process your data is the fulfilment of legal obligations on our part.

Finally, where services or applications exist, these shall contain their particular conditions with specific provisions on the protection of personal data. It must be read and accepted prior to requesting the service in question.

8. User Registration/Making purchases:

Purposes:

REGISTER:
It is the management of registered users on the website, as well as obtaining discount coupons, keeping track of your purchases, tracking your orders.

MAKE PURCHASES:
The main purpose of this processing is to maintain the contractual relationship with our customers, facilitate the processing of orders, discounts and promotion of products and services.

Therefore, we process your personal data for the purpose of (i) managing the service provided; and (ii) sending you information by electronic means concerning your request.

REGISTRATION OF COMPANIES:
To be able to register for discounts on bookings.

PAYMENT PLATFORM:
To be able to manage your payments online quickly and securely.

Legal basis:
The basis of legitimacy is the provision of a service based on a sales contract or pre-contract and user consent.

Grupo Abades assures the confidentiality of the data provided and guarantees that under no circumstances will it be transferred for any other use without the prior express consent of our users. We will only ask you for data that is necessary for the provision of the requested service and it will only be used for this purpose.

9. Sending of invoices:

Purpose:
After filling in the form provided for this purpose, we will be able to send you the invoice(s) requested.

Legal basis:
Compliance with legal obligations.


3. WHAT KIND OF DATA DO WE PROCESS AND HOW DO WE COLLECT IT?

For the purposes set out in the previous section, a set of personal data is processed that we can divide into the following sources:

- Data provided directly by the user:
At the time of sending through the various forms provided on the website or any other means available to you.

The user guarantees that the data provided for the provision of the requested services responds truthfully to the actual situation and that he or she will communicate any changes that affect such data. Consequently, the user will be liable to the Provider for any damages caused as a result of breaching the obligations assumed in this clause.

- Data collected indirectly:
All data that, if you have given your consent, The Provider collects from the typology of external sources.

- Data derived from the provision of the service itself.
All such data collected during the provision of the service.


4. HOW LONG WILL WE KEEP YOUR DATA?

Your personal data will be kept for as long as it is necessary for the performance of the contractual relationship. Once this period has elapsed, the data will be deleted in accordance with the provisions of the data protection regulations, which implies its blocking, being available only at the request of Judges and courts, the Public Prosecutor's Office or the competent Public Administrations, in particular the Data Protection Authority, during the period of limitation of any actions that may arise, in order to be subsequently deleted.

Limitation periods vary depending on the type of service, but for illustrative purposes, in general the limitation period for most personal civil actions is 5 years.

In addition to the general treatment of the previous point, the following particularities on data conservation will be observed:

Customer Data: retention period of 4 years (Art. 66 et seq. of the General Tax Law), and 6 years for accounting books and invoices (Art. 30 of the Commercial Code) Customer Service: We will process your data for as long as it is necessary to deal with your request.
Data contained in curricula vitae: a maximum of 1 year for future selection processes unless you state otherwise.
Data provided for the purpose of receiving commercial communications and communications of interest: from the time the User gives his/her consent until he/she withdraws it.

5. WHAT ARE YOUR RIGHTS WHEN YOU PROVIDE US WITH YOUR DATA?

Data protection regulations give you a number of rights in relation to the data processing involved in our services, which can be summarised as follows:

- Right to access: To know what type of data we are processing and the characteristics of the processing we are carrying out.
- Right to rectification: To be able to request the modification of your data due to it being inaccurate or untrue.
- Right to portability: To be able to obtain a copy in an interoperable format of the data being processed.
- The right to treatment limitation, in the cases included in the Law.
- Right to deletion: Request the deletion of your data when such processing is no longer necessary.
- Right to object: To request the cessation of the sending of commercial communications in the terms indicated.
- The right to withdraw the consent given.

In order to exercise these rights, you must send an express request, together with a copy of your ID card or equivalent document, through the means indicated below: As a result of your request, if you do not receive a reply from us in a timely manner, or you do not find it satisfactory, we inform you that the competent supervisory authority is the Spanish Data Protection Agency (www.agpd.es).

- E-MAIL addressed to lopd@abades.com with Data Protection in the subject line.
The sending of this email must be done from the e-mail address you included on the form(s). Otherwise, they will not be shown to you, as your identity will not be considered sufficiently proven.

- Via the following link: https://derechos.datagestion.net/UEABADES

On the website of the Spanish Data Protection Agency (AEPD) you can find a series of templates that will help you exercise your rights.


6. RECIPIENTS

Users are expressly informed that under no circumstances will personal data be passed on to third parties, except under legal obligation or in the cases described below. Any exception to this rule will require your prior, unequivocal, express and informed consent.

- In fulfilling our obligations, we may disclose your data to:
Public Administrations and courts, law enforcement authorities whenever such information is required in accordance with established legal processes.

- Your data may be communicated to the following recipients for the purpose of purchasing:
Banks for payment of purchases by credit card.

To the Office of Consumers and Users in the event of a complaint.

To those transport companies that may have been entrusted with the delivery of the corresponding orders to customers.

- Social media:
If you contact us through any of the corporate profiles that we have on social networks and that we make available to users, they will be able to find out about our activities, opinions, as well as access photos and videos. In addition to providing us with the data you pass on to us, you will also be providing it to the entities responsible for that social network. To find out how these entities use and treat your data, we recommend that you carefully read the privacy policies of the social networks you are active on.


7. SECURITY MEASURES

In accordance with the provisions of the current regulations on the protection of personal data (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights), we comply with all the provisions for the treatment of personal data for which we are responsible, and manifestly with the principles described in article 5 of the GDPR, under which it is processed in a lawful, fair and transparent manner in relation to the data subject and must be appropriate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

The Website uses HTTPS (secure connection). This is a security protocol that makes your data travel in an integral and safe manner, meaning that the transmission of the data between a server and a web user, and during feedback, is totally encrypted.

We guarantee that we have implemented appropriate technical and organisational policies to apply the security measures established by the GDPR and the LOPD in order to protect your rights and freedoms, providing you with all the necessary information so that you can exercise your rights. We have installed all the technical means and measures at our disposal to prevent the loss, misuse, alteration, unauthorised access and theft of the personal data you provide us. However, you must be aware that Internet security measures are not impregnable.


8. MINORS

Minors (14 years of age) may not use the services available through the Website without the prior authorisation of their parents, guardians or legal representatives, who shall be solely responsible for all acts carried out through the Website by the minors in their care, including the completion of the forms with the personal data of said minors and the ticking, where applicable, of the boxes that accompany them. We are not responsible for the veracity or accuracy of the data that is filled in.

The processing of personal data of a minor may only be based on his or her consent if he or she is over 14 years of age.

Exceptions are those cases in which the law requires the assistance of the holders of parental authority or guardianship for the conclusion of the legal act or transaction in the context of which the consent to processing is sought.

The processing of the data of minors under 14 years of age, based on consent, shall only be lawful if the consent of the holder of parental authority or guardianship is given, to the extent determined by the holders of parental authority or guardianship.


9. DURATION AND MODIFICATION OF THE PRIVACY POLICY

We reserve the right to modify this Privacy Policy, in whole or in part, by posting changes on the Website. Likewise, we may change, delete or add, without prior notice, both the contents and services provided, as well as the way in which they are presented. Consequently, as the general conditions/policies published at the time you access will be understood to be valid, you should read them on a periodic basis.

Notwithstanding the foregoing, we may terminate, suspend or interrupt, at any time and without prior notice, access to the contents of the Website, without the User being able to demand any compensation whatsoever.