This privacy policy applies to the processing of data carried out at Predi Son Jaumell Hotel Rural. Please read it carefully, as it contains important information about the processing of your personal data and the rights granted to you under the applicable legislation.
This policy is available at the hotel reception, where you may request a copy to keep.
As a general rule, the fields in our forms marked as mandatory must be completed in order for us to process your requests.
 

1. WHO IS THE DATA CONTROLLER?

The data controllers for the processing of customer and guest data at the hotel are the company operating the hotel in which you are staying (hereinafter, the HOTEL), whose identification and contact details are as follows (also available at the hotel reception):
The HOTEL is responsible for the processing of customer and guest data required for the operational management of the hotel, such as the hotel’s administrative and accounting management, the management of bookings and stays, the provision of contracted services and the handling of customer complaints.

PREDI SON JAUMELL is responsible for the processing of personal data relating to the company and hotel management, which includes:
The management control of the hotels and the analysis of business data;
The definition and control of the standards applied by the hotels, as well as the control and improvement of quality at the level of the PREDI SON JAUMELL companies;
>The commercial use of customer and user data for the sending of commercial communications, the management of loyalty programmes, the creation of commercial profiles or the personalisation of customer services.

For further information about the processing of your data or the exercise of the rights granted to you by the applicable legislation, you may send an email to the Data Protection Officer: dpd@hotelsviva.com
 

2- FOR WHAT PURPOSES WILL YOUR DATA BE PROCESSED AND ON WHAT LEGAL BASIS?

The data of customers and guests of the PREDI SON JAUMELL hotel are processed for the following purposes:
  2.1 Management of bookings and provision of the requested services
 2.2 Registration and control of travellers
 2.3 Recording of entertainment activities and activities
 2.4 Attention to special needs
 2.5 Quality control
 2.6 Use of the WIFI service
 2.7 Handling of queries and complaints
 2.8 Consolidation of customer data
 2.9 Sending of non-personalised commercial communications and management of distribution lists (segmentation)
 2.10 Creation of a commercial profile for the personalisation of PREDI SON JAUMELL services and commercial communications

Below you will find detailed information about each of these purposes.
 

2.1 Management of bookings and provision of the requested services

The HOTEL will process the data provided in booking or service requests for the management of such bookings and the provision of the requested services.

What data are processed for this purpose and how have they been obtained? The categories of data that the HOTEL will process for these purposes are as follows:
- Identification and contact details of the booking holder;
- Data relating to the booking itself or service request, including dates of stay, number and age of guests and requested services;
- Data relating to transactions of goods and services.

These data are obtained either directly from you or from third parties who have processed the booking or requested the service on your behalf, for example, the travel agency through which you booked your stay.
The processing of these data is necessary for the performance of the accommodation contract, the provision of the requested services or the implementation of pre-contractual measures at your own request.
The financial data and data relating to transactions of goods and services generated by your stay will be processed for accounting and administrative management purposes and for compliance with the HOTEL’s legal obligations in accounting and tax matters.

The HOTEL has a VIRTUAL BUTLER service. This tool is provided through the WhatsApp application supplied by WhatsApp Ireland Limited. More information is available at https://www.whatsapp.com/legal/privacy-policy-eea#G1Di6og0cz0BSJDBp. The BUTLER service has been enabled to effectively provide the services offered in our establishments. Specifically, customers may request information, make bookings at our restaurant and spa, and submit requests relating to our HOTEL services. For this purpose, we will process your contact details, specifically your mobile phone number, in order to properly respond to your requests. The processing of this data is based on your consent. Failure to give your consent, or withdrawal of your consent, does not affect the fulfilment of your booking or the provision of the contracted services. You may request to unsubscribe from this processing at any time by requesting it directly in the chat of the application or by notifying reception.

The data collected at the time of your registration at the hotel, together with the data generated during your stay and, where applicable, the data provided to our BUTLER service, will be consolidated in PREDI SON JAUMELL databases. More information is available in the section “Consolidation of company customer data”.
 

2.2 Registration and control of travellers

In application of the current traveller control legislation, hotels must register the information of guests staying at their establishments. This information is collected in the registration form that guests must complete and is consolidated in a traveller register book that must be kept by the HOTEL and made available to the competent authorities.

What data are processed for this purpose?
- First name and surname, sex, date of birth, country of nationality, identity document number and type, date of issue of the document, date of entry and signature.

Likewise, when required by the health regulations in force during your stay, the HOTEL will establish a register of the persons accessing the establishment in order to allow the competent health authorities to control epidemics. Upon arrival, you will be expressly informed of the specific applicable health obligations.
 

2.3. Recording of entertainment activities and activities.

The entertainment activities or activities organised by the HOTEL may be photographed or recorded for subsequent display on screens located within the hotel itself. Your consent will be requested prior to the capture and dissemination of your image. Such consent does not affect your participation in the entertainment activities or activities and may be withdrawn by requesting this at the hotel reception during your stay or by contacting the Data Protection Officer once your stay has ended.
 

2.4. Attention to special needs.

Health data that you provide in order to attend to special needs, such as allergies or medication intake, will be processed by the HOTEL solely for this purpose. The processing of these data is based on the explicit consent you provide when requesting special attention or when providing this information when requesting a treatment at the SPA. You may withdraw your consent for the processing of your health data at any time by notifying the hotel reception, although in such a case it may not be possible to provide the special attention or requested service.
 

2.5. Quality control.

In order to evaluate the application of PREDI SON JAUMELL standards and assess the quality of the services and products offered to its customers, PREDI SON JAUMELL may carry out customer satisfaction or opinion surveys. These surveys are anonymous and completion is not mandatory.

However, if you provide data that identify you in these surveys, such as your name or room number, HOTELS VIVA & RESORTS may use the contact details you have provided to contact you in relation to the complaints or suggestions you have made. This processing is based on PREDI SON JAUMELL’s legitimate interest in assessing and managing the quality of the services and products offered and improving customer service.

How has this interest been balanced against your rights and freedoms? For the balancing of this interest against your rights and freedoms, the following has been determined:
The processing is compatible with the reasonable expectations of the data subjects, as they are PREDI SON JAUMELL customers who, having made a complaint or suggestion in relation to the provision of the service received, have voluntarily provided their identification details. Likewise, the data used to contact the data subjects have been provided by the data subjects themselves.

The impact of the processing on the privacy of the data subjects is limited, since the purpose of the contact is limited to resolving complaints or discussing the suggestions raised by the data subjects, and this purpose also benefits the data subjects by improving the quality of the services and the level of customer care.
 

2.6. Use of the WIFI service.

Your identification and contact details will be processed for the management of access to the Wi-Fi and the security of the hotel’s systems.

We do not control or monitor connections made through the Wi-Fi, unless this is essential to prevent or manage a threat to the security of our systems or to investigate breaches of the Wi-Fi terms of use or applicable laws. Nevertheless, in such cases, we will always choose the least intrusive method for the privacy of Wi-Fi users.

The legal basis for the processing of your data is the provision of the requested WIFI service and our legitimate interest in managing the security of our systems.
 

2.7. Handling of queries and complaints.

The data provided in your queries or complaints will be processed in order to respond to your requests and manage any complaints. This processing is necessary for the performance of the accommodation contract, the implementation of pre-contractual measures at your own request or the defence against customer claims.

The processing of any health data you may have provided in your complaint is covered by Article 9.2(f) of the GDPR, as such processing is necessary for the establishment, exercise or defence of legal claims.
 

2.8. Consolidation of PREDI SON JAUMELL customer data.

The data provided by customers, together with the data generated by their stays at the HOTEL, are consolidated in databases owned by PREDI SON JAUMELL.

What data are consolidated? The categories of customer data that are consolidated are as follows:
- Identification data: first name, surname, identification document (type, number, date of issue), country of residence, postal, delivery or billing address, email, fax, mobile phone number;
- Personal characteristic data: sex, date and country of birth, nationality, family data, including family situation, children, their date of birth, whether they are adults or minors, partner, language;
- Data relating to the booking, including dates of stay, number and age of guests, services included in the booking and consumption during the stay, including purchases, use of services, food and beverages consumed, use of facilities;
- Data provided in claims and complaints;
- Data relating to transactions of goods and services;
- Financial, economic and insurance data;
- Data obtained from the BUTLER service.

These data are consolidated in PREDI SON JAUMELL systems located in the European Union.

The purpose of this consolidation is to maintain a customer register, standardise information formats and coding, and allow the centralised management of operational processes common to all hotels, for example, the communication of traveller registration forms to the competent authorities when required by the applicable legislation.

This consolidation is based on the legitimate interest recognised by Recital 48 of the GDPR in transmitting customers’ personal data between companies, as they are affiliated entities forming part of a central body for internal administrative purposes.

How has this interest been balanced against your rights and freedoms?
For the balancing of this interest against your rights and freedoms, the following has been determined:
- The impact of the processing on the privacy of the data subjects is limited, taking into account the purpose, the limitation of the retention period of these data and the adoption of technical and organisational measures to prevent the use of such data for commercial purposes, including profiling, without the consent of the data subjects.
- The consolidated data are also used for the purposes indicated below.
 

2.9. Sending of non-personalised commercial communications and management of distribution lists (segmentation)

PREDI SON JAUMELL processes the identification and contact details provided by customers, together with data relating to their customer status, language and market of origin, for the sending of non-personalised commercial communications relating to the tourism products and services offered by PREDI SON JAUMELL and the management of distribution lists.

The consolidation of this information for this purpose is based on PREDI SON JAUMELL’s legitimate interest in creating and using a commercial database of PREDI SON JAUMELL customers for direct marketing purposes.

How has this interest been balanced against your rights and freedoms?
For the balancing of this interest against your rights and freedoms, the following has been determined:
- Recital 47 of the GDPR states that the processing of personal data for direct marketing purposes may be considered to be carried out on the basis of legitimate interest. Recital 48 of the GDPR recognises that there may be a legitimate interest in transmitting customers’ personal data between companies, as they are affiliated entities forming part of a central body for internal administrative purposes.
- This processing is compatible with the reasonable expectations of the data subjects, as they are customers of the company and there is a prior contractual relationship before the sending of commercial communications, which refer to PREDI SON JAUMELL’s own tourism products or services.
- The impact on the privacy of the data subjects is limited, as the processing affects a limited number of data and the possibility to object to the processing is offered both at the time the data are collected and in the commercial communications themselves.

The sending of commercial communications by electronic means is based on Article 21.2 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, which transposes Directive 2002/58/EC (e-Privacy Directive) in Spain.

To manage its distribution lists, PREDI SON JAUMELL classifies the recipients of its communications according to their customer status, language and market of origin. This processing is based on PREDI SON JAUMELL’s legitimate interest in segmenting the recipients of its communications.

How has this interest been balanced against your rights and freedoms?
For the balancing of this interest against your rights and freedoms, the following has been determined:
- The processing is compatible with the reasonable expectations of the data subjects, as it constitutes ancillary processing to the sending of commercial communications and enables the recipients of such communications to receive them in a format and with content adapted to their language and market.
- The processing does not pose a significant threat to the privacy of the data subjects, as it consists of a simple classification based on objective criteria that do not allow new information about the data subjects to be inferred. Technical and organisational measures have been adopted to prevent the creation of commercial profiles, predictions or individualised behavioural analyses on the customer data set, unless the data subjects have authorised the processing of their data for this purpose. Likewise, data subjects retain control over their information, as they are offered the possibility to object to receiving commercial communications at any time.
 

2.10. Creation of a commercial profile for the personalisation of PREDI SON JAUMELL services and commercial communications

If you have authorised the personalisation of PREDI SON JAUMELL services and communications, PREDI SON JAUMELL will access the data generated by your stay at the HOTEL in order to include them in a commercial profile.

What data are included in my profile?
The profile created by PREDI SON JAUMELL will consolidate the following data generated by your bookings and stays at the hotels:
- Identification and contact data: first name, surname, country of residence, postal address, email, fax, mobile phone number;
- Personal characteristic data: gender, date and country of birth, nationality, family data, including family situation, children, their date of birth, partner, language;
- Data relating to transactions of goods and services: data relating to the booking, including dates of stay, number and age of guests and services included in the booking, and consumption during the stay, including purchases, use of services, food and beverages consumed, use of facilities;
- Preferences expressed during the stay, for example, if you have requested a special type of pillow;
- Data provided in any claims, complaints or surveys.

Health data or other special categories of data, such as religion or beliefs, or payment method data, for example bank card details, that you may have provided for your stay will never be included in your profile.

PREDI SON JAUMELL will use this profile to:
Personalise the treatment and services provided by the companies and PREDI SON JAUMELL, for example, to wish you a happy birthday or to take into account the preferences you have expressed during your stays.

What does this personalisation involve?
- The hotels and the companies of HOTELS VIVA & RESORTS & PREDI SON JAUMELL with which you contact or contract a service will consult the data in your profile in order to personalise the attention given to your request and the provision of that service. This personalisation is carried out in accordance with the standards defined by PREDI SON JAUMELL. Your profile is only consulted when you contact and interact with the hotels and companies of the group and is carried out by connecting to PREDI SON JAUMELL’s customer relationship management tool (CRM), located in the European Union. The data in your profile are not incorporated into the systems of the hotels and companies carrying out the consultation.
- Personalise your offers according to your consumption profile, for example, to determine the periods of the year in which you have stayed or usually stay at our establishments or the type of product that may be of interest to you, taking into account your past bookings or the actions you have taken on the corporate website, for example, products aimed at family holidays if you have travelled as a family, or stays related to products you have viewed on our website without contracting them. This profile is also used to make special offers based on the frequency of your bookings, the products contracted and the amounts spent.

Although no automated individualised decisions are made based on this profile that produce legal effects concerning our customers or similarly significantly affect them, we inform you of your right to object to the adoption of such decisions in accordance with Article 22 of Regulation (EU) 2016/679.

These processing operations and data flows are based on the consent you have given. Failure to give your consent, or withdrawal of your consent, does not affect the fulfilment of your booking or the provision of the contracted services. You may withdraw your consent at any time by sending an email to gdpr@hotelsviva.com.
 

3. TO WHOM ARE YOUR DATA DISCLOSED?

Your data will only be disclosed between PREDI SON JAUMELL companies in the situations described in the previous sections, or to third parties due to legal obligations, with your prior consent or when necessary to provide you with the requested services. Specifically:
- The HOTEL will disclose guest registration forms to the competent authorities when required by the applicable health, security or traveller control regulations.

If your booking includes ancillary services provided by third-party suppliers, or if your requests relate to such services, the personal data necessary to process such booking or availability request will be disclosed to the relevant suppliers, solely for this purpose. These disclosures are necessary for the provision of the requested services or for the implementation of pre-contractual measures at your own request.
 

4. HOW LONG ARE YOUR DATA RETAINED?

As a general rule, customer and guest data will be retained for the duration of the relationship maintained with the HOTEL and PREDI SON JAUMELL and, in any case, for the periods provided for in the applicable legal provisions and for the time necessary to address any liabilities arising from the processing. Your data will be erased when they are no longer necessary or relevant for the purposes for which they were collected. Specifically:
- The HOTEL will retain the financial data and data relating to transactions of goods and services generated by your stay for the period required by the applicable accounting and tax legislation.
- The HOTEL will retain the guest register books required by Organic Law 4/2015 of 30 March on the protection of citizen security for a minimum of 3 years.
- Health data provided by customers to the hotel in order to attend to special needs are erased daily in relation to non-staying customers and once the stay has ended in the case of customers staying at the HOTEL.
- Chats generated in the WhatsApp application for the BUTLER service will be deleted once your stay at the HOTEL has ended.
- Customer data consolidated in the central hotel management tool (PMS) are retained for 6 years.

Data processed by PREDI SON JAUMELL for commercial purposes, including commercial profiles, will be retained for as long as you do not object to the processing or request their erasure. The media recording the existence of your consent to the processing of your data for these purposes, such as signed forms, logs of electronic form submissions and check-in sheets, will be retained for the entire duration of the processing and the applicable limitation periods.

Data processed by PREDI SON JAUMELL for management control and business data analysis purposes are retained indefinitely. With regard to customer data where customers did not give their consent to profiling, the data are anonymised when the retention period of their information in the central PMS expires.
 

5. WHAT ARE YOUR RIGHTS?

You have the right to obtain confirmation as to whether or not we are processing your personal data and, if so, to access them. You may also request that your data be rectified when they are inaccurate or that incomplete data be completed, as well as request their erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected.

In certain circumstances, you may request the restriction of the processing of your data. In such a case, we will only process the affected data for the establishment, exercise or defence of legal claims or for the protection of the rights of other persons. Under certain conditions and for reasons related to your particular situation, you may also object to the processing of your data. In this case, we will stop processing the data unless there are compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Likewise, and under certain conditions, you may request the portability of your data so that they are transmitted to another data controller.

You may withdraw the consent you have given for certain purposes, without affecting the lawfulness of processing based on consent before its withdrawal.

You may withdraw your consent or object to the processing of your data for direct marketing purposes at any time, including the creation of commercial profiles. In such a case, we will stop processing your personal information for those purposes. You also have the right to object to the adoption of automated individual decisions that produce legal effects concerning you or similarly significantly affect you, where this right applies in accordance with Article 22 of Regulation (EU) 2016/679.

To stop receiving commercial communications, you may use the link provided for this purpose in our communications or send an email to the following address: gdpr@hotelsviva.com

To request the erasure of your commercial profile, you may send an email to the following address: gdpr@hotelsviva.com

You also have the right to lodge a complaint with a data protection authority.

To exercise your rights, you must send us a request by post or email to the addresses indicated in the section “Who is the data controller?”

You can obtain more information about your rights and how to exercise them on the website of the Spanish Data Protection Agency: https://www.aepd.es