PRIVACY POLICY – FURTHER INFORMATION

LATEST AMENDMENT: 28/05/2018

The Privacy Policy, in conjunction with the Cookies Policy, is part of the General Conditions that govern the Website www.aluahotels.com.
ALUA HOTELS & RESORTS, reserves the right to modify or adapt this Privacy Policy at all times. Therefore, we recommend that you review it each time you access the website. In the event that the user has registered on the website and accesses their account or profile, by accessing it, you will be informed if there have been substantial changes regarding the processing of your personal data.

Who is responsible for processing your data?
The data collected or provided voluntarily by means of the Website, either by browsing it, or the data you may provide us in the contact forms, via e-mail or by phone, will be collected and handled by the Controller/Processor.
For the purposes of this Privacy Policy, the party responsible for the processing of personal data is:

ALUA HOTELS GROUP SLU, CIF: B87154969
Address: C/ Gremi Sucrers i Candelers, 18, 07009, Palma de Mallorca

As well as the following Company (in the capacity of data controller/processor):

LEISURE TRIP AND TRAVEL SLU, CIF: B57916611
(AluaSoul Mallorca Resort, AluaSun Torrenova, AluaSoul Palma, AluaSoul Alcudia Bay, AluaSoul Ibiza)
Domicilio: C/ Gremi Sucrers i Candelers, 18, 07009, Palma de Mallorca

HOTEL INVESTMENTS AND LEISURE SLU, CIF: B57962201
(Hotel Ambar Beach)
Domicilio: C/ Gremi Sucrers i Candelers, 18, 07009, Palma de Mallorca

TENERIFE GESTIÓN HOTELERA SLU, CIF: B57987463
(Hotel Parque San Antonio)
Domicilio: C/ Gremi Sucrers i Candelers, 18, 07009, Palma de Mallorca

BEACH ROSTORRE SL, CIF: B07220791
(Alua Hawaii Mallorca & Suites)
Av. México, 4, 2º, 07006, Palma de Mallorca

BEACH MIAMI CALDERERS SL, CIF: B07008725
(Alua Miami Ibiza)
Av. México, 4, 2º, 07006, Palma de Mallorca

BAECH PALMA NOVA SL, CIF: B07027089
(Alua Palmanova Bay)
Av. México, 4, 2º, 07006, Palma de Mallorca

BEACH HAWAII EMBARCADOR SL, CIF: B07019607
(Alua Hawaii Ibiza)
Av. México, 4, 2º, 07006, Palma de Mallorca
HOTEL NOTARIO ALEMANY 26 SL, CIF: B67082735
(Alua Calviá Dreams, Hotel Barracuda)
Av. Sarrià, 202-106, planta 11, 08017, Barcelona


Who should you contact at ALUA HOTELS & RESORTS regarding your data protection?
Av. México, 4, 2º, 07006, Palma de Mallorca
Tel: 971465611
E-mail: rgpd@aluahotels.com
If, for any reason, you wish to contact us regarding any matter related to the processing of your personal data or privacy (with our Data Protection Delegate), you can do so via any of the means indicated above.

What data do we collect through our website?

When you browse the website, ALUA HOTELS & RESORTS will collect information regarding:

- IP address.
- Browser version.
- Operating system.
- Duration of visit or time spent browsing on the website.

Such information is stored via Google Analytics, so we are referring to the Google Privacy Policy, as it collects and processes such information. http://www.google.com/intl/en/policies/privacy/
Likewise, the website enables the use of Google Maps, which can gain access to your location, assuming that you allow it, in order to provide greater specificity regarding distance and/or routes to our facilities. To this effect, we refer to the Privacy Policy used by Google Maps, in order to see how they use and process such data. http://www.google.com/intl/en/policies/privacy/

The information we handle will not be related to a specific user and will be stored in our databases, in order to perform statistical analysis, improvements on the website, on our products and/or services and will help us improve our business strategy. The data will not be communicated to third parties.

Registering as a user on the website

To access certain products and/or services, it may be necessary for the user to register on the website. For this purpose, personal data is requested on the registration form. The necessary and obligatory data to be provided by the user in order to carry out such registration is marked with the symbol *. If this information is not provided, registration will not be carried out.
The generated username and password are personal and non-transferable, with the user being responsible for their safeguarding. We recommend that you do not write them down and that you do not notify third parties.
In this case, the navigation data will be associated with the user's registration, identifying the same user who browses the website. This enables us to personalise the offer of products and/or services that, in our opinion, best suit the user, as well as to recommend certain products and/or services.

The registration data of each user will be included in the databases of ALUA HOTELS & RESORTS, along with the history of operations carried out by the user, and will be stored in them unless the account of the registered user is deleted. Once such account has been deleted, this data will be removed from our databases, while separately storing for 10 years data related to the transactions carried out, without accessing or altering this data, in order to comply with the legally valid terms. Any data that is not linked to the transactions carried out will be maintained unless consent is withdrawn, in which case it will be deleted immediately (always taking into account the legal deadlines).

The legal basis for the processing of your personal data is the execution of a contract between the parties.
In relation to sending communications and promotions electronically and the response to requests for information, the legitimacy of the processing is the consent of the affected party.

The purposes of the processing will be the following:
a) To manage registration in the user registration area and access to the website.
b) To manage the purchase of products and/or services made available to you through the website.
c) To keep you informed of the processing and status of your requests, purchases and/or reservations.
d) To respond to your request for information.
e) To manage all the utilities and/or services offered by the platform to the user.

Thus, we inform you that you can receive communications via email and/or on your phone, in order to inform you of possible incidents, errors, problems and/or status of your requests.

For the sending of commercial communications, the express consent of the user will be requested when registering. To this effect, the user may revoke the consent given, by contacting ALUA HOTELS & RESORTS, by using the means indicated above. In any case, in each commercial communication, you will be given the possibility to unsubscribe when receiving them, either through a link and/or e-mail address.


Newsletter Mailing

The option to subscribe to the newsletter of ALUA HOTELS & RESORTS is enabled on the website. To do so, you must provide us with an e-mail address to which the newsletter will be sent.

Such information will be stored in a database of ALUA HOTELS & RESORTS, in which it will be registered until the interested party requests cancellation or, if applicable, ALUA HOTELS & RESORTS discontinues to mail the newsletter.

The legal basis for the processing of this personal data is the express consent given by all interested parties who subscribe to this service by ticking the box designated for that purpose.

The data of the emails will only be processed and stored in order to manage the sending of the newsletter by the users who request it.

In order to send the newsletter, the user's express consent will be requested at the time of registering by ticking the box provided for that purpose. To this effect, the user may revoke the consent given, by contacting ALUA HOTELS & RESORTS using any of the means indicated above. In any case, in each communication, you will be given the possibility of unsubscribing from receiving them, either through a link and/or e-mail address.


If you are one of the following groups, check the information below:

+ CONTACTS OF THE WEB OR EMAIL
For what purposes do we process your personal data?
Answer your questions, requests or enquiries.
Manage the requested service, answer your request, or process your request
Information by electronic means, that relate to your request
Commercial information or events by electronic means, always with your express authorisation.
What is the legal basis for the processing of your data?
The acceptance and consent of the interested party: In those cases where in order to complete an application it is necessary to fill in a form and click on the submit button, doing so will necessarily imply that you have been informed and have expressly granted your consent to the content of the clause annexed to such form or acceptance of the privacy policy.
All our forms have a checkbox with the following formula, in order to send the information: "□ I have read and accept the Privacy Policy."

+ CUSTOMERS
For what purposes do we process your personal data?
Preparation of the budget and monitoring thereof by means of communications between both parties.
Information by electronic means, that relate to your request.
Commercial information or events by electronic means, as long as there is express authorisation.
To manage the administrative, communications and logistics services performed by the Controller.
Billing.
To carry out the corresponding transactions.
Billing and declaring corresponding taxes.
Control and recovery management.
What is the legal basis for the processing of your data?
The legal basis is contractual, just like your consent.

+ SUPPLIERS.
For what purposes do we process your data?
Information by electronic means, that relate to your request.
Commercial information or events by electronic means, always with your express consent.
Manage administrative services, communications and logistics carried out by the Controller.
Billing.
Carry out the corresponding transactions.
Billing and declaring corresponding taxes.
Control and recovery management.
What is the legal basis for the processing of your data?
The legal basis is the acceptance of a contractual relationship, or otherwise your consent to contact us and offer your products by any means.

+ MEMBERS OF THE CLUB “AMIGO ALUA LIFE”
For what purposes do we process your data?
To offer the holder and their family important advantages and exclusive discounts.
What is the legal basis for the processing of your data?
The legal basis is contractual, the acceptance of a contract and your consent when registering.

+ SOCIAL MEDIA CONTACTS
For what purposes do we process your data?
To respond to your enquiries and requests.
To manage the requested service, respond to your request or process your request.
To connect with you and build a community of followers.
What is the legal basis for the processing of your data?
The acceptance of a contractual relationship in the environment of the corresponding social network, and in accordance with its privacy policies:
Facebook http://www.facebook.com/policy.php?ref=pf
Instagram https://help.instagram.com/155833707900388
Twitter http://twitter.com/privacy
LinkedIn http://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv
YouTube: https://www.youtube.com/yt/policyandsafety/es/policy.html

How long do we keep your personal information?
We can only consult or cancel your data in a restricted way by having a specific profile. We will process it as long as you permit it by following us, being friends or clicking on "like", "follow" or similar buttons.
Any rectification of your data or restriction of information or publications must be made through your profile or user settings in the social network itself.

+ VIDEO SURVEILLANCE
For what purposes do we process your data?
Video surveillance of our facilities.
To control our employees.
At times it can be submitted to the courts to exercise legal actions.
What is the legal basis for the processing of your data?
The unambiguous consent of the interested party when accessing our facilities after viewing the information posted of the area under video-surveillance.

+ JOBSEEKERS
For what purposes do we process your data?
To organise the selection process to contract employees.
To give appointments for work interviews and assess your candidacy.
If you have given your consent, we may pass it on to the associates and related entities of ALUA HOTELS & RESORTS, with the sole purpose of helping you find work.
What is the legal basis for the processing of your data?
The legal basis is your unambiguous consent, when you submit your CV and receive and sign information related to the processes we are going to carry out.
How long do we keep your personal information?
The curriculum will be stored for a period of one year, after which, if we have not contacted you, it will be eliminated.

+ RRHH
For what purposes do we process your data?

Management of the employment relationship and the worker's file.
To carry out all the administrative, fiscal and accounting procedures necessary to comply with our contractual commitments, obligations regarding labour regulations, Social Security, prevention of occupational risks, fiscal and accounting.
Payroll management by financial entity.
To control working hours through the access control system by fingerprint/card (if applicable).
Management of group insurance/pension plan of the entity.
To perform training activities both paid and non-paid.
What is the legal basis for the processing of your data?
The legal basis for the processing of your data is the execution of your employment contract.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Do we include personal data from third parties?
No, as a general rule we only process the data provided by the holders. If you provide us with data from third parties, you must first inform and request your consent to such people, or otherwise you will exempt us from any responsibility for the breach of this requirement.

And personal data from minors?
We do not process data from under 14s, therefore refrain from providing it if you are below that age.

Do we send communication via electronic means?
We only do so to manage your request, if it is included in the contact means you have provided.
If we carry out commercial communications, they will have been previously and expressly authorised by you.

What security measures do we apply?
You can rest assured: We have adopted an optimal level of protection of the personal data that we manage, and we have installed all the means and technical measures at our disposal, according to the state of the technology, to avoid loss, misuse, alteration, non-authorised access and theft of personal data.
To what extent will decision making be automated?
ALUA HOTELS & RESORTS does not use fully automated decision-making processes to engage, develop or terminate a contractual relationship with the user. In the event that we use these processes in a particular case, we will keep you informed and we will inform you of your rights in this regard if the law prescribes it.
Will profiling take place?
In order to be able to offer you products and/or services according to your interests and improve your user experience, we can create a "commercial profile" based on the information provided. However, automated decisions will not be made based on that profile.

To which recipients will your data be communicated?
To the Companies that make up the group ALUA HOTELS & RESORTS.
Your data will not be transferred to third parties, except legal obligation. Specifically, the State Agency for Tax Administration, and banks and financial entities will be notified for the collection of the service provided or product purchased, as well as those responsible for the treatment necessary for the execution of the agreement.
In case of purchase or payment, if you choose any application, web, platform, bank card, or any other online service, your data will be transferred to that platform or will be processed in your environment, always with maximum security.
In the event that you have given us your consent for the processing of your name and images and other information related to the activity of ALUA HOTELS & RESORTS, will be disseminated in the different social networks and the website of ALUA HOTELS & RESORTS
International transfers.
In the event that it is necessary to carry out international transfers of data by ALUA HOTELS & RESORTS they will only be made to entities under the authorisation of the US-European Union Privacy Shield agreement (more information: https://www.privacyshield.gov/welcome), to entities that have proved that they comply with the level of protection and guarantees in accordance with the parameters and requirements set forth in current legislation on data protection, such as the European Regulation, or when there is a legal authorisation to carry out the international transfer.

What rights do you have?
To know if we are processing your data or not.
To access your personal data.
To request the amendment of your data if it is inaccurate.
To request the deletion of your data if it is no longer needed for the purposes for which it was collected or if you withdraw the consent granted.
To request the limitation of the processing of your data, in some cases, in which case we will only keep them in accordance with current regulations.
To carry your data, which will be provided in a structured, commonly used or mechanical reading format. If you prefer, we can send it to the new manager you designate. It is only valid in certain cases.
To file a claim with the Spanish Data Protection Agency, if you believe that we have not treated you correctly.
To withdraw consent for any processing for which you have consented, at any time.
If you modify any information, we would be grateful if inform us so we can keep it updated.

Would you like a form for the exercising of your rights?
We have forms for the exercising of your rights, request one by email or if you prefer, you can use the ones drawn up by the Spanish Data Protection Agency or third parties.
These forms must be signed electronically or accompanied by a photocopy of your ID.
If someone represents you, you must attach a copy of your ID, or sign it with your electronic signature.
The forms can be presented in person, sent by letter or by mail to the address of party in charge at the beginning of this text.
You have the right to file a claim with the Spanish Agency for Data Protection, in the event that you consider that the request for your rights has not been adequately addressed.

The deadline for ALUA HOTELS & RESORTS to resolve it is one month, counting from the effective reception of your request by us.

You have the right to revoke consent at any time for any of the treatments for which you have granted.

¿Do we use cookies?
If we use other types of cookies that are not necessary, you can consult the cookies policy in the corresponding link from the start of our website.

How long do we keep your personal information?
Personal data will be stores while you are still connected with us.
Once you dissociate, the personal data processed for each purpose will be stored during the legally foreseen terms, including the period in which a judge or court may request them, taking into account the limitation period for legal actions.
The data processed will be maintained as long as the aforementioned legal deadlines do not expire, if there is a legal maintenance obligation, or if the legal term does not exist, until the interested party requests their suppression or witdraws the consent granted.
We will keep all the information and communications related to your purchase or to the provision of our service, while the guarantees of the products or services last, to attend to possible claims.
In each processing or type of data, we provide you with a specific period, which you can consult in the following table:

File	Document	Storage
Customers	Bills. Forms and coupons. Contracts	10 years. 15 years. 5 years
Human Resources	Pay slips, TC1, TC2, etc. CVs. Dismissal compensation docs. Contracts. Data of temporary workers. Worker's file.	10 years. Until the end of the selection process, and 1 year more with your consent. 4 years. For up to 5 years after leaving.
Marketing	Databases or web visitors	While processing is taking plac
Suppliers	Bills. Contracts.	10 years. 5 years
Access control and video surveillance	Visitors list. Videos	30 days. 30 days block. 3 years destruction
Accounting	Accounting books and documents. Partner and management boards agreements, company bylaws, minutes, board of directors regulation and delegated committees. Financial statements, audit reports. Records and documents related to grants.	6 years
Fiscal	Running the administration of the ALUA HOTELS & RESORTS, rights and obligations related to the payment of taxes.Administration of dividend payments and tax withholdings.	10 years
Health and safety	Medical Records	5 years
Insurance	Insurance policies	6 years (general rule). 2 years (damages). 5 years (personal). 10 years (life)
Purchases	Register all deliveries of goods or services, intra-community acquisitions, imports and exports for VAT purposes.	5 years
Legal	Documents Intellectual and Industrial Property. Contracts and agreements. Permits, licences, certificates. Confidentiality and non-competition agreements	5 years. 6 years from expiry date of permit, licence or certificate. 10 years (limitation period for bringing criminal action). Always the term of the obligation or confidentiality.
Protection of personal data	Processing of personal data, if different from the processing notified to the AEPD (Spanish Data Protection Agency). Personal data of employees stored in the networks, computers and communications equipment used by them, access controls and internal management/administration systems.	3 years. 5 years