This document regulates the rules relating to the Privacy Policy under which HOSPEDERÍA ASADOR EL PUERTO S.L., as Data Controller (hereinafter, “the Controller”), will process the personal data of its customers (whether or not they purchase its services) and suppliers or third parties, provided by them during their access to the website https://hotelabril. This data is provided during the registration process or by any other legally valid means.

If you expressly agree to the transfer of your data to the Controller, regardless of the means by which you do so, provided that your consent is express, you give your free, informed, specific, and unambiguous consent for the Controller to process your personal data, in accordance with the General Data Protection Regulation of the European Parliament and of the Council 679/2016 of April 27 (hereinafter “GDPR”) and Organic Law 3/2018 of December 5 on Data Protection and Guarantee of Digital Rights.

Website content

Data collection

The Data Controller may collect data from its customers, suppliers, and other third parties (hereinafter collectively referred to as “the data subject” or “data subjects”) on its website when they access it and register or request its services through the contact link.

The data subject must enter all the data required by the Platform at any given time (especially those marked with an asterisk), as failure to do so will prevent them from completing their registration as a user or using certain features or services available through the Platform.

Data will also be collected from data subjects when they have provided it to the Data Controller by other means, in the normal course of commercial or professional activity.

Likewise, the interested party shall guarantee that the Personal Data provided is true and accurate and shall notify any changes or modifications thereto through the appropriate channel.

In the event that the interested party provides data from third parties, they shall assume responsibility for having previously informed them and obtained their consent to do so, in accordance with Article 14 of the GDPR.

Category of data collected

The Data Controller may process the following personal data of the user:

Identification data: name and surname(s), tax identification number (NIF)
Contact details: telephone number, email address, and postal address.
Company for which they work
Curriculum vitae

Recipients of the data

Those providers who perform services for the Data Controller in relation to the service it provides to the data subject or vice versa will have access to your data. The Data Controller will maintain the corresponding data processing agreements with each of the providers that provide services to it in order to ensure that these providers will process your data in accordance with the provisions of current legislation.

Personal data may also be transferred to the competent authorities whenever there is a legal obligation to do so.

Similarly, it may be communicated to the financial institutions through which the management of collections and payments is carried out.

It may also be transferred to third-party companies related to the Controller’s activity, for the purpose of sending the user commercial information that may be of interest to them, always connected with the Controller’s business and provided that the user has expressly accepted this.

Purpose of the processing

The Data Controller will process personal data for the purposes set out below, depending on the reason for which they have been provided:

To carry out the provision of the contracted services, the maintenance of the contractual relationship, and the monitoring thereof.
To contact, process, manage, and respond to the user’s request, application, incident, or query (whether by email, contact form, or telephone).
To manage, where applicable, the user’s participation in the private customer area.
To manage, where applicable, the sending of commercial communications about products and services marketed by the Data Controller by electronic and/or conventional means.
To create, where applicable, a user profile in order to offer products and services related to the Data Controller in accordance with their interests.
Assess and manage, where appropriate, the CV provided by the user for selection processes that match their professional profile and carry out the necessary actions for the selection and hiring of personnel.
Manage the membership of the user and/or the company to which they belong to the company, in order to provide them with the services of the Association.

Based on the above and depending on the user category, the Data Controller may use the data for the following purposes:

Customers:

• Budget preparation Billing
  Sending commercial communications Updates to service conditions
  Regular communication within the scope of the contracted services Creating a professional profile for the provision of services
  Suppliers
  Billing
  Sending commercial communications Updates to service conditions
  Regular communication within the scope of the contracted services.
  Social media contacts
  Creation of a community of followers
  Management of friend requests Sending commercial information.
  Creating a professional profile for the provision of services Updates to service conditions Job applicants
  Assessment of the data included in the CV to analyze its suitability for the needs of the Data Controller Sending relevant information related to the job sought in the organization
  If the user expressly accepts, the data may be transferred to collaborating or related companies with the aim of helping the user to find a job.
  Create a professional profile.
  Legitimacy for the collection and processing of data
  The legal basis for the collection and processing of user data is, on the one hand, the imperative obligation to be able to provide the contracted services and, on the other hand, the consent expressly granted by the user for its collection and processing.
  Duration of processing and storage of data
  Data for customer relationship management, billing, and collection of services will be retained for as long as the contract is in force. Once the relationship has ended, if applicable, the data may be retained for the time required by applicable law and until any liabilities arising from the contract have expired.
  Data for the management of queries and requests will be kept for the time necessary to respond to them, with a maximum period of one year.
  Data for sending commercial communications and creating commercial profiles of our products or services will be kept for as long as the commercial relationship with the user is maintained and they do not withdraw their consent for this.
  Curriculum vitae data for selection processes will be kept for two years.
  For information purposes, the legal retention periods for information relating to different matters are listed below:
  TYPE OF DOCUMENT PERIOD LEGAL REF.
  Employment or social security-related documentation
  4 years
  Article 21 of Royal Legislative Decree 5/2000, of August 4, approving the revised text of the Law on Infractions and Sanctions in the Social Order
  Accounting and tax documentation for commercial purposes
  6 years
  Art. 30 Commercial Code
  Accounting and tax documentation for tax purposes
  4 years
  Articles 66 to 70 General Tax Law
  Building access control
  1 month
  Instruction 1/1996 of the AEPD
  Video surveillance
  1 month
  AEPD Guide of November 26, 2018 Organic Law 4/1997. Law 5/2014 of April 4, on Private Security
  User rights
  Any user who provides their personal data to the Data Controller may exercise the following rights:
  Access, rectification, opposition, deletion, portability, and limitation of processing, as well as the right to refuse the automated processing of personal data collected by the Data Controller.
  In turn, all users have the right to withdraw their consent at any time.
  These rights may be exercised free of charge by the user, referring to the request specified in the application through the contact details provided in the Legal Notice link.
  The user has the right to revoke their consent at any time for the sending of commercial communications, simply by notifying the Data Controller and informing them that they no longer wish to receive commercial communications. To do so, the user may revoke their consent by referring to their request through the contact details provided in the Legal Notice or by clicking on the link “no more commercial communications.”
  The user has the right to file a complaint with the Spanish Data Protection Agency if they believe that the Data Controller has committed any type of infringement in the processing of their data.
  Minors
  The Data Controller will not collect data from minors under any circumstances, except in cases where the law allows it. Given the difficulty of verifying the age of users, it is the responsibility of the parents or guardians of minors under the age of 14 to establish control measures on the devices that minors may access, in order to prevent them from improperly disclosing their data.