Privacy policy
Effective date: 28/12/2018 (V.05)
(SECOND LAYER OF INFORMATION)
About us
At AR HOTELS & RESORT, we have updated our Privacy Policy to match the new regulations, both European (Regulation 2016/679), and national (Organic Law 3/2018). Our contact details, as Co-controllers of the processing of the data which we collect through our Website and our profiles on the different social networks are the following:
https://www.ar-hotels.com/aviso-legal
What data do we collect?
The data provided by users of our website or the different social networks on which we maintain a professional profile, may meet different needs, all easily identifiable depending on the context. For example: if a user fills out a contact form and/or takes part in a certain promotion, evidently, their data will be used for those purposes and to keep them informed, subsequently, of any news related to our services and/or the promotion offered. Under no circumstances do we collect more data than strictly necessary to fulfil the stated purposes at all times. Generally, we shall always limit ourselves to collecting the following types of data:
For what purpose do we process/use your personal data?
The purposes for which we collect the personal data of users of our Web and Social Networks shall always be expressed clearly and transparently. For example: regarding contact forms, the data will be processed exclusively to meet information requests and the interested party will be kept up to date about future activities, services and products related to their request. In any case, at any time and always free of charge, the interested party may exercise any of the rights provided for in current legislation (see below), by sending a simple email addressed to our Data Protection Officer: dpo@ar-hotels.com.
In cases where AR HOTELS & RESORT would like to use your data for more than one purpose, it will always seek consent for each one of them. Example: the user will be free to give their consent to take part in a promotion of services linked to a certain season (summer), opting (or not) to take part in a promotion or newsletter which has a different frequency and/or is continued over time. Under no circumstances shall the entity force consent which is bound or en bloc: our users can always choose at any time what information to receive, how and when.
The Legal Basis
Technically, the term "Legal Basis" identifies the qualification that protects us with regard to the processing of the personal data of our users. Example: if a user decides to purchase certain services or products through our website, the legal basis for the processing of their personal data will obviously be the contract. Through a contract, AR HOTELS & RESORT will manage the preparation of reservations, stays, orders, shipping, collection, returns, guarantees, etc.
In other cases, the legal basis that enables the processing of the user's personal data will be the consent of the user. This is the case regarding the processing of curriculum data of people who would like to work with us.
For the user’s information, the summary of the legal bases that cover the processing of the different data is in the initial part of this section.
In case of doubt, as always, our Data Protection Officer can be contacted directly on the following email: dpo@ar-hotels.com.
Legal interest as legal basis for processing.
According to 47º statement of the European Regulation 2016/679, we use Legitimate Interest as the legal basis for the processing of personal data of our clients in the following way:
First Purpose: Direct marketing, meaning sending commercial information periodically by electronic ways (emails).
Interested parties’ interests and fundamental rights: only the email addresses, whose owners have given previous consent and have subscribed to our newsletter, will be processed; and/or have been guests at our establishments; and/or have participated in our customer satisfaction survey, promotions and raffles. The interested parties’ rights are permanently guaranteed in the following way:
In any moment, the interested parties can exercise any of the rights provided by the current legislation in matters of privacy, as well as contact our DPO: dpo@ar-hotels.com;
All organizational, technical and legal measures are taken for the correct protection of the processed personal data;
There is a relevant and appropriate relationship between the parties (which may be a contract and/or a participation consent for the mentioned activities). Therefore, the privacy expectations of the interested parties are reasonable, in accordance with the affected rights and the type of the processed personal data (name and email).
Second Purpose: intra-group communications, only for administrative, accounting, fiscal, taxes and invoicing processes:
Interested parties’ interests and fundamental rights: Only necessary data of people who have previously been customers of our establishments will be processed in order to comply with the accounting and tax obligations. The interested parties’ rights are permanently guaranteed in the following way:
In any moment, the interested parties can exercise any of the rights provided by the current legislation in matters of privacy, as well as contact our DPO: dpo@ar-hotels.com;
All organizational, technical and legal measures are taken for the correct protection of the processed personal data;
The is a relevant and appropriate relationship between the parties (contract). Therefore, the privacy expectations of the interested parties are reasonable, in accordance with the affected rights and the type of processed personal date (identifying/accounting data).
Withdrawal of Consent
In cases where consent has been the legal basis by which the personal data of our users has been processed (as in the example of the CVs/résumés), such consent may be withdrawn at any time and in the simplest manner. If it was easy to send us a CV via email, it will be as easy to withdraw your consent, through the same route: an email addressed to our Data Protection Officer.
It is obviously impossible for such withdrawal of consent to have retroactive effects, nor for it to come into force at the same time the user sends us his or her decision to no longer consent to the processing of their data.
Conservation Period
Here, we shall indicate how long AR HOTELS & RESORT intends to store the personal data of the users of our online services.
There is no uniform conservation period, because the processing and purposes are different and varied. In any case, the entity will always follow the rules shown below:
Also, in this case, do not hesitate to contact our Data Protection Office to find out the details of our personal data retention policy.
Automated Decisions
"Automated Decisions" means those decisions taken by the Controller, without human intervention and based on personal data provided by the user, either manually (for example, by filling out a form), or by studying their browsing habits.
AR HOTELS & RESORT hereby notifies that it does not take any automated decisions, through analysing the browsing of its users, both on the Web, and on the profiles of social networks.
Recipients of Information
AR HOTELS & RESORT shares the information with the companies associated with the symbols and brands of AR HOTELS & RESORT. An exhaustive list of such companies and their corresponding contact information can be obtained by clicking on this link: https://www.ar-hotels.com/aviso-legal. This communication is made under the provisions of Recital 48 of the European Data Protection Regulation 2016/679 “Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data”.
The entity may have, on a one-off basis, external collaborators, these relationships always being covered by a Data Processing contract.
Rights of Interested Parties
AR HOTELS & RESORT hereby notifies interested parties of their rights. As always, in case of doubt, you can consult with our Data Protection Officer. Interested parties can exercise their rights via a simple email, addressed to: dpo@ar-hotels.com.
Right of access: the user can request information from the entity about what the latter has with regard their online relationship and, eventually, their offline relationship. For example, the user can request access to their data regarding their registration to a newsletter, or to knowledge about their clinical history. In any case, the entity will request proof of identity from the petitioner, depending on the importance of the data to which access is required. More specifically, the user has the right to know:
Right of rectification: in the event that the entity had erroneously recorded some data, or also where the user had changed all or part of their data (for example, changing the email where they want to receive our information), they would only have to send us an email, stating which data they wanted to rectify and how.
Right of withdrawal: in this case, the interested party may exercise the so-called "Right to be forgotten". The entity, once the legally stipulated deadlines for the conservation of the different data held by the interested party have expired, will proceed to its definitive elimination. In any case, as long as the aforementioned deadlines do not expire, the data object of this request will be blocked and not used in any way, beyond its mere conservation.
Right to limitation of processing: the interested party may request that the processing of their data be limited in the following cases:
Right of portability: the interested party may request a copy of their data, in a structured machine readable or shared use format. This copy can be sent directly to the interested party or whoever they choose, provided that this possibility is technically feasible.
Right of opposition: the interested party may request that the entity carry out data processing, based on the legitimate interest of the entity. Likewise, this right to oppose processing for the purpose of direct marketing and profiling may be exercised.
Right not to be subjected to automated decisions: in the event that the entity carried out this type of activity (taking automated decisions, which in some way affected the rights or interests of the interested party, without human intervention), the interested party may request, at any time, not be subjected to these practices.
Closing Regulations
Users of this Website understand that all information provided through social networks (posts, mentions, comments, links, chats, videos, photos, etc.) may be public and, as such, used by third parties over which the entity has no technical possibly of restricting. Such third parties, without authorisation from AR HOTELS & RESORT, may use such data published by users, for purposes not directly related to the interests of the company, without, therefore, authorisation, concession, consent being sought for such acts or mere knowledge thereof. Therefore, users should be aware of this fact, which is inherent in using information published via Social Networks.
All opinions and, in general, information published by users only represent the opinion of the person who posted the information in the first place and does not indicate that our company has taken part thereof.
Regarding the identification of users who link, comment, post and contribute (texts, videos, photos, etc.) on behalf of management companies and owners of platforms known as "Social Networks", the entity cannot ensure compliance with current legislation at all times in terms of data protection and refers users to the privacy policies of each social network.
As regards contents published in spaces on Social Networks used by AR HOTELS & RESORT, users are reminded to follow the rules expressed above.
