In the event that the website allows subscription to the Newsletter or registration for the “Hidden Rewards” loyalty programme, it will be necessary for the user to provide the personal data required in the corresponding form, including at least a valid e-mail address.

Signing up for the Newsletter and the Hidden Rewards programme will be done independently, and it is not obligatory to accept the sending of commercial communications in order to form part of the loyalty programme.

For the sending of commercial communications, the user's express consent will be required by ticking the corresponding box. Additionally, a double opt-in system will be implemented, whereby the user must confirm their subscription via a link sent to their e-mail address.

The legal basis for the processing shall be:

- The user's consent to receive commercial communications.

- The execution of a contract or the application of pre-contractual measures, in connection with the management of the Hidden Rewards programme

Personal data will be processed for the following purposes:

- Manage Newsletter subscription

- Send commercial communications, promotions and news

- Manage the registration, participation and benefits associated with the Hidden Rewards programme.

- Where appropriate, personalise the offers and benefits of the programme, only when the user has given his consent to do so.

In the event of processing based on profiling (e.g. personalisation of offers on the basis of consumption habits or preferences), this will only be carried out on the basis of the user's consent.

The data will be kept as long as the user does not request cancellation of the service, does not cancel their participation in the programme or does not withdraw their consent. Once the relationship has ended, the data will be deleted or blocked in accordance with the legally established deadlines.

The data may be processed by email marketing service providers and technology platforms associated with the loyalty programme, who will act as data processors under appropriate contractual safeguards. In case of international transfers, appropriate safeguards will apply in accordance with the GDPR.

Users may withdraw their consent at any time, as well as unsubscribe from the Newsletter or the Hidden Rewards programme through the link provided in each communication or through the channels indicated in this Privacy Policy.

Commercial communications may be carried out centrally by the HIDDEN HOTELS group, using customer management tools (CRM), and may include information from different establishments in the group, always in accordance with the consent given by the user.

__________________________________________________________________________________________________

If you belong to any of the following groups, please consult the detailed information below

            +WEB OR EMAIL CONTACTS

For what purposes will we process your personal data?

• Attend and respond to your queries, requests or petitions.
• Manage the requested service or information.
• Maintain communications related to your application, including by electronic means.
• To send you commercial communications or information about events, only if you have expressly authorised this.

What is the legal basis for processing your data?

The legal basis for the processing of your data is:

• The application of pre-contractual measures or the performance of a contract, where your request relates to the procurement of services.
• The legitimate interest of the data controller, to deal with general enquiries and to maintain the relationship derived from your request.
• The consent of the data subject, in relation to the sending of commercial communications.

In those cases in which the processing is based on consent, this will be obtained by ticking the corresponding box, which will not be pre-ticked in any case.

All forms shall have a check box with the following formula:

“I have read and accept the Privacy Policy”.”

By filling in and sending the form, the user declares that he/she has been informed about the processing of his/her data in accordance with this Privacy Policy.

How long will we keep personal data?

The personal data provided through contact forms or by sending e-mails will be kept for the time necessary to deal with and manage the request made.

Once the management of the consultation has been completed, the data may be duly blocked for the duration of the statute of limitations for possible legal liabilities.

In the event that the user has authorised the sending of commercial communications, their data will be retained as long as they do not withdraw said consent.

            + CLIENTS/GUEST / HOSPITALITY

For what purposes will we process your personal data?

Your personal data will be processed in order to manage the contractual relationship derived from the reservation and stay in the establishments of the HIDDEN HOTELS group.

Specific purposes include:

• Budgeting and monitoring of budgets.
• Managing the reservation, including prior processing, confirmation, modification, or cancellation.
• The provision of accommodation and associated services during the stay.
• The management of communications necessary for the correct provision of the service (confirmations, reminders, incidents or relevant information about the stay), including by electronic means.
• Administrative, accounting and tax management derived from the services provided.
• The carrying out of economic transactions, collections, payments and, where appropriate, guarantees or pre-authorisations.
• Compliance with the legal obligations applicable to the hotel sector, in particular those relating to the registration of travellers and public safety regulations.
• The management of internal controls, audits, complaint handling, fraud prevention and recovery of outstanding amounts.
• Conducting satisfaction surveys and service quality evaluations.
• The sending of commercial communications, promotions or offers related to HIDDEN HOTELS, only with the express authorisation of the user.
• Likewise, the data may be used centrally by the HIDDEN HOTELS group to send commercial communications, provided that the user has given his or her express consent.

What is the legal basis for processing your data?

            The legal basis for the processing of your personal data is:

• The execution of a contract or the implementation of pre-contractual measures, for the management of quotations, reservations, accommodation and associated services.
• Compliance with legal obligations in relation to tax, accounting, public safety and applicable sectorial regulations.
• The legitimate interest of the data controller, for the management of complaints, fraud prevention, debt collection and improvement of the quality of service, including the carrying out of satisfaction surveys.
• The consent of the data subject, in relation to the sending of commercial communications.

The communications necessary for the management of the reservation or provision of the service will not be considered as commercial communications, as they are based on the execution of the contract.

How long will we keep personal data?

The personal data will be kept for the time necessary for the management of the contractual relationship arising from the reservation and stay in the establishments of the HIDDEN HOTELS group.

In particular:

• Data related to bookings and accommodation services: during the contractual relationship and, subsequently, during the periods required by the applicable regulations, in particular the regulations on the registration of travellers, as well as tax and accounting obligations.
• Data associated with invoicing and payments: during the legally required tax and accounting periods.
• Data used for fraud prevention, claims or recoveries: for the time necessary for the management of such actions and the applicable statute of limitations.
• Data used for satisfaction surveys: for the time necessary to assess the quality of service, applying minimisation criteria.

In the event that the user has authorised the sending of commercial communications, their data will be retained as long as they do not withdraw said consent.

Once the aforementioned periods have expired, the data will be deleted or, where appropriate, blocked during the periods of limitation of possible legal liabilities, in accordance with the applicable regulations.

            + SUPPLIERS.

For what purposes will we process your personal data?

We will process the personal data of suppliers and collaborators in order to properly manage the commercial or professional relationship that links them with the different companies of the HIDDEN HOTELS group.

 Specific purposes include:

• Maintaining communications related to requests, proposals, offers, or exchanges of information necessary for the provision of services.
• Sending information by electronic means related to your request or to the existing contractual relationship.
• Sending commercial or event-related information only where express authorization exists.
• Managing administrative, communication, and logistical services necessary for the contracting, provision, and control of the supplied services or products.
• Carrying out the corresponding financial transactions, including payments, collections, and reconciliations.
• Managing invoicing, accounting, and compliance with applicable tax or fiscal obligations.
• Carrying out control procedures, internal audits, quality verification, fraud prevention, or recovery of outstanding amounts, when necessary for the proper execution of the contractual relationship.

What is the legal basis for processing your data?

            The legal basis for processing supplier data is the performance of a contract or the application of pre-contractual measures related to the provision of services or supply of products. In the absence of a contractual relationship, the legal basis may derive from the data subject’s consent when they contact us through any channel. Certain processing operations linked to tax, accounting, or legal obligations are based on compliance with legal obligations. Commercial communications will be sent only where express consent exists.

How long will we keep personal data?

The personal data of suppliers and collaborators will be kept for the time necessary to manage the existing contractual or professional relationship.

• In particular:
• Identification and contact data: for the duration of the contractual or commercial relationship.
• Data related to invoicing, payments and accounting: during the legally required tax and accounting deadlines.
• Data used for administrative management, audits, internal control or fraud prevention: for the time necessary for these purposes and the applicable limitation periods.

In the event that a contractual relationship is not formalised, the data will be kept for the time necessary to process the request or proposal and will subsequently be deleted, unless there is a legal obligation to keep them.

In the event that the provider has authorised the sending of commercial communications, your data will be retained until you withdraw this consent.

Once the aforementioned periods have expired, the data will be deleted or, where appropriate, blocked during the periods of limitation of possible legal liabilities, in accordance with the applicable regulations.

            + SOCIAL MEDIA CONTACTS

For what purposes will we process your personal data?

When you interact with us through our official social media accounts, the personal data you provide or that is visible on your profile will be processed for the following purposes:

• Attend and respond to your queries, requests or petitions.
• Manage the relationship with you as a user of the social network.
• Interact with you and energise the community of followers.
• To analyse user interaction and participation for statistical purposes and to improve our services.

What is the legal basis for processing your data?

The legal basis for the processing is:

• The legitimate interest of the data controller in managing its presence on social networks and attending to the users who interact with its profiles.
• The execution of the relationship established with the user within the social network itself, in accordance with its terms of use.

In any case, the processing is carried out in accordance with the privacy policies of the corresponding social network. HIDDEN HOTELS and the social network platform may act as co-responsible for the processing in relation to certain processing (for example, page usage statistics), in accordance with the provisions of each platform.

How long will we keep personal data?

The personal data will be processed for as long as the user maintains a relationship with the HIDDEN HOTELS profile on the social network (for example, by following or interacting with it).

However, HIDDEN HOTELS has no direct control over the conservation of the data on the platform, so the effective deletion of the data will depend on the user's privacy settings and the policies of the corresponding social network.

In any case, HIDDEN HOTELS may delete or stop processing data that is inappropriate or excessive in the context of the interaction with your profiles.

            + VIDEO SURVEILLANCE

For what purposes will we process your personal data?

The images captured through the video surveillance systems installed in our facilities will be processed in order to guarantee the security of people, goods and facilities.

Likewise, in the field of employment, they may be used to monitor compliance with employment obligations, within the limits established by the regulations in force and respecting the rights of workers in all cases.

The images may be made available to law enforcement agencies, as well as to courts and tribunals, when necessary for the investigation of facts or the exercise of legal actions.

What is the legal basis for processing your data?

The legal basis for the processing is the legitimate interest of the controller, in accordance with Article 6.1.f) of the GDPR, in conjunction with Article 22 of Organic Law 3/2018.

In the case of labour inspection, the treatment is additionally covered by the provisions of Article 20.3 of the Workers' Statute.

How long will we keep personal data?

The images will be kept for a maximum period of 30 days from their capture.

However, they may be kept for a longer period when necessary to prove the commission of acts against the integrity of persons, property or installations, or when they are to be provided in the context of police or judicial proceedings.

In such cases, the images will be blocked and made available to the competent authorities, in accordance with the applicable regulations.

+ JOB APPLICANTS

For what purposes will we process your personal data?

We will process the personal data included in your résumé or provided during the recruitment process for the following purposes:

• Organizing and managing current or future recruitment processes for hiring staff within the different companies of the HIDDEN HOTELS group.
• Evaluating your application and assessing whether your profile matches the offered position.
• Contacting you to arrange interviews or assessments related to the recruitment process.
• If you give your express consent, communicating your application to other group companies or collaborating entities, solely for the purpose of facilitating your entry into the labor market.

What is the legal basis for processing your data?

            The legal basis for processing your personal data is the consent you provide by submitting your résumé or participating in recruitment processes. Certain data may also be processed in application of pre-contractual measures related to the potential execution of an employment contract.

How long will we keep personal data?

Résumés will be retained for a maximum period of one year from receipt. After this period, if no recruitment process has been initiated with you, the data will be securely deleted, unless you have expressly authorized their retention for an additional period or there is an active recruitment process requiring longer retention.

             + HR

For what purposes will we process your personal data?

We will process employees’ personal data in order to properly manage the employment relationship and the employee’s personnel file. This includes:

• Administrative, labor, and contractual management derived from the employment relationship.
• Completion of all administrative, tax, accounting, and Social Security procedures necessary to comply with legal and contractual obligations.
• Management of salary payments, remuneration, and employee benefits through the corresponding financial institution.
• Management of time control and working hours registration through the enabled systems (card, personal code, platform, employee portal, or biometric system, only where legally and technically permissible).
• Management of group insurance policies, additional coverage, or pension plans in which the employee may be included.
• Management of staff training, whether mandatory, subsidized, or non-subsidized.
• Management of actions related to occupational risk prevention, health surveillance, and regulatory compliance.
• Management of incidents, leave, absences, disciplinary actions, or any other action derived from the employment relationship.
• Conducting internal audits, quality controls, or internal procedures necessary to ensure the proper functioning of the human resources area and the group.

What is the legal basis for processing your data?

            The legal bases that legitimize the processing are:

• Compliance with legal obligations applicable to the employer, including labor, Social Security, occupational risk prevention, tax, and accounting regulations (Article 6.1(c) GDPR).
• Compliance with legal obligations applicable to the employer, including those derived from labour, social security, occupational risk prevention, tax and accounting regulations (art. 6.1.c) GDPR).
• Employee consent only for processing operations not covered by the employment relationship or a legal obligation, such as certain voluntary training actions or optional social benefits (Article 6.1(a) GDPR).
• Legitimate interest of the employer, in cases such as internal controls, audits, or actions necessary for fraud prevention or proper organizational functioning (Article 6.1(f) GDPR), always within the limits provided by law.

How long will we keep personal data?

The personal data of employees will be kept for the time necessary to manage the employment relationship and, once the employment relationship has ended, for the legally required periods. In particular:

- Data derived from the employment relationship, pay slips, contributions and associated documentation: during the term of the contract and, subsequently, during the periods established by labour, Social Security, tax and accounting regulations.
- Data related to occupational risk prevention and health surveillance: during the periods required by the specific applicable regulations.
- Data linked to time control and recording of working hours: during the legally established period.
- Data relating to training, disciplinary files or internal evaluations: for the time necessary for the purpose for which they were collected and the applicable limitation periods.

Once the aforementioned periods have expired, the data will be deleted or, where appropriate, blocked during the periods of limitation of possible legal liabilities, in accordance with the applicable regulations.