{"id":407,"date":"2025-09-10T17:25:02","date_gmt":"2025-09-10T15:25:02","guid":{"rendered":"https:\/\/hiddenhotels.com\/posada-terra-santa\/politica-de-privacidad\/"},"modified":"2026-04-15T11:10:52","modified_gmt":"2026-04-15T09:10:52","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/hiddenhotels.com\/posada-terra-santa\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Privacy Policy<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

LAST UPDATED: 15\/03\/2025<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

LAST UPDATED: 25\/03\/2026<\/p>

\u00a0<\/p>

The Privacy Policy forms part of the General Terms and Conditions governing the Website. https:\/\/hiddenhotels.com\/posada-terra-santa\/<\/a> together with the Cookies Policy and the Legal Notice.<\/p>

HIDDEN AWAY HOTELS, S.L.<\/strong>reserves the right to modify or adapt this Privacy Policy at any time. Therefore, we recommend that you review it each time you access the Website. In the event that the user has registered on the website and accesses their account or profile, upon accessing the same, you will be informed in the event that there have been substantial changes in relation to the processing of your personal data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Who is responsible for the processing of your data?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The data that is collected or that you voluntarily provide us with through the Website, whether by browsing it, as well as any data that you may provide us with in the contact forms, via email or by telephone, will be collected and processed by the corresponding Data Controllers, whose respective data is indicated below:<\/p>

\u00a0<\/p>

HIDDEN AWAY HOTELS, S.L.<\/strong><\/p>

VAT NUMBER: B57676108<\/p>

Address: C\/ Echegaray, 8, 28014, Madrid<\/p>

as the company operating the establishment POSADA TERRA SANTA and responsible for the processing in relation to the management of reservations, stay and provision of services.<\/p>

Likewise, in relation to marketing activities, customer management and the sending of commercial communications, the data may be processed jointly by HIDDEN AWAY HOTELS, S.L., CREGEST, S.L. and the various companies of the HIDDEN HOTELS group, under a system of joint responsibility in accordance with article 26 of the RGPD.<\/p>

The purpose of this joint processing is the centralised management of clients, the sending of commercial communications and the improvement of the services offered by the group.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Contact at HIDDEN AWAY HOTELS, S.L., for the protection of your personal information<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Tel: 910 56 93 54<\/p>

Contact Data Protection Officer: lopd@hiddenhotels.com<\/a><\/p>

If, for any reason, you wish to contact us on any matter relating to the processing of your personal data or privacy (with our Data Protection Officer), you may do so through any of the means indicated above.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

What data do we collect through the website?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

By simply browsing the website, technical data such as IP address, browser type and version, operating system, language, pages visited, duration of the visit and other browsing data may be processed.<\/p>

This data will be processed by HIDDEN AWAY HOTELS, S.L. in order to guarantee the correct functioning of the website, improve the browsing experience, analyse the use of the site and optimise the content and services offered.<\/p>

The legal basis for the processing shall be:<\/p>

- The user's consent, in relation to the use of analytical or measurement cookies.
- The legitimate interest of the party responsible, in relation to technical cookies necessary for the operation of the website.<\/p>

The use of analytical cookies, such as Google Analytics or other similar tools, shall be subject to the prior consent of the user, which may be granted, rejected or configured through the cookie settings panel.<\/p>

In relation to Google Analytics, HIDDEN AWAY HOTELS, S.L. acts as data controller, while Google acts as data processor or, where appropriate, as an independent data controller in accordance with its own terms and conditions. In any case, the necessary measures have been taken to ensure an adequate level of data protection, including the formalisation of standard contractual clauses where necessary.<\/p>

The website may also integrate Google Maps services or other geolocation tools. In these cases, these services will only be activated when the user expressly consents to them. The use of these services may involve the communication of data to third party providers, who will process the information in accordance with their own privacy policies.<\/p>

The information obtained through these mechanisms will not be associated with identified users, unless the user provides their data through forms or other channels enabled on the website.<\/p>

The data may be communicated to technology service providers who act as data processors, subject to the corresponding contractual guarantees. No data will be transferred to third parties, unless legally obliged to do so.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

User registration on the website\/ Submission of forms\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

To access certain services, such as making a reservation or registering for group programmes, the user must fill in the forms provided, providing the personal data necessary for the correct processing of the request. The fields marked as obligatory must be completed, otherwise it will not be possible to process the request or provide the corresponding service.<\/p>

In these cases, the personal data provided will be processed for the purpose of managing the user's registration, processing the bookings or requests made, as well as providing the services contracted.<\/p>

Additionally, and only when the user has expressly authorised it, their data may be used to send commercial communications related to HIDDEN HOTELS products, services and promotions.<\/p>

The browsing data may be associated with the personal data provided when the user interacts with the website, in order to improve the user experience, analyse the use of the services and, where appropriate, personalise the content offered. In those cases where such personalisation involves profiling, it will be carried out solely on the basis of the user's consent.<\/p>

Personal data will be kept for the following periods:<\/p>

- Registration data and user account: as long as the account remains active.<\/p>

- Data related to bookings or services: during the contractual relationship and thereafter for the applicable legal time periods.<\/p>

- Data for sending commercial communications: until the user withdraws his or her consent.<\/p>

- Data associated with enquiries or forms: for the time necessary to deal with the request.<\/p>

Once these periods have expired, the data will be deleted or, where appropriate, blocked for the periods prescribed by law.<\/p>

The legal basis for the processing shall be:<\/p>

- The execution of a contract, for the management of the registration, booking and provision of services.<\/p>

- Compliance with applicable legal obligations<\/p>

- The user's consent for the sending of commercial communications and, where appropriate, for profiling.<\/p>

- The legitimate interest of the responsible party, to guarantee the security of the website and to improve the services offered.<\/p>

The purposes of the processing shall be:<\/p>

  1. a) Manage the user's registration and access to the website<\/li>
  2. b) Managing the procurement of services and bookings<\/li>
  3. c) Reporting on the status of requests, purchases or reservations made<\/li>
  4. (d) To deal with requests for information<\/li>
  5. (e) Ensuring the proper functioning of the platform<\/li><\/ol>

    Likewise, communications necessary for the correct provision of the service, such as booking confirmations, operational warnings or technical incidents may be sent, including by electronic means, as they are linked to the execution of the contract.<\/p>

    The sending of commercial communications will only take place when the user has given their express consent by means of the corresponding enabled box. In these cases, a double opt-in system will be implemented, whereby the user must confirm their subscription via a link sent to their e-mail address.<\/p>

    Users may withdraw their consent at any time, as well as unsubscribe from commercial communications through the link provided in each mailing or through the channels indicated in this Privacy Policy.<\/p>

    The personal data may be incorporated into customer management systems (CRM) used by the HIDDEN HOTELS group, in order to manage the relationship with the customer and, where appropriate, to send commercial communications, always on the basis of the user's consent.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    BOOKING ENGINE (ROIBACK)<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    When the user makes a reservation through the booking engine available on the website, he\/she must provide the personal data necessary for the management of the reservation.<\/p>

    \u00a0<\/p>

    The booking engine is provided by ROIBACK, which generally acts as a data processor in accordance with Article 28 of the GDPR, providing technological booking management services on behalf of HIDDEN AWAY HOTELS, S.L. and\/or the relevant hotel operator.<\/p>

    \u00a0<\/p>

    The data entered during the booking process will be communicated to the company that owns or operates the selected establishment, which will act as the data controller for the management, processing, confirmation, modification or cancellation of the booking, as well as for the provision of the contracted accommodation services.<\/p>

    \u00a0<\/p>

    The legal basis for the processing is the performance of a contract or the implementation of pre-contractual measures at the request of the user.<\/p>

    \u00a0<\/p>

    Personal data may be used to send communications necessary for the correct management of the booking, including confirmations, reminders, incidents, modifications or relevant information about the stay, including by electronic means, as they are linked to the execution of the contract.<\/p>

    \u00a0<\/p>

    Likewise, and only when the user has expressly authorised it, the data may be used for sending commercial communications by HIDDEN HOTELS or the corresponding establishment. In these cases, a double opt-in system will be applied to validate consent.<\/p>

    \u00a0<\/p>

    The data will be kept for the time necessary for the management of the reservation and the provision of the service, as well as for the legally required periods in accordance with the applicable regulations.<\/p>

    \u00a0<\/p>

    Within the framework of the provision of the service, the data may be communicated to technology providers acting as data processors, as well as to financial institutions for the management of payments. No data will be transferred to third parties, unless legally obliged to do so.<\/p>

    \u00a0<\/p>

    The user should review the specific data protection information provided during the booking process, which will identify the data controller and detail the conditions applicable to such processing.<\/p>

    \u00a0<\/p>

    The data may be integrated into customer management systems (CRM) used by the HIDDEN HOTELS group, in order to manage the relationship with the customer and, where appropriate, to send commercial communications, always on the basis of the user's consent.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Redsys payment and gateway<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    To complete the booking process, the user must provide the necessary data to make the corresponding payment.<\/p>

    The payment service is carried out through the Redsys gateway, managed by the corresponding financial institutions. In this context, the banks and Redsys act as independent data controllers with respect to the data necessary for the execution of the financial transaction, in accordance with their own privacy policies and regulations.<\/p>

    HIDDEN AWAY HOTELS, S.L. and\/or the company operating the establishment do not access or store the full details of the bank card used, but only receive confirmation of the payment made.<\/p>

    The legal basis for the processing of payment-related data is the execution of the accommodation contract as well as the fulfilment of statutory tax and accounting obligations.<\/p>

    The data provided for payment will be processed in a secure environment, in accordance with applicable industry security standards, including protocols such as PCI-DSS and strong authentication systems (SCA).<\/p>

    In certain cases, such as non-refundable rates, booking guarantees or possible charges associated with the stay, pre-authorisations or charges may be made in accordance with the booking conditions. Such treatments shall be limited exclusively to the management of the contracted service.<\/p>

    The data may be communicated to financial institutions and payment service providers necessary for the correct execution of the transaction. No additional transfers will be made to third parties, unless legally obliged to do so.<\/p>

    Users are advised to consult the privacy policies of the financial institutions and Redsys to find out about the specific processing of their data in the field of payment management.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Newsletter\/ Hidden Rewards<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    In the event that the website allows subscription to the Newsletter or registration for the \u201cHidden Rewards\u201d loyalty programme, it will be necessary for the user to provide the personal data required in the corresponding form, including at least a valid e-mail address.<\/p>

    \u00a0<\/p>

    Signing up for the Newsletter and the Hidden Rewards programme will be done independently, and it is not obligatory to accept the sending of commercial communications in order to form part of the loyalty programme.<\/p>

    For the sending of commercial communications, the user's express consent will be required by ticking the corresponding box. Additionally, a double opt-in system will be implemented, whereby the user must confirm their subscription via a link sent to their email address.<\/p>

    The legal basis for the processing shall be:<\/p>

    - The user's consent to receive commercial communications.<\/p>

    - The execution of a contract or the application of pre-contractual measures, in connection with the management of the Hidden Rewards programme<\/p>

    Personal data will be processed for the following purposes:<\/p>

    - Manage Newsletter subscription<\/p>

    - Send commercial communications, promotions and news<\/p>

    - Manage the registration, participation and benefits associated with the Hidden Rewards programme.<\/p>

    - Where appropriate, personalise the offers and benefits of the programme, only when the user has given his consent to do so.<\/p>

    In the event of processing based on profiling (e.g. personalisation of offers on the basis of consumption habits or preferences), this will only be carried out on the basis of the user's consent.<\/p>

    The data will be kept as long as the user does not request cancellation of the service, does not cancel their participation in the programme or does not withdraw their consent. Once the relationship has ended, the data will be deleted or blocked in accordance with the legally established deadlines.<\/p>

    The data may be processed by email marketing service providers and technology platforms associated with the loyalty programme, who will act as data processors under appropriate contractual safeguards. In case of international transfers, appropriate safeguards will apply in accordance with the GDPR.<\/p>

    Users may withdraw their consent at any time, as well as unsubscribe from the Newsletter or the Hidden Rewards programme through the link provided in each communication or through the channels indicated in this Privacy Policy.<\/p>

    Commercial communications may be carried out centrally by the HIDDEN HOTELS group, using customer management tools (CRM), and may include information from different establishments of the group, always in accordance with the consent given by the user.<\/p>

    __________________________________________________________________________________________________<\/p>

    If you are one of the following groups, please see the information below:<\/p>

    \u00a0<\/strong><\/p>

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 + CONTACTS FROM THE WEB OR EMAIL<\/strong><\/p>

    For what purposes will we process your personal data?<\/strong><\/p>