Privacy policy
LAST UPDATED: 15/03/2025
The Privacy Policy forms part of the General Terms and Conditions governing the www.sedaclubhotel.com website.
together with the Cookies Policy and the Legal Notice.
WANA INVERSIONES SA, reserves the right to modify or adapt this Privacy Policy at any time.
time. We therefore recommend that you check it each time you access the Website. In the event of
user has registered on the website and accesses his or her account or profile, upon accessing the same, he or she will be informed in
in the event that there have been substantial changes in relation to the processing of your personal data.
Who is responsible for the processing of your data?
The data that is collected or that you voluntarily provide to us through the Website, either by browsing the
and all those that you can provide us with in the contact forms, via email or by telephone, will be
collected and processed by the Data Controller, the details of which are set out below:
WANA INVERSIONES SA, CIF: A83057174
Address: C/ Echegaray, 8, 2814, Madrid.
SEDA CLUB HOTEL
Address: Plaza de la Trinidad, 18001, Granada.
Registered in the Mercantile Register of Madrid, volume 16743, folio 43, page M-285986.
Contact WANA INVERSIONES S.A., for the protection of your personal information
C/ Echegaray, 8, 28014, Madrid.
Tel: 910 56 93 54
Data Protection Officer Contact: lopd@hiddenhotels.com
If, for any reason, you would like to contact us about any treatment-related issue
of your personal data or privacy (with our Data Protection Officer), you can do so by contacting us at
any of the above means.
What data do we collect through the website?
By the simple fact of browsing the Website, WANA INVERSIONES SA, will collect information relating to:
- IP address.
- Browser version.
- Operating system.
- Duration of the visit or browsing of the Website.
Such information is stored by Google Analytics, for which we refer to Google's Privacy Policy,
as it collects and processes such information. http://www.google.com/intl/en/policies/privacy/
Likewise, the Website provides the Google Maps utility, which can access your location, in
if you allow it, in order to provide you with more specificity on distance and/or paths
our sites. In this regard, we refer to the Privacy Policy used by Google Maps, in order to
to be aware of the use and processing of such data http://www.google.com/intl/en/policies/privacy/
The information that we handle will not be related to a specific user and will be stored in our
databases, for the purpose of statistical analysis, improvements to the Website, about our products and/or services.
services and help us to improve our business strategy. The data will not be passed on to third parties.
User registration on the website/ Submission of forms
To access certain services, such as booking, the user is required to fill in a form. In order to do so,
In the registration form, a number of personal data are requested. The data are necessary and obligatory for
to carry out such registration. If these fields are not provided, the registration will not be carried out.
In this case, the browsing data will be associated with the user's registration data, identifying the same user.
browsing the Website. In this way, it will be possible to personalise the offer of products and/or services that, at
in our judgement, best suits the user.
The registration data of each user will be incorporated into the databases of WANA INVERSIONES S.A., along with the
history of transactions carried out by it, and shall be stored therein as long as the account is not deleted from the
registered user. Once such an account is deleted, such information will be removed from our databases,
data relating to the transactions carried out will be kept in a segregated area for 10 years, without being accessed or
alter them, in order to comply with the legal deadlines in force. The data that are not
linked to the transactions carried out will be maintained unless you withdraw your consent, in which case they will be
deleted immediately (always taking into account the legal deadlines).
The legal basis for the processing of your personal data is the performance of a contract between the parties.
In relation to the sending of communications and promotions by electronic means and the reply to requests for
information, the legitimacy of the processing is the consent of the user.
The purposes of the processing shall be the following:
a) Manage your access to the Website.
b) To manage the purchase of the services made available to you through the Website.
c) Keep you informed of the processing and status of your requests, purchases and/or bookings.
d) Respond to your request for information.
e) Manage all the utilities and/or services offered by the platform to the user.
Thus, we inform you that you will be able to receive communications via email and/or on your telephone, in order to inform you of possible
incidents, errors, problems and/or status of your applications.
For the sending of commercial communications, the user's express consent will be requested at the time of making the
registration. In this regard, the user may revoke the consent given, by contacting WANA INVERSIONES
S.A., using the means indicated above. In any case, in each commercial communication, you will be given the following information
the possibility of unsubscribing from receiving them, either by means of a link and/or e-mail address
electronic.
Newsletter Sending
In the event that the Website allows the option of subscribing to the Newsletter of WANA INVERSIONES SA,
you will need to provide us with an e-mail address to which it will be sent.
Such information will be stored in a database of WANA INVERSIONES SA, where it will be registered.
until the interested party requests cancellation or, where appropriate, until WANA INVERSIONES SA ceases to be a party to the contract.
sending of the same.
The legal basis for the processing of these personal data is the express consent given by all those who
interested parties who subscribe to this service by ticking the box provided for this purpose.
Data from e-mails will only be processed and stored for the purpose of managing the dispatch of
the Newsletter by users who request it.
In order to send the Newsletter, the user's express consent will be requested when registering for the Newsletter.
by ticking the box provided for this purpose. In this regard, the user may revoke the consent given,
by contacting WANA INVERSIONES SA, using the means indicated above. In any case, in
Each communication, you will be given the possibility to unsubscribe from receiving them, either by means of a link
and/or e-mail address.
If you are one of the following groups, please see the information below:
+ CONTACTS FROM THE WEB OR EMAIL
For what purposes will we process your personal data?
- Respond to your queries, requests or petitions.
- Manage the requested service, answer your request, or process your request.
- Information by electronic means, concerning your application.
- Commercial or event information by electronic means, subject to express authorisation.
What is the legitimacy for the processing of your data?
Acceptance and consent of the data subject: In cases where it is necessary for an application to be made
fill in a form and click on the submit button, the completion of the form will necessarily involve
that you have been informed and have expressly given your consent to the content of the clause attached to the said form or acceptance of the privacy policy.
All our forms have a checkbox with the following formula, in order to be able to
send the information: "□ I have read and accept the Privacy Policy".
+ CONTACTS FROM THE WEB OR EMAIL
For what purposes will we process your personal data?
- Respond to your queries, requests or petitions.
- Manage the requested service, answer your request, or process your request.
- Information by electronic means, concerning your application.
- Commercial or event information by electronic means, subject to express authorisation.
What is the legitimacy for the processing of your data?
Acceptance and consent of the data subject: In cases where it is necessary for an application to be made
fill in a form and click on the submit button, the completion of the form will necessarily involve
that it has been informed and has expressly given its consent to the contents of the clause annexed thereto.
form or acceptance of the privacy policy.
All our forms have a checkbox with the following formula, in order to be able to
send the information: "□ I have read and accept the Privacy Policy".
+ SOCIAL MEDIA CONTACTS
For what purposes will we process your personal data?
- Respond to your queries, requests or petitions.
- Manage the requested service, answer your request, or process your request.
- Engage with you and create a community of followers.
What is the legitimacy for the processing of your data?
Acceptance of a contractual relationship in the relevant social network environment, and in accordance with its privacy policies.
Privacy:
Facebook http://www.facebook.com/policy.php?ref=pf
Instagram https://help.instagram.com/155833707900388
Whatsapp: https://www.whatsapp.com/legal/#privacy-policy
How long will we keep personal data?
We can only consult or remove your data in a restricted way because you have a specific profile. We will treat them both
time as you leave us by following us, being a friend or giving us "like", "follow" or similar buttons.
Any rectification of your data or restriction of information or publications must be made through the
configuration of your profile or user on the social network itself.
+ SUPPLIERS.
For what purposes will we process your personal data?
- Information by electronic means, concerning your application.
- Commercial or event information by electronic means, subject to express authorisation.
- Manage the administrative, communications and logistical services provided by the Head.
- Billing.
- Carry out the relevant transactions.
- Invoicing and declaration of the appropriate taxes.
- Control and recovery management.
+ VIDEO SURVEILLANCE
For what purposes will we process your personal data?
- Video surveillance of our facilities.
- Control of our employees.
- They may sometimes be transferred to courts and tribunals for the exercise of legitimate claims.
What is the legitimacy for the processing of your data?
The unequivocal consent of the data subject upon accessing our facilities after viewing the information sign of the video-surveilled area.
+ JOB SEEKERS
For what purposes will we process your personal data?
- Organisation of selection processes for the recruitment of employees.
- Call you for job interviews and evaluate your application.
- If you have given us your consent, we may pass it on to collaborating or related entities, with the sole purpose of
aim to help you find a job.
What is the legitimacy for the processing of your data?
The legal basis is your unequivocal consent, by submitting your CV and receiving and signing information concerning the
treatments that we are going to carry out.
How long will we keep personal data?
The curriculum vitae will be stored for a period of one year, after which, in the event that we have not been contacted
with you, it will be eliminated.
+ HR
For what purposes will we process your personal data?
- Management of the employment relationship and the employee's file.
- Carry out all the administrative, fiscal and accounting procedures necessary to comply with our
contractual commitments, obligations in terms of labour regulations, social security, health and safety, health and safety at work, and the
labour, tax and accounting risks.
- Management of payroll payments through a financial institution.
- Time control via fingerprint/card access control system (if applicable).
- Management of the entity's group insurance / pension plan.
- To carry out both subsidised and non-reimbursed training activities.
What is the legitimacy for the processing of your data?
The legal basis for the processing of your data is the performance of your employment contract. The fulfilment of the
relevant legal obligations. The consent of the data subject.
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Do we include personal data of third parties?
No, as a general rule we only process the data provided to us by the owners. If you provide us with data from third parties,
you must inform and seek the consent of such persons in advance, or else we will be exempted from our obligation to inform and seek their consent.
any liability for non-compliance with this requirement.
Do we include personal data of third parties?
No, as a general rule we only process the data provided to us by the owners. If you provide us with data from third parties,
you must inform and seek the consent of such persons in advance, or else we will be exempted from our obligation to inform and seek their consent.
any liability for non-compliance with this requirement.
What about data on minors?
By law, we do not process data from children under 14 years of age on our website. Therefore, please refrain from providing them if you are under that age.
Will we communicate electronically?
- They will only be used to process your request, if it is one of the means of contact you have provided us with.
- If we send commercial communications, they will have been previously and expressly authorised by you.
What security measures do we apply?
You can rest assured: We have adopted an optimal level of personal data protection that
We have installed all the technical means and measures at our disposal, according to the state of the art.
technology, to prevent the loss, misuse, alteration, unauthorised access and theft of personal data.
To what extent will decision-making be automated?
WANA INVERSIONES SA, does not use fully automated decision-making processes to engage,
develop or terminate a contractual relationship with the user. In the event that we use those processes in a case of
In particular, we will keep you informed and inform you of your rights in this respect if required by law.
What about data on minors?
By law, we do not process data of children under 14 years of age on our website. Therefore, please refrain from
facilitate them if you are not that age.
Will we communicate electronically?
- They will only be used to process your request, if it is one of the means of contact you have provided us with.
- If we send commercial communications, they will have been previously and expressly authorised by you.
What security measures do we apply?
You can rest assured: We have adopted an optimal level of protection for the personal data we handle, and we have installed all the technical means and measures at our disposal, according to the state of the art.
technology, to prevent the loss, misuse, alteration, unauthorised access and theft of personal data.
To what extent will decision-making be automated?
WANA INVERSIONES SA, does not use fully automated decision-making processes to engage,
develop or terminate a contractual relationship with the user. In the event that we use those processes in a case of
In particular, we will keep you informed and inform you of your rights in this respect if required by law.
Will profiling take place?
In order to be able to offer you products and/or services according to your interests and to improve your experience in
user, we may draw up a "business profile" on the basis of the information provided. However, the following will not be taken
automated decisions based on that profile.
To which recipients will your data be communicated?
In particular, the Agencia Estatal de la Administración Tributaria and banks and institutions shall be notified of the following
financial institutions for the collection of payment for the service provided or product purchased, as well as to processors
necessary for the implementation of the agreement.
In case of purchase or payment, if you choose any application, website, platform, bank card, or any other service
online, your data will be transferred to that platform or processed in its environment, always with maximum security.
Your data may be transferred to the entities that make up the HIDDEN AWAY HOTELS group. They will not be transferred to other third parties, unless legally obliged to do so. In the event that you have given us your consent for the processing of your name and images and other information related to the activity of WANA INVERSIONES SA, they will be disclosed in the different networks.
social media and the organisation's website.
International transfers.
In the event that international data transfers by WANA are required
INVERSIONES SA, shall ensure that such transfers are possible in accordance with the General Regulation
Data Protection Act or any other requirement established by the applicable regulations. For these purposes, the company
adopt such arrangements as may be necessary to ensure a level of data protection equivalent to that provided for in the
European legislation.
In case of working in a system of shared folders in applications such as Dropbox, Google Drive, Microsoft
OneDrive, Amazon, Apple, HubSpot, etc...an international transfer will be made to the United States under the
Article 49(c) of the General Data Protection Regulation or any other mechanism which ensures that
a level of data protection equivalent to that provided for in European legislation
What rights do you have?
- To know whether we are processing your data or not.
- To access your personal data.
- To request the rectification of your data if it is inaccurate.
- To request the deletion of your data if they are no longer necessary for the purposes for which they were collected or if you withdraw your consent.
- To request the limitation of the processing of your data, in certain cases, in which case we will only keep them in accordance with the regulations in force.
- To submit your data, which will be provided to you in a structured, commonly used or machine-readable format. If you
If you prefer, we can send them to the new person in charge that you designate. It is only valid in certain
assumptions.
- To file a complaint with the Spanish Data Protection Agency if you believe that we have failed to protect your personal data.
properly attended to.
- To withdraw consent to any processing for which you have consented, at any time.
If you change any data, please let us know so that we can keep them up to date.
Do you want a form for exercising your rights?
- We have forms for the exercise of your rights, ask us for them by email or if you prefer, you can use the
prepared by the Spanish Data Protection Agency or third parties.
- These forms must be electronically signed or be accompanied by a photocopy of the ID card.
- If someone is representing you, you must attach a copy of their ID card, or have them sign it with their electronic signature.
- The forms can be submitted in person, by letter or by mail to the address of the Responsible at the beginning of this text.
You have the right to lodge a complaint with the Spanish Data Protection Agency if you consider that your rights have not been adequately addressed.
WANA INVERSIONES SA has a maximum period of one month to resolve the problem, counting from the effective reception of your request.
request on our part.
You have the right to withdraw your consent at any time for any of the processing operations for which you have given your consent.
Do we process cookies?
If we use other types of cookies that are not necessary, you can consult the cookie policy in the corresponding link at the top of our website.
How long will we keep your personal data?
- Personal data will be kept for as long as you remain connected with us.
-Once you have opted out, the personal data processed for each purpose will be kept for the periods provided for by law, including the period in which a judge or court may require them, taking into account the time limit of
limitation period for legal action.
- The data processed will be retained until the expiry of the aforementioned legal deadlines, if any.
legal obligation of maintenance, or in the absence of such a legal deadline, until such time as the data subject requests its deletion
or revoke the consent given.
- We will maintain all information and communications relating to your purchase or the provision of our services.
service, for the duration of the guarantees of the products or services, in order to attend to possible claims.
- For each processing or type of data, we provide you with a specific period, which you can consult in the following table:
Data relating to
Customers and suppliers
Document
By way of example and without limitation, the following are listed below
some of the most significant documents. Invoices (issued
by the company and drawn on the company). Contracts between
traders (purchase and sale, commission, transport, provision of services, etc.).
services, etc.) Contracts with private individuals. Real estate contracts
(leasing of business premises, sale and purchase, exchange,
etc.) Business correspondence Contracts and documents
banking (current accounts, deposits, leasing, renting, etc.)
Expenditure notes.
Parties subject to the Prevention of Money Laundering Act,
documentation accrediting compliance with PBC obligations
Conservation
Obligation to keep the
minimum documentation 6 years.
It should be retained depending on
of the case of prescription of
actions. Article 30 of the Code
Commerce Act provides that the
employers shall keep the books,
correspondence, documentation and
supporting documents concerning their
business, for six years from
of the last entry made in the
books. However, this rule is
limited to establishing a period
minimum period of time during which in
attention to the interests of character
general has to keep the
trader the documents to be
have been generated over the course of the
development of its activity.
Law 10/2010 art. 25
10 years
Customers and suppliers
Payrolls, TC1, TC2, etc.
10 years (Royal Legislative Decree
5/2000 of 4 August 2000, on the
approves the consolidated text of the Law
on Infringements and Penalties in the
Social Order).
CVs
Until the end of the selection process, and for a further 2 years unless the data subject revokes consent or requests deletion.
Training of workers
Art 5.2, Order TAS/2307/2007
4 years
Working Time Records
Art. 34.9 Royal Legislative Decree
2/2015, which approves the
consolidated text of the Statute Law
of Workers.
4 years
Severance pay documents.
Contracts.
Data on temporary workers.
RD 425/2005 par. 3 Additional Provision 1
4 years
Article 30 of the Commercial Code
establishes a minimum period of 6 years. Organic Law 7/2012 recommends keeping it for 10 years.
years.
Worker's file.
Up to 5 years after discharge (Real
Legislative Decree 5/2000 of 4 December 2000.
August, approving the
consolidated text of the Law on
Infringements and Sanctions in the
Social Order).
Documentation or computer records proving the
compliance with OHS regulations
RDL 5/2000 art. 4
5 years
Marketing
Databases or web visitors.
For the duration of treatment.
Access control and video surveillance
Visitor registration
Instruction 1/1996 AEPD
30 days
Video surveillance
Instruction 1/2006 AEPD
Images/sounds captured by video surveillance systems will be cancelled within a maximum period of one month from their capture.
The recordings shall be destroyed within a maximum period of one month from their recording, unless they are related to serious or very serious criminal or administrative offences in the field of public security, to an ongoing police investigation or to an ongoing judicial or administrative procedure.
30 days
Corporate Documentation
Memorandum of association together with articles of association
of corporate resolutions, deeds of incorporation, deeds of
granting/renewal of powers of attorney, deed of sale and purchase
of shares, deed of sale and purchase of assets, deeds of
shares, dissolution/liquidation, etc.)
Minute books of general meeting and board of directors meetings
administration (commercial companies), register of companies, register book of
regulatory actions, register of members, register of members, register book
of contracts with the sole member, other books.
Other types of corporate documentation (private contracts of
purchase and sale of shares, shareholder loans, pledges of shares, and
shares, etc.)
It is recommended to keep them for
the whole life of the society, from its
constitution up to at least 6
years after its dissolution and
liquidation. In the event that the
deeds shall incorporate rights or
obligations to society, it is
I recommend adhering to the deadlines of
prescription previously
The
Obligation to keep the
minimum documentation 6 years. A
from the last entry made in
the Books. The following shall be retained
throughout the life of the company
from its constitution to as a
at least 6 years after its
dissolution and liquidation.
It is recommended to keep them for
the whole life of the society, from its
constitution up to at least 6
years after its dissolution and
liquidation.
Fiscal/ Tax
Administration of the entity, rights and duties of the entity, and
obligations relating to the payment of taxes.
Administration of dividend payments and withholding taxes.
All documents justifying the tax action of the
taxable person (supporting documents for receipts and expenditure), including
both the accounts and the supporting documentation for them
(contracts, invoices, bills, receipts, delivery notes...) All types of
tax declarations.
Obligation to keep the
documentation: Minimum 4 years.
Articles 66, 67 and 68, of the Act
General Taxation. The period
general prescription of the
tax obligations is 4 years.
With regard to the
tax returns, the period of
4-year statute of limitations begins to
counting from the day on which
deadline for submissions
voluntary taxation. In the case of
that there has been an action
subsequent administration
(inspection, partial verification) or
of the taxable person (declaration
rectification, appeal) which has
interrupted the statute of limitations,
starts a new 4-year term to
from that performance. However,
it is advisable to keep the
physical documentation Organic Law
7/2012, recommends keeping it
for 10 years. The Order
EHA/962/2007, provides for the
possibility to destroy invoices
received on paper if they are previously
has carried out a process of
certified digitisation that obtains
signed digital copies
electronically.
Health and Safety
Clinical Histories.
Workers' Medical Records
Health data of Spa clients (wellness treatments).
Article 17.1 of the Law 41/2002 of
14 November, on the autonomy of the
patient and rights and obligations
in the field of information and
clinical documentation
5 years
Insurance
Insurance policies
6 years (general rule)
2 years (damage)
5 years (personal)
10 years (life)
Legal
Intellectual and Industrial Property Documents.
Contracts and agreements.
6 years (general rule)
2 years (damage)
5 years (personal)
10 years (life)
Permits, licences, certificates
6 years from the date of expiry
of the permit, licence or certificate.
10 years (criminal statute of limitations)
Confidentiality and non-competition agreements
The period of duration of the
obligation or confidentiality
Protection of human rights and fundamental freedoms
data
Records and documents proving compliance with the requirements of the data protection regulation (audits, reports, contracts with data protection officers, etc).
For the duration of the data processing and thereafter for 3 years
Documentation proving that the requests for
exercise of data subjects' rights
For 3 years after application
Logs/ Logs of accesses to information systems
2 years
If the processing is based on the data subject's consent, proof of consent
For the duration of the data processing and thereafter for 3 years
Traffic data relating to internet connections, e-mails and calls sent or received from fixed-line telephony.
User identifier, IP address (source/destination), number of
phone, IMSI and IMEI (source/destination), date and time of the
communication (start/end), identification of the type of service or
communication used (voice, data, SMS or MMS)
Article 5, of Law 25/2007, of
conservation of data relating to the
electronic communications and
public communications networks.
1 year
Biometric data (fingerprint,
facial recognition), if it is
In the case in point, by virtue of the
guides published by the
AEPD. It is currently not
permitted for use.
Biometric data are registered in the tool/software enabled for this purpose by the entity, in case a positive Impact Assessment has been carried out, within the current legal framework.
In compliance with the principle of
limitation of the retention period,
personal data may be
treated no longer than the
necessary for the purposes of the
treatment, therefore, taking into account
takes into account the provisions of Article
34.9 of the ET, the undertaking shall retain
records for four years and
remain at the disposal of the
workers, their families and their
legal representatives and the
Labour and Safety Inspectorate
Social. It will be the user who notifies and
initiate the deregistration procedure
definitive.
Building access control: 30 days,
files to control access
(Inst. 1/1996 AEPD)
INACTIVE FOOTPRINTS: 6 MONTHS
OF INACTIVITY. RECORDS:
EMPLOYEES, 4 YEARS, NO
EMPLOYEES: 30 DAYS
1 year
Academic data, history
academic, data
student IDs,
attendance data,
sanctions, reports
psycho-pedagogical data, data from
continuous evaluation and
final results, request for
scholarships and grants.
Academic record, personal data file of the centre
educational records, academic records, disciplinary reports and reports,
evaluation records and report cards, application files
and resolution of grants
Transcript of records and academic history:
permanently.
Disciplinary reports and reports: 5 years.
Evaluation reports and evaluation bulletin
notes: permanently for minutes and 5 years for bulletins.
Scholarship application and resolution files: 6 years from the resolution.
Guests
Check-in of travellers/guests.
3 years (Organic Law 4/2015 of
protection of public safety,
Order INT/1922/2003 and in RD
933/ 2021, of 26 October
(documentary record keeping obligations
and information of natural persons
or legal entities engaged in the following activities
of accommodation).
