IT'S ALL YOURS

Data Controller 1:

The "Hotel" (as defined in the email received) is responsible for the processing of your data.

Data Controller 2:

The Data Controller for the processing of your data is Barceló Gestión Hotelera, S.L. (hereinafter with respect to this document, "BGH", "Barceló" or "Barceló Gestión Hotelera") with registered office at c/ Josep Rover Motta, 27, 07006, Palma de Mallorca.

This clause does not define co-responsibility in the processing of data by the indicated entities.

If you have any questions regarding data protection, please contact the Barceló Group's Data Protection Office at dpo@barcelo.com.

BGH informs the Data Subject that their data will be processed by Barceló, for the following purposes:

1. Management of the reservation and contracted services.

In order to manage the reservation received by the head office or by a channel outside Barceló Gestión Hotelera (for example, Expedia, Booking, Agencies or Tour Operators with which the client has contracted), the Hotel needs to receive certain information from the client, such as: name, surname, address, ID card, passport or equivalent identification document, e-mail, telephone number or date of birth. This information will be used to assign the requested stay or another service requested to the accommodation service (e.g. events, celebrations, congresses).In the event that the customer requests specific services (e.g., SPA services or services), providing information regarding their health, the Hotel understands that the information mentioned is communicated voluntarily by the customer, as there is no prior request for this information. These personal data is stored in order to manage the customer request. However, the hotel requests the consent of the interested party for the treatment of this information.Similarly, in the event that for the provision of Hotel services it is necessary to process data of third parties related to the client (e.g.: family, companions), the client guarantees the accuracy of the information provided on these third parties, as well as compliance with the duty to have informed about the communication of their data to the Hotel and, where appropriate, to have obtained their consent for their processing.

Legitimization: This processing is necessary for the execution of the contract. 

2.  Data processing of minors. In the event of personal data relating to the person under age must be managed in order to manage the service, the Hotel request the proper authorization of his/her legal representatives when said child less than 13 years old, although the handling of his/her personal information is necessary to satisfy the services requested by the legal representatives of the child. This authorization is understood for the treatment of the minor data necessary for the service provided by the service provided to you (e.g., the animation services, mini-club, guarderieous services).

Legitimization: This processing is necessary for the execution of the contract. However, if the minor is under 14 years of age, the Hotel will request authorization from his/her legal representative for the processing of his/her personal data.

3. Compliance with accounting, legal, fiscal and administrative obligations.

Legitimization: This processing is necessary for the execution of the contract. 

4.  Communication of the information generated in the Hotel to Barceló Hotel Management and to the hotels of the Barceló network for the personalization of products. With the client's consent, the Hotel, with the objective of personalizing the services it may offer in the future to its clients, will communicate the information generated by the client in use of the services offered in the Hotel in which the client is staying, to Barceló Gestión Hotelera and to the companies that own the hotels that are part of the Barceló network. This information is very useful for Barceló and its hotels in order to offer its clients personalized products based on the commercial interests shown in the use of the services offered in the hotels, in such a way that the client's experience can be improved in subsequent contracts.

This communication may involve international data transfers when the Hotel receiving the data is located outside the European Union. In any case, BGH has adopted the appropriate guarantees to regulate international data transfers with the aforementioned Hotels, by signing the Standard Contractual Clauses.

Legitimization: This processing will only be carried out with the guest's consent. The guest may withdraw his/her consent by following the instructions set out in Section VI.

5.  Management of guest complaints. The Hotel processes the data included in any claims made by customers in order to carry out said claims, and the benefit of discount or beneficial conditions in the future to compensate any injury incurred by the customer at the Hotel.In the event, the information regarding the claim may be communicated to Barceló Management in order to offer the customer a satisfactory resolution. For the same purpose and in the event that the guest may have suffered compensable damage, BGH will communicate this information to the insurance company contracted in order to manage the claim suffered by the guest.

Legitimization: This processing is necessary for the execution of the contract. 

6.  Communication of data to Barceló Gestión Hotelera for customer service. Barceló Hotel Management provides a customer service to resolve requests generated by guests or potential at the hotels, both in terms of booking information and related to queries that may arise with the booking or services offered by the hotels. Where appropriate, requests sent by guests to the Hotel may be referred to Barceló Gestión Hotelera in order to ensure a centralized management at the Group level.

Legitimization: This processing is necessary for the execution of the contract.

7.   Communication of data to Barceló Gestión Hotelera for administrative purposes. For accounting purposes, internal audits or internal business valuations, the Hotel may communicate guest data to BGH. Given that the Hotel will only process this data for the purpose of performing administrative, statistical, internal business assessment or corporate audits, the guest will not be harmed in any way by such processing nor will their data protection rights be affected. The Hotel will make the aforementioned communication of data based on its legitimate interest in order to improve the provision of its services.

8. Quality Survey Submission. The guest has forms where you can fill out surveys on an ad-hoc or anonymous basis. In the latter case, the Hotel will process the information regarding the survey holder and his/her opinion in order to improve the services provided in the Hotel, and may communicate it to Barceló Gestión Hotelera in order to improve our services at the Group level, both at the Hotel of reference and in other hotels. This information may also be communicated for commercial purposes based on the provisions of Purpose 3 of this section, provided that the guest has given his/her consent for this purpose.

Legitimization: This processing is based on the legitimate interest of the Hotel. The guest can always object to receive such communications by following the instructions marked in Section VI.

9.  Performing checks for the detection of fraudulent activities.In order to check and monitor actions that may constitute fraud, the Hotel reports that it carries out an analysis of the transactions carried out in the Hotel in order to identify and analyze in more detail those that it detects as suspicious of being fraudulent.  If necessary, the Hotel could give access to this information to Barceló Gestión Hotelera as legal advisor of the hotel.

Legitimization: This processing is based on the legitimate interest of the Hotel, since it carries out a check and follow-up of all the operations made by its guests for the detection of possible fraudulent conduct in the transactions made during the contracting process. Customers can oppose the processing of their data by following the instructions in section V.

10. Communication of your data to the Security Forces and Corps. By legal obligation, the Hotel must communicate the information related to the guests occupying the rooms to the Security Forces and Corps, who will process their information under their own purposes and legitimizations.

Legitimization: This processing will be carried out under the legal obligation applied to the Hotel established by the Organic Law 4/2015, of March 30, for the protection of public safety, the Schengen Convention and the Order INT/1922/2003, of July 3, on the books-register and entry reports of travelers in hospitality establishments and other similar.

11. Judicial or Administrative Proceedings. The Hotel, before possible judicial or administrative proceedings that may arise as a result of services offered or provided by it, will process that information necessary to present the appropriate allegations, exercise their right of defense or file those claims it deems appropriate depending on the facts occurred.

Legitimization: This processing is based on legal obligations, marked by administrative rules (mainly, the Law of Common Administrative Procedure) or is necessary for the Hotel to exercise its legitimate right to effective judicial protection, both in its right of defense and in the filing of legal claims it deems appropriate, based on the Civil Procedure Act or the Criminal Procedure Act.

12.  System Incident Management. The Hotel will handle it as necessary for its customers to manage any incident reported or detected by its own means (including any incidents provided by its service providers). Such data processing will only be carried out in order to solve the incident and resolve any problems deriving from it. The Hotel understands that it has an interest to prevent the safety of its information, and is aimed at resolving incidents that put said safety or the provision of services offered to customers at risk.Legitimization: This processing is necessary for the satisfaction of legitimate interests of the Hotel. At any time the guest may object to the processing of his/her data for this purpose by following the instructions in Section VI.

13. Processing of data relating to video surveillance. This processing will be carried out in accordance with the informative clause relating to video surveillance, available to the guest upon request at the reception desk.

14. Data Processing of the Barceló Application.This processing will be regulated through the Privacy Policy that can be found in the Application itself.

BGH will send you an e-mail with a link to download the Barceló Application. Through the Barceló Application the guest will have at his/her disposal general information about the Hotel as well as request information about the different services offered by the Hotel.

Legitimization: This processing is based on the legitimate interest of the Hotel, since in case the guest downloads the Barceló Application, he/she will have at his/her disposal information related to the Hotel.

1. Sending marketing communications by any means with offers related to the following products and/or services:

· Those you have already contracted or have contracted with the Hotel.

· Those that the guest can enjoy at the Hotel (e.g., furniture of the reserved room).

· Those related to tourism and leisure, such as cultural activities, excursions, sporting events, etc.

Based on the information received by BGH from the Hotel, personal data may be processed for the elaboration of profiles (e.g. product preferences based on consumption in the Hotel, surveys completed in the Hotel...) whose results allow the preparation and analysis of customized products, through segmentation into different groups in relation to common patterns. These profiles will only be used to send you personalized communications about the products and services indicated above. This processing will not affect those commercial communications that BGH addresses to the client based on its legitimate interest, as described in the informative clause provided by BGH in the reservation of a Hotel of the Barceló network through its own channels (web page, telephone, e-mail).

Legitimization: This processing will only be carried out if BGH has the client's consent, except in the case that the Data Subject is a guest of BGH and has already contracted services with this entity. The guest may withdraw his/her consent by following the instructions set out in Section VI.

5.  Management of guest complaints. In order to manage in a centralized manner those claims filed by the guest in relation to the services contracted in the hotels, BGH will receive the information related to the claim generated in the hotel, with the purpose of processing such a claim and being able to offer an adequate solution to the guest, being able to offer discounts or more beneficial conditions in subsequent stays to compensate for the damages suffered. Thus, BGH needs access to the information generated by the guest at the hotel in order to adequately address the filed claim.

If the claim is due to compensable damages suffered by the guest, BGH will communicate this information to the insurance company contracted by BGH in order to manage the claim suffered by the guest.

Legitimization: This processing is necessary for the execution of the contract with the Hotel, in accordance with the description of the present purpose with regard to the processing carried out by BGH.

3. Customer Service. BGH has customer service for the resolution of requests generated by guests or potential guests, in relation to questions about services offered by the hotels.

Legitimization: This processing is necessary for the execution of the contract with the Hotel, in accordance with the description of the present purpose with regard to the processing carried out by BGH.

4. Online reputation monitoring. BGH will be able, based on the information received from the Hotel, to check the reviews that guests make on websites such as TripAdvisor and similar, in order to monitor its online reputation and to make business decisions for the continuous improvement of its services, being able to make contact in case of negative experiences to propose possible solutions. BGH understands that it has a legitimate interest in improving its services and protecting its brand.

Legitimization: This processing is based on the legitimate interest of BGH to monitor the reputation of its brand on the Internet and to be able to address claims and complaints addressed on websites such as those indicated. The guest shall have the right to object to this processing of personal data by following the instructions set out in Section VI.

5. User Registration in myBarceló. BGH will process the identifying information necessary to enable the user's registration in its myBarceló platform, so that the user can enjoy certain discounts in the contracting of BGH products, consult information related to the hotels or enjoy services only for myBarceló users.

In your case, those users who reach the myBarceló Unique level could:

· Receive special gifts to reward the use of the benefits and special conditions offered by myBarceló.

· Provide the personal data of a third party so that he/she can enjoy discounts when contracting BGH products.

In case the user wants to register by identifying him/herself through Facebook, Google + or Twitter, he/she should know that in this case such entities will provide us with the information related to his/her identification (name, surname and/or ID of the network in question), as well as that information that the user wants to share at the time of formalizing his/her registration through this medium.

Legitimization: this processing will only be carried out if BGH has the user's consent.

·Notwithstanding the foregoing, BGH will send the special gifts to the level users. Unique based on a legitimate interest, considering the link between BGH and the user and the use by the user of the special conditions offered by myBarceló. At any time the user will have the right to object to this processing of personal data by following the instructions in Section VI.

In the event that the Unique user level provides personal data of a third party as indicated in this paragraph, the user guarantees the accuracy of the information communicated to BGH, as well as having informed the third party and obtained, where appropriate, their express consent to the aforementioned transfer.

By registering for the myBarceló Loyalty Program the user will receive an SMS with the option of subscribing to the BGH text alerts program, known as BGH Alerts. The Program sends subscribing SMS alerts to users related to updates for their stays and alerts regarding promotions and unfulfilled bookings. To subscribe to the BGH Alerts Program, the user must have registered in the MyBarceló Loyalty Program and respond with YES to the received SMS to confirm the subscription to the BGH Alerts Program. To request help for the Program you can send an SMS with the word HELP. To unsubscribe from the program you must send an SMS with the word STOP. The frequency of messages that the user will receive for the BGH Alerts Program is two messages per month. The data rate and/or messages established by your operator may be applied.

Legitimization: This processing will only be carried out if BGH has the user's consent by sending YES confirming his/her subscription to the Program.

6. Data Processing of the Barceló Application.This processing will be regulated through the Privacy Policy found in the Application itself

7. Processing of data relating to access to the Wi-Fi network provided by BGH: This processing will be carried out in accordance with the privacy policy accepted by the guest when using the Wi-Fi services offered in the hotels.

The personal data to which you have access will be processed for as long as the contractual relationship is maintained. After this, the Hotel will keep the personal data after the termination of the contractual relationship, duly blocked, to be made available to the competent Public Administrations, Judges and Courts or the Public Prosecutor's Office during the period of limitation of actions that may arise from the relationship with the client and/or the legally established retention periods. The Hotel will proceed with the specific information of your data once these deadlines have passed.For its part, BGH will process the information provided by the Hotel, based on the execution of the contract or a legitimate interest, as appropriate in each case, retaining it until the purposes for which they were collected have been fulfilled.

On the other hand, with respect to data processed by BGH that have been transferred by the Hotel on the basis of the guest's consent, BGH will retain such information as long as the consent is not withdrawn or the right of deletion is not requested.

In any case, once the indicated purposes have been fulfilled, the consent is withdrawn or the right of suppression is exercised, both BGH and the Hotel will keep the personal data, duly blocked, to meet possible requirements of Public Administrations and courts, in accordance with the provisions of the data protection regulations in force.

The Hotel may communicate the data to:

· BGH and companies owning hotels in the Barceló network. This communication may involve an international transfer of data as mentioned above.

· Competent Public Bodies, Judges and Courts, especially the State Security Forces and Corps.

· Apart from the above data communications, the Hotel has the collaboration of some third party service providers who have access to the personal data of guests and who process such data in the name and on behalf of BGH as a result of their provision of services. Specifically, the Hotel will contract the provision of services by third party suppliers that carry out their activity, including but not limited to, in the following sectors: legal advice, multidisciplinary professional services companies, technology service providers, IT service providers.

Barceló Gestión Hotelera may communicate the data to:

· The insurance brokerage and insurance company of BGH in the event that the client suffers a compensable damage.

· Competent Public Bodies, Judges and Courts.

· Apart from the above data communications, BGH has the collaboration of some third party service providers who have access to the personal data of customers and who process the referred data in the name and on behalf of BGH as a consequence of their provision of services. To this end, BGH shall contract the provision of services by third parties that make use of their activity, for example, and not limited, in the following sectors: legal advice, multidisciplinary professional services, tech services, IT services. Suppliers include Salesforce Inc., a company located in the United States and covered by Privacy Shield.

The guest may exercise, if desired, the rights of access, rectification and deletion of data, as well as request to limit the processing of personal data, oppose to it, request data portability, as well as not to be subject to automated individual decisions.

In any case, the guest is informed that the management of those requests relating to the exercise of rights relating to the processing of personal data will be processed by the Data Protection Officer located in c / Josep Rover Motta, 27, 07006, Palma de Mallorca or by sending an email to the address dpo@barcelo.com attaching in both cases to this request, a copy of your ID card, NIF or official document that identifies you.

The guest may, in relation to those processing operations based on the obtaining of his/her consent, withdraw his/her consent through the procedure detailed in the previous paragraph.

The Hotel has received the information related to the Data Subject through:

(i) Barceló Gestión Hotelera, if the services of the Hotel have been requested through the BGH website, telephone channels or e-mail.

(ii) Third parties outside BGHarceló, such as tour operators, agencies or entities such as Expedia, Booking or similar.

The guest may file a complaint with the Spanish Data Protection Agency in relation to the response received from the hotel and Barceló Gestión Hotelera in attending to their rights.

In any case, the guest is informed that the management of claims regarding the processing of personal data will be processed by the Data Protection Delegate of Barceló Gestión Hotelera, S.L. and located at c/ Josep Rover Motta, 27, 07006, in Palma de Mallorca or by sending an email to the address dpo@barcelo.com attaching in both cases to this request, a copy of your ID card, NIF or official document that identifies you.